dissect.target.plugins.os.windows.dpapi.dpapi

Module Contents

Classes

DPAPIPlugin

Parent class for internal plugins.

class dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin(target: dissect.target.Target)

Bases: dissect.target.plugin.InternalPlugin

Parent class for internal plugins.

InternalPlugin marks all non-private methods internal by default (same as @internal decorator).

__namespace__ = 'dpapi'

MASTER_KEY_REGEX

SECURITY_POLICY_KEY = 'HKEY_LOCAL_MACHINE\\SECURITY\\Policy'

SYSTEM_KEY = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA'

SYSTEM_USERNAME = 'System'

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

syskey() → bytes

lsakey() → bytes

secrets() → dict[str, bytes]

master_keys() → dict[str, dict[str, dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile]]

decrypt_system_blob(data: bytes) → bytes