// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
// Mobius Forensic Toolkit
// Copyright (C) 2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018 Eduardo Aguiar
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License as published by the
// Free Software Foundation; either version 2, or (at your option) any later
// version.
//
// This program is distributed in the hope that it will be useful, but
// WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
// Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#include "registry_data_impl_lsa_poleklist.h"
#include <mobius/crypt/cipher_aes.h>
#include <mobius/crypt/hash_sha2_256.h>
#include <mobius/decoder/data_decoder.h>

namespace mobius
{
namespace forensics
{
namespace registry
{
// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
//! \brief decrypt data
//! \param key LSA Secrets decryption key
//! \param data value's data
//! \return plaintext
// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
const mobius::bytearray
decrypt_aes (const mobius::bytearray& key, const mobius::bytearray& data)
{
  // generate AES key
  const mobius::bytearray salt = data.slice (28, 59);

  mobius::crypt::hash_sha2_256 sha256;
  sha256.update (key);

  for (int i = 0; i < 1000; i++)
    sha256.update (salt);

  const auto aes_key = sha256.get_digest ();

  // decrypt data
  mobius::bytearray tmp;
  mobius::bytearray dbuffer (16);

  for (std::uint64_t i = 60; i < data.size (); i += 16)
    {
      mobius::crypt::cipher_aes aes (aes_key, mobius::crypt::new_cipher_block_mode_cbc ({0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}));
      mobius::bytearray buffer = data.slice (i, i + 15);

      if (buffer.size () < 16)
        buffer.resize (16);

      aes.decrypt (buffer.begin (), buffer.end (), dbuffer.begin ());
      tmp += dbuffer;
    }

  return tmp;
}

// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
//! \brief constructor
//! \param lsa_key LSA Secrets decryption key
//! \param encrypted_data value's encrypted data
// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
registry_data_impl_lsa_poleklist::registry_data_impl_lsa_poleklist (
  const mobius::bytearray& lsa_key,
  const mobius::bytearray& encrypted_data)
  : lsa_key_ (lsa_key),
    encrypted_data_ (encrypted_data)
{
}

// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
//! \brief load data on demand
// =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
void
registry_data_impl_lsa_poleklist::_load_data () const
{
  // return if data is loaded
  if (data_loaded_)
    return;

  // decrypt data
  if (encrypted_data_.size () >= 60)
    {
      auto data = decrypt_aes (lsa_key_, encrypted_data_);

      // decode plaintext
      auto decoder = mobius::decoder::data_decoder (data);
      auto size = decoder.get_uint32_le ();
      decoder.skip (12);
      data_ = decoder.get_bytearray_by_size (size);
    }

  // set subkeys loaded
  data_loaded_ = true;
}


} // namespace registry
} // namespace forensics
} // namespace mobius
