:py:mod:`dissect.target.plugins.os.windows.dpapi.dpapi`
=======================================================

.. py:module:: dissect.target.plugins.os.windows.dpapi.dpapi


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.dpapi.dpapi.HAS_CRYPTO


.. py:data:: HAS_CRYPTO
   :value: True

   

.. py:class:: DPAPIPlugin(target: dissect.target.target.Target)


   Bases: :py:obj:`dissect.target.plugin.InternalPlugin`

   Parent class for internal plugins.

   InternalPlugin marks all non-private methods internal by default
   (same as ``@internal`` decorator).

   .. py:attribute:: __namespace__
      :value: 'dpapi'

      

   .. py:attribute:: MASTER_KEY_REGEX

      

   .. py:attribute:: SECURITY_POLICY_KEY
      :value: 'HKEY_LOCAL_MACHINE\\SECURITY\\Policy'

      

   .. py:attribute:: SYSTEM_KEY
      :value: 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA'

      

   .. py:attribute:: SYSTEM_USERNAME
      :value: 'System'

      

   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with
      the current target (``self.target``). For example, check if a certain
      file exists.
      Otherwise it should raise an ``UnsupportedPluginError``.

      :raises UnsupportedPluginError: If the plugin could not be loaded.


   .. py:method:: keychain() -> set


   .. py:method:: syskey() -> bytes


   .. py:method:: lsakey() -> bytes


   .. py:method:: secrets() -> dict[str, bytes]


   .. py:method:: master_keys() -> dict[str, dict[str, dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile]]


   .. py:method:: decrypt_system_blob(data: bytes) -> bytes

      Decrypt the given bytes using the System master key.


   .. py:method:: decrypt_user_blob(data: bytes, username: str) -> bytes

      Decrypt the given bytes using the master key of the given user.


   .. py:method:: decrypt_blob(data: bytes) -> bytes

      Attempt to decrypt the given bytes using any of the available master keys.